@wowok/agent-mcp 3.4.1 → 3.4.3

package/dist/schemas/onchain_operations.schema.json

@@ -109,8 +109,19 @@
                         "type": "object",
                         "properties": {
                           "name": {
+                            "description": "Name of the product or service to purchase. Must match a listed sale name EXACTLY (the buy path resolves each item by exact name match) and MUST be ≤ 64 bytes (UTF-8): the on-chain buy path caps buyer-sent item names at 64 bytes even though the merchant side lists names up to 256 bytes — a longer name aborts E_NAME_LENGTH_EXCEEDED (abort 1) before anything else runs (F-RQ-01). When the exact name is impractical (long/CJK names that risk transport corruption), OMIT it and use sale_id or sale_name instead — the handler resolves the reference against the Service's LIVE sales list and fills this name for you (CHAN-P1-16).",
+                            "type": "string"
+                          },
+                          "sale_id": {
+                            "description": "CHAN-P1-16: buy by the SKU's 0-based INDEX in the Service's live sales list (the order the service_quote / query lists them). The handler resolves the index to the live sale (name + price), rewrites item.name on your behalf, and echoes `sale_index + sale_name + price` in the response — the exact name never crosses the wire. Out-of-range index → refused with the full live index table (index + name + price) so one retry lands. Consumed by the MCP gate, never reaches the chain.",
+                            "type": "integer",
+                            "minimum": 0,
+                            "maximum": 9007199254740991
+                          },
+                          "sale_name": {
+                            "description": "CHAN-P1-16: buy by SKU NAME matched against the Service's LIVE sales list (exact match first; whitespace/case-tolerant, then containment when the name was corrupted in transport). Exactly one live match → the handler fills item.name and echoes `sale_index + sale_name + price`; several candidates → refused with every candidate's index; none → refused with the full live index table. Consumed by the MCP gate, never reaches the chain.",
                             "type": "string",
-                            "description": "Name of the product or service to purchase. Must match a listed sale name EXACTLY (the buy path resolves each item by exact name match) and MUST be ≤ 64 bytes (UTF-8): the on-chain buy path caps buyer-sent item names at 64 bytes even though the merchant side lists names up to 256 bytes — a longer name aborts E_NAME_LENGTH_EXCEEDED (abort 1) before anything else runs (F-RQ-01)."
+                            "minLength": 1
                           },
                           "quantity": {
                             "anyOf": [
@@ -130,7 +141,6 @@
                           }
                         },
                         "required": [
-                          "name",
                           "quantity",
                           "wip_hash"
                         ],
@@ -1660,15 +1670,10 @@
                       "description": "Payment record remark"
                     },
                     "index": {
-                      "anyOf": [
-                        {
-                          "type": "number"
-                        },
-                        {
-                          "type": "string"
-                        }
-                      ],
-                      "description": "Payment record index"
+                      "type": "integer",
+                      "minimum": 0,
+                      "maximum": 9007199254740991,
+                      "description": "Payment record index (non-negative integer)"
                     }
                   },
                   "required": [
@@ -1690,7 +1695,7 @@
               "type": "number"
             },
             "compensation_fund_receive": {
-              "description": "Receive order compensation funds from this Service object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received balance.\n  Use this for the common case: \"deposit all recently received coins into pending balance.\"\n  Example: receive: 'recently'\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a specific balance record from a Payment/payer.\n  Use this when targeting a specific received balance (advanced).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+              "description": "Receive order compensation funds from this Service object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received balance.\n  Use this for the common case: \"deposit all recently received coins into pending balance.\"\n  Example: receive: 'recently'\n  REWARD-OBJECT TRAP (F55 gf32-mn-261103): on a REWARD object, 'recently' resolves through\n  the Payment-derived ReceivedBalance primitive — a Reward that holds plain CoinWrapper\n  sweeps (query_received answers ReceivedNormal[]) aborts with 'received is ReceivedNormal[]\n  (expected ReceivedBalance)'. For a plain coin sweep on a Reward use owner_receive:'recently'\n  (same call — it unwraps received objects to the Permission owner) instead of receive.\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a specific balance record from a Payment/payer.\n  Use this when targeting a specific received balance (advanced).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
               "anyOf": [
                 {
                   "type": "object",
@@ -2030,6 +2035,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -3012,7 +3025,7 @@
                                             ]
                                           },
                                           "permissionIndex": {
-                                            "description": "Forward operation permission 2: Permission index (one of the two must be specified); recommended if all Progress object operators are the same (e.g., same reward reviewers for all orders). RANGE: use a USER_DEFINED index ≥1000 (0–999 are builtin/reserved) — a USER_DEFINED index works for the Permission's admin immediately without any grant; a builtin index (<1000) aborts with MoveAbort 7 unless it was explicitly granted to the operators first.",
+                                            "description": "Forward operation permission 2: Permission index (one of the two must be specified); recommended if all Progress object operators are the same (e.g., same reward reviewers for all orders). RANGE: use a USER_DEFINED index ≥1000 (0–999 are builtin/reserved) — a USER_DEFINED index works for the Permission's admin immediately without any grant; a builtin index (<1000) is ALSO admin-usable immediately (the Permission's owner/admin short-circuits every builtin index check — the chain's admin-passthrough rule) and only NON-ADMIN operators must be granted it first (cour I4: pre-grant the state is 'admin-only', never 'unusable' — a non-admin caller without the grant aborts MoveAbort 7).",
                                             "anyOf": [
                                               {
                                                 "type": "number"
@@ -3203,7 +3216,7 @@
                                             ]
                                           },
                                           "permissionIndex": {
-                                            "description": "Forward operation permission 2: Permission index (one of the two must be specified); recommended if all Progress object operators are the same (e.g., same reward reviewers for all orders). RANGE: use a USER_DEFINED index ≥1000 (0–999 are builtin/reserved) — a USER_DEFINED index works for the Permission's admin immediately without any grant; a builtin index (<1000) aborts with MoveAbort 7 unless it was explicitly granted to the operators first.",
+                                            "description": "Forward operation permission 2: Permission index (one of the two must be specified); recommended if all Progress object operators are the same (e.g., same reward reviewers for all orders). RANGE: use a USER_DEFINED index ≥1000 (0–999 are builtin/reserved) — a USER_DEFINED index works for the Permission's admin immediately without any grant; a builtin index (<1000) is ALSO admin-usable immediately (the Permission's owner/admin short-circuits every builtin index check — the chain's admin-passthrough rule) and only NON-ADMIN operators must be granted it first (cour I4: pre-grant the state is 'admin-only', never 'unusable' — a non-admin caller without the grant aborts MoveAbort 7).",
                                             "anyOf": [
                                               {
                                                 "type": "number"
@@ -3490,7 +3503,7 @@
                                       ]
                                     },
                                     "permissionIndex": {
-                                      "description": "Forward operation permission 2: Permission index (one of the two must be specified); recommended if all Progress object operators are the same (e.g., same reward reviewers for all orders). RANGE: use a USER_DEFINED index ≥1000 (0–999 are builtin/reserved) — a USER_DEFINED index works for the Permission's admin immediately without any grant; a builtin index (<1000) aborts with MoveAbort 7 unless it was explicitly granted to the operators first.",
+                                      "description": "Forward operation permission 2: Permission index (one of the two must be specified); recommended if all Progress object operators are the same (e.g., same reward reviewers for all orders). RANGE: use a USER_DEFINED index ≥1000 (0–999 are builtin/reserved) — a USER_DEFINED index works for the Permission's admin immediately without any grant; a builtin index (<1000) is ALSO admin-usable immediately (the Permission's owner/admin short-circuits every builtin index check — the chain's admin-passthrough rule) and only NON-ADMIN operators must be granted it first (cour I4: pre-grant the state is 'admin-only', never 'unusable' — a non-admin caller without the grant aborts MoveAbort 7).",
                                       "anyOf": [
                                         {
                                           "type": "number"
@@ -3898,6 +3911,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -4807,7 +4828,7 @@
                     "like",
                     "dislike"
                   ],
-                  "description": "Buyer rating. Ratings NEVER affect settlement (the settlement anchor is the delivered moment, not this review) — this is reputation only."
+                  "description": "Buyer rating. Ratings NEVER affect settlement (the settlement anchor is the delivered moment, not this review) — this is reputation only. F30 (gf32-mn-261103): when the target repository also declares a U64 star policy (the compile-emitted 'rating' policy read by reward-claim guards), the composite AUTO-writes the derived numeric star row too (like→5, dislike→1) in the same pre-forward phase — the documented flow alone satisfies review-incentive guards; no hand-built second data_add is needed."
                 },
                 "tags": {
                   "description": "Optional structured tags for statistics and market exposure (e.g. ['fast_delivery','good_quality']).",
@@ -4928,6 +4949,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -6517,6 +6546,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -7403,7 +7440,7 @@
                   "type": "integer",
                   "minimum": 0,
                   "maximum": 9007199254740991,
-                  "description": "Awarded compensation in integer smallest units (0 = a denial ruling that pays nothing). Hard-capped at 3x the disputed order amount on chain. Funded from the Service's merchant-prepaid compensation fund — an award larger than the fund balance aborts the later payout until the merchant tops up. A non-zero award consumes the order's one-shot compensation latch: refund rails gated on 'no award paid' can never fire afterwards, so pair them with a merchant-recovery rail at build time."
+                  "description": "Awarded compensation in integer smallest units (0 = a denial ruling that pays nothing). Hard-capped at 3x the disputed order amount on chain. Funded from the Service's merchant-prepaid compensation fund — an award larger than the fund balance aborts the later payout until the merchant tops up. TWO-RAIL INDEPENDENCE (decision 11): the award rides the arbitration track and does NOT gate, pair, or entitle any order fund rail — never build a 'merchant-recovery rail' on top of an award (that pairing was the historical double-payout root cause). Fund rails are NODE-GATED and must not read order.claimed_by; a node-gated fund rail and the award are independent commercial payouts, and double collection is LEGAL, disclosed at the MCP dual-payout confirmation gate. RULING DIRECTION (F-P6-04): a zero-award dismissal is STORED as indemnity = Some(0), NOT None — a guard leg that reads 'absence' to detect a dismissal is rejected on-chain; express the direction as amount == 0 (dismissal) vs amount > 0 (buyer-favored award), combined with the case being concluded (a live pre-ruling case also has no indemnity yet)."
                 }
               },
               "required": [
@@ -7861,6 +7898,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -8838,6 +8883,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -9495,7 +9548,7 @@
               "description": "Description string (max 4000 bcs characters)"
             },
             "receive": {
-              "description": "Receive CoinWrapper objects received by this Treasury object and deposit them into its balance.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received balance.\n  Use this for the common case: \"deposit all recently received coins into pending balance.\"\n  Example: receive: 'recently'\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a specific balance record from a Payment/payer.\n  Use this when targeting a specific received balance (advanced).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+              "description": "Receive CoinWrapper objects received by this Treasury object and deposit them into its balance.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received balance.\n  Use this for the common case: \"deposit all recently received coins into pending balance.\"\n  Example: receive: 'recently'\n  REWARD-OBJECT TRAP (F55 gf32-mn-261103): on a REWARD object, 'recently' resolves through\n  the Payment-derived ReceivedBalance primitive — a Reward that holds plain CoinWrapper\n  sweeps (query_received answers ReceivedNormal[]) aborts with 'received is ReceivedNormal[]\n  (expected ReceivedBalance)'. For a plain coin sweep on a Reward use owner_receive:'recently'\n  (same call — it unwraps received objects to the Permission owner) instead of receive.\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a specific balance record from a Payment/payer.\n  Use this when targeting a specific received balance (advanced).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
               "anyOf": [
                 {
                   "type": "object",
@@ -9654,15 +9707,10 @@
                       "description": "Payment record remark"
                     },
                     "index": {
-                      "anyOf": [
-                        {
-                          "type": "number"
-                        },
-                        {
-                          "type": "string"
-                        }
-                      ],
-                      "description": "Payment record index"
+                      "type": "integer",
+                      "minimum": 0,
+                      "maximum": 9007199254740991,
+                      "description": "Payment record index (non-negative integer)"
                     }
                   },
                   "required": [
@@ -9801,15 +9849,10 @@
                       "description": "Payment record remark"
                     },
                     "index": {
-                      "anyOf": [
-                        {
-                          "type": "number"
-                        },
-                        {
-                          "type": "string"
-                        }
-                      ],
-                      "description": "Payment record index"
+                      "type": "integer",
+                      "minimum": 0,
+                      "maximum": 9007199254740991,
+                      "description": "Payment record index (non-negative integer)"
                     }
                   },
                   "required": [
@@ -10364,6 +10407,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -11064,7 +11115,7 @@
               ]
             },
             "receive": {
-              "description": "Unwrap CoinWrapper objects received by Reward object and store them in pending balance.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received balance.\n  Use this for the common case: \"deposit all recently received coins into pending balance.\"\n  Example: receive: 'recently'\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a specific balance record from a Payment/payer.\n  Use this when targeting a specific received balance (advanced).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+              "description": "Unwrap CoinWrapper objects received by Reward object and store them in pending balance.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received balance.\n  Use this for the common case: \"deposit all recently received coins into pending balance.\"\n  Example: receive: 'recently'\n  REWARD-OBJECT TRAP (F55 gf32-mn-261103): on a REWARD object, 'recently' resolves through\n  the Payment-derived ReceivedBalance primitive — a Reward that holds plain CoinWrapper\n  sweeps (query_received answers ReceivedNormal[]) aborts with 'received is ReceivedNormal[]\n  (expected ReceivedBalance)'. For a plain coin sweep on a Reward use owner_receive:'recently'\n  (same call — it unwraps received objects to the Permission owner) instead of receive.\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a specific balance record from a Payment/payer.\n  Use this when targeting a specific received balance (advanced).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly. F55 (gf32-mn-261103): on a REWARD object holding a plain coin sweep, 'recently' aborts ('received is ReceivedNormal[] (expected ReceivedBalance)') — use owner_receive:'recently' for that shape; receive targets Payment-derived ReceivedBalance entries only.",
               "anyOf": [
                 {
                   "type": "object",
@@ -11295,7 +11346,7 @@
                     ]
                   },
                   "evidence": {
-                    "description": "ksk9d2-tn-261026 F-01 claim-time attestation pin (reward::evidence_bind). REQUIRES store_from_id on the SAME guard — the binding reads THE pinned store_from row, so the chain aborts 16 (E_EVIDENCE_NEEDS_STORE_FROM) at build time without it. At claim the chain counts repository rows under (repo, key) matching the predicate for the claim's OWN store_from value (the submitted order) via the native evidence_count and aborts 15 (E_EVIDENCE_NOT_OWNED) when none — a borrowed foreign row can never pay.",
+                    "description": "ksk9d2-tn-261026 F-01 claim-time attestation pin. REQUIRES store_from_id on the SAME guard — the binding reads THE pinned store_from row, so the chain aborts 16 (E_EVIDENCE_NEEDS_STORE_FROM) at build time without it. At claim the chain counts repository rows under (repo, key) matching the predicate for the claim's OWN store_from value (the submitted order) via the native row-match count and aborts 15 (E_EVIDENCE_NOT_OWNED) when none — a borrowed foreign row can never pay.",
                     "type": "object",
                     "properties": {
                       "repo": {
@@ -11537,15 +11588,10 @@
                       "description": "Payment record remark"
                     },
                     "index": {
-                      "anyOf": [
-                        {
-                          "type": "number"
-                        },
-                        {
-                          "type": "string"
-                        }
-                      ],
-                      "description": "Payment record index"
+                      "type": "integer",
+                      "minimum": 0,
+                      "maximum": 9007199254740991,
+                      "description": "Payment record index (non-negative integer)"
                     }
                   },
                   "required": [
@@ -11644,6 +11690,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -12507,15 +12561,10 @@
                       "description": "Payment record remark"
                     },
                     "index": {
-                      "anyOf": [
-                        {
-                          "type": "number"
-                        },
-                        {
-                          "type": "string"
-                        }
-                      ],
-                      "description": "Payment record index"
+                      "type": "integer",
+                      "minimum": 0,
+                      "maximum": 9007199254740991,
+                      "description": "Payment record index (non-negative integer)"
                     }
                   },
                   "required": [
@@ -12547,7 +12596,7 @@
                   "description": "REQUIRED for operating existing object. Provide the Allocation object ID or existing name to reference the target object."
                 },
                 "received_coins": {
-                  "description": "Unwrap the CoinWrapper objects received by the Allocation object and deposit them into the pending allocation balance.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received balance.\n  Use this for the common case: \"deposit all recently received coins into pending balance.\"\n  Example: receive: 'recently'\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a specific balance record from a Payment/payer.\n  Use this when targeting a specific received balance (advanced).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+                  "description": "Unwrap the CoinWrapper objects received by the Allocation object and deposit them into the pending allocation balance.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received balance.\n  Use this for the common case: \"deposit all recently received coins into pending balance.\"\n  Example: receive: 'recently'\n  REWARD-OBJECT TRAP (F55 gf32-mn-261103): on a REWARD object, 'recently' resolves through\n  the Payment-derived ReceivedBalance primitive — a Reward that holds plain CoinWrapper\n  sweeps (query_received answers ReceivedNormal[]) aborts with 'received is ReceivedNormal[]\n  (expected ReceivedBalance)'. For a plain coin sweep on a Reward use owner_receive:'recently'\n  (same call — it unwraps received objects to the Permission owner) instead of receive.\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a specific balance record from a Payment/payer.\n  Use this when targeting a specific received balance (advanced).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
                   "anyOf": [
                     {
                       "type": "object",
@@ -12634,7 +12683,7 @@
                   "type": "string"
                 },
                 "alloc_batch": {
-                  "description": "Q8-F01 AGGREGATE RELEASE — sweep SEVERAL pools in ONE transaction (allocation::alloc_batch). Provide the COMPLETE pool list INCLUDING 'object': the anchor Allocation addressed by this operation must appear in the list, and the SDK refuses a list that omits it. REQUIRES alloc_by_guard — that one Guard defines the release and is applied to every pool. WHY THIS EXISTS: a crowdfunding settlement holds each backer's escrow in its own Allocation under the SAME release/refund Guard; with single-pool calls a keeper needs N ordered transactions, and any keeper that stops at the first failure strands the remaining pools while the release reports done. ALL-OR-NOTHING: one pool aborting reverts the whole batch. PRE-FILTER drained pools before building the call — a zero-balance pool aborts the ENTIRE batch with EZERO_DISTRIBUTION (14) and nothing is released; an empty candidate set means there is genuinely nothing to release (an empty list is refused with EEMPTY_POOL_BATCH 26 instead of a fake success). EVERY pool must carry an allocator BOUND to alloc_by_guard: an unbound pool completes the sweep having distributed NOTHING, so the SDK verifies membership pool-by-pool and REFUSES the call before any gas is spent. Each recipient still receives a CoinWrapper and claims it through the normal POST-DISTRIBUTION CLAIM step — batching changes the release atomicity, not the claim path.",
+                  "description": "Q8-F01 AGGREGATE RELEASE — sweep SEVERAL pools in ONE transaction (a single on-chain batch release). Provide the COMPLETE pool list INCLUDING 'object': the anchor Allocation addressed by this operation must appear in the list, and the SDK refuses a list that omits it. REQUIRES alloc_by_guard — that one Guard defines the release and is applied to every pool. WHY THIS EXISTS: a crowdfunding settlement holds each backer's escrow in its own Allocation under the SAME release/refund Guard; with single-pool calls a keeper needs N ordered transactions, and any keeper that stops at the first failure strands the remaining pools while the release reports done. ALL-OR-NOTHING: one pool aborting reverts the whole batch. PRE-FILTER drained pools before building the call — a zero-balance pool aborts the ENTIRE batch with EZERO_DISTRIBUTION (14) and nothing is released; an empty candidate set means there is genuinely nothing to release (an empty list is refused with EEMPTY_POOL_BATCH 26 instead of a fake success). EVERY pool must carry an allocator BOUND to alloc_by_guard: an unbound pool completes the sweep having distributed NOTHING, so the SDK verifies membership pool-by-pool and REFUSES the call before any gas is spent. Each recipient still receives a CoinWrapper and claims it through the normal POST-DISTRIBUTION CLAIM step — batching changes the release atomicity, not the claim path.",
                   "minItems": 1,
                   "type": "array",
                   "items": {
@@ -12682,9 +12731,13 @@
                             {
                               "type": "number",
                               "const": 1
+                            },
+                            {
+                              "type": "number",
+                              "const": 2
                             }
                           ],
-                          "description": "Which aggregate produces the scalar: 0 = RECORD COUNT (u64 — how many candidate rows match the predicate), 1 = VALUE SUM (u256 — sum of the matching rows' numeric payloads, overflow-safe). Any other value is refused on-chain (EFORMULA_SPEC_INVALID=24)."
+                          "description": "Which aggregate produces the scalar: 0 = RECORD COUNT (u64 — how many candidate rows match the predicate), 1 = VALUE SUM (u256 — sum of the matching rows' numeric payloads, overflow-safe), 2 = ESCROW-BOUND VALUE SUM (u256 — like 1, but every row is first clamped to the escrow it points to: min(row_value, Order.amount of the Order that row's id names); a row whose id is not a real framework Order contributes 0, fail-closed). PREFER 2 whenever anyone other than the payer can write the candidate rows: an unbound SUM (1) lets a writer inflate the scalar simply by writing a large row, while 2 caps each row at the real order amount behind it (ksc-tn-261024 F-01 root cure). Any other value is refused on-chain (EFORMULA_SPEC_INVALID=24)."
                         },
                         "predicate": {
                           "oneOf": [
@@ -12908,7 +12961,7 @@
                           "items": {
                             "type": "string"
                           },
-                          "description": "EXPLICIT candidate object IDs (vector<address>) to scan. Duplicates are deduped; max 100 candidates; an EMPTY list matches no records (scalar 0) — there is no 'all objects' wildcard. S12-③ witness boundary (v139): the 100-cap applies to THIS guard-table vector; the guard's inline WITNESS is separately capped at 4096 BCS bytes total (passport MAX_SUBMISSION_SIZE — a 100-address roster fits), so keep roster-style attestation here in the vector and reserve the witness for per-call attestation."
+                          "description": "EXPLICIT candidate object IDs (vector<address>) to scan. Duplicates are deduped; max 100 candidates; an EMPTY list matches no records (scalar 0) — there is no 'all objects' wildcard. S12-③ witness boundary (v140): the 100-cap applies to THIS guard-table vector; the guard's inline WITNESS is separately capped at 4096 BCS bytes total (passport MAX_SUBMISSION_SIZE — a 100-address roster fits), so keep roster-style attestation here in the vector and reserve the witness for per-call attestation."
                         }
                       },
                       "required": [
@@ -13010,6 +13063,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -14562,6 +14623,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -17956,14 +18025,14 @@
                         "where"
                       ],
                       "additionalProperties": false,
-                      "description": "Returns U256. ESCROW-BOUND sum (query 1179, live cap v139): per-row min(row_value, order.amount, LIVE allocation.balance of the Order the row id names) — only funds still in escrow right now count, so a refunded or already-disbursed order contributes 0 naturally; a row whose Order has no allocation link also contributes 0, while an unreadable allocation object aborts the query (corruption is never a silent 0). A row keyed by anything that is not an Order contributes 0 (fail-closed). Unlike query_repository_data_sum_where (self-reported row values), a record cannot claim more than the escrow actually bound to it — the forgery-proof aggregate for threshold gates and Formula pricing. Use logic_as_u256_* to compare the sum."
+                      "description": "Returns U256. ESCROW-BOUND sum (query 1179, live cap v140): per-row min(row_value, order.amount, LIVE allocation.balance of the Order the row id names) — only funds still in escrow right now count, so a refunded or already-disbursed order contributes 0 naturally; a row whose Order has no allocation link also contributes 0, while an unreadable allocation object aborts the query (corruption is never a silent 0). A row keyed by anything that is not an Order contributes 0 (fail-closed). Unlike query_repository_data_sum_where (self-reported row values), a record cannot claim more than the escrow actually bound to it — the forgery-proof aggregate for threshold gates and Formula pricing. Use logic_as_u256_* to compare the sum."
                     },
                     {
                       "type": "object",
                       "properties": {
                         "type": {
                           "type": "string",
-                          "const": "query_repository_data_find_where"
+                          "const": "query_repository_data_sum_where_bound_all"
                         },
                         "object": {
                           "type": "object",
@@ -17997,22 +18066,6 @@
                           "additionalProperties": false,
                           "description": "Reference to the policy key (String type table entry) whose data table is scanned."
                         },
-                        "ids": {
-                          "type": "object",
-                          "properties": {
-                            "identifier": {
-                              "type": "integer",
-                              "minimum": 0,
-                              "maximum": 255,
-                              "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
-                            }
-                          },
-                          "required": [
-                            "identifier"
-                          ],
-                          "additionalProperties": false,
-                          "description": "Reference to the candidate ID list (VecAddress type table entry). Duplicates are deduped; max 100 candidates."
-                        },
                         "where": {
                           "oneOf": [
                             {
@@ -18228,25 +18281,24 @@
                               "additionalProperties": false
                             }
                           ],
-                          "description": "Predicate filter applied to each candidate's data value."
+                          "description": "Predicate filter applied to each row's data value."
                         }
                       },
                       "required": [
                         "type",
                         "object",
                         "key",
-                        "ids",
                         "where"
                       ],
                       "additionalProperties": false,
-                      "description": "Returns VecAddress. Lists the IDs of ALL matching candidates in candidate order. Compose: vec_length + logic_as_u256_greater_than_or_equal (existence/threshold), vec_indexof_address (first/last position), vec_contains_address (membership)."
+                      "description": "Returns U256. ALL-MODE escrow-bound sum (query 1181, flag enable_repository_data_sum_bound_all, protocol v141 — the query ABORTS while the flag is off): the 1179 per-row clamp min(row_value, order.amount, LIVE allocation.balance) over a DERIVED candidate set — the per-key RowRosterKey dynamic-field roster the framework maintains on every data write — instead of a caller-supplied ids list, so the aggregate no longer depends on the caller submitting an honest, complete candidate list (the ks13/HKS-04 ROSTER-01 face). No ids parameter. The roster is bounded by REPOSITORY_QUERY_MAX_CANDIDATES: a key with more rows aborts the query (fail-closed, never a silent truncation). Pre-flag rows (written before the roster was maintained, or under a disabled flag on an older binary) are NOT in the roster and contribute 0 — rebuild or re-touch rows after enabling. Use logic_as_u256_* to compare the sum."
                     },
                     {
                       "type": "object",
                       "properties": {
                         "type": {
                           "type": "string",
-                          "const": "query_repository_data_keys_where"
+                          "const": "query_repository_data_find_where"
                         },
                         "object": {
                           "type": "object",
@@ -18264,7 +18316,7 @@
                           "additionalProperties": false,
                           "description": "Reference to the Repository object in the Guard table (must be Address type)."
                         },
-                        "id": {
+                        "key": {
                           "type": "object",
                           "properties": {
                             "identifier": {
@@ -18278,7 +18330,23 @@
                             "identifier"
                           ],
                           "additionalProperties": false,
-                          "description": "Reference to the single candidate ID (Address type table entry) to probe across policies."
+                          "description": "Reference to the policy key (String type table entry) whose data table is scanned."
+                        },
+                        "ids": {
+                          "type": "object",
+                          "properties": {
+                            "identifier": {
+                              "type": "integer",
+                              "minimum": 0,
+                              "maximum": 255,
+                              "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                            }
+                          },
+                          "required": [
+                            "identifier"
+                          ],
+                          "additionalProperties": false,
+                          "description": "Reference to the candidate ID list (VecAddress type table entry). Duplicates are deduped; max 100 candidates."
                         },
                         "where": {
                           "oneOf": [
@@ -18495,86 +18563,25 @@
                               "additionalProperties": false
                             }
                           ],
-                          "description": "Predicate filter applied to the value stored under each policy key for this ID."
+                          "description": "Predicate filter applied to each candidate's data value."
                         }
                       },
                       "required": [
                         "type",
                         "object",
-                        "id",
+                        "key",
+                        "ids",
                         "where"
                       ],
                       "additionalProperties": false,
-                      "description": "Returns VecString. Reverse lookup: all policy keys whose stored value for the given ID matches the predicate (scans the policy schema and probes each key). Compose: vec_length (how many keys match), vec_indexof_string + logic_as_u256_equal (does a specific key match), vec_contains_string (specific key membership)."
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "type": {
-                          "type": "string",
-                          "const": "query_repository_policies_keys"
-                        },
-                        "object": {
-                          "type": "object",
-                          "properties": {
-                            "identifier": {
-                              "type": "integer",
-                              "minimum": 0,
-                              "maximum": 255,
-                              "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
-                            }
-                          },
-                          "required": [
-                            "identifier"
-                          ],
-                          "additionalProperties": false,
-                          "description": "Reference to the Repository object in the Guard table (must be Address type)."
-                        }
-                      },
-                      "required": [
-                        "type",
-                        "object"
-                      ],
-                      "additionalProperties": false,
-                      "description": "Returns VecString. Lists ALL policy key names of the Repository (max 50). Use vec_length to bound per-key composite queries or vec_contains_string to assert a key exists."
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "type": {
-                          "type": "string",
-                          "const": "query_order_named_operator_member"
-                        },
-                        "object": {
-                          "type": "object",
-                          "properties": {
-                            "identifier": {
-                              "type": "integer",
-                              "minimum": 0,
-                              "maximum": 255,
-                              "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
-                            }
-                          },
-                          "required": [
-                            "identifier"
-                          ],
-                          "additionalProperties": false,
-                          "description": "Reference to the Order object in the Guard table (must be Address type)."
-                        }
-                      },
-                      "required": [
-                        "type",
-                        "object"
-                      ],
-                      "additionalProperties": false,
-                      "description": "Returns Bool. Whether the transaction signer is on the order's named-operator roster (DM-P1 rider-roster exclusive admission): reads the namedOperator roster of the order's Progress and checks tx-signer membership. Parameterless — the signer comes from the transaction context. Gated by protocol v138 (feature flag enable_order_named_operator_member); on a chain without the flag the guard evaluation aborts. Typical use: AND it into the forward-edge guard on courier handover edges (e.g. PickupOrder/DeliverOrder) so only roster members can advance — the on-chain namedOperator rail alone only AUTHORIZES, it never DENIES (R-19)."
+                      "description": "Returns VecAddress. Lists the IDs of ALL matching candidates in candidate order. Compose: vec_length + logic_as_u256_greater_than_or_equal (existence/threshold), vec_indexof_address (first/last position), vec_contains_address (membership)."
                     },
                     {
                       "type": "object",
                       "properties": {
                         "type": {
                           "type": "string",
-                          "const": "query_repository_data_has"
+                          "const": "query_repository_data_keys_where"
                         },
                         "object": {
                           "type": "object",
@@ -18606,45 +18613,373 @@
                             "identifier"
                           ],
                           "additionalProperties": false,
-                          "description": "Reference to the row's principal address (Address type table entry) — the row id the data was written under."
-                        },
-                        "key": {
-                          "type": "string",
-                          "minLength": 1,
-                          "description": "Row name — the policy key string of the data row to probe."
-                        }
-                      },
-                      "required": [
-                        "type",
-                        "object",
-                        "id",
-                        "key"
-                      ],
-                      "additionalProperties": false,
-                      "description": "Returns Bool. Whether the Repository holds a data row for (key, id) — single-row exact read by (key, id), the primitive for per-value mutual-consent attestation (e.g. a settlement keeper asserting the buyer acceptance row exists before executing a refund allocator). NOT protocol-gated (legacy query, works on every chain version)."
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "type": {
-                          "type": "string",
-                          "const": "query_repository_data"
+                          "description": "Reference to the single candidate ID (Address type table entry) to probe across policies."
                         },
-                        "object": {
-                          "type": "object",
-                          "properties": {
-                            "identifier": {
-                              "type": "integer",
-                              "minimum": 0,
-                              "maximum": 255,
-                              "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
-                            }
-                          },
-                          "required": [
-                            "identifier"
-                          ],
-                          "additionalProperties": false,
-                          "description": "Reference to the Repository object in the Guard table (must be Address type)."
+                        "where": {
+                          "oneOf": [
+                            {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "const": "range"
+                                },
+                                "valueMin": {
+                                  "description": "Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).",
+                                  "type": "string"
+                                },
+                                "valueMax": {
+                                  "description": "Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).",
+                                  "type": "string"
+                                },
+                                "minInclusive": {
+                                  "description": "Default true. false makes the lower bound exclusive.",
+                                  "type": "boolean"
+                                },
+                                "maxInclusive": {
+                                  "description": "Default true. false makes the upper bound exclusive.",
+                                  "type": "boolean"
+                                }
+                              },
+                              "required": [
+                                "kind"
+                              ],
+                              "additionalProperties": false,
+                              "description": "Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."
+                            },
+                            {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "const": "numEq"
+                                },
+                                "value": {
+                                  "type": "string",
+                                  "description": "Exact numeric match. Plain number string (U256 semantics)."
+                                }
+                              },
+                              "required": [
+                                "kind",
+                                "value"
+                              ],
+                              "additionalProperties": false
+                            },
+                            {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "const": "gt"
+                                },
+                                "value": {
+                                  "type": "string",
+                                  "description": "Greater than. Plain number string (U256 semantics)."
+                                }
+                              },
+                              "required": [
+                                "kind",
+                                "value"
+                              ],
+                              "additionalProperties": false
+                            },
+                            {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "const": "gte"
+                                },
+                                "value": {
+                                  "type": "string",
+                                  "description": "Greater than or equal. Plain number string (U256 semantics)."
+                                }
+                              },
+                              "required": [
+                                "kind",
+                                "value"
+                              ],
+                              "additionalProperties": false
+                            },
+                            {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "const": "lt"
+                                },
+                                "value": {
+                                  "type": "string",
+                                  "description": "Less than. Plain number string (U256 semantics)."
+                                }
+                              },
+                              "required": [
+                                "kind",
+                                "value"
+                              ],
+                              "additionalProperties": false
+                            },
+                            {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "const": "lte"
+                                },
+                                "value": {
+                                  "type": "string",
+                                  "description": "Less than or equal. Plain number string (U256 semantics)."
+                                }
+                              },
+                              "required": [
+                                "kind",
+                                "value"
+                              ],
+                              "additionalProperties": false
+                            },
+                            {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "const": "addressEq"
+                                },
+                                "identifier": {
+                                  "type": "integer",
+                                  "minimum": 0,
+                                  "maximum": 255,
+                                  "description": "Identifier of the Address-type table entry to compare against."
+                                }
+                              },
+                              "required": [
+                                "kind",
+                                "identifier"
+                              ],
+                              "additionalProperties": false
+                            },
+                            {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "const": "stringEq"
+                                },
+                                "value": {
+                                  "type": "string",
+                                  "description": "Exact string match (byte equality, UTF-8)."
+                                }
+                              },
+                              "required": [
+                                "kind",
+                                "value"
+                              ],
+                              "additionalProperties": false
+                            },
+                            {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "const": "stringContains"
+                                },
+                                "value": {
+                                  "type": "string",
+                                  "description": "Substring match, case-sensitive."
+                                }
+                              },
+                              "required": [
+                                "kind",
+                                "value"
+                              ],
+                              "additionalProperties": false
+                            },
+                            {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "const": "stringNoCaseContains"
+                                },
+                                "value": {
+                                  "type": "string",
+                                  "description": "Substring match, case-insensitive."
+                                }
+                              },
+                              "required": [
+                                "kind",
+                                "value"
+                              ],
+                              "additionalProperties": false
+                            },
+                            {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "const": "boolEq"
+                                },
+                                "value": {
+                                  "type": "boolean",
+                                  "description": "Boolean equality."
+                                }
+                              },
+                              "required": [
+                                "kind",
+                                "value"
+                              ],
+                              "additionalProperties": false
+                            }
+                          ],
+                          "description": "Predicate filter applied to the value stored under each policy key for this ID."
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "object",
+                        "id",
+                        "where"
+                      ],
+                      "additionalProperties": false,
+                      "description": "Returns VecString. Reverse lookup: all policy keys whose stored value for the given ID matches the predicate (scans the policy schema and probes each key). Compose: vec_length (how many keys match), vec_indexof_string + logic_as_u256_equal (does a specific key match), vec_contains_string (specific key membership)."
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "query_repository_policies_keys"
+                        },
+                        "object": {
+                          "type": "object",
+                          "properties": {
+                            "identifier": {
+                              "type": "integer",
+                              "minimum": 0,
+                              "maximum": 255,
+                              "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                            }
+                          },
+                          "required": [
+                            "identifier"
+                          ],
+                          "additionalProperties": false,
+                          "description": "Reference to the Repository object in the Guard table (must be Address type)."
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "object"
+                      ],
+                      "additionalProperties": false,
+                      "description": "Returns VecString. Lists ALL policy key names of the Repository (max 50). Use vec_length to bound per-key composite queries or vec_contains_string to assert a key exists."
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "query_order_named_operator_member"
+                        },
+                        "object": {
+                          "type": "object",
+                          "properties": {
+                            "identifier": {
+                              "type": "integer",
+                              "minimum": 0,
+                              "maximum": 255,
+                              "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                            }
+                          },
+                          "required": [
+                            "identifier"
+                          ],
+                          "additionalProperties": false,
+                          "description": "Reference to the Order object in the Guard table (must be Address type)."
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "object"
+                      ],
+                      "additionalProperties": false,
+                      "description": "Returns Bool. Whether the transaction signer is on the order's named-operator roster (DM-P1 rider-roster exclusive admission): reads the namedOperator roster of the order's Progress and checks tx-signer membership. Parameterless — the signer comes from the transaction context. Gated by protocol v138 (feature flag enable_order_named_operator_member); on a chain without the flag the guard evaluation aborts. Typical use: AND it into the forward-edge guard on courier handover edges (e.g. PickupOrder/DeliverOrder) so only roster members can advance — the on-chain namedOperator rail alone only AUTHORIZES, it never DENIES (R-19)."
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "query_repository_data_has"
+                        },
+                        "object": {
+                          "type": "object",
+                          "properties": {
+                            "identifier": {
+                              "type": "integer",
+                              "minimum": 0,
+                              "maximum": 255,
+                              "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                            }
+                          },
+                          "required": [
+                            "identifier"
+                          ],
+                          "additionalProperties": false,
+                          "description": "Reference to the Repository object in the Guard table (must be Address type)."
+                        },
+                        "id": {
+                          "type": "object",
+                          "properties": {
+                            "identifier": {
+                              "type": "integer",
+                              "minimum": 0,
+                              "maximum": 255,
+                              "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                            }
+                          },
+                          "required": [
+                            "identifier"
+                          ],
+                          "additionalProperties": false,
+                          "description": "Reference to the row's principal address (Address type table entry) — the row id the data was written under."
+                        },
+                        "key": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Row name — the policy key string of the data row to probe."
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "object",
+                        "id",
+                        "key"
+                      ],
+                      "additionalProperties": false,
+                      "description": "Returns Bool. Whether the Repository holds a data row for (key, id) — single-row exact read by (key, id), the primitive for per-value mutual-consent attestation (e.g. a settlement keeper asserting the buyer acceptance row exists before executing a refund allocator). NOT protocol-gated (legacy query, works on every chain version)."
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "query_repository_data"
+                        },
+                        "object": {
+                          "type": "object",
+                          "properties": {
+                            "identifier": {
+                              "type": "integer",
+                              "minimum": 0,
+                              "maximum": 255,
+                              "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                            }
+                          },
+                          "required": [
+                            "identifier"
+                          ],
+                          "additionalProperties": false,
+                          "description": "Reference to the Repository object in the Guard table (must be Address type)."
                         },
                         "id": {
                           "type": "object",
@@ -18904,6 +19239,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -19810,6 +20153,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -19996,15 +20347,10 @@
                       "description": "Payment record remark"
                     },
                     "index": {
-                      "anyOf": [
-                        {
-                          "type": "number"
-                        },
-                        {
-                          "type": "string"
-                        }
-                      ],
-                      "description": "Payment record index"
+                      "type": "integer",
+                      "minimum": 0,
+                      "maximum": 9007199254740991,
+                      "description": "Payment record index (non-negative integer)"
                     }
                   },
                   "required": [
@@ -20120,6 +20466,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -20728,6 +21082,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -21456,7 +21818,7 @@
               "additionalProperties": false
             },
             "arb_claim_compensation": {
-              "description": "Specify the adjudicated Arb object to obtain order compensation. ZERO-INDEMNITY GATE (BF-14, chain abort 11): when the ruling's indemnity is 0 (a dismissal) the claim is REFUSED on-chain — the case stays open, the dispute fee stays escrowed (withdrawable by the arbitrator only after the 30-day window closes with no objection, or blocked while an objection is pending), and `order.claimed_by` is NOT written. A claim that DOES pay (indemnity > 0) closes the case (state 5), pays the claimant, writes `order.claimed_by`, and releases the fee path. DIRECTION CAUTION: because only paying claims write `claimed_by`, a dismissal leaves it `none` — refund-style rails gated on `claimed_by == none` stay LIVE after a dismissal, while merchant-recovery rails gated on `claimed_by != none` can never fire (F-BS-54). Read ruling DIRECTION from `arb.indemnity.amount` (query 1641), never from `claimed_by`. F05 REVERSE GATE (yfd-ln-261024): when this order's escrow is ALREADY fully released (allocation balance 0 of a positive order amount), the claim is REFUSED unless acknowledge_dual_payout is true — pairing a paid compensation with a completed escrow track is a netting decision the operator must state (see acknowledge_dual_payout).",
+              "description": "Specify the adjudicated Arb object to obtain order compensation. ZERO-INDEMNITY GATE (BF-14, chain abort 11): when the ruling's indemnity is 0 (a dismissal) the claim is REFUSED on-chain — the case stays open, the dispute fee stays escrowed (withdrawable by the arbitrator only after the 30-day window closes with no objection, or blocked while an objection is pending), and `order.claimed_by` is NOT written. A claim that DOES pay (indemnity > 0) closes the case (state 5), pays the claimant, writes `order.claimed_by`, and releases the fee path. DIRECTION (decision 11, TWO-RAIL INDEPENDENCE): `claimed_by` records only that a claim PAID or a dismissal was stamped — never WHO won. Order fund rails are NODE-GATED and NEVER read `claimed_by`; read ruling DIRECTION from `arb.indemnity.amount` (query 1641), never from `claimed_by`. F05 REVERSE GATE (yfd-ln-261024): when this order's escrow is ALREADY fully released (allocation balance 0 of a positive order amount), the claim is REFUSED unless acknowledge_dual_payout is true — pairing a paid compensation with a completed escrow track is a netting decision the operator must state (see acknowledge_dual_payout).",
               "type": "object",
               "properties": {
                 "arb": {
@@ -21474,7 +21836,7 @@
               "type": "boolean"
             },
             "arb_case_conclude": {
-              "description": "DISMISSAL CONVERGER (F-BS-54/56, F-OF2-01): stamp a CONCLUDED, DEFENDANT-FAVORED ruling onto this order through the service's case-conclusion entry so the `claimed_by == none` refund rails close AT RULING TIME instead of staying live forever. PERMISSIONLESS: any keeper (merchant agent, watchdog, even the buyer) may drive it; it writes the claimed_by=case flag and MOVES NO FUNDS. The chain refuses anything but a concluded (Arbitrated/Withdrawn) case leaving NO indemnity (E_CASE_NOT_DISMISSAL_CONCLUSION, abort 48). TYPICAL KEEPER LOOP after a 0-indemnity ruling: arb_claim_compensation aborts 11 (BF-14 zero-indemnity gate) → call THIS to close the refund rails → the escrow can then only exit through the merchant-recovery rails.",
+              "description": "DISMISSAL CONVERGER (F-BS-54/56, F-OF2-01): stamp a CONCLUDED ruling in the DISMISSAL direction onto this order through the service's case-conclusion entry so the case stops reading as open (dispute frozen, no later compensation claim can consume the zero award). PERMISSIONLESS: any keeper (merchant agent, watchdog, even the buyer) may drive it; it writes the claimed_by=case flag and MOVES NO FUNDS. DIRECTION FORK — the chain expresses a ruling direction ONLY as the indemnity it left behind. A case reads as DISMISSAL when its indemnity is none OR amount == 0 (defendant-favored): THIS is the only direction this call accepts — the chain refuses anything else (E_CASE_NOT_DISMISSAL_CONCLUSION, abort 48). A case whose ruling left indemnity > 0 = buyer-favored COMPENSATION: NEVER this call — that direction converges through the compensation claim (arb_claim_compensation) instead. Prerequisite: the arb case must already be CONCLUDED (status Arbitrated/Withdrawn — check arb_case_view first). On a LIVE case the dismissal reading deliberately reports true merely because no indemnity exists yet; that is NOT a ruling direction, so the concluded check always comes first. TYPICAL KEEPER LOOP after a 0-indemnity ruling: arb_claim_compensation aborts 11 (BF-14 zero-indemnity gate) → call THIS to stamp the dismissal → the escrow principal exits only through its node-gated fund rails (decision 11, TWO-RAIL INDEPENDENCE: fund rails read node state, never `claimed_by`).",
               "type": "object",
               "properties": {
                 "arb": {
@@ -21710,19 +22072,14 @@
                       ]
                     },
                     "remark": {
-                      "type": "string",
-                      "description": "Payment record remark"
-                    },
-                    "index": {
-                      "anyOf": [
-                        {
-                          "type": "number"
-                        },
-                        {
-                          "type": "string"
-                        }
-                      ],
-                      "description": "Payment record index"
+                      "type": "string",
+                      "description": "Payment record remark"
+                    },
+                    "index": {
+                      "type": "integer",
+                      "minimum": 0,
+                      "maximum": 9007199254740991,
+                      "description": "Payment record index (non-negative integer)"
                     }
                   },
                   "required": [
@@ -21843,6 +22200,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -23022,6 +23387,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -23141,7 +23514,7 @@
               ]
             },
             "about_address": {
-              "description": "About binding (K3 contract): ONLY the counterparty ACCOUNT address (address first byte = account type) or a Proof object address (first byte = Proof type) — a messenger contact record. NEVER a business object (Progress/Order/Arb) and never a guard decision condition. Accepts null/undefined (→ Move Option::none). When provided, must be a raw 0x-prefixed address (NOT a name). e.g. the peer account being proved with.",
+              "description": "About binding (K3 contract): ONLY the counterparty ACCOUNT address (address first byte = account type) or a Proof object address (first byte = Proof type) — a messenger contact record. NEVER a business object (Progress/Arb) and never a guard decision condition. ONE EXCEPTION (F-27, Move truth — the order's required_info_bind entry): a Proof intended for order.required_info_bind MUST carry about = the ORDER's own address, with the Proof creator = the order owner (E_REQUIRED_INFO_PROOF_NOT_BOUND, abort 11 — the messenger-contact restriction does not apply to that flow). Accepts null/undefined (→ Move Option::none). When provided, must be a raw 0x-prefixed address (NOT a name). e.g. the peer account being proved with.",
               "anyOf": [
                 {
                   "type": "string",
@@ -23234,6 +23607,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -23922,6 +24303,14 @@
               "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
               "type": "boolean"
             },
+            "window_profile": {
+              "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+              "type": "string",
+              "enum": [
+                "production",
+                "test"
+              ]
+            },
             "response_level": {
               "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
               "type": "string",
@@ -26345,117 +26734,400 @@
               "description": "GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.",
               "allOf": [
                 {
-                  "$ref": "#/definitions/__schema3"
-                }
-              ],
-              "$ref": "#/definitions/__schema2"
-            },
-            "sessionIdx": {
-              "description": "GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.",
-              "allOf": [
+                  "$ref": "#/definitions/__schema3"
+                }
+              ],
+              "$ref": "#/definitions/__schema2"
+            },
+            "sessionIdx": {
+              "description": "GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema3"
+                }
+              ],
+              "$ref": "#/definitions/__schema2"
+            },
+            "forwardIdx": {
+              "description": "GuardNode that returns the forward operation index (U64 type) within the session. Typically an 'identifier' node referencing a U64 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema3"
+                }
+              ],
+              "$ref": "#/definitions/__schema2"
+            }
+          },
+          "required": [
+            "type",
+            "object",
+            "historyIdx",
+            "sessionIdx",
+            "forwardIdx"
+          ],
+          "additionalProperties": false,
+          "description": "Returns U64. Counts the number of retained submissions within the specified forward operation."
+        },
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "const": "query_progress_history_session_forward_retained_submission_value"
+            },
+            "object": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the Progress object in the Guard table (must be Address type)."
+            },
+            "historyIdx": {
+              "description": "GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema3"
+                }
+              ],
+              "$ref": "#/definitions/__schema2"
+            },
+            "sessionIdx": {
+              "description": "GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema3"
+                }
+              ],
+              "$ref": "#/definitions/__schema2"
+            },
+            "forwardIdx": {
+              "description": "GuardNode that returns the forward operation index (U64 type) within the session. Typically an 'identifier' node referencing a U64 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema3"
+                }
+              ],
+              "$ref": "#/definitions/__schema2"
+            },
+            "identifier": {
+              "description": "GuardNode that returns the submission identifier (U8 type) — which retained submission of the forward to read. Typically an 'identifier' node referencing a U8 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema3"
+                }
+              ],
+              "$ref": "#/definitions/__schema2"
+            }
+          },
+          "required": [
+            "type",
+            "object",
+            "historyIdx",
+            "sessionIdx",
+            "forwardIdx",
+            "identifier"
+          ],
+          "additionalProperties": false,
+          "description": "Returns VecU8 (the ONLY history query that does not return U64). Value of the specified retained submission of a HISTORY record (query 1281) — the history-side counterpart of the ACTIVE-SESSION-ONLY 1268 read, which goes blind once the session migrates into history. Use 1274/1275 to discover the history/session/forward indexes first. Throws error when the record carries no submission for the identifier (Guard validation fails)."
+        },
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "const": "query_repository_data_count_where"
+            },
+            "object": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the Repository object in the Guard table (must be Address type)."
+            },
+            "key": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the policy key (String type table entry) whose data table is scanned."
+            },
+            "ids": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the candidate ID list (VecAddress type table entry). Duplicates are deduped; max 100 candidates."
+            },
+            "where": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "range"
+                    },
+                    "valueMin": {
+                      "description": "Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).",
+                      "type": "string"
+                    },
+                    "valueMax": {
+                      "description": "Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).",
+                      "type": "string"
+                    },
+                    "minInclusive": {
+                      "description": "Default true. false makes the lower bound exclusive.",
+                      "type": "boolean"
+                    },
+                    "maxInclusive": {
+                      "description": "Default true. false makes the upper bound exclusive.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "kind"
+                  ],
+                  "additionalProperties": false,
+                  "description": "Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "numEq"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Exact numeric match. Plain number string (U256 semantics)."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "gt"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Greater than. Plain number string (U256 semantics)."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "gte"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Greater than or equal. Plain number string (U256 semantics)."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "lt"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Less than. Plain number string (U256 semantics)."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
                 {
-                  "$ref": "#/definitions/__schema3"
-                }
-              ],
-              "$ref": "#/definitions/__schema2"
-            },
-            "forwardIdx": {
-              "description": "GuardNode that returns the forward operation index (U64 type) within the session. Typically an 'identifier' node referencing a U64 value from the Guard table.",
-              "allOf": [
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "lte"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Less than or equal. Plain number string (U256 semantics)."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
                 {
-                  "$ref": "#/definitions/__schema3"
-                }
-              ],
-              "$ref": "#/definitions/__schema2"
-            }
-          },
-          "required": [
-            "type",
-            "object",
-            "historyIdx",
-            "sessionIdx",
-            "forwardIdx"
-          ],
-          "additionalProperties": false,
-          "description": "Returns U64. Counts the number of retained submissions within the specified forward operation."
-        },
-        {
-          "type": "object",
-          "properties": {
-            "type": {
-              "type": "string",
-              "const": "query_progress_history_session_forward_retained_submission_value"
-            },
-            "object": {
-              "type": "object",
-              "properties": {
-                "identifier": {
-                  "type": "integer",
-                  "minimum": 0,
-                  "maximum": 255,
-                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
-                }
-              },
-              "required": [
-                "identifier"
-              ],
-              "additionalProperties": false,
-              "description": "Reference to the Progress object in the Guard table (must be Address type)."
-            },
-            "historyIdx": {
-              "description": "GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.",
-              "allOf": [
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "addressEq"
+                    },
+                    "identifier": {
+                      "type": "integer",
+                      "minimum": 0,
+                      "maximum": 255,
+                      "description": "Identifier of the Address-type table entry to compare against."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "identifier"
+                  ],
+                  "additionalProperties": false
+                },
                 {
-                  "$ref": "#/definitions/__schema3"
-                }
-              ],
-              "$ref": "#/definitions/__schema2"
-            },
-            "sessionIdx": {
-              "description": "GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.",
-              "allOf": [
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "stringEq"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Exact string match (byte equality, UTF-8)."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
                 {
-                  "$ref": "#/definitions/__schema3"
-                }
-              ],
-              "$ref": "#/definitions/__schema2"
-            },
-            "forwardIdx": {
-              "description": "GuardNode that returns the forward operation index (U64 type) within the session. Typically an 'identifier' node referencing a U64 value from the Guard table.",
-              "allOf": [
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "stringContains"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Substring match, case-sensitive."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
                 {
-                  "$ref": "#/definitions/__schema3"
-                }
-              ],
-              "$ref": "#/definitions/__schema2"
-            },
-            "identifier": {
-              "description": "GuardNode that returns the submission identifier (U8 type) — which retained submission of the forward to read. Typically an 'identifier' node referencing a U8 value from the Guard table.",
-              "allOf": [
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "stringNoCaseContains"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Substring match, case-insensitive."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
                 {
-                  "$ref": "#/definitions/__schema3"
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "boolEq"
+                    },
+                    "value": {
+                      "type": "boolean",
+                      "description": "Boolean equality."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
                 }
               ],
-              "$ref": "#/definitions/__schema2"
+              "description": "Predicate filter applied to each candidate's data value."
             }
           },
           "required": [
             "type",
             "object",
-            "historyIdx",
-            "sessionIdx",
-            "forwardIdx",
-            "identifier"
+            "key",
+            "ids",
+            "where"
           ],
           "additionalProperties": false,
-          "description": "Returns VecU8 (the ONLY history query that does not return U64). Value of the specified retained submission of a HISTORY record (query 1281) — the history-side counterpart of the ACTIVE-SESSION-ONLY 1268 read, which goes blind once the session migrates into history. Use 1274/1275 to discover the history/session/forward indexes first. Throws error when the record carries no submission for the identifier (Guard validation fails)."
+          "description": "Returns U64. Counts candidates whose stored value matches the predicate. Numeric predicates: U256 semantics (pass plain number strings). Range is closed interval per side (minInclusive/maxInclusive default true); a missing side is unbounded. numEq/gt/gte/lt/lte are sugar over range. Entries whose value type does not match the predicate kind are skipped (never error), so the count only reflects matching entries."
         },
         {
           "type": "object",
           "properties": {
             "type": {
               "type": "string",
-              "const": "query_repository_data_count_where"
+              "const": "query_repository_data_sum_where"
             },
             "object": {
               "type": "object",
@@ -26731,14 +27403,14 @@
             "where"
           ],
           "additionalProperties": false,
-          "description": "Returns U64. Counts candidates whose stored value matches the predicate. Numeric predicates: U256 semantics (pass plain number strings). Range is closed interval per side (minInclusive/maxInclusive default true); a missing side is unbounded. numEq/gt/gte/lt/lte are sugar over range. Entries whose value type does not match the predicate kind are skipped (never error), so the count only reflects matching entries."
+          "description": "Returns U256. Sums the numeric payloads of candidates whose stored value matches the predicate (on-chain checked add, overflow aborts). Non-numeric or mismatching entries contribute 0. Use logic_as_u256_* to compare the sum."
         },
         {
           "type": "object",
           "properties": {
             "type": {
               "type": "string",
-              "const": "query_repository_data_sum_where"
+              "const": "query_repository_data_sum_where_bound"
             },
             "object": {
               "type": "object",
@@ -26786,7 +27458,7 @@
                 "identifier"
               ],
               "additionalProperties": false,
-              "description": "Reference to the candidate ID list (VecAddress type table entry). Duplicates are deduped; max 100 candidates."
+              "description": "Reference to the candidate ID list (VecAddress type table entry). Each id should be an ORDER address (e.g. order-keyed contribution rows). Duplicates are deduped; max 100 candidates."
             },
             "where": {
               "oneOf": [
@@ -27014,14 +27686,14 @@
             "where"
           ],
           "additionalProperties": false,
-          "description": "Returns U256. Sums the numeric payloads of candidates whose stored value matches the predicate (on-chain checked add, overflow aborts). Non-numeric or mismatching entries contribute 0. Use logic_as_u256_* to compare the sum."
+          "description": "Returns U256. ESCROW-BOUND sum (query 1179, live cap v140): per-row min(row_value, order.amount, LIVE allocation.balance of the Order the row id names) — only funds still in escrow right now count, so a refunded or already-disbursed order contributes 0 naturally; a row whose Order has no allocation link also contributes 0, while an unreadable allocation object aborts the query (corruption is never a silent 0). A row keyed by anything that is not an Order contributes 0 (fail-closed). Unlike query_repository_data_sum_where (self-reported row values), a record cannot claim more than the escrow actually bound to it — the forgery-proof aggregate for threshold gates and Formula pricing. Use logic_as_u256_* to compare the sum."
         },
         {
           "type": "object",
           "properties": {
             "type": {
               "type": "string",
-              "const": "query_repository_data_sum_where_bound"
+              "const": "query_repository_data_sum_where_bound_all"
             },
             "object": {
               "type": "object",
@@ -27055,22 +27727,6 @@
               "additionalProperties": false,
               "description": "Reference to the policy key (String type table entry) whose data table is scanned."
             },
-            "ids": {
-              "type": "object",
-              "properties": {
-                "identifier": {
-                  "type": "integer",
-                  "minimum": 0,
-                  "maximum": 255,
-                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
-                }
-              },
-              "required": [
-                "identifier"
-              ],
-              "additionalProperties": false,
-              "description": "Reference to the candidate ID list (VecAddress type table entry). Each id should be an ORDER address (e.g. order-keyed contribution rows). Duplicates are deduped; max 100 candidates."
-            },
             "where": {
               "oneOf": [
                 {
@@ -27286,18 +27942,17 @@
                   "additionalProperties": false
                 }
               ],
-              "description": "Predicate filter applied to each candidate's data value."
+              "description": "Predicate filter applied to each row's data value."
             }
           },
           "required": [
             "type",
             "object",
             "key",
-            "ids",
             "where"
           ],
           "additionalProperties": false,
-          "description": "Returns U256. ESCROW-BOUND sum (query 1179, live cap v139): per-row min(row_value, order.amount, LIVE allocation.balance of the Order the row id names) — only funds still in escrow right now count, so a refunded or already-disbursed order contributes 0 naturally; a row whose Order has no allocation link also contributes 0, while an unreadable allocation object aborts the query (corruption is never a silent 0). A row keyed by anything that is not an Order contributes 0 (fail-closed). Unlike query_repository_data_sum_where (self-reported row values), a record cannot claim more than the escrow actually bound to it — the forgery-proof aggregate for threshold gates and Formula pricing. Use logic_as_u256_* to compare the sum."
+          "description": "Returns U256. ALL-MODE escrow-bound sum (query 1181, flag enable_repository_data_sum_bound_all, protocol v141 — the query ABORTS while the flag is off): the 1179 per-row clamp min(row_value, order.amount, LIVE allocation.balance) over a DERIVED candidate set — the per-key RowRosterKey dynamic-field roster the framework maintains on every data write — instead of a caller-supplied ids list, so the aggregate no longer depends on the caller submitting an honest, complete candidate list (the ks13/HKS-04 ROSTER-01 face). No ids parameter. The roster is bounded by REPOSITORY_QUERY_MAX_CANDIDATES: a key with more rows aborts the query (fail-closed, never a silent truncation). Pre-flag rows (written before the roster was maintained, or under a disabled flag on an older binary) are NOT in the roster and contribute 0 — rebuild or re-touch rows after enabling. Use logic_as_u256_* to compare the sum."
         },
         {
           "type": "object",