@wowok/agent-mcp 3.4.2 → 3.4.3

package/dist/schemas/onchain_operations_guard.schema.json

@@ -3365,6 +3365,272 @@
                   "additionalProperties": false,
                   "description": "Returns U256. ESCROW-BOUND sum (query 1179, live cap v140): per-row min(row_value, order.amount, LIVE allocation.balance of the Order the row id names) — only funds still in escrow right now count, so a refunded or already-disbursed order contributes 0 naturally; a row whose Order has no allocation link also contributes 0, while an unreadable allocation object aborts the query (corruption is never a silent 0). A row keyed by anything that is not an Order contributes 0 (fail-closed). Unlike query_repository_data_sum_where (self-reported row values), a record cannot claim more than the escrow actually bound to it — the forgery-proof aggregate for threshold gates and Formula pricing. Use logic_as_u256_* to compare the sum."
                 },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "query_repository_data_sum_where_bound_all"
+                    },
+                    "object": {
+                      "type": "object",
+                      "properties": {
+                        "identifier": {
+                          "type": "integer",
+                          "minimum": 0,
+                          "maximum": 255,
+                          "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                        }
+                      },
+                      "required": [
+                        "identifier"
+                      ],
+                      "additionalProperties": false,
+                      "description": "Reference to the Repository object in the Guard table (must be Address type)."
+                    },
+                    "key": {
+                      "type": "object",
+                      "properties": {
+                        "identifier": {
+                          "type": "integer",
+                          "minimum": 0,
+                          "maximum": 255,
+                          "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                        }
+                      },
+                      "required": [
+                        "identifier"
+                      ],
+                      "additionalProperties": false,
+                      "description": "Reference to the policy key (String type table entry) whose data table is scanned."
+                    },
+                    "where": {
+                      "oneOf": [
+                        {
+                          "type": "object",
+                          "properties": {
+                            "kind": {
+                              "type": "string",
+                              "const": "range"
+                            },
+                            "valueMin": {
+                              "description": "Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).",
+                              "type": "string"
+                            },
+                            "valueMax": {
+                              "description": "Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).",
+                              "type": "string"
+                            },
+                            "minInclusive": {
+                              "description": "Default true. false makes the lower bound exclusive.",
+                              "type": "boolean"
+                            },
+                            "maxInclusive": {
+                              "description": "Default true. false makes the upper bound exclusive.",
+                              "type": "boolean"
+                            }
+                          },
+                          "required": [
+                            "kind"
+                          ],
+                          "additionalProperties": false,
+                          "description": "Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "kind": {
+                              "type": "string",
+                              "const": "numEq"
+                            },
+                            "value": {
+                              "type": "string",
+                              "description": "Exact numeric match. Plain number string (U256 semantics)."
+                            }
+                          },
+                          "required": [
+                            "kind",
+                            "value"
+                          ],
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "kind": {
+                              "type": "string",
+                              "const": "gt"
+                            },
+                            "value": {
+                              "type": "string",
+                              "description": "Greater than. Plain number string (U256 semantics)."
+                            }
+                          },
+                          "required": [
+                            "kind",
+                            "value"
+                          ],
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "kind": {
+                              "type": "string",
+                              "const": "gte"
+                            },
+                            "value": {
+                              "type": "string",
+                              "description": "Greater than or equal. Plain number string (U256 semantics)."
+                            }
+                          },
+                          "required": [
+                            "kind",
+                            "value"
+                          ],
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "kind": {
+                              "type": "string",
+                              "const": "lt"
+                            },
+                            "value": {
+                              "type": "string",
+                              "description": "Less than. Plain number string (U256 semantics)."
+                            }
+                          },
+                          "required": [
+                            "kind",
+                            "value"
+                          ],
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "kind": {
+                              "type": "string",
+                              "const": "lte"
+                            },
+                            "value": {
+                              "type": "string",
+                              "description": "Less than or equal. Plain number string (U256 semantics)."
+                            }
+                          },
+                          "required": [
+                            "kind",
+                            "value"
+                          ],
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "kind": {
+                              "type": "string",
+                              "const": "addressEq"
+                            },
+                            "identifier": {
+                              "type": "integer",
+                              "minimum": 0,
+                              "maximum": 255,
+                              "description": "Identifier of the Address-type table entry to compare against."
+                            }
+                          },
+                          "required": [
+                            "kind",
+                            "identifier"
+                          ],
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "kind": {
+                              "type": "string",
+                              "const": "stringEq"
+                            },
+                            "value": {
+                              "type": "string",
+                              "description": "Exact string match (byte equality, UTF-8)."
+                            }
+                          },
+                          "required": [
+                            "kind",
+                            "value"
+                          ],
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "kind": {
+                              "type": "string",
+                              "const": "stringContains"
+                            },
+                            "value": {
+                              "type": "string",
+                              "description": "Substring match, case-sensitive."
+                            }
+                          },
+                          "required": [
+                            "kind",
+                            "value"
+                          ],
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "kind": {
+                              "type": "string",
+                              "const": "stringNoCaseContains"
+                            },
+                            "value": {
+                              "type": "string",
+                              "description": "Substring match, case-insensitive."
+                            }
+                          },
+                          "required": [
+                            "kind",
+                            "value"
+                          ],
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "kind": {
+                              "type": "string",
+                              "const": "boolEq"
+                            },
+                            "value": {
+                              "type": "boolean",
+                              "description": "Boolean equality."
+                            }
+                          },
+                          "required": [
+                            "kind",
+                            "value"
+                          ],
+                          "additionalProperties": false
+                        }
+                      ],
+                      "description": "Predicate filter applied to each row's data value."
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "object",
+                    "key",
+                    "where"
+                  ],
+                  "additionalProperties": false,
+                  "description": "Returns U256. ALL-MODE escrow-bound sum (query 1181, flag enable_repository_data_sum_bound_all, protocol v141 — the query ABORTS while the flag is off): the 1179 per-row clamp min(row_value, order.amount, LIVE allocation.balance) over a DERIVED candidate set — the per-key RowRosterKey dynamic-field roster the framework maintains on every data write — instead of a caller-supplied ids list, so the aggregate no longer depends on the caller submitting an honest, complete candidate list (the ks13/HKS-04 ROSTER-01 face). No ids parameter. The roster is bounded by REPOSITORY_QUERY_MAX_CANDIDATES: a key with more rows aborts the query (fail-closed, never a silent truncation). Pre-flag rows (written before the roster was maintained, or under a disabled flag on an older binary) are NOT in the roster and contribute 0 — rebuild or re-touch rows after enabling. Use logic_as_u256_* to compare the sum."
+                },
                 {
                   "type": "object",
                   "properties": {
@@ -4311,6 +4577,14 @@
           "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
           "type": "boolean"
         },
+        "window_profile": {
+          "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
+          "type": "string",
+          "enum": [
+            "production",
+            "test"
+          ]
+        },
         "response_level": {
           "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
           "type": "string",
@@ -6279,117 +6553,400 @@
               "description": "GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.",
               "allOf": [
                 {
-                  "$ref": "#/definitions/__schema1"
-                }
-              ],
-              "$ref": "#/definitions/__schema0"
-            },
-            "sessionIdx": {
-              "description": "GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.",
-              "allOf": [
+                  "$ref": "#/definitions/__schema1"
+                }
+              ],
+              "$ref": "#/definitions/__schema0"
+            },
+            "sessionIdx": {
+              "description": "GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema1"
+                }
+              ],
+              "$ref": "#/definitions/__schema0"
+            },
+            "forwardIdx": {
+              "description": "GuardNode that returns the forward operation index (U64 type) within the session. Typically an 'identifier' node referencing a U64 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema1"
+                }
+              ],
+              "$ref": "#/definitions/__schema0"
+            }
+          },
+          "required": [
+            "type",
+            "object",
+            "historyIdx",
+            "sessionIdx",
+            "forwardIdx"
+          ],
+          "additionalProperties": false,
+          "description": "Returns U64. Counts the number of retained submissions within the specified forward operation."
+        },
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "const": "query_progress_history_session_forward_retained_submission_value"
+            },
+            "object": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the Progress object in the Guard table (must be Address type)."
+            },
+            "historyIdx": {
+              "description": "GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema1"
+                }
+              ],
+              "$ref": "#/definitions/__schema0"
+            },
+            "sessionIdx": {
+              "description": "GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema1"
+                }
+              ],
+              "$ref": "#/definitions/__schema0"
+            },
+            "forwardIdx": {
+              "description": "GuardNode that returns the forward operation index (U64 type) within the session. Typically an 'identifier' node referencing a U64 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema1"
+                }
+              ],
+              "$ref": "#/definitions/__schema0"
+            },
+            "identifier": {
+              "description": "GuardNode that returns the submission identifier (U8 type) — which retained submission of the forward to read. Typically an 'identifier' node referencing a U8 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema1"
+                }
+              ],
+              "$ref": "#/definitions/__schema0"
+            }
+          },
+          "required": [
+            "type",
+            "object",
+            "historyIdx",
+            "sessionIdx",
+            "forwardIdx",
+            "identifier"
+          ],
+          "additionalProperties": false,
+          "description": "Returns VecU8 (the ONLY history query that does not return U64). Value of the specified retained submission of a HISTORY record (query 1281) — the history-side counterpart of the ACTIVE-SESSION-ONLY 1268 read, which goes blind once the session migrates into history. Use 1274/1275 to discover the history/session/forward indexes first. Throws error when the record carries no submission for the identifier (Guard validation fails)."
+        },
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "const": "query_repository_data_count_where"
+            },
+            "object": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the Repository object in the Guard table (must be Address type)."
+            },
+            "key": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the policy key (String type table entry) whose data table is scanned."
+            },
+            "ids": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the candidate ID list (VecAddress type table entry). Duplicates are deduped; max 100 candidates."
+            },
+            "where": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "range"
+                    },
+                    "valueMin": {
+                      "description": "Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).",
+                      "type": "string"
+                    },
+                    "valueMax": {
+                      "description": "Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).",
+                      "type": "string"
+                    },
+                    "minInclusive": {
+                      "description": "Default true. false makes the lower bound exclusive.",
+                      "type": "boolean"
+                    },
+                    "maxInclusive": {
+                      "description": "Default true. false makes the upper bound exclusive.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "kind"
+                  ],
+                  "additionalProperties": false,
+                  "description": "Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "numEq"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Exact numeric match. Plain number string (U256 semantics)."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "gt"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Greater than. Plain number string (U256 semantics)."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "gte"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Greater than or equal. Plain number string (U256 semantics)."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "lt"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Less than. Plain number string (U256 semantics)."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
                 {
-                  "$ref": "#/definitions/__schema1"
-                }
-              ],
-              "$ref": "#/definitions/__schema0"
-            },
-            "forwardIdx": {
-              "description": "GuardNode that returns the forward operation index (U64 type) within the session. Typically an 'identifier' node referencing a U64 value from the Guard table.",
-              "allOf": [
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "lte"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Less than or equal. Plain number string (U256 semantics)."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
                 {
-                  "$ref": "#/definitions/__schema1"
-                }
-              ],
-              "$ref": "#/definitions/__schema0"
-            }
-          },
-          "required": [
-            "type",
-            "object",
-            "historyIdx",
-            "sessionIdx",
-            "forwardIdx"
-          ],
-          "additionalProperties": false,
-          "description": "Returns U64. Counts the number of retained submissions within the specified forward operation."
-        },
-        {
-          "type": "object",
-          "properties": {
-            "type": {
-              "type": "string",
-              "const": "query_progress_history_session_forward_retained_submission_value"
-            },
-            "object": {
-              "type": "object",
-              "properties": {
-                "identifier": {
-                  "type": "integer",
-                  "minimum": 0,
-                  "maximum": 255,
-                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
-                }
-              },
-              "required": [
-                "identifier"
-              ],
-              "additionalProperties": false,
-              "description": "Reference to the Progress object in the Guard table (must be Address type)."
-            },
-            "historyIdx": {
-              "description": "GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.",
-              "allOf": [
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "addressEq"
+                    },
+                    "identifier": {
+                      "type": "integer",
+                      "minimum": 0,
+                      "maximum": 255,
+                      "description": "Identifier of the Address-type table entry to compare against."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "identifier"
+                  ],
+                  "additionalProperties": false
+                },
                 {
-                  "$ref": "#/definitions/__schema1"
-                }
-              ],
-              "$ref": "#/definitions/__schema0"
-            },
-            "sessionIdx": {
-              "description": "GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.",
-              "allOf": [
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "stringEq"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Exact string match (byte equality, UTF-8)."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
                 {
-                  "$ref": "#/definitions/__schema1"
-                }
-              ],
-              "$ref": "#/definitions/__schema0"
-            },
-            "forwardIdx": {
-              "description": "GuardNode that returns the forward operation index (U64 type) within the session. Typically an 'identifier' node referencing a U64 value from the Guard table.",
-              "allOf": [
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "stringContains"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Substring match, case-sensitive."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
                 {
-                  "$ref": "#/definitions/__schema1"
-                }
-              ],
-              "$ref": "#/definitions/__schema0"
-            },
-            "identifier": {
-              "description": "GuardNode that returns the submission identifier (U8 type) — which retained submission of the forward to read. Typically an 'identifier' node referencing a U8 value from the Guard table.",
-              "allOf": [
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "stringNoCaseContains"
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Substring match, case-insensitive."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
                 {
-                  "$ref": "#/definitions/__schema1"
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "boolEq"
+                    },
+                    "value": {
+                      "type": "boolean",
+                      "description": "Boolean equality."
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "value"
+                  ],
+                  "additionalProperties": false
                 }
               ],
-              "$ref": "#/definitions/__schema0"
+              "description": "Predicate filter applied to each candidate's data value."
             }
           },
           "required": [
             "type",
             "object",
-            "historyIdx",
-            "sessionIdx",
-            "forwardIdx",
-            "identifier"
+            "key",
+            "ids",
+            "where"
           ],
           "additionalProperties": false,
-          "description": "Returns VecU8 (the ONLY history query that does not return U64). Value of the specified retained submission of a HISTORY record (query 1281) — the history-side counterpart of the ACTIVE-SESSION-ONLY 1268 read, which goes blind once the session migrates into history. Use 1274/1275 to discover the history/session/forward indexes first. Throws error when the record carries no submission for the identifier (Guard validation fails)."
+          "description": "Returns U64. Counts candidates whose stored value matches the predicate. Numeric predicates: U256 semantics (pass plain number strings). Range is closed interval per side (minInclusive/maxInclusive default true); a missing side is unbounded. numEq/gt/gte/lt/lte are sugar over range. Entries whose value type does not match the predicate kind are skipped (never error), so the count only reflects matching entries."
         },
         {
           "type": "object",
           "properties": {
             "type": {
               "type": "string",
-              "const": "query_repository_data_count_where"
+              "const": "query_repository_data_sum_where"
             },
             "object": {
               "type": "object",
@@ -6665,14 +7222,14 @@
             "where"
           ],
           "additionalProperties": false,
-          "description": "Returns U64. Counts candidates whose stored value matches the predicate. Numeric predicates: U256 semantics (pass plain number strings). Range is closed interval per side (minInclusive/maxInclusive default true); a missing side is unbounded. numEq/gt/gte/lt/lte are sugar over range. Entries whose value type does not match the predicate kind are skipped (never error), so the count only reflects matching entries."
+          "description": "Returns U256. Sums the numeric payloads of candidates whose stored value matches the predicate (on-chain checked add, overflow aborts). Non-numeric or mismatching entries contribute 0. Use logic_as_u256_* to compare the sum."
         },
         {
           "type": "object",
           "properties": {
             "type": {
               "type": "string",
-              "const": "query_repository_data_sum_where"
+              "const": "query_repository_data_sum_where_bound"
             },
             "object": {
               "type": "object",
@@ -6720,7 +7277,7 @@
                 "identifier"
               ],
               "additionalProperties": false,
-              "description": "Reference to the candidate ID list (VecAddress type table entry). Duplicates are deduped; max 100 candidates."
+              "description": "Reference to the candidate ID list (VecAddress type table entry). Each id should be an ORDER address (e.g. order-keyed contribution rows). Duplicates are deduped; max 100 candidates."
             },
             "where": {
               "oneOf": [
@@ -6948,14 +7505,14 @@
             "where"
           ],
           "additionalProperties": false,
-          "description": "Returns U256. Sums the numeric payloads of candidates whose stored value matches the predicate (on-chain checked add, overflow aborts). Non-numeric or mismatching entries contribute 0. Use logic_as_u256_* to compare the sum."
+          "description": "Returns U256. ESCROW-BOUND sum (query 1179, live cap v140): per-row min(row_value, order.amount, LIVE allocation.balance of the Order the row id names) — only funds still in escrow right now count, so a refunded or already-disbursed order contributes 0 naturally; a row whose Order has no allocation link also contributes 0, while an unreadable allocation object aborts the query (corruption is never a silent 0). A row keyed by anything that is not an Order contributes 0 (fail-closed). Unlike query_repository_data_sum_where (self-reported row values), a record cannot claim more than the escrow actually bound to it — the forgery-proof aggregate for threshold gates and Formula pricing. Use logic_as_u256_* to compare the sum."
         },
         {
           "type": "object",
           "properties": {
             "type": {
               "type": "string",
-              "const": "query_repository_data_sum_where_bound"
+              "const": "query_repository_data_sum_where_bound_all"
             },
             "object": {
               "type": "object",
@@ -6989,22 +7546,6 @@
               "additionalProperties": false,
               "description": "Reference to the policy key (String type table entry) whose data table is scanned."
             },
-            "ids": {
-              "type": "object",
-              "properties": {
-                "identifier": {
-                  "type": "integer",
-                  "minimum": 0,
-                  "maximum": 255,
-                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
-                }
-              },
-              "required": [
-                "identifier"
-              ],
-              "additionalProperties": false,
-              "description": "Reference to the candidate ID list (VecAddress type table entry). Each id should be an ORDER address (e.g. order-keyed contribution rows). Duplicates are deduped; max 100 candidates."
-            },
             "where": {
               "oneOf": [
                 {
@@ -7220,18 +7761,17 @@
                   "additionalProperties": false
                 }
               ],
-              "description": "Predicate filter applied to each candidate's data value."
+              "description": "Predicate filter applied to each row's data value."
             }
           },
           "required": [
             "type",
             "object",
             "key",
-            "ids",
             "where"
           ],
           "additionalProperties": false,
-          "description": "Returns U256. ESCROW-BOUND sum (query 1179, live cap v140): per-row min(row_value, order.amount, LIVE allocation.balance of the Order the row id names) — only funds still in escrow right now count, so a refunded or already-disbursed order contributes 0 naturally; a row whose Order has no allocation link also contributes 0, while an unreadable allocation object aborts the query (corruption is never a silent 0). A row keyed by anything that is not an Order contributes 0 (fail-closed). Unlike query_repository_data_sum_where (self-reported row values), a record cannot claim more than the escrow actually bound to it — the forgery-proof aggregate for threshold gates and Formula pricing. Use logic_as_u256_* to compare the sum."
+          "description": "Returns U256. ALL-MODE escrow-bound sum (query 1181, flag enable_repository_data_sum_bound_all, protocol v141 — the query ABORTS while the flag is off): the 1179 per-row clamp min(row_value, order.amount, LIVE allocation.balance) over a DERIVED candidate set — the per-key RowRosterKey dynamic-field roster the framework maintains on every data write — instead of a caller-supplied ids list, so the aggregate no longer depends on the caller submitting an honest, complete candidate list (the ks13/HKS-04 ROSTER-01 face). No ids parameter. The roster is bounded by REPOSITORY_QUERY_MAX_CANDIDATES: a key with more rows aborts the query (fail-closed, never a silent truncation). Pre-flag rows (written before the roster was maintained, or under a disabled flag on an older binary) are NOT in the roster and contribute 0 — rebuild or re-touch rows after enabling. Use logic_as_u256_* to compare the sum."
         },
         {
           "type": "object",