@curviate/sdk 0.25.0 → 0.26.0

package/CHANGELOG.md

@@ -7,6 +7,98 @@ Versioning: semantic. Minor for additive changes, patch for bug fixes; no stabil
 
 ---
 
+## [0.26.0] - 2026-09-06
+
+Fixture regenerated against the deployed production document
+(`https://api.curviate.com`, `server_git_sha bd795601...`, 125 paths).
+**BREAKING at the type level** for a consumer that reads `row` off an error
+or a safety warning as a `string`: it is now `string | null` on both. Three
+response enums also widen, which reds an exhaustive `switch` with a `never`
+default. Everything else in this release is additive.
+
+### Added
+
+- **`NOT_STORED` in the error taxonomy.** The `422` a read gets when
+  `mode=cache_only` (or `refill` on a resource that cannot be filled) finds
+  nothing in Curviate's store, so the API refuses rather than reaching
+  LinkedIn. It was missing from `ERROR_CODES`, so it decoded to `INTERNAL`:
+  a caller could not branch on it, and, the harmful half, `INTERNAL` is
+  retryable, so a `cache_only` miss was retried on a GET against an answer
+  that cannot change until the caller picks another mode. It is now decoded to
+  itself and is deliberately absent from the retryable set. Not the same as
+  `RESOURCE_NOT_FOUND`: the resource may exist and this API simply holds no
+  copy, so the fix is another mode, not another id. `cache_only` is the mode
+  that raises it on these reads, and `refill` or `auto` is the remedy.
+
+  **This reds `@curviate/cli`'s exit-code exhaustiveness guard, by design.**
+  That guard iterates the exported `ERROR_CODES` array rather than a copy of
+  it, which is the whole reason the array is exported, so a code added here
+  with no exit-code mapping is supposed to fail it. Map `NOT_STORED` there when
+  bumping the pin.
+- **`messaging.getChat(chatId, params?)` takes the retrieval query.**
+  `GET /v1/{account_id}/chats/{chat_id}` declares `expand`, `mode` and
+  `max_age`; the method sent no query at all, so a chat read was the one
+  store-servable read with no retrieval ladder. `ChatGetQuery` is derived from
+  the generated `paths` types, like every other query type here.
+  `users.get()` and `messaging.listMessages()` already carried the pair and
+  are unchanged; the README now documents all three.
+
+### Regenerated types
+
+- **BREAKING - `row` is nullable on both `Error` and `SafetyWarning`.**
+  `Error.row` goes `string | undefined` to `string | null | undefined`, and
+  `SafetyWarning.row` - which is REQUIRED, so it is the one that will actually
+  break a build - goes `string` to `string | null`. `null` says the breach
+  names no row: an `activity_window` refusal on an action that spends no
+  budget of its own has an hour to answer for and no counter. Read
+  `hint.parameter` in that case; it names `posture`. A consumer that assigned
+  `.row` to a `string` or passed it somewhere non-null now has a type error,
+  and that error is correct - the runtime value was always going to be `null`
+  once the server started sending it. The SDK's own `CurviateError.budgetRow`
+  is UNCHANGED (`string | undefined`): `transport.ts` maps the wire field with
+  a `typeof === "string"` guard, so a `null` row arrives as an absent
+  `budgetRow`, which is what "no row to name" already meant on that surface.
+- **BREAKING for an exhaustive `switch` - three response enums widen.** Each
+  gains a member, so a `switch` with a `never`-typed default arm stops
+  compiling. None of them removes a member, so a `switch` with a real default
+  keeps working:
+  - `GET /v1/{account_id}/safety-events` `items[].reason` gains
+    `activity_window` alongside `budget_exhausted` and `rate_limited`.
+  - `GET /v1/{account_id}/safety-events` `items[].budget_row` gains `"*"`, the
+    wildcard for an event that is not scoped to one row.
+  - `notices[].code` on the ten chat and message reads that accept
+    `expand=public_identifier` gains `EXPANSION_WITHHELD_ACTIVITY_WINDOW`
+    alongside `EXPANSION_LIMIT_REACHED`: the expansion was refused because the
+    account is outside its activity window, not because the page ran out of
+    lookup budget. Same consequence for the reader either way -
+    `public_identifier` is `null` for reasons that are not "no public profile"
+    - but a different fix, so it is a separate code. The `notices` key itself
+    is not new.
+- **Additive - `interface_ceiling` and `effective_interface_ceiling` on every
+  budget row.** Optional, `number | null`. They appear on `quotas[]` from
+  `GET /v1/accounts/{account_id}` and on the policy rows from
+  `GET`/`PATCH /v1/{account_id}/safety-policy`. What a call through the
+  matching ELEVATED interface (`/sales-navigator/...`, `/recruiter/...`) is
+  held to on that row; `null` wherever the row and limit profile have no such
+  figure, which is every row on `basic` and `premium`. `ceiling`,
+  `effective_ceiling`, `band` and `over_default` all remain the STANDARD
+  figure, so a row can report `band: "over"` while an elevated call still
+  succeeds. Read `effective_interface_ceiling`, not `interface_ceiling`, for
+  the same reason `effective_ceiling` and not `ceiling` answers that on the
+  standard side. On the `PATCH` request body both are typed `unknown` and
+  documented READ-ONLY: sent back they are accepted and ignored, so a read can
+  round-trip unedited.
+- **Additive - `activity_window` on the `PATCH /v1/{account_id}/safety-policy`
+  request body**, typed `unknown` and documented NOT ACCEPTED. Send the
+  settable subfields instead: top-level `timezone`, and per row
+  `activity_window_start`, `activity_window_end`, `activity_window_timezone`,
+  `activity_window_applies_to`.
+- Description-only, no type change: `reset_at` on `Error` and `SafetyWarning`
+  now states that it is the window roll on a `ceiling` refusal and the next
+  window open on an `activity_window` one, and restates the two cases where no
+  clock frees the account (the `pending_invites` gauge, and InMail credits).
+  The chat-search `q` parameter documents that a 1-2 character term is slower.
+
 ## [0.25.0] - 2026-09-05
 
 **BREAKING** for a consumer that pinned the old type declarations: `quotas[]`

package/README.md

@@ -122,6 +122,13 @@ try {
     case "ACCOUNT_NOT_FOUND":
       console.error("Account does not exist for this tenant.");
       break;
+    case "NOT_STORED":
+      // A cache_only read the store could not answer, so nothing was fetched.
+      // The id may be perfectly good, so do not go looking for it again:
+      // re-read with mode "refill" or "auto", and on a narrowed listing drop
+      // the narrowing parameters. See "Retrieval modes" below.
+      console.warn("Nothing stored for that resource under this mode.");
+      break;
     default:
       if (err.retryLikelyToSucceed) {
         // Safe to retry: server-side transient error
@@ -137,6 +144,67 @@ exported `ErrorCode` type is the complete set, so `tsc` tells you when a `switch
 
 ---
 
+## Retrieval modes
+
+Some reads can be answered from Curviate's own store instead of a live LinkedIn
+fetch. Those reads take the same two query parameters, `mode` and `max_age`:
+
+- `users.get()`, including `users.get("me")` (`GET /v1/{account_id}/users/{user_id}`)
+- `messaging.getChat()` (`GET /v1/{account_id}/chats/{chat_id}`)
+- `messaging.listMessages()` (`GET /v1/{account_id}/chats/{chat_id}/messages`)
+
+No other read accepts them, so do not pass them elsewhere. These two keys are
+refused rather than ignored: sending either to a read that does not declare it
+is a `400`, and so is sending either one twice. A read that accepted
+`mode=cache_only` and then called LinkedIn anyway would break the one guarantee
+that parameter makes, so neither case is resolved quietly.
+
+| `mode` | What the read does |
+| --- | --- |
+| `auto` (default) | serves a stored copy while it is inside the resource's freshness threshold, otherwise fetches |
+| `live` | always fetches |
+| `refill` | serves a stored copy at any age, and fetches once when this read has none |
+| `cache_only` | never fetches, and throws `NOT_STORED` when the store cannot answer |
+
+`max_age` is the mechanism the first three are presets over: the oldest stored
+copy, in seconds, the read will accept. It overrides them in both directions,
+and `max_age: 0` is the same as `mode: "live"`. It cannot be combined with
+`cache_only`, whose guarantee is not a freshness threshold; that pair is
+rejected with `INVALID_REQUEST` rather than one of the two being quietly
+dropped.
+
+```ts
+// Serve whatever is stored, at any age; reach LinkedIn only if nothing is.
+const chat = await acc.messaging.getChat("chat_1", { mode: "refill" });
+
+// Never reach LinkedIn. Throws NOT_STORED when the store holds nothing.
+const profile = await acc.users.get("me", { mode: "cache_only" });
+
+// Accept a stored copy up to five minutes old, fetch otherwise.
+const page = await acc.messaging.listMessages("chat_1", { max_age: 300 });
+```
+
+Every one of these responses carries fields that say what you are holding:
+
+- `source` is `"store"` or `"live"`, and `observed_at` is when the data was seen
+  on LinkedIn. A stored answer can carry less than a live one, because some
+  fields are dropped before anything is written, so `source: "store"` is how you
+  know to ask again with `mode: "live"` when a field you need is missing.
+- `withdrawn` is always present, never inferred from a missing field. `true`
+  means LinkedIn has said the resource is gone, such as a removed profile, and
+  the answer you are holding is the copy Curviate still has: do not act on it.
+  `withdrawn_at` rides along when it is `true`. This is the field to branch on
+  before messaging or acting on anything served from the store, and `refill`,
+  which serves a copy at any age, is the mode most likely to hand you one.
+
+`NOT_STORED` under `cache_only` does not always mean the resource is unknown.
+On `listMessages` it also fires when the request narrows the page in a way the
+stored copy cannot reproduce, so a fully stored chat can refuse a narrowed
+`cache_only` read. Re-read without the narrowing parameters, or with a mode that
+may fetch.
+
+---
+
 ## Cursor pagination
 
 Resources that return lists support cursor pagination. `curviate.paginate()` is an async iterator that follows the `cursor` field automatically, so you pull items one at a time without managing cursors:

package/dist/index.d.ts

@@ -2689,7 +2689,7 @@ interface paths {
         head?: never;
         /**
          * Update an account's safety policy
-         * @description The single safety-policy write. Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the Curviate default. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Four fields on the read are derived rather than configured: `effective_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, which for the zone is the top-level `timezone`. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result, and it holds until the next connect. When the seat and the detected product disagree, the detected product wins the numbers and the read reports the disagreement as `seat_tier_mismatch`.
+         * @description The single safety-policy write. Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the Curviate default. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result, and it holds until the next connect. When the seat and the detected product disagree, the detected product wins the numbers and the read reports the disagreement as `seat_tier_mismatch`.
          */
         patch: operations["patchV1AccountIdSafetyPolicy"];
         trace?: never;
@@ -2747,9 +2747,9 @@ interface components {
              * @enum {string}
              */
             required_tier?: "core" | "sales_nav" | "recruiter";
-            /** @description Present on a PLATFORM_RATE_LIMIT raised because one account-safety budget row is paused: LinkedIn refused a recent call on that row, so this one was refused locally without reaching LinkedIn. Names the paused row (for example profile_views, connection_requests_no_note). The pause is scoped to this row on this account; every other row keeps working. Absent on every other rate limit. Also present on BUDGET_EXHAUSTED, where it names the row that hit its CEILING rather than one LinkedIn paused: read the code to tell the two apart, because the recovery differs. */
-            row?: string;
-            /** @description Present on BUDGET_EXHAUSTED: when this row's budget frees up, as an absolute instant rather than a duration, so it stays true however long you hold it. Null for the pending_invites row, whose backlog falls when invitations are accepted or withdrawn rather than at any window boundary, so there is no instant to name. */
+            /** @description Present on a PLATFORM_RATE_LIMIT raised because one account-safety budget row is paused: LinkedIn refused a recent call on that row, so this one was refused locally without reaching LinkedIn. Names the paused row (for example profile_views, connection_requests_no_note). The pause is scoped to this row on this account; every other row keeps working. Absent on every other rate limit. Also present on BUDGET_EXHAUSTED, where it names the row that hit its CEILING rather than one LinkedIn paused: read the code to tell the two apart, because the recovery differs. Null on a BUDGET_EXHAUSTED whose reason is activity_window and whose action spends no budget of its own, because there is no row to name; hint.parameter still names the setting to change. Never null on a rate limit. */
+            row?: string | null;
+            /** @description Present on BUDGET_EXHAUSTED: the instant the refusal lifts, as an absolute instant rather than a duration, so it stays true however long you hold it. It is the window roll on a ceiling refusal and the next window open on an activity-window one. It is null in the two cases where no clock frees the account: the pending_invites gauge, whose backlog falls when invitations are accepted or withdrawn, and an InMail credit exhaustion (row inmail), which LinkedIn regrants on a schedule this product cannot read. */
             reset_at?: string | null;
             /** @description Present on BUDGET_EXHAUSTED: the exact setting to change, as a field rather than as prose. parameter is addressable on PATCH /v1/{account_id}/safety-policy, so an agent can decide between waiting until reset_at, escalating to a human, and reconfiguring, without parsing the message. */
             hint?: {
@@ -2812,9 +2812,9 @@ interface components {
          *     }
          */
         SafetyWarning: {
-            /** @description The budget row that breached, for example profile_views or pending_invites. */
-            row: string;
-            /** @description When the row frees up, as an absolute instant. Null for the pending_invites gauge. */
+            /** @description The budget row that breached, for example profile_views or pending_invites. Null when the breach is not about a row: an activity_window warning on an action that spends no budget of its own (editing a message, dismissing a notification, a Recruiter or Sales Navigator admin action) is still governed by the hours the account works in. Read hint.parameter for what to change; whenever this is null it names posture, because the activity window edges are set per action type and this action has none, so the levers that reach it are the account timezone and posture. */
+            row: string | null;
+            /** @description The instant the refusal lifts: the window roll on a ceiling refusal, the next window open on an activity-window one. Null in the two cases no clock frees, the pending_invites gauge and InMail credits (row inmail). */
             reset_at: string | null;
             hint: {
                 /** @description The settable parameter on PATCH /v1/{account_id}/safety-policy. */
@@ -6806,13 +6806,13 @@ interface operations {
                         }[];
                         /** @description Opaque cursor for the next page, or null at end-of-list. */
                         cursor: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -6989,13 +6989,13 @@ interface operations {
                             /** @description Message body (content pass-through, never stored). */
                             text?: string | null;
                         } | null;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -7165,13 +7165,13 @@ interface operations {
                         }[];
                         /** @description Opaque cursor for the next page, or null at end-of-list. */
                         cursor: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -7508,13 +7508,13 @@ interface operations {
                         sent_at: number;
                         /** @description Message body (content pass-through, never stored). */
                         text?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -7714,13 +7714,13 @@ interface operations {
                          * @enum {boolean}
                          */
                         filter_effective?: true;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -10361,13 +10361,13 @@ interface operations {
                         }[];
                         /** @description Next-page cursor; follow until items is empty (presence is not a has-more guarantee). */
                         cursor?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -10783,13 +10783,13 @@ interface operations {
                             /** @description The vanity slug from the profile URL, for example jane-smith. Present only when the request asks for it with expand=public_identifier, and then always present, carrying the slug or null when the platform surfaces none for this person. */
                             public_identifier?: string | null;
                         };
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -11143,13 +11143,13 @@ interface operations {
                         }[];
                         /** @description Next-page cursor; follow until items is empty. */
                         cursor?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -11519,13 +11519,13 @@ interface operations {
                                 [key: string]: unknown;
                             };
                         };
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -12096,7 +12096,7 @@ interface operations {
     getV1AccountIdChatsSearch: {
         parameters: {
             query: {
-                /** @description The search term: matches both participant names and message content (e.g. 'sophie keller'). */
+                /** @description The search term: matches both participant names and message content (e.g. 'sophie keller'). Terms of 3 or more characters are fast; a 1-2 character term is slower. */
                 query: string;
                 /** @description Maximum chats to return per page (1-100, default 20). The server may walk a few internal pages to fill one page. */
                 limit?: number;
@@ -12725,13 +12725,13 @@ interface operations {
                         }[];
                         /** @description Next-page cursor. Follow until items is empty. */
                         cursor?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -27956,6 +27956,10 @@ interface operations {
                             ceiling: number | null;
                             /** @description What this row is ACTUALLY held to right now: `ceiling` with the account's warm-up ramp applied. Compare `used` against THIS one, and `band` is computed against it too. While an account is new, thinly connected, dormant or recovering from a restriction the two differ, and on a five-day-old account they differ by a factor of about seven. Equal to `ceiling` once the ramp is over, and `null` wherever `ceiling` is null. The account's ramp, its factor and the triggers behind it are on GET /v1/{account_id}/safety-policy as `warm_up`. */
                             effective_ceiling?: number | null;
+                            /** @description What a call through the matching ELEVATED interface is held to on this row: the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations. Null when this row and limit profile have no such figure, which is every row on `basic` and `premium` and most rows everywhere. Everything else on this row (`ceiling`, `effective_ceiling`, `band` and `over_default`) is the STANDARD-interface figure, because one counter serves both interfaces and the standard side is the conservative one to band against. The consequence is worth reading: on a `sales_navigator` or `recruiter` account a row can report `band: "over"` with `posture: "enforce"` while a call through the elevated interface still succeeds; the refusal the band predicts is the one a standard call gets. */
+                            interface_ceiling?: number | null;
+                            /** @description `interface_ceiling` with the account's warm-up ramp applied, and null wherever `interface_ceiling` is null. Read THIS to know where an elevated-interface call stops, for the same reason `effective_ceiling` rather than `ceiling` answers that for a standard one. */
+                            effective_interface_ceiling?: number | null;
                             /**
                              * @description Where `used` sits against this row's own bands. `green` routine, `amber` at or past the routine band, `hard` at or past the warn-louder band, `over` at or past the ceiling. `over` is what `posture` acts on: `warn` reports it and lets the action through, `enforce` refuses. A row with no figures reports `green` at every value, because there is nothing to be past.
                              * @enum {string}
@@ -30427,7 +30431,7 @@ interface operations {
                         /** @description The account this policy governs. */
                         account_id?: string;
                         /**
-                         * @description Which set of Curviate defaults every row below is resolved from. Each profile inherits the one before it and raises a few rows: `premium` adds a daily invitation band and open-profile InMail, `sales_navigator` raises profile views and search, `recruiter` raises profile views again. This is the platform product active on the account, not the Curviate seat entitlement. The two can disagree, and this is the one that governs the numbers. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations. A standard-interface call still lives under the `basic` or `premium` figure for its row, and Curviate does not yet track that difference: on a non-`basic` profile the numbers here are the headroom of the elevated interface, not of every call, so read them as an upper bound rather than as your budget for a standard call.
+                         * @description Which set of Curviate defaults every row below is resolved from. Each profile inherits the one before it and raises a few rows: `premium` adds a daily invitation band and open-profile InMail, `sales_navigator` raises profile views and search, `recruiter` raises profile views again. This is the platform product active on the account, not the Curviate seat entitlement. The two can disagree, and this is the one that governs the numbers. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
                          * @enum {string}
                          */
                         limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
@@ -30510,7 +30514,7 @@ interface operations {
                             /** @description IANA zone name the activity window is read in. Null disables the window entirely. */
                             activity_window_timezone?: string | null;
                             /**
-                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. Stored reads and inbound events are never subject to the window under either setting, at any hour.
+                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. A read Curviate answers from its own store never reaches LinkedIn, so it is never subject to the window under either setting, at any hour; the same read IS covered when the store cannot answer it, or when you ask for it live. Inbound events are never subject to it either.
                              * @enum {string}
                              */
                             activity_window_applies_to?: "writes" | "all";
@@ -30534,7 +30538,11 @@ interface operations {
                             source_class?: "substrate" | "linkedin_official" | "practitioner" | "inferred" | "unseeded";
                             /** @description What this row is ACTUALLY held to right now: `ceiling` with the account's warm-up ramp applied. Read this one, not `ceiling`, to know where the next call will be stopped. On an account in warm-up the two differ, and on a five-day-old account they differ by a factor of about seven. Null when the row has no ceiling to ramp. `warm_up_state` and `warm_up_factor` beside it are the values ACTIVE on this row, not the seeded ones. */
                             effective_ceiling?: number | null;
-                            /** @description Empty when nothing on this row is above default. */
+                            /** @description What a call through the matching ELEVATED interface is held to on this row: the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations. Null when this row and limit profile have no such figure, which is every row on `basic` and `premium` and most rows everywhere. Everything else on this row (`ceiling`, `effective_ceiling`, `band` and `over_default`) is the STANDARD-interface figure, because one counter serves both interfaces and the standard side is the conservative one to band against. The consequence is worth reading: on a `sales_navigator` or `recruiter` account a row can report `band: "over"` with `posture: "enforce"` while a call through the elevated interface still succeeds; the refusal the band predicts is the one a standard call gets. */
+                            interface_ceiling?: number | null;
+                            /** @description `interface_ceiling` with the account's warm-up ramp applied, and null wherever `interface_ceiling` is null. Read THIS to know where an elevated-interface call stops, for the same reason `effective_ceiling` rather than `ceiling` answers that for a standard one. */
+                            effective_interface_ceiling?: number | null;
+                            /** @description Empty when nothing on this row is above default. Computed against the STANDARD-interface default, like `band` and for the same reason. */
                             over_default?: {
                                 /**
                                  * @description The field whose configured value is above default.
@@ -30593,7 +30601,7 @@ interface operations {
             content: {
                 "application/json": {
                     /**
-                     * @description Which set of Curviate defaults this account's rows resolve from: `basic`, `premium`, `sales_navigator` or `recruiter`. Each inherits the one before it and raises a few rows. This is the platform product active on the account, NOT the Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Automatic detection at connect is not built yet, so setting this is currently the only way an account leaves `basic`; set it back to `basic` to undo. The change is recorded in the ledger and it moves the defaults under every row at once, so any row you have configured explicitly keeps your value. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations. A standard-interface call still lives under the `basic` or `premium` figure for its row, and Curviate does not yet track that difference: on a non-`basic` profile the numbers here are the headroom of the elevated interface, not of every call, so read them as an upper bound rather than as your budget for a standard call.
+                     * @description Which set of Curviate defaults this account's rows resolve from: `basic`, `premium`, `sales_navigator` or `recruiter`. Each inherits the one before it and raises a few rows. This is the platform product active on the account, NOT the Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it from the platform when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result and holds until the next connect. Set it back to `basic` to undo. The change is recorded in the ledger and it moves the defaults under every row at once, so any row you have configured explicitly keeps your value. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
                      * @enum {string}
                      */
                     limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
@@ -30643,7 +30651,7 @@ interface operations {
                         /** @description IANA zone name the activity window is read in, e.g. `Europe/Berlin`. Must be a real zone; anything else is a 400. Null DISABLES the activity window: a guessed zone inverts it, which is worse than not having one. */
                         activity_window_timezone?: string | null;
                         /**
-                         * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads that Curviate cannot serve from its store; a read it may serve from the store (a profile by key, for one) stays exempt. Stored reads and inbound events are never subject to the window under either setting, at any hour.
+                         * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads. A read Curviate answers from its own store never reaches LinkedIn and so is never covered; the same read IS covered when the store cannot answer it, or when you ask for it live. Stored reads and inbound events are never subject to the window under either setting, at any hour.
                          * @enum {string|null}
                          */
                         activity_window_applies_to?: "writes" | "all" | null;
@@ -30667,6 +30675,10 @@ interface operations {
                         source_class?: "substrate" | "linkedin_official" | "practitioner" | "inferred" | "unseeded" | null;
                         /** @description READ-ONLY. `ceiling` with the account's warm-up ramp applied, which is what this row is actually held to. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
                         effective_ceiling?: unknown;
+                        /** @description READ-ONLY. What a call through the matching elevated interface (`/v1/{account_id}/sales-navigator/...`, `/v1/{account_id}/recruiter/...`) is held to on this row, or null when this row and limit profile have no such figure. `ceiling`, `effective_ceiling`, `band` and `over_default` are all the STANDARD-interface figure, so on a `sales_navigator` or `recruiter` account a row can report `over` while a call through the elevated interface still succeeds. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
+                        interface_ceiling?: unknown;
+                        /** @description READ-ONLY. `interface_ceiling` with the account's warm-up ramp applied. Read THIS to know where an elevated-interface call stops, for the same reason `effective_ceiling` and not `ceiling` answers that for a standard one. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
+                        effective_interface_ceiling?: unknown;
                         /** @description READ-ONLY. Which scope supplied this row's effective `posture`. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
                         posture_source?: unknown;
                         /** @description READ-ONLY. The fields on this row configured above the Curviate default. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
@@ -30682,6 +30694,8 @@ interface operations {
                     posture_source?: unknown;
                     /** @description READ-ONLY. The account's DERIVED warm-up ramp, recomputed on every read. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
                     warm_up?: unknown;
+                    /** @description NOT ACCEPTED. Send its settable subfields instead: the top-level `timezone`, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone`, `activity_window_applies_to`. */
+                    activity_window?: unknown;
                 };
             };
         };
@@ -30703,7 +30717,7 @@ interface operations {
                         /** @description The account this policy governs. */
                         account_id?: string;
                         /**
-                         * @description Which set of Curviate defaults every row below is resolved from. Each profile inherits the one before it and raises a few rows: `premium` adds a daily invitation band and open-profile InMail, `sales_navigator` raises profile views and search, `recruiter` raises profile views again. This is the platform product active on the account, not the Curviate seat entitlement. The two can disagree, and this is the one that governs the numbers. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations. A standard-interface call still lives under the `basic` or `premium` figure for its row, and Curviate does not yet track that difference: on a non-`basic` profile the numbers here are the headroom of the elevated interface, not of every call, so read them as an upper bound rather than as your budget for a standard call.
+                         * @description Which set of Curviate defaults every row below is resolved from. Each profile inherits the one before it and raises a few rows: `premium` adds a daily invitation band and open-profile InMail, `sales_navigator` raises profile views and search, `recruiter` raises profile views again. This is the platform product active on the account, not the Curviate seat entitlement. The two can disagree, and this is the one that governs the numbers. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
                          * @enum {string}
                          */
                         limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
@@ -30786,7 +30800,7 @@ interface operations {
                             /** @description IANA zone name the activity window is read in. Null disables the window entirely. */
                             activity_window_timezone?: string | null;
                             /**
-                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. Stored reads and inbound events are never subject to the window under either setting, at any hour.
+                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. A read Curviate answers from its own store never reaches LinkedIn, so it is never subject to the window under either setting, at any hour; the same read IS covered when the store cannot answer it, or when you ask for it live. Inbound events are never subject to it either.
                              * @enum {string}
                              */
                             activity_window_applies_to?: "writes" | "all";
@@ -30810,7 +30824,11 @@ interface operations {
                             source_class?: "substrate" | "linkedin_official" | "practitioner" | "inferred" | "unseeded";
                             /** @description What this row is ACTUALLY held to right now: `ceiling` with the account's warm-up ramp applied. Read this one, not `ceiling`, to know where the next call will be stopped. On an account in warm-up the two differ, and on a five-day-old account they differ by a factor of about seven. Null when the row has no ceiling to ramp. `warm_up_state` and `warm_up_factor` beside it are the values ACTIVE on this row, not the seeded ones. */
                             effective_ceiling?: number | null;
-                            /** @description Empty when nothing on this row is above default. */
+                            /** @description What a call through the matching ELEVATED interface is held to on this row: the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations. Null when this row and limit profile have no such figure, which is every row on `basic` and `premium` and most rows everywhere. Everything else on this row (`ceiling`, `effective_ceiling`, `band` and `over_default`) is the STANDARD-interface figure, because one counter serves both interfaces and the standard side is the conservative one to band against. The consequence is worth reading: on a `sales_navigator` or `recruiter` account a row can report `band: "over"` with `posture: "enforce"` while a call through the elevated interface still succeeds; the refusal the band predicts is the one a standard call gets. */
+                            interface_ceiling?: number | null;
+                            /** @description `interface_ceiling` with the account's warm-up ramp applied, and null wherever `interface_ceiling` is null. Read THIS to know where an elevated-interface call stops, for the same reason `effective_ceiling` rather than `ceiling` answers that for a standard one. */
+                            effective_interface_ceiling?: number | null;
+                            /** @description Empty when nothing on this row is above default. Computed against the STANDARD-interface default, like `band` and for the same reason. */
                             over_default?: {
                                 /**
                                  * @description The field whose configured value is above default.
@@ -30920,15 +30938,15 @@ interface operations {
                             /** @description The event's id. Also the value encoded in the next page's cursor. */
                             id: string;
                             /**
-                             * @description The budget row that breached. It is not always a row the call itself spends: an invitation refused because the outstanding backlog is at its ceiling reports `pending_invites`, which is the thing that breached.
+                             * @description The budget row that breached. It is not always a row the call itself spends: an invitation refused because the outstanding backlog is at its ceiling reports `pending_invites`, which is the thing that breached. `*` means the event was not about a row at all: the activity window closing on an action that spends no budget of its own, such as editing a message or a Recruiter admin action. The `budget_row` filter accepts real row names only, so page without it to see those.
                              * @enum {string}
                              */
-                            budget_row: "connection_requests_with_note" | "connection_requests_no_note" | "messages_first_degree" | "inmail" | "open_profile_inmail" | "profile_views" | "search" | "comments" | "post_likes" | "follows" | "content_poll" | "job_poll" | "posts" | "endorsements" | "invite_responses" | "withdrawal_sweep" | "total_actions" | "pending_invites";
+                            budget_row: "connection_requests_with_note" | "connection_requests_no_note" | "messages_first_degree" | "inmail" | "open_profile_inmail" | "profile_views" | "search" | "comments" | "post_likes" | "follows" | "content_poll" | "job_poll" | "posts" | "endorsements" | "invite_responses" | "withdrawal_sweep" | "total_actions" | "pending_invites" | "*";
                             /**
-                             * @description Why it was flagged. `budget_exhausted`: the account reached the ceiling configured for that row, which you can raise on the safety policy. `rate_limited`: the platform itself refused this account on that row recently and Curviate is holding the row until the pause expires, which no configuration change lifts.
+                             * @description Which rule flagged it, and each one calls for a different response. `budget_exhausted`: the account reached the ceiling configured for that row, which you can raise on the safety policy. `activity_window`: the account was acting outside its configured activity window, so no ceiling was the constraint. Wait for the window to open, move `activity_window_start` or `activity_window_end`, or check `activity_window_timezone` is the zone you meant. `rate_limited`: the platform itself refused this account on that row recently and Curviate is holding the row until the pause expires, which no configuration change lifts.
                              * @enum {string}
                              */
-                            reason: "budget_exhausted" | "rate_limited";
+                            reason: "budget_exhausted" | "activity_window" | "rate_limited";
                             /** @description Whether the action was stopped. `false` is a warning: the action went through, and this record is the only lasting trace that it crossed a limit. Under the default `warn` posture every event is a warning, which is what makes reading this surface the point of running it. */
                             blocked: boolean;
                             /** @description The operation the caller was running when it breached. */
@@ -31232,6 +31250,7 @@ type ChatListQuery = NonNullable<paths["/v1/{account_id}/chats"]["get"]["paramet
 type StartChatBody = paths["/v1/{account_id}/chats"]["post"]["requestBody"]["content"]["application/json"];
 type StartChatResult = paths["/v1/{account_id}/chats"]["post"]["responses"]["201"]["content"]["application/json"];
 type ChatDetail = paths["/v1/{account_id}/chats/{chat_id}"]["get"]["responses"]["200"]["content"]["application/json"];
+type ChatGetQuery = NonNullable<paths["/v1/{account_id}/chats/{chat_id}"]["get"]["parameters"]["query"]>;
 type MarkChatReadBody = paths["/v1/{account_id}/chats/{chat_id}"]["patch"]["requestBody"]["content"]["application/json"];
 type MarkChatReadResult = paths["/v1/{account_id}/chats/{chat_id}"]["patch"]["responses"]["200"]["content"]["application/json"];
 type MessageListPage = paths["/v1/{account_id}/chats/{chat_id}/messages"]["get"]["responses"]["200"]["content"]["application/json"];
@@ -31263,8 +31282,15 @@ declare class MessagingResource {
      * `COMPANY_` chat id from `inboxes.listChats()`.
      */
     startChat(body: StartChatBody): Promise<StartChatResult>;
-    /** Get details of a single chat. `GET /v1/{account_id}/chats/{chat_id}` */
-    getChat(chatId: string): Promise<ChatDetail>;
+    /**
+     * Get details of a single chat. `GET /v1/{account_id}/chats/{chat_id}`
+     *
+     * A store-servable read: `{ mode, max_age }` says how willing it is to reach
+     * LinkedIn, and the response's `source` says which way the answer came. See
+     * "Retrieval modes" in the README for the four modes and what `max_age`
+     * overrides.
+     */
+    getChat(chatId: string, params?: ChatGetQuery): Promise<ChatDetail>;
     /**
      * Mark a chat read or unread. `PATCH /v1/{account_id}/chats/{chat_id}`
      * Body: `{read}`.
@@ -33077,7 +33103,7 @@ declare class Curviate {
  * The taxonomy is additive-only: new codes may be appended, existing ones are
  * never removed or renamed.
  */
-declare const ERROR_CODES: readonly ["UNAUTHORIZED", "INVALID_REQUEST", "UNSUPPORTED_MEDIA_TYPE", "PAYLOAD_TOO_LARGE", "ACCOUNT_NOT_FOUND", "ACCOUNT_RESTRICTED", "ACCOUNT_ALREADY_LINKED", "RESOURCE_NOT_FOUND", "RESOURCE_ACCESS_RESTRICTED", "FILTER_CANDIDATES_REQUIRED", "TIER_NOT_ACTIVE", "LINKEDIN_FEATURE_NOT_SUBSCRIBED", "RATE_LIMIT_ACCOUNT", "RATE_LIMIT_TENANT", "PLATFORM_RATE_LIMIT", "RATE_LIMITED", "BUDGET_EXHAUSTED", "PLATFORM_ERROR", "PLATFORM_NOT_IMPLEMENTED", "LINKEDIN_OPERATION_NOT_SUPPORTED", "CHECKPOINT_NOT_FOUND", "CHECKPOINT_EXPIRED", "CHECKPOINT_INVALID_CODE", "CHECKPOINT_MAX_ATTEMPTS", "CHECKPOINT_ALREADY_RESOLVED", "CHECKPOINT_UNSUPPORTED", "CONNECTION_IN_PROGRESS", "PREMIUM_CONFLICT", "REAUTH_REQUIRED", "LINKEDIN_AUTH_FAILED", "LINKEDIN_SESSION_EVICTED", "LINKEDIN_RATE_LIMITED", "LINKEDIN_COOKIE_INVALID", "LINKEDIN_SERVICE_UNAVAILABLE", "MESSAGE_WINDOW_EXPIRED", "RECIPIENT_UNREACHABLE", "CONNECTION_REQUEST_CONFLICT", "PAYMENT_REQUIRED", "PAYMENT_FAILED", "SUBSCRIPTION_BUSY", "SUBSCRIPTION_NOT_FOUND", "SEAT_NOT_FOUND", "SEAT_CANCELLED", "INTERNAL"];
+declare const ERROR_CODES: readonly ["UNAUTHORIZED", "INVALID_REQUEST", "UNSUPPORTED_MEDIA_TYPE", "PAYLOAD_TOO_LARGE", "ACCOUNT_NOT_FOUND", "ACCOUNT_RESTRICTED", "ACCOUNT_ALREADY_LINKED", "RESOURCE_NOT_FOUND", "NOT_STORED", "RESOURCE_ACCESS_RESTRICTED", "FILTER_CANDIDATES_REQUIRED", "TIER_NOT_ACTIVE", "LINKEDIN_FEATURE_NOT_SUBSCRIBED", "RATE_LIMIT_ACCOUNT", "RATE_LIMIT_TENANT", "PLATFORM_RATE_LIMIT", "RATE_LIMITED", "BUDGET_EXHAUSTED", "PLATFORM_ERROR", "PLATFORM_NOT_IMPLEMENTED", "LINKEDIN_OPERATION_NOT_SUPPORTED", "CHECKPOINT_NOT_FOUND", "CHECKPOINT_EXPIRED", "CHECKPOINT_INVALID_CODE", "CHECKPOINT_MAX_ATTEMPTS", "CHECKPOINT_ALREADY_RESOLVED", "CHECKPOINT_UNSUPPORTED", "CONNECTION_IN_PROGRESS", "PREMIUM_CONFLICT", "REAUTH_REQUIRED", "LINKEDIN_AUTH_FAILED", "LINKEDIN_SESSION_EVICTED", "LINKEDIN_RATE_LIMITED", "LINKEDIN_COOKIE_INVALID", "LINKEDIN_SERVICE_UNAVAILABLE", "MESSAGE_WINDOW_EXPIRED", "RECIPIENT_UNREACHABLE", "CONNECTION_REQUEST_CONFLICT", "PAYMENT_REQUIRED", "PAYMENT_FAILED", "SUBSCRIPTION_BUSY", "SUBSCRIPTION_NOT_FOUND", "SEAT_NOT_FOUND", "SEAT_CANCELLED", "INTERNAL"];
 /**
  * The complete set of error codes observable by API callers.
  *

package/dist/index.js

@@ -12,6 +12,14 @@ var ERROR_CODES = [
   // linking again. Not retryable.
   "ACCOUNT_ALREADY_LINKED",
   "RESOURCE_NOT_FOUND",
+  // A read found nothing in Curviate's store and its mode may not fetch, so it
+  // refused rather than reaching LinkedIn. 422, and NOT RESOURCE_NOT_FOUND: the
+  // resource may be perfectly real, so the fix is another mode, not another id.
+  // Absent from RETRYABLE_CODES on purpose, nothing about the answer changes
+  // until the caller picks one.
+  //
+  // `cache_only` is the mode that raises it; re-read with `refill` or `auto`.
+  "NOT_STORED",
   "RESOURCE_ACCESS_RESTRICTED",
   // Search filter resolution: a plain-string filter value matched several
   // LinkedIn taxonomy options and one has to be picked (422). The body carries
@@ -653,11 +661,19 @@ var MessagingResource = class {
       body
     });
   }
-  /** Get details of a single chat. `GET /v1/{account_id}/chats/{chat_id}` */
-  getChat(chatId) {
+  /**
+   * Get details of a single chat. `GET /v1/{account_id}/chats/{chat_id}`
+   *
+   * A store-servable read: `{ mode, max_age }` says how willing it is to reach
+   * LinkedIn, and the response's `source` says which way the answer came. See
+   * "Retrieval modes" in the README for the four modes and what `max_age`
+   * overrides.
+   */
+  getChat(chatId, params) {
     return this.ctx.request({
       method: "GET",
-      path: apiPath`/v1/{account_id}/chats/${chatId}`
+      path: apiPath`/v1/{account_id}/chats/${chatId}`,
+      ...params ? { query: params } : {}
     });
   }
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curviate/sdk",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "private": false,
   "description": "TypeScript SDK for the Curviate API.",
   "license": "MIT",

package/src/generated/types.ts

@@ -2591,7 +2591,7 @@ export interface paths {
         head?: never;
         /**
          * Update an account's safety policy
-         * @description The single safety-policy write. Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the Curviate default. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Four fields on the read are derived rather than configured: `effective_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, which for the zone is the top-level `timezone`. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result, and it holds until the next connect. When the seat and the detected product disagree, the detected product wins the numbers and the read reports the disagreement as `seat_tier_mismatch`.
+         * @description The single safety-policy write. Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the Curviate default. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result, and it holds until the next connect. When the seat and the detected product disagree, the detected product wins the numbers and the read reports the disagreement as `seat_tier_mismatch`.
          */
         patch: operations["patchV1AccountIdSafetyPolicy"];
         trace?: never;
@@ -2650,9 +2650,9 @@ export interface components {
              * @enum {string}
              */
             required_tier?: "core" | "sales_nav" | "recruiter";
-            /** @description Present on a PLATFORM_RATE_LIMIT raised because one account-safety budget row is paused: LinkedIn refused a recent call on that row, so this one was refused locally without reaching LinkedIn. Names the paused row (for example profile_views, connection_requests_no_note). The pause is scoped to this row on this account; every other row keeps working. Absent on every other rate limit. Also present on BUDGET_EXHAUSTED, where it names the row that hit its CEILING rather than one LinkedIn paused: read the code to tell the two apart, because the recovery differs. */
-            row?: string;
-            /** @description Present on BUDGET_EXHAUSTED: when this row's budget frees up, as an absolute instant rather than a duration, so it stays true however long you hold it. Null for the pending_invites row, whose backlog falls when invitations are accepted or withdrawn rather than at any window boundary, so there is no instant to name. */
+            /** @description Present on a PLATFORM_RATE_LIMIT raised because one account-safety budget row is paused: LinkedIn refused a recent call on that row, so this one was refused locally without reaching LinkedIn. Names the paused row (for example profile_views, connection_requests_no_note). The pause is scoped to this row on this account; every other row keeps working. Absent on every other rate limit. Also present on BUDGET_EXHAUSTED, where it names the row that hit its CEILING rather than one LinkedIn paused: read the code to tell the two apart, because the recovery differs. Null on a BUDGET_EXHAUSTED whose reason is activity_window and whose action spends no budget of its own, because there is no row to name; hint.parameter still names the setting to change. Never null on a rate limit. */
+            row?: string | null;
+            /** @description Present on BUDGET_EXHAUSTED: the instant the refusal lifts, as an absolute instant rather than a duration, so it stays true however long you hold it. It is the window roll on a ceiling refusal and the next window open on an activity-window one. It is null in the two cases where no clock frees the account: the pending_invites gauge, whose backlog falls when invitations are accepted or withdrawn, and an InMail credit exhaustion (row inmail), which LinkedIn regrants on a schedule this product cannot read. */
             reset_at?: string | null;
             /** @description Present on BUDGET_EXHAUSTED: the exact setting to change, as a field rather than as prose. parameter is addressable on PATCH /v1/{account_id}/safety-policy, so an agent can decide between waiting until reset_at, escalating to a human, and reconfiguring, without parsing the message. */
             hint?: {
@@ -2715,9 +2715,9 @@ export interface components {
          *     }
          */
         SafetyWarning: {
-            /** @description The budget row that breached, for example profile_views or pending_invites. */
-            row: string;
-            /** @description When the row frees up, as an absolute instant. Null for the pending_invites gauge. */
+            /** @description The budget row that breached, for example profile_views or pending_invites. Null when the breach is not about a row: an activity_window warning on an action that spends no budget of its own (editing a message, dismissing a notification, a Recruiter or Sales Navigator admin action) is still governed by the hours the account works in. Read hint.parameter for what to change; whenever this is null it names posture, because the activity window edges are set per action type and this action has none, so the levers that reach it are the account timezone and posture. */
+            row: string | null;
+            /** @description The instant the refusal lifts: the window roll on a ceiling refusal, the next window open on an activity-window one. Null in the two cases no clock frees, the pending_invites gauge and InMail credits (row inmail). */
             reset_at: string | null;
             hint: {
                 /** @description The settable parameter on PATCH /v1/{account_id}/safety-policy. */
@@ -6710,13 +6710,13 @@ export interface operations {
                         }[];
                         /** @description Opaque cursor for the next page, or null at end-of-list. */
                         cursor: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -6893,13 +6893,13 @@ export interface operations {
                             /** @description Message body (content pass-through, never stored). */
                             text?: string | null;
                         } | null;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -7069,13 +7069,13 @@ export interface operations {
                         }[];
                         /** @description Opaque cursor for the next page, or null at end-of-list. */
                         cursor: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -7412,13 +7412,13 @@ export interface operations {
                         sent_at: number;
                         /** @description Message body (content pass-through, never stored). */
                         text?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -7618,13 +7618,13 @@ export interface operations {
                          * @enum {boolean}
                          */
                         filter_effective?: true;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -10265,13 +10265,13 @@ export interface operations {
                         }[];
                         /** @description Next-page cursor; follow until items is empty (presence is not a has-more guarantee). */
                         cursor?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -10687,13 +10687,13 @@ export interface operations {
                             /** @description The vanity slug from the profile URL, for example jane-smith. Present only when the request asks for it with expand=public_identifier, and then always present, carrying the slug or null when the platform surfaces none for this person. */
                             public_identifier?: string | null;
                         };
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -11047,13 +11047,13 @@ export interface operations {
                         }[];
                         /** @description Next-page cursor; follow until items is empty. */
                         cursor?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -11423,13 +11423,13 @@ export interface operations {
                                 [key: string]: unknown;
                             };
                         };
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -12000,7 +12000,7 @@ export interface operations {
     getV1AccountIdChatsSearch: {
         parameters: {
             query: {
-                /** @description The search term: matches both participant names and message content (e.g. 'sophie keller'). */
+                /** @description The search term: matches both participant names and message content (e.g. 'sophie keller'). Terms of 3 or more characters are fast; a 1-2 character term is slower. */
                 query: string;
                 /** @description Maximum chats to return per page (1-100, default 20). The server may walk a few internal pages to fill one page. */
                 limit?: number;
@@ -12629,13 +12629,13 @@ export interface operations {
                         }[];
                         /** @description Next-page cursor. Follow until items is empty. */
                         cursor?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and this page held more people needing a profile lookup than one request performs. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -27860,6 +27860,10 @@ export interface operations {
                             ceiling: number | null;
                             /** @description What this row is ACTUALLY held to right now: `ceiling` with the account's warm-up ramp applied. Compare `used` against THIS one, and `band` is computed against it too. While an account is new, thinly connected, dormant or recovering from a restriction the two differ, and on a five-day-old account they differ by a factor of about seven. Equal to `ceiling` once the ramp is over, and `null` wherever `ceiling` is null. The account's ramp, its factor and the triggers behind it are on GET /v1/{account_id}/safety-policy as `warm_up`. */
                             effective_ceiling?: number | null;
+                            /** @description What a call through the matching ELEVATED interface is held to on this row: the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations. Null when this row and limit profile have no such figure, which is every row on `basic` and `premium` and most rows everywhere. Everything else on this row (`ceiling`, `effective_ceiling`, `band` and `over_default`) is the STANDARD-interface figure, because one counter serves both interfaces and the standard side is the conservative one to band against. The consequence is worth reading: on a `sales_navigator` or `recruiter` account a row can report `band: "over"` with `posture: "enforce"` while a call through the elevated interface still succeeds; the refusal the band predicts is the one a standard call gets. */
+                            interface_ceiling?: number | null;
+                            /** @description `interface_ceiling` with the account's warm-up ramp applied, and null wherever `interface_ceiling` is null. Read THIS to know where an elevated-interface call stops, for the same reason `effective_ceiling` rather than `ceiling` answers that for a standard one. */
+                            effective_interface_ceiling?: number | null;
                             /**
                              * @description Where `used` sits against this row's own bands. `green` routine, `amber` at or past the routine band, `hard` at or past the warn-louder band, `over` at or past the ceiling. `over` is what `posture` acts on: `warn` reports it and lets the action through, `enforce` refuses. A row with no figures reports `green` at every value, because there is nothing to be past.
                              * @enum {string}
@@ -30331,7 +30335,7 @@ export interface operations {
                         /** @description The account this policy governs. */
                         account_id?: string;
                         /**
-                         * @description Which set of Curviate defaults every row below is resolved from. Each profile inherits the one before it and raises a few rows: `premium` adds a daily invitation band and open-profile InMail, `sales_navigator` raises profile views and search, `recruiter` raises profile views again. This is the platform product active on the account, not the Curviate seat entitlement. The two can disagree, and this is the one that governs the numbers. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations. A standard-interface call still lives under the `basic` or `premium` figure for its row, and Curviate does not yet track that difference: on a non-`basic` profile the numbers here are the headroom of the elevated interface, not of every call, so read them as an upper bound rather than as your budget for a standard call.
+                         * @description Which set of Curviate defaults every row below is resolved from. Each profile inherits the one before it and raises a few rows: `premium` adds a daily invitation band and open-profile InMail, `sales_navigator` raises profile views and search, `recruiter` raises profile views again. This is the platform product active on the account, not the Curviate seat entitlement. The two can disagree, and this is the one that governs the numbers. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
                          * @enum {string}
                          */
                         limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
@@ -30414,7 +30418,7 @@ export interface operations {
                             /** @description IANA zone name the activity window is read in. Null disables the window entirely. */
                             activity_window_timezone?: string | null;
                             /**
-                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. Stored reads and inbound events are never subject to the window under either setting, at any hour.
+                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. A read Curviate answers from its own store never reaches LinkedIn, so it is never subject to the window under either setting, at any hour; the same read IS covered when the store cannot answer it, or when you ask for it live. Inbound events are never subject to it either.
                              * @enum {string}
                              */
                             activity_window_applies_to?: "writes" | "all";
@@ -30438,7 +30442,11 @@ export interface operations {
                             source_class?: "substrate" | "linkedin_official" | "practitioner" | "inferred" | "unseeded";
                             /** @description What this row is ACTUALLY held to right now: `ceiling` with the account's warm-up ramp applied. Read this one, not `ceiling`, to know where the next call will be stopped. On an account in warm-up the two differ, and on a five-day-old account they differ by a factor of about seven. Null when the row has no ceiling to ramp. `warm_up_state` and `warm_up_factor` beside it are the values ACTIVE on this row, not the seeded ones. */
                             effective_ceiling?: number | null;
-                            /** @description Empty when nothing on this row is above default. */
+                            /** @description What a call through the matching ELEVATED interface is held to on this row: the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations. Null when this row and limit profile have no such figure, which is every row on `basic` and `premium` and most rows everywhere. Everything else on this row (`ceiling`, `effective_ceiling`, `band` and `over_default`) is the STANDARD-interface figure, because one counter serves both interfaces and the standard side is the conservative one to band against. The consequence is worth reading: on a `sales_navigator` or `recruiter` account a row can report `band: "over"` with `posture: "enforce"` while a call through the elevated interface still succeeds; the refusal the band predicts is the one a standard call gets. */
+                            interface_ceiling?: number | null;
+                            /** @description `interface_ceiling` with the account's warm-up ramp applied, and null wherever `interface_ceiling` is null. Read THIS to know where an elevated-interface call stops, for the same reason `effective_ceiling` rather than `ceiling` answers that for a standard one. */
+                            effective_interface_ceiling?: number | null;
+                            /** @description Empty when nothing on this row is above default. Computed against the STANDARD-interface default, like `band` and for the same reason. */
                             over_default?: {
                                 /**
                                  * @description The field whose configured value is above default.
@@ -30497,7 +30505,7 @@ export interface operations {
             content: {
                 "application/json": {
                     /**
-                     * @description Which set of Curviate defaults this account's rows resolve from: `basic`, `premium`, `sales_navigator` or `recruiter`. Each inherits the one before it and raises a few rows. This is the platform product active on the account, NOT the Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Automatic detection at connect is not built yet, so setting this is currently the only way an account leaves `basic`; set it back to `basic` to undo. The change is recorded in the ledger and it moves the defaults under every row at once, so any row you have configured explicitly keeps your value. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations. A standard-interface call still lives under the `basic` or `premium` figure for its row, and Curviate does not yet track that difference: on a non-`basic` profile the numbers here are the headroom of the elevated interface, not of every call, so read them as an upper bound rather than as your budget for a standard call.
+                     * @description Which set of Curviate defaults this account's rows resolve from: `basic`, `premium`, `sales_navigator` or `recruiter`. Each inherits the one before it and raises a few rows. This is the platform product active on the account, NOT the Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it from the platform when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result and holds until the next connect. Set it back to `basic` to undo. The change is recorded in the ledger and it moves the defaults under every row at once, so any row you have configured explicitly keeps your value. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
                      * @enum {string}
                      */
                     limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
@@ -30547,7 +30555,7 @@ export interface operations {
                         /** @description IANA zone name the activity window is read in, e.g. `Europe/Berlin`. Must be a real zone; anything else is a 400. Null DISABLES the activity window: a guessed zone inverts it, which is worse than not having one. */
                         activity_window_timezone?: string | null;
                         /**
-                         * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads that Curviate cannot serve from its store; a read it may serve from the store (a profile by key, for one) stays exempt. Stored reads and inbound events are never subject to the window under either setting, at any hour.
+                         * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads. A read Curviate answers from its own store never reaches LinkedIn and so is never covered; the same read IS covered when the store cannot answer it, or when you ask for it live. Stored reads and inbound events are never subject to the window under either setting, at any hour.
                          * @enum {string|null}
                          */
                         activity_window_applies_to?: "writes" | "all" | null;
@@ -30571,6 +30579,10 @@ export interface operations {
                         source_class?: "substrate" | "linkedin_official" | "practitioner" | "inferred" | "unseeded" | null;
                         /** @description READ-ONLY. `ceiling` with the account's warm-up ramp applied, which is what this row is actually held to. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
                         effective_ceiling?: unknown;
+                        /** @description READ-ONLY. What a call through the matching elevated interface (`/v1/{account_id}/sales-navigator/...`, `/v1/{account_id}/recruiter/...`) is held to on this row, or null when this row and limit profile have no such figure. `ceiling`, `effective_ceiling`, `band` and `over_default` are all the STANDARD-interface figure, so on a `sales_navigator` or `recruiter` account a row can report `over` while a call through the elevated interface still succeeds. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
+                        interface_ceiling?: unknown;
+                        /** @description READ-ONLY. `interface_ceiling` with the account's warm-up ramp applied. Read THIS to know where an elevated-interface call stops, for the same reason `effective_ceiling` and not `ceiling` answers that for a standard one. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
+                        effective_interface_ceiling?: unknown;
                         /** @description READ-ONLY. Which scope supplied this row's effective `posture`. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
                         posture_source?: unknown;
                         /** @description READ-ONLY. The fields on this row configured above the Curviate default. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
@@ -30586,6 +30598,8 @@ export interface operations {
                     posture_source?: unknown;
                     /** @description READ-ONLY. The account's DERIVED warm-up ramp, recomputed on every read. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
                     warm_up?: unknown;
+                    /** @description NOT ACCEPTED. Send its settable subfields instead: the top-level `timezone`, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone`, `activity_window_applies_to`. */
+                    activity_window?: unknown;
                 };
             };
         };
@@ -30607,7 +30621,7 @@ export interface operations {
                         /** @description The account this policy governs. */
                         account_id?: string;
                         /**
-                         * @description Which set of Curviate defaults every row below is resolved from. Each profile inherits the one before it and raises a few rows: `premium` adds a daily invitation band and open-profile InMail, `sales_navigator` raises profile views and search, `recruiter` raises profile views again. This is the platform product active on the account, not the Curviate seat entitlement. The two can disagree, and this is the one that governs the numbers. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations. A standard-interface call still lives under the `basic` or `premium` figure for its row, and Curviate does not yet track that difference: on a non-`basic` profile the numbers here are the headroom of the elevated interface, not of every call, so read them as an upper bound rather than as your budget for a standard call.
+                         * @description Which set of Curviate defaults every row below is resolved from. Each profile inherits the one before it and raises a few rows: `premium` adds a daily invitation band and open-profile InMail, `sales_navigator` raises profile views and search, `recruiter` raises profile views again. This is the platform product active on the account, not the Curviate seat entitlement. The two can disagree, and this is the one that governs the numbers. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
                          * @enum {string}
                          */
                         limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
@@ -30690,7 +30704,7 @@ export interface operations {
                             /** @description IANA zone name the activity window is read in. Null disables the window entirely. */
                             activity_window_timezone?: string | null;
                             /**
-                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. Stored reads and inbound events are never subject to the window under either setting, at any hour.
+                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. A read Curviate answers from its own store never reaches LinkedIn, so it is never subject to the window under either setting, at any hour; the same read IS covered when the store cannot answer it, or when you ask for it live. Inbound events are never subject to it either.
                              * @enum {string}
                              */
                             activity_window_applies_to?: "writes" | "all";
@@ -30714,7 +30728,11 @@ export interface operations {
                             source_class?: "substrate" | "linkedin_official" | "practitioner" | "inferred" | "unseeded";
                             /** @description What this row is ACTUALLY held to right now: `ceiling` with the account's warm-up ramp applied. Read this one, not `ceiling`, to know where the next call will be stopped. On an account in warm-up the two differ, and on a five-day-old account they differ by a factor of about seven. Null when the row has no ceiling to ramp. `warm_up_state` and `warm_up_factor` beside it are the values ACTIVE on this row, not the seeded ones. */
                             effective_ceiling?: number | null;
-                            /** @description Empty when nothing on this row is above default. */
+                            /** @description What a call through the matching ELEVATED interface is held to on this row: the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations. Null when this row and limit profile have no such figure, which is every row on `basic` and `premium` and most rows everywhere. Everything else on this row (`ceiling`, `effective_ceiling`, `band` and `over_default`) is the STANDARD-interface figure, because one counter serves both interfaces and the standard side is the conservative one to band against. The consequence is worth reading: on a `sales_navigator` or `recruiter` account a row can report `band: "over"` with `posture: "enforce"` while a call through the elevated interface still succeeds; the refusal the band predicts is the one a standard call gets. */
+                            interface_ceiling?: number | null;
+                            /** @description `interface_ceiling` with the account's warm-up ramp applied, and null wherever `interface_ceiling` is null. Read THIS to know where an elevated-interface call stops, for the same reason `effective_ceiling` rather than `ceiling` answers that for a standard one. */
+                            effective_interface_ceiling?: number | null;
+                            /** @description Empty when nothing on this row is above default. Computed against the STANDARD-interface default, like `band` and for the same reason. */
                             over_default?: {
                                 /**
                                  * @description The field whose configured value is above default.
@@ -30824,15 +30842,15 @@ export interface operations {
                             /** @description The event's id. Also the value encoded in the next page's cursor. */
                             id: string;
                             /**
-                             * @description The budget row that breached. It is not always a row the call itself spends: an invitation refused because the outstanding backlog is at its ceiling reports `pending_invites`, which is the thing that breached.
+                             * @description The budget row that breached. It is not always a row the call itself spends: an invitation refused because the outstanding backlog is at its ceiling reports `pending_invites`, which is the thing that breached. `*` means the event was not about a row at all: the activity window closing on an action that spends no budget of its own, such as editing a message or a Recruiter admin action. The `budget_row` filter accepts real row names only, so page without it to see those.
                              * @enum {string}
                              */
-                            budget_row: "connection_requests_with_note" | "connection_requests_no_note" | "messages_first_degree" | "inmail" | "open_profile_inmail" | "profile_views" | "search" | "comments" | "post_likes" | "follows" | "content_poll" | "job_poll" | "posts" | "endorsements" | "invite_responses" | "withdrawal_sweep" | "total_actions" | "pending_invites";
+                            budget_row: "connection_requests_with_note" | "connection_requests_no_note" | "messages_first_degree" | "inmail" | "open_profile_inmail" | "profile_views" | "search" | "comments" | "post_likes" | "follows" | "content_poll" | "job_poll" | "posts" | "endorsements" | "invite_responses" | "withdrawal_sweep" | "total_actions" | "pending_invites" | "*";
                             /**
-                             * @description Why it was flagged. `budget_exhausted`: the account reached the ceiling configured for that row, which you can raise on the safety policy. `rate_limited`: the platform itself refused this account on that row recently and Curviate is holding the row until the pause expires, which no configuration change lifts.
+                             * @description Which rule flagged it, and each one calls for a different response. `budget_exhausted`: the account reached the ceiling configured for that row, which you can raise on the safety policy. `activity_window`: the account was acting outside its configured activity window, so no ceiling was the constraint. Wait for the window to open, move `activity_window_start` or `activity_window_end`, or check `activity_window_timezone` is the zone you meant. `rate_limited`: the platform itself refused this account on that row recently and Curviate is holding the row until the pause expires, which no configuration change lifts.
                              * @enum {string}
                              */
-                            reason: "budget_exhausted" | "rate_limited";
+                            reason: "budget_exhausted" | "activity_window" | "rate_limited";
                             /** @description Whether the action was stopped. `false` is a warning: the action went through, and this record is the only lasting trace that it crossed a limit. Under the default `warn` posture every event is a warning, which is what makes reading this surface the point of running it. */
                             blocked: boolean;
                             /** @description The operation the caller was running when it breached. */