@curviate/sdk 0.26.0 → 0.28.0

package/CHANGELOG.md

@@ -7,6 +7,117 @@ Versioning: semantic. Minor for additive changes, patch for bug fixes; no stabil
 
 ---
 
+## [0.28.0] - 2026-09-07
+
+Fixture regenerated against the deployed staging document
+(`https://api.staging.curviate.com`, `server_git_sha 14fa8234...`, 125 paths).
+**BREAKING**: `messaging.searchChats` now rejects a `query` shorter than 3
+characters server-side. Pre-1.0 a breaking change ships as a minor, so a caret
+range on `0.27.x` will not pick this up.
+
+### BREAKING
+
+- **`searchChats` requires a `query` of at least 3 characters.** A 1-2 character
+  term previously returned `200`; it now returns `400 INVALID_REQUEST` with a
+  message naming the minimum. The search is served from an index built out of
+  overlapping 3-character sequences, so a shorter term cannot use it at all and
+  falls back to a scan: measured at 238-292 ms against 4.5 ms for the same term
+  one character longer. Returning `200` after 60x the work, with no way for a
+  caller to learn why, was the worse contract.
+
+  The bound is now expressed in the OpenAPI schema (`minLength: 3`) and in the
+  generated parameter description. **TypeScript cannot express a string minimum
+  length**, so the generated type is still `string`: the constraint is
+  documented and enforced at the wire, not by the compiler. Debounce a
+  type-ahead to 3 characters rather than relying on types to catch it.
+
+  `companies.searchChats` is a different endpoint and is unaffected; its
+  `query` stays optional and unbounded.
+
+### Added
+
+- **`accounts.retrieve` gains `event_log`**: `{ retained, row_cap, at_row_cap }`.
+  Reports where the account stands against the retained event log's per-account
+  row budget. While `at_row_cap` is true, events are still delivered to any
+  registered webhook but are no longer retained, so the events resource has
+  stopped being a complete record of what arrived. Additive and always present.
+
+- Every string parameter and body field on the surface now publishes its real
+  length bounds (`minLength` / `maxLength`) where the server enforces one. This
+  was previously emitted only for numbers, so string constraints existed in
+  descriptions and nowhere a generated client could read them.
+
+---
+
+## [0.27.0] - 2026-09-06
+
+Fixture regenerated against the deployed production document
+(`https://api.curviate.com`, `server_git_sha 2a86542f...`, 125 paths).
+**BREAKING**: the `message.delivered` webhook event is gone from the catalogue,
+from `CurviateEvent`, and from the events a subscription can be created with.
+Everything else here is additive or description-only. Pre-1.0 a breaking change
+ships as a minor, so a caret range on `0.26.x` will not pick this up.
+
+### BREAKING
+
+- **`message.delivered` is removed from the webhook event catalogue.** The
+  platform never emitted it, so no `event.event === 'message.delivered'` branch
+  has ever run: the event was subscribable and undeliverable. Two surfaces lose
+  the member.
+  - `CurviateEvent` (hand-written, `src/webhooks.ts`) drops its
+    `{ event: "message.delivered"; data: MessagePayload }` arm, going from 25
+    arms to 24. A `switch` on `event.event` that still lists it stops
+    compiling, and that arm was dead code in every build it ever shipped in.
+  - The generated create-events enum, `events` on the `messaging` variant of
+    the `POST /v1/webhooks` request body
+    (`operations["postV1Webhooks"]["requestBody"]`), goes from 8 members to 7.
+    Passing `"message.delivered"` to a create call is now a type error, and the
+    server rejects the value.
+
+  The two are pinned to each other by an exact two-way type equality in
+  `test/webhooks.constructEvent.test.ts`, so they cannot drift apart: that pin
+  is what failed first on this regeneration.
+
+  `GET /v1/webhooks/events` now reports 27 events, messaging 7, where it
+  reported 28 and 8.
+
+  **The read path is untyped and deliberately unaffected.** `events` on a
+  webhook returned by `GET /v1/webhooks` or `GET /v1/webhooks/{id}` is
+  `string[]`, not the create enum. A subscription created before 2026-09-06 may
+  still echo `message.delivered` in its stored `events` until the server-side
+  cleanup migration lands; it was never delivered. Reading such a subscription
+  back therefore neither breaks a build nor throws, and no migration is
+  required of a consumer that only lists webhooks.
+
+  **The replacement is a read, not an event**: `is_delivered` on the message
+  resource.
+
+### Regenerated types
+
+- **BREAKING for an exhaustive `switch` - `notices[].code` gains
+  `EXPANSION_WITHHELD_CEILING`.** On the same ten chat and message reads that
+  accept `expand=public_identifier`, alongside `EXPANSION_LIMIT_REACHED` and
+  `EXPANSION_WITHHELD_ACTIVITY_WINDOW`. The expansion was withheld because the
+  account is at an account-safety ceiling, not because the page ran out of
+  lookup budget and not because the account is outside its activity window.
+  Same consequence for the reader as its two siblings, `public_identifier` is
+  `null` for a reason that is not "no public profile", and a different remedy,
+  which is why it is a separate code rather than a reuse. Additive on the wire:
+  only a `switch` with a `never`-typed default arm stops compiling.
+- Description-only, no type change:
+  - `SafetyWarning` now states that `hint.message` is the one field whose text
+    differs from the `BUDGET_EXHAUSTED` refusal. On a warn-posture ceiling
+    breach it says the action went through and how far past the ceiling the row
+    now stands, rather than telling the caller what was refused. The shape is
+    unchanged, so no branch moves; the string is longer and more specific.
+  - The `502` response documents that `retry_likely_to_succeed` is what
+    separates its two cases: a temporary upstream error is worth retrying, an
+    upstream response that could not be interpreted is not, and the latter
+    carries `retry_hint: {"kind": "never"}`. No new field, and the SDK's own
+    retry set is unchanged in this release.
+  - The `notices` description on the ten expansion reads now lists the ceiling
+    case as a third reason a person can go unresolved.
+
 ## [0.26.0] - 2026-09-06
 
 Fixture regenerated against the deployed production document

package/dist/index.d.ts

@@ -2611,7 +2611,7 @@ interface paths {
         };
         /**
          * List webhook event types
-         * @description Returns the complete canonical event catalogue (28 events) grouped by source: messaging (8), user (2), account_status (15), plus 3 tier-gated events. A local catalogue read: no platform call is made.
+         * @description Returns the complete canonical event catalogue (27 events) grouped by source: messaging (7), user (2), account_status (15), plus 3 tier-gated events. A local catalogue read: no platform call is made.
          */
         get: operations["getV1WebhooksEvents"];
         put?: never;
@@ -2689,7 +2689,7 @@ interface paths {
         head?: never;
         /**
          * Update an account's safety policy
-         * @description The single safety-policy write. Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the Curviate default. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result, and it holds until the next connect. When the seat and the detected product disagree, the detected product wins the numbers and the read reports the disagreement as `seat_tier_mismatch`.
+         * @description The single safety-policy write. Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the Curviate default. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result, and it holds until the next connect. When the seat and the detected product disagree, the detected product wins the numbers and the read reports the disagreement as `seat_tier_mismatch`. One field on this operation does not configure anything: `clear_halts` lifts the platform pause on the action types you name. When the platform refuses a call on an account, Curviate pauses that action type for the platform's own retry-after or a seeded cooldown, and every later call on it is refused locally without reaching the platform; the account resource reports the live pauses as `quotas[].halt`. Naming an action type here lifts its pause immediately, so the next call goes out. An action type with no active pause is accepted and does nothing, which makes it safe to send for a set you have not checked, and only the ones actually lifted are ledgered, each with the expiry it cut short, the actor and the time, readable afterwards on `GET /v1/{account_id}/safety-events` with `reason: "halt_cleared"`. Clearing disarms nothing: if the platform refuses the account again the pause returns, and a 429 or a refused write returns it for the full cooldown. Clear one when you have reason to believe the refusal was a transient upstream fault rather than the platform pushing back on this account.
          */
         patch: operations["patchV1AccountIdSafetyPolicy"];
         trace?: never;
@@ -2703,7 +2703,7 @@ interface paths {
         };
         /**
          * List what Curviate refused or warned about
-         * @description Returns this account's safety events, newest first: every action Curviate refused, and every action it let through while flagging that a limit had been crossed. Under the default posture nothing is refused, so everything here is a warning and `blocked` is how you tell the two apart. Each event names the budget row that breached, why, the operation that hit it and when. Filter by `budget_row` for one action type and by `since` / `until` for a period, and page until `cursor` is null. This is a read of what already happened, so it never changes a limit or a count: to change what is refused, update the safety policy. The account resource is the other half of the picture, reporting where each row stands right now rather than what has already been flagged.
+         * @description Returns this account's safety events, newest first: every action Curviate refused, and every action it let through while flagging that a limit had been crossed. Under the default posture nothing is refused, so everything here is a warning and `blocked` is how you tell the two apart. Each event names the budget row that breached, why, the operation that hit it and when. Filter by `budget_row` for one action type and by `since` / `until` for a period, and page until `cursor` is null. This is a read of what already happened, so it never changes a limit or a count: to change what is refused, update the safety policy. The account resource is the other half of the picture, reporting where each row stands right now rather than what has already been flagged. One entry here is not a refusal: `reason: "halt_cleared"` with `blocked: false` records somebody lifting a platform pause early through `clear_halts` on the safety policy, and it sits beside the `rate_limited` entry it lifted so the pause and its end read as one thread.
          */
         get: operations["getV1AccountIdSafetyEvents"];
         put?: never;
@@ -2799,13 +2799,13 @@ interface components {
             }[];
         };
         /**
-         * @description Present on a successful response when this account crossed an account-safety ceiling while the affected budget row is on the default warn posture. The action still happened. Field-identical to the BUDGET_EXHAUSTED error body except that blocked is false, so one branch handles both postures and switching the account to enforce is a configuration change rather than a client rewrite.
+         * @description Present on a successful response when this account crossed an account-safety ceiling while the affected budget row is on the default warn posture. The action still happened. Field-identical to the BUDGET_EXHAUSTED error body except that blocked is false and hint.message describes the outcome, so one branch handles both postures and switching the account to enforce is a configuration change rather than a client rewrite.
          * @example {
          *       "row": "profile_views",
          *       "reset_at": "2026-09-05T00:00:00.000Z",
          *       "hint": {
          *         "parameter": "profile_views.ceiling",
-         *         "message": "This account is at its configured ceiling for profile_views."
+         *         "message": "This account is at its ceiling for profile_views. This action went through because profile_views.posture is warn, and it counted: 101 of 100 this window. Raise profile_views.ceiling, or wait for the window to reset at 2026-09-05T00:00:00.000Z."
          *       },
          *       "reason": "ceiling",
          *       "blocked": false
@@ -2819,7 +2819,7 @@ interface components {
             hint: {
                 /** @description The settable parameter on PATCH /v1/{account_id}/safety-policy. */
                 parameter: string;
-                /** @description What the condition is and what changing that parameter would do. */
+                /** @description What the condition is and what changing that parameter would do. This is the one field whose text differs from the BUDGET_EXHAUSTED refusal: here it says the action went through, and on a ceiling breach how far past the ceiling this row now stands, rather than telling you to set posture to warn when it already is. Branch on parameter, reason and blocked, never on this text. */
                 message: string;
             };
             /**
@@ -6806,13 +6806,13 @@ interface operations {
                         }[];
                         /** @description Opaque cursor for the next page, or null at end-of-list. */
                         cursor: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -6989,13 +6989,13 @@ interface operations {
                             /** @description Message body (content pass-through, never stored). */
                             text?: string | null;
                         } | null;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -7165,13 +7165,13 @@ interface operations {
                         }[];
                         /** @description Opaque cursor for the next page, or null at end-of-list. */
                         cursor: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -7508,13 +7508,13 @@ interface operations {
                         sent_at: number;
                         /** @description Message body (content pass-through, never stored). */
                         text?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -7714,13 +7714,13 @@ interface operations {
                          * @enum {boolean}
                          */
                         filter_effective?: true;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -10361,13 +10361,13 @@ interface operations {
                         }[];
                         /** @description Next-page cursor; follow until items is empty (presence is not a has-more guarantee). */
                         cursor?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -10783,13 +10783,13 @@ interface operations {
                             /** @description The vanity slug from the profile URL, for example jane-smith. Present only when the request asks for it with expand=public_identifier, and then always present, carrying the slug or null when the platform surfaces none for this person. */
                             public_identifier?: string | null;
                         };
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -11143,13 +11143,13 @@ interface operations {
                         }[];
                         /** @description Next-page cursor; follow until items is empty. */
                         cursor?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -11519,13 +11519,13 @@ interface operations {
                                 [key: string]: unknown;
                             };
                         };
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -12096,7 +12096,7 @@ interface operations {
     getV1AccountIdChatsSearch: {
         parameters: {
             query: {
-                /** @description The search term: matches both participant names and message content (e.g. 'sophie keller'). Terms of 3 or more characters are fast; a 1-2 character term is slower. */
+                /** @description The search term: matches both participant names and message content (e.g. 'sophie keller'). Minimum 3 characters. A shorter term cannot use the search index and is rejected with INVALID_REQUEST. */
                 query: string;
                 /** @description Maximum chats to return per page (1-100, default 20). The server may walk a few internal pages to fill one page. */
                 limit?: number;
@@ -12725,13 +12725,13 @@ interface operations {
                         }[];
                         /** @description Next-page cursor. Follow until items is empty. */
                         cursor?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -12985,7 +12985,7 @@ interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            /** @description A temporary upstream error occurred, or the upstream response could not be interpreted. Please try again. */
+            /** @description A temporary upstream error occurred, or the upstream response could not be interpreted. Check `retry_likely_to_succeed`: a temporary error is worth retrying, a response that could not be interpreted is not, and carries `retry_hint: {"kind": "never"}`. */
             502: {
                 headers: {
                     [name: string]: unknown;
@@ -27899,7 +27899,7 @@ interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description The account's metadata and current state, including the quotas[] budget view (one entry per counted action row for this account, for the current window of that row's grain) account_states[], the platform conditions the account is currently in, and activity_window, the hours in which live writes are reported or refused. */
+            /** @description The account's metadata and current state, including the quotas[] budget view (one entry per counted action row for this account, for the current window of that row's grain) account_states[], the platform conditions the account is currently in, activity_window, the hours in which live writes are reported or refused, and event_log, where the account stands against the retained event log's row budget. */
             200: {
                 headers: {
                     "RateLimit-Policy": components["headers"]["RateLimit-Policy"];
@@ -27972,7 +27972,7 @@ interface operations {
                             posture: "warn" | "enforce";
                             /** @description Whether something on this row is configured above Curviate's own default. The safety policy carries the detail: which field, the value, the default and how well calibrated that default is. */
                             over_default: boolean;
-                            /** @description An active pause on this row because the platform refused a recent request on it, or `null`. A halt is not a ceiling: no limit you raise lifts it, and it clears itself when it expires. */
+                            /** @description An active pause on this row because the platform refused a recent request on it, or `null`. A halt is not a ceiling: no limit you raise lifts it, and it clears itself when it expires. To lift one before it expires, send this row in `clear_halts` on `PATCH /v1/{account_id}/safety-policy`; that is recorded, and the pause returns if the platform refuses the account again. */
                             halt: {
                                 /** @description What the platform did: `rate_limited`, `platform_fault`, or `resend_cooldown` (the same invitation was sent too recently). */
                                 reason?: string;
@@ -27999,6 +27999,15 @@ interface operations {
                             /** @description True when no zone is set, which DISABLES the activity window. Curviate never guesses a zone: a guess eight hours wrong inverts the window, refusing every daytime write and permitting every nocturnal one. If you configured a window and it never fires, this is why. */
                             timezone_unset?: boolean;
                         };
+                        /** @description Where this account stands against the retained event log's row budget. Events are retained for 24 hours so you can read what the platform sent without running a listener; an account may hold at most row_cap of them at once. While at_row_cap is true, further events for this account are still delivered to any webhook you registered but are NOT retained, so the events resource stops being a complete record of what arrived. The budget is a backstop against a misbehaving upstream, sized so ordinary use never approaches it. */
+                        event_log?: {
+                            /** @description Events currently held for this account. A level, not a total: retention is 24 hours, so this falls on its own as events age out. */
+                            retained?: number;
+                            /** @description The maximum this account may hold at once. */
+                            row_cap?: number;
+                            /** @description True while the cap is biting and incoming events are not being retained. Delivery to a registered webhook is unaffected. */
+                            at_row_cap?: boolean;
+                        };
                         safety_warning?: components["schemas"]["SafetyWarning"];
                     };
                 };
@@ -29753,7 +29762,7 @@ interface operations {
                         value: string;
                     }[];
                     /** @description Messaging events to subscribe to (default: [message.received]) */
-                    events?: ("message.received" | "message.delivered" | "message.read" | "message.reaction" | "message.edited" | "message.deleted" | "chat.updated" | "chat.deleted")[];
+                    events?: ("message.received" | "message.read" | "message.reaction" | "message.edited" | "message.deleted" | "chat.updated" | "chat.deleted")[];
                     /**
                      * @description Field-remapping keys for the messaging delivery payload
                      * @default []
@@ -30514,7 +30523,7 @@ interface operations {
                             /** @description IANA zone name the activity window is read in. Null disables the window entirely. */
                             activity_window_timezone?: string | null;
                             /**
-                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. A read Curviate answers from its own store never reaches LinkedIn, so it is never subject to the window under either setting, at any hour; the same read IS covered when the store cannot answer it, or when you ask for it live. Inbound events are never subject to it either.
+                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. A read Curviate answers from its own store never reaches LinkedIn, so it is never subject to the window under either setting, at any hour; the same read IS covered when the store cannot answer it, or when you ask for it live. Inbound events are never subject to it either. One action set to `all` reaches the whole account's live reads that spend no budget of their own (notifications, profile analytics, SSI, profile visitors, the invitation and saved-list listings): those calls debit no action type, so they have none to read this setting from and take the account-wide answer instead. Reads that DO debit an action type read that action type's own setting.
                              * @enum {string}
                              */
                             activity_window_applies_to?: "writes" | "all";
@@ -30612,6 +30621,8 @@ interface operations {
                      * @enum {string|null}
                      */
                     tenant_default_posture?: "warn" | "enforce" | null;
+                    /** @description Lift the platform pause on these action types now, instead of waiting for it to expire. When the platform refuses a call on an account (a rate limit, a server error on a budgeted route, an invitation resend cooldown), Curviate pauses that action type for the platform's own retry-after or a seeded cooldown, and every later call on it is refused locally without reaching the platform. Naming an action type here clears that pause: the next call goes out. Read `quotas[].halt` on the account to see which action types are paused and for how long. A type with no active pause is accepted and does nothing, so this is safe to send for a set you have not checked. Clearing is recorded in the account's ledger with the expiry it cut short, who cleared it and when, and it appears on the safety-events surface. It does not disarm anything: if the platform refuses the account again, the pause comes straight back, longer than the one you cleared where the platform says so. Clear a pause when you have reason to believe the refusal was a transient upstream fault rather than the platform pushing back on this account; clearing one and calling straight back into a real rate limit is itself how accounts get restricted. */
+                    clear_halts?: ("connection_requests_with_note" | "connection_requests_no_note" | "messages_first_degree" | "inmail" | "open_profile_inmail" | "profile_views" | "search" | "comments" | "post_likes" | "follows" | "content_poll" | "job_poll" | "posts" | "endorsements" | "invite_responses" | "withdrawal_sweep")[];
                     /**
                      * @description This account's posture default, overriding the tenant default for this account only. Null clears the override.
                      * @enum {string|null}
@@ -30651,7 +30662,7 @@ interface operations {
                         /** @description IANA zone name the activity window is read in, e.g. `Europe/Berlin`. Must be a real zone; anything else is a 400. Null DISABLES the activity window: a guessed zone inverts it, which is worse than not having one. */
                         activity_window_timezone?: string | null;
                         /**
-                         * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads. A read Curviate answers from its own store never reaches LinkedIn and so is never covered; the same read IS covered when the store cannot answer it, or when you ask for it live. Stored reads and inbound events are never subject to the window under either setting, at any hour.
+                         * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads. A read Curviate answers from its own store never reaches LinkedIn and so is never covered; the same read IS covered when the store cannot answer it, or when you ask for it live. Stored reads and inbound events are never subject to the window under either setting, at any hour. One action set to `all` reaches the whole account's live reads that spend no budget of their own (notifications, profile analytics, SSI, profile visitors, the invitation and saved-list listings): those calls debit no action type, so they have none to read this setting from and take the account-wide answer instead. Reads that DO debit an action type read that action type's own setting.
                          * @enum {string|null}
                          */
                         activity_window_applies_to?: "writes" | "all" | null;
@@ -30800,7 +30811,7 @@ interface operations {
                             /** @description IANA zone name the activity window is read in. Null disables the window entirely. */
                             activity_window_timezone?: string | null;
                             /**
-                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. A read Curviate answers from its own store never reaches LinkedIn, so it is never subject to the window under either setting, at any hour; the same read IS covered when the store cannot answer it, or when you ask for it live. Inbound events are never subject to it either.
+                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. A read Curviate answers from its own store never reaches LinkedIn, so it is never subject to the window under either setting, at any hour; the same read IS covered when the store cannot answer it, or when you ask for it live. Inbound events are never subject to it either. One action set to `all` reaches the whole account's live reads that spend no budget of their own (notifications, profile analytics, SSI, profile visitors, the invitation and saved-list listings): those calls debit no action type, so they have none to read this setting from and take the account-wide answer instead. Reads that DO debit an action type read that action type's own setting.
                              * @enum {string}
                              */
                             activity_window_applies_to?: "writes" | "all";
@@ -30943,11 +30954,11 @@ interface operations {
                              */
                             budget_row: "connection_requests_with_note" | "connection_requests_no_note" | "messages_first_degree" | "inmail" | "open_profile_inmail" | "profile_views" | "search" | "comments" | "post_likes" | "follows" | "content_poll" | "job_poll" | "posts" | "endorsements" | "invite_responses" | "withdrawal_sweep" | "total_actions" | "pending_invites" | "*";
                             /**
-                             * @description Which rule flagged it, and each one calls for a different response. `budget_exhausted`: the account reached the ceiling configured for that row, which you can raise on the safety policy. `activity_window`: the account was acting outside its configured activity window, so no ceiling was the constraint. Wait for the window to open, move `activity_window_start` or `activity_window_end`, or check `activity_window_timezone` is the zone you meant. `rate_limited`: the platform itself refused this account on that row recently and Curviate is holding the row until the pause expires, which no configuration change lifts.
+                             * @description Which rule flagged it, and each one calls for a different response. `budget_exhausted`: the account reached the ceiling configured for that row, which you can raise on the safety policy. `activity_window`: the account was acting outside its configured activity window, so no ceiling was the constraint. Wait for the window to open, move `activity_window_start` or `activity_window_end`, or check `activity_window_timezone` is the zone you meant. `rate_limited`: the platform itself refused this account on that row recently and Curviate is holding the row until the pause expires. No ceiling you raise lifts it; the one thing that does is `clear_halts` on the safety policy, which lifts it deliberately and records that it was lifted. `halt_cleared` is the odd one out and the only entry that is not a refusal: somebody lifted one of those platform pauses early through `clear_halts` on the safety policy, so the row was open again from that instant. It carries `blocked: false` and its `method` is `update_safety_policy` rather than the operation that breached. Read it beside the `rate_limited` entry it lifts: the pause and its lifting are one thread, and an entry list that showed only the first would report a row as still paused.
                              * @enum {string}
                              */
-                            reason: "budget_exhausted" | "activity_window" | "rate_limited";
-                            /** @description Whether the action was stopped. `false` is a warning: the action went through, and this record is the only lasting trace that it crossed a limit. Under the default `warn` posture every event is a warning, which is what makes reading this surface the point of running it. */
+                            reason: "budget_exhausted" | "activity_window" | "rate_limited" | "halt_cleared";
+                            /** @description Whether the action was stopped. `false` is a warning: the action went through, and this record is the only lasting trace that it crossed a limit. Under the default `warn` posture every event is a warning, which is what makes reading this surface the point of running it. A `halt_cleared` entry is also `false`, for a different reason: it stopped nothing, it lifted a stop. */
                             blocked: boolean;
                             /** @description The operation the caller was running when it breached. */
                             method: string;
@@ -33440,6 +33451,10 @@ interface CurviateEventEnvelope {
  * the generated create-events enum (see `test/webhooks.constructEvent.test.ts`);
  * it must never drift from the served catalogue again.
  *
+ * > Removed in 0.27.0 (BREAKING): `message.delivered`. The platform never
+ * > emitted it, so no `event.event === 'message.delivered'` branch has ever
+ * > run. The read-path replacement is `is_delivered` on the message resource.
+ *
  * @example
  * const event = await constructEvent(rawBody, header, secret);
  * if (event.event === 'message.received') {
@@ -33449,9 +33464,6 @@ interface CurviateEventEnvelope {
 type CurviateEvent = CurviateEventEnvelope & ({
     event: "message.received";
     data: MessagePayload;
-} | {
-    event: "message.delivered";
-    data: MessagePayload;
 } | {
     event: "message.read";
     data: MessagePayload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curviate/sdk",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "private": false,
   "description": "TypeScript SDK for the Curviate API.",
   "license": "MIT",

package/src/generated/types.ts

@@ -2513,7 +2513,7 @@ export interface paths {
         };
         /**
          * List webhook event types
-         * @description Returns the complete canonical event catalogue (28 events) grouped by source: messaging (8), user (2), account_status (15), plus 3 tier-gated events. A local catalogue read: no platform call is made.
+         * @description Returns the complete canonical event catalogue (27 events) grouped by source: messaging (7), user (2), account_status (15), plus 3 tier-gated events. A local catalogue read: no platform call is made.
          */
         get: operations["getV1WebhooksEvents"];
         put?: never;
@@ -2591,7 +2591,7 @@ export interface paths {
         head?: never;
         /**
          * Update an account's safety policy
-         * @description The single safety-policy write. Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the Curviate default. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result, and it holds until the next connect. When the seat and the detected product disagree, the detected product wins the numbers and the read reports the disagreement as `seat_tier_mismatch`.
+         * @description The single safety-policy write. Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the Curviate default. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result, and it holds until the next connect. When the seat and the detected product disagree, the detected product wins the numbers and the read reports the disagreement as `seat_tier_mismatch`. One field on this operation does not configure anything: `clear_halts` lifts the platform pause on the action types you name. When the platform refuses a call on an account, Curviate pauses that action type for the platform's own retry-after or a seeded cooldown, and every later call on it is refused locally without reaching the platform; the account resource reports the live pauses as `quotas[].halt`. Naming an action type here lifts its pause immediately, so the next call goes out. An action type with no active pause is accepted and does nothing, which makes it safe to send for a set you have not checked, and only the ones actually lifted are ledgered, each with the expiry it cut short, the actor and the time, readable afterwards on `GET /v1/{account_id}/safety-events` with `reason: "halt_cleared"`. Clearing disarms nothing: if the platform refuses the account again the pause returns, and a 429 or a refused write returns it for the full cooldown. Clear one when you have reason to believe the refusal was a transient upstream fault rather than the platform pushing back on this account.
          */
         patch: operations["patchV1AccountIdSafetyPolicy"];
         trace?: never;
@@ -2605,7 +2605,7 @@ export interface paths {
         };
         /**
          * List what Curviate refused or warned about
-         * @description Returns this account's safety events, newest first: every action Curviate refused, and every action it let through while flagging that a limit had been crossed. Under the default posture nothing is refused, so everything here is a warning and `blocked` is how you tell the two apart. Each event names the budget row that breached, why, the operation that hit it and when. Filter by `budget_row` for one action type and by `since` / `until` for a period, and page until `cursor` is null. This is a read of what already happened, so it never changes a limit or a count: to change what is refused, update the safety policy. The account resource is the other half of the picture, reporting where each row stands right now rather than what has already been flagged.
+         * @description Returns this account's safety events, newest first: every action Curviate refused, and every action it let through while flagging that a limit had been crossed. Under the default posture nothing is refused, so everything here is a warning and `blocked` is how you tell the two apart. Each event names the budget row that breached, why, the operation that hit it and when. Filter by `budget_row` for one action type and by `since` / `until` for a period, and page until `cursor` is null. This is a read of what already happened, so it never changes a limit or a count: to change what is refused, update the safety policy. The account resource is the other half of the picture, reporting where each row stands right now rather than what has already been flagged. One entry here is not a refusal: `reason: "halt_cleared"` with `blocked: false` records somebody lifting a platform pause early through `clear_halts` on the safety policy, and it sits beside the `rate_limited` entry it lifted so the pause and its end read as one thread.
          */
         get: operations["getV1AccountIdSafetyEvents"];
         put?: never;
@@ -2702,13 +2702,13 @@ export interface components {
             }[];
         };
         /**
-         * @description Present on a successful response when this account crossed an account-safety ceiling while the affected budget row is on the default warn posture. The action still happened. Field-identical to the BUDGET_EXHAUSTED error body except that blocked is false, so one branch handles both postures and switching the account to enforce is a configuration change rather than a client rewrite.
+         * @description Present on a successful response when this account crossed an account-safety ceiling while the affected budget row is on the default warn posture. The action still happened. Field-identical to the BUDGET_EXHAUSTED error body except that blocked is false and hint.message describes the outcome, so one branch handles both postures and switching the account to enforce is a configuration change rather than a client rewrite.
          * @example {
          *       "row": "profile_views",
          *       "reset_at": "2026-09-05T00:00:00.000Z",
          *       "hint": {
          *         "parameter": "profile_views.ceiling",
-         *         "message": "This account is at its configured ceiling for profile_views."
+         *         "message": "This account is at its ceiling for profile_views. This action went through because profile_views.posture is warn, and it counted: 101 of 100 this window. Raise profile_views.ceiling, or wait for the window to reset at 2026-09-05T00:00:00.000Z."
          *       },
          *       "reason": "ceiling",
          *       "blocked": false
@@ -2722,7 +2722,7 @@ export interface components {
             hint: {
                 /** @description The settable parameter on PATCH /v1/{account_id}/safety-policy. */
                 parameter: string;
-                /** @description What the condition is and what changing that parameter would do. */
+                /** @description What the condition is and what changing that parameter would do. This is the one field whose text differs from the BUDGET_EXHAUSTED refusal: here it says the action went through, and on a ceiling breach how far past the ceiling this row now stands, rather than telling you to set posture to warn when it already is. Branch on parameter, reason and blocked, never on this text. */
                 message: string;
             };
             /**
@@ -6710,13 +6710,13 @@ export interface operations {
                         }[];
                         /** @description Opaque cursor for the next page, or null at end-of-list. */
                         cursor: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -6893,13 +6893,13 @@ export interface operations {
                             /** @description Message body (content pass-through, never stored). */
                             text?: string | null;
                         } | null;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -7069,13 +7069,13 @@ export interface operations {
                         }[];
                         /** @description Opaque cursor for the next page, or null at end-of-list. */
                         cursor: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -7412,13 +7412,13 @@ export interface operations {
                         sent_at: number;
                         /** @description Message body (content pass-through, never stored). */
                         text?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -7618,13 +7618,13 @@ export interface operations {
                          * @enum {boolean}
                          */
                         filter_effective?: true;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -10265,13 +10265,13 @@ export interface operations {
                         }[];
                         /** @description Next-page cursor; follow until items is empty (presence is not a has-more guarantee). */
                         cursor?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -10687,13 +10687,13 @@ export interface operations {
                             /** @description The vanity slug from the profile URL, for example jane-smith. Present only when the request asks for it with expand=public_identifier, and then always present, carrying the slug or null when the platform surfaces none for this person. */
                             public_identifier?: string | null;
                         };
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -11047,13 +11047,13 @@ export interface operations {
                         }[];
                         /** @description Next-page cursor; follow until items is empty. */
                         cursor?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -11423,13 +11423,13 @@ export interface operations {
                                 [key: string]: unknown;
                             };
                         };
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -12000,7 +12000,7 @@ export interface operations {
     getV1AccountIdChatsSearch: {
         parameters: {
             query: {
-                /** @description The search term: matches both participant names and message content (e.g. 'sophie keller'). Terms of 3 or more characters are fast; a 1-2 character term is slower. */
+                /** @description The search term: matches both participant names and message content (e.g. 'sophie keller'). Minimum 3 characters. A shorter term cannot use the search index and is rejected with INVALID_REQUEST. */
                 query: string;
                 /** @description Maximum chats to return per page (1-100, default 20). The server may walk a few internal pages to fill one page. */
                 limit?: number;
@@ -12629,13 +12629,13 @@ export interface operations {
                         }[];
                         /** @description Next-page cursor. Follow until items is empty. */
                         cursor?: string | null;
-                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, or the account is outside its activity window at this hour and enforces it. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
+                        /** @description Present only when expand=public_identifier was asked for and some people on this page went unresolved for a reason the payload cannot show: more of them needed a profile lookup than one request performs, the account is outside its activity window at this hour and enforces it, or the account's profile_views budget is at its configured ceiling and enforces that. Absent whenever there is nothing to report, so a response that resolved everyone carries no such key. Branch on each entry's code, never on its message. */
                         notices?: {
                             /**
-                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy.
+                             * @description EXPANSION_LIMIT_REACHED: more people on this page needed a profile lookup than one request performs, so the ones past the budget carry public_identifier null without ever having been looked up. Their null therefore does not mean the person has no public profile. Ask for a smaller page to resolve everyone. EXPANSION_WITHHELD_ACTIVITY_WINDOW: the profile lookups this page needed were refused because the account is outside its activity window at this hour and enforces it, so those people carry public_identifier null and their null does not mean they have no public profile either. Ask again inside the window, or widen the window on this account's safety policy. EXPANSION_WITHHELD_CEILING: the profile lookups this page needed were refused because the account's profile_views budget is at its configured ceiling and it enforces that, so those people carry public_identifier null and their null does not mean they have no public profile either. Raise the profile_views ceiling on this account's safety policy, or ask for a smaller page.
                              * @enum {string}
                              */
-                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW";
+                            code: "EXPANSION_LIMIT_REACHED" | "EXPANSION_WITHHELD_ACTIVITY_WINDOW" | "EXPANSION_WITHHELD_CEILING";
                             /** @description One sentence explaining the condition and how to resolve it. */
                             message: string;
                             /** @description The request field the notice is about, here expand. */
@@ -12889,7 +12889,7 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            /** @description A temporary upstream error occurred, or the upstream response could not be interpreted. Please try again. */
+            /** @description A temporary upstream error occurred, or the upstream response could not be interpreted. Check `retry_likely_to_succeed`: a temporary error is worth retrying, a response that could not be interpreted is not, and carries `retry_hint: {"kind": "never"}`. */
             502: {
                 headers: {
                     [name: string]: unknown;
@@ -27803,7 +27803,7 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description The account's metadata and current state, including the quotas[] budget view (one entry per counted action row for this account, for the current window of that row's grain) account_states[], the platform conditions the account is currently in, and activity_window, the hours in which live writes are reported or refused. */
+            /** @description The account's metadata and current state, including the quotas[] budget view (one entry per counted action row for this account, for the current window of that row's grain) account_states[], the platform conditions the account is currently in, activity_window, the hours in which live writes are reported or refused, and event_log, where the account stands against the retained event log's row budget. */
             200: {
                 headers: {
                     "RateLimit-Policy": components["headers"]["RateLimit-Policy"];
@@ -27876,7 +27876,7 @@ export interface operations {
                             posture: "warn" | "enforce";
                             /** @description Whether something on this row is configured above Curviate's own default. The safety policy carries the detail: which field, the value, the default and how well calibrated that default is. */
                             over_default: boolean;
-                            /** @description An active pause on this row because the platform refused a recent request on it, or `null`. A halt is not a ceiling: no limit you raise lifts it, and it clears itself when it expires. */
+                            /** @description An active pause on this row because the platform refused a recent request on it, or `null`. A halt is not a ceiling: no limit you raise lifts it, and it clears itself when it expires. To lift one before it expires, send this row in `clear_halts` on `PATCH /v1/{account_id}/safety-policy`; that is recorded, and the pause returns if the platform refuses the account again. */
                             halt: {
                                 /** @description What the platform did: `rate_limited`, `platform_fault`, or `resend_cooldown` (the same invitation was sent too recently). */
                                 reason?: string;
@@ -27903,6 +27903,15 @@ export interface operations {
                             /** @description True when no zone is set, which DISABLES the activity window. Curviate never guesses a zone: a guess eight hours wrong inverts the window, refusing every daytime write and permitting every nocturnal one. If you configured a window and it never fires, this is why. */
                             timezone_unset?: boolean;
                         };
+                        /** @description Where this account stands against the retained event log's row budget. Events are retained for 24 hours so you can read what the platform sent without running a listener; an account may hold at most row_cap of them at once. While at_row_cap is true, further events for this account are still delivered to any webhook you registered but are NOT retained, so the events resource stops being a complete record of what arrived. The budget is a backstop against a misbehaving upstream, sized so ordinary use never approaches it. */
+                        event_log?: {
+                            /** @description Events currently held for this account. A level, not a total: retention is 24 hours, so this falls on its own as events age out. */
+                            retained?: number;
+                            /** @description The maximum this account may hold at once. */
+                            row_cap?: number;
+                            /** @description True while the cap is biting and incoming events are not being retained. Delivery to a registered webhook is unaffected. */
+                            at_row_cap?: boolean;
+                        };
                         safety_warning?: components["schemas"]["SafetyWarning"];
                     };
                 };
@@ -29657,7 +29666,7 @@ export interface operations {
                         value: string;
                     }[];
                     /** @description Messaging events to subscribe to (default: [message.received]) */
-                    events?: ("message.received" | "message.delivered" | "message.read" | "message.reaction" | "message.edited" | "message.deleted" | "chat.updated" | "chat.deleted")[];
+                    events?: ("message.received" | "message.read" | "message.reaction" | "message.edited" | "message.deleted" | "chat.updated" | "chat.deleted")[];
                     /**
                      * @description Field-remapping keys for the messaging delivery payload
                      * @default []
@@ -30418,7 +30427,7 @@ export interface operations {
                             /** @description IANA zone name the activity window is read in. Null disables the window entirely. */
                             activity_window_timezone?: string | null;
                             /**
-                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. A read Curviate answers from its own store never reaches LinkedIn, so it is never subject to the window under either setting, at any hour; the same read IS covered when the store cannot answer it, or when you ask for it live. Inbound events are never subject to it either.
+                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. A read Curviate answers from its own store never reaches LinkedIn, so it is never subject to the window under either setting, at any hour; the same read IS covered when the store cannot answer it, or when you ask for it live. Inbound events are never subject to it either. One action set to `all` reaches the whole account's live reads that spend no budget of their own (notifications, profile analytics, SSI, profile visitors, the invitation and saved-list listings): those calls debit no action type, so they have none to read this setting from and take the account-wide answer instead. Reads that DO debit an action type read that action type's own setting.
                              * @enum {string}
                              */
                             activity_window_applies_to?: "writes" | "all";
@@ -30516,6 +30525,8 @@ export interface operations {
                      * @enum {string|null}
                      */
                     tenant_default_posture?: "warn" | "enforce" | null;
+                    /** @description Lift the platform pause on these action types now, instead of waiting for it to expire. When the platform refuses a call on an account (a rate limit, a server error on a budgeted route, an invitation resend cooldown), Curviate pauses that action type for the platform's own retry-after or a seeded cooldown, and every later call on it is refused locally without reaching the platform. Naming an action type here clears that pause: the next call goes out. Read `quotas[].halt` on the account to see which action types are paused and for how long. A type with no active pause is accepted and does nothing, so this is safe to send for a set you have not checked. Clearing is recorded in the account's ledger with the expiry it cut short, who cleared it and when, and it appears on the safety-events surface. It does not disarm anything: if the platform refuses the account again, the pause comes straight back, longer than the one you cleared where the platform says so. Clear a pause when you have reason to believe the refusal was a transient upstream fault rather than the platform pushing back on this account; clearing one and calling straight back into a real rate limit is itself how accounts get restricted. */
+                    clear_halts?: ("connection_requests_with_note" | "connection_requests_no_note" | "messages_first_degree" | "inmail" | "open_profile_inmail" | "profile_views" | "search" | "comments" | "post_likes" | "follows" | "content_poll" | "job_poll" | "posts" | "endorsements" | "invite_responses" | "withdrawal_sweep")[];
                     /**
                      * @description This account's posture default, overriding the tenant default for this account only. Null clears the override.
                      * @enum {string|null}
@@ -30555,7 +30566,7 @@ export interface operations {
                         /** @description IANA zone name the activity window is read in, e.g. `Europe/Berlin`. Must be a real zone; anything else is a 400. Null DISABLES the activity window: a guessed zone inverts it, which is worse than not having one. */
                         activity_window_timezone?: string | null;
                         /**
-                         * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads. A read Curviate answers from its own store never reaches LinkedIn and so is never covered; the same read IS covered when the store cannot answer it, or when you ask for it live. Stored reads and inbound events are never subject to the window under either setting, at any hour.
+                         * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads. A read Curviate answers from its own store never reaches LinkedIn and so is never covered; the same read IS covered when the store cannot answer it, or when you ask for it live. Stored reads and inbound events are never subject to the window under either setting, at any hour. One action set to `all` reaches the whole account's live reads that spend no budget of their own (notifications, profile analytics, SSI, profile visitors, the invitation and saved-list listings): those calls debit no action type, so they have none to read this setting from and take the account-wide answer instead. Reads that DO debit an action type read that action type's own setting.
                          * @enum {string|null}
                          */
                         activity_window_applies_to?: "writes" | "all" | null;
@@ -30704,7 +30715,7 @@ export interface operations {
                             /** @description IANA zone name the activity window is read in. Null disables the window entirely. */
                             activity_window_timezone?: string | null;
                             /**
-                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. A read Curviate answers from its own store never reaches LinkedIn, so it is never subject to the window under either setting, at any hour; the same read IS covered when the store cannot answer it, or when you ask for it live. Inbound events are never subject to it either.
+                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. A read Curviate answers from its own store never reaches LinkedIn, so it is never subject to the window under either setting, at any hour; the same read IS covered when the store cannot answer it, or when you ask for it live. Inbound events are never subject to it either. One action set to `all` reaches the whole account's live reads that spend no budget of their own (notifications, profile analytics, SSI, profile visitors, the invitation and saved-list listings): those calls debit no action type, so they have none to read this setting from and take the account-wide answer instead. Reads that DO debit an action type read that action type's own setting.
                              * @enum {string}
                              */
                             activity_window_applies_to?: "writes" | "all";
@@ -30847,11 +30858,11 @@ export interface operations {
                              */
                             budget_row: "connection_requests_with_note" | "connection_requests_no_note" | "messages_first_degree" | "inmail" | "open_profile_inmail" | "profile_views" | "search" | "comments" | "post_likes" | "follows" | "content_poll" | "job_poll" | "posts" | "endorsements" | "invite_responses" | "withdrawal_sweep" | "total_actions" | "pending_invites" | "*";
                             /**
-                             * @description Which rule flagged it, and each one calls for a different response. `budget_exhausted`: the account reached the ceiling configured for that row, which you can raise on the safety policy. `activity_window`: the account was acting outside its configured activity window, so no ceiling was the constraint. Wait for the window to open, move `activity_window_start` or `activity_window_end`, or check `activity_window_timezone` is the zone you meant. `rate_limited`: the platform itself refused this account on that row recently and Curviate is holding the row until the pause expires, which no configuration change lifts.
+                             * @description Which rule flagged it, and each one calls for a different response. `budget_exhausted`: the account reached the ceiling configured for that row, which you can raise on the safety policy. `activity_window`: the account was acting outside its configured activity window, so no ceiling was the constraint. Wait for the window to open, move `activity_window_start` or `activity_window_end`, or check `activity_window_timezone` is the zone you meant. `rate_limited`: the platform itself refused this account on that row recently and Curviate is holding the row until the pause expires. No ceiling you raise lifts it; the one thing that does is `clear_halts` on the safety policy, which lifts it deliberately and records that it was lifted. `halt_cleared` is the odd one out and the only entry that is not a refusal: somebody lifted one of those platform pauses early through `clear_halts` on the safety policy, so the row was open again from that instant. It carries `blocked: false` and its `method` is `update_safety_policy` rather than the operation that breached. Read it beside the `rate_limited` entry it lifts: the pause and its lifting are one thread, and an entry list that showed only the first would report a row as still paused.
                              * @enum {string}
                              */
-                            reason: "budget_exhausted" | "activity_window" | "rate_limited";
-                            /** @description Whether the action was stopped. `false` is a warning: the action went through, and this record is the only lasting trace that it crossed a limit. Under the default `warn` posture every event is a warning, which is what makes reading this surface the point of running it. */
+                            reason: "budget_exhausted" | "activity_window" | "rate_limited" | "halt_cleared";
+                            /** @description Whether the action was stopped. `false` is a warning: the action went through, and this record is the only lasting trace that it crossed a limit. Under the default `warn` posture every event is a warning, which is what makes reading this surface the point of running it. A `halt_cleared` entry is also `false`, for a different reason: it stopped nothing, it lifted a stop. */
                             blocked: boolean;
                             /** @description The operation the caller was running when it breached. */
                             method: string;