@sema-agent/sdk 23.1.0 → 24.0.0

package/openapi.yaml

@@ -423,7 +423,7 @@ paths:
         prepare-time refusal code that HAS a status in the server's per-code triage table (`resume_at.*` — `resume_at.not_found` is 404, the rest 422 —, governance codes,
         `rewind.store_unconfigured` / `rewind.capture_disabled` / `rewind.child_scope_unsupported` / `rewind_snapshot.unresolvable`, the
         registered `config.*` codes incl. the three roster-bound ones and — server >= 7.116.0 — `config.invalid_checkpoint_store` (400) and
-        `config.user_invoked_skill_unknown` (400: top-level `userInvokedSkills` named a skill this run does not carry) and — server >= 7.117.0 — `config.image_invalid` (400: an inline image failed the engine's byte admission; `error` starts with `TaskSpec.images: `) and — server >= 7.126.0 — `config.tool_face_control` (400: `allowTools: ["mcp__*"]`, `excludeTools: ["*"]` (and, on server 7.126.0–7.128.x only, a name in `allowTools` / `excludeTools` that no tool of this run answers to — server >= 7.129.0 runs those as written and announces each once with the operator row `runner_config_advisory`), or an `excludeTools` entry that reaches a protocol tool this leg depends on; the engine rejects before the run starts, never silently ignoring the name; `error` is the engine's sentence naming the entry, its list and why), `corrupt_session`; codes outside the table, e.g. `rewind.invalid_spec`, stay
+        `config.user_invoked_skill_unknown` (400: top-level `userInvokedSkills` named a skill this run does not carry) and — server >= 7.117.0 — `config.image_invalid` (400: an inline image failed the engine's byte admission; `error` starts with `TaskSpec.images: `) and — server >= 7.126.0 — `config.tool_face_control` (400: `allowTools: ["mcp__*"]`, `excludeTools: ["*"]` (and, on server 7.126.0–7.128.x only, a name in `allowTools` / `excludeTools` that no tool of this run answers to — server >= 7.129.0 runs those as written and announces each once with the operator row `runner_config_advisory`), or an `excludeTools` entry that reaches a protocol tool this leg depends on; the engine rejects before the run starts, never silently ignoring the name; `error` is the engine's sentence naming the entry, its list and why) and — server >= 7.132.0, BREAKING (200 + failed body before) — `config.agent.unknown_tool` (400: a delegated agent's `allowTools` names a near-miss / a retired name with a successor / an impossible spelling, judged by the engine before the run; the intake refusal of `agents[i].denyTools` entries that read as nothing has answered this 400 since 7.131.0) and `config.legacy_tool_name` (400: a stored session-rule row names a tool the engine reads as nothing) and `prompt.assembled_role_refused` (400: `systemPrompt` / `appendSystemPrompt` — `settings.outputStyle` folded in — carries the engine's locked prompt text verbatim; send role text only) and — server >= 7.131.0 — `config.user_attachment_invalid` (400; server >= 7.132.0 the body adds `detail: { path, index? }`), `corrupt_session`; these registered codes answer 400 on all three submit legs without spending the `Idempotency-Key` (async / live legs: 2xx with the same code on the terminal run row); codes outside the table, e.g. `rewind.invalid_spec`, stay
         200 with a failed body) answers its 4xx / 5xx ERROR BODY only when the whole submission did ZERO WORK (cumulative
         `stats.turns === 0` AND `stats.tokens === 0` — the common case: nothing billed, not idempotency-cached). When a
         `verify` / `cascade` run's earlier tier already ran turns and only the last tier is refused, the SAME code arrives
@@ -9657,6 +9657,16 @@ components:
             a child process spawned on this host NEVER inherits a name the deployment declared as its own credential — every `inheritEnv` policy (`"all"` and `"scrub"` alike) subtracts that list first, and an allow list naming one is
             refused. It speaks of INHERITANCE only (the engine process's own environment stays readable to same-user processes on the host; a credential that never enters it remains the root fix).
             ABSENT = an old server (<= 7.128.x) or a word this deployment does not wire: read it as "not promised", not as "absent capability". A shell gates on the word, never on a version number.
+        inherit_env.own_credential_values_withheld:
+          type: boolean
+          description: >-
+            ENGINE CAPABILITY WORD (core `ENGINE_CAPABILITIES`' second word, core 7.52.0; server >= 7.132.0 projects it; the key IS the word, dotted):
+            a child process spawned on this host does NOT inherit a variable whose VALUE equals one of this deployment's credential values (whole-string equality, whatever
+            the variable is called) — a key copied into another variable name is withheld under `inheritEnv: "all"` too. 🔴 A FACT, not a promise — it can be `false`:
+            true <=> every credential variable of the live configuration that has a value in the environment went into the engine's value arm; the engine refuses a value it
+            reads as "not a credential" (blank / a placeholder word / one repeated character / under 8 characters) or "the value of a variable every child process gets"
+            (startup does not refuse; the name arm still withholds) => `false`. A credential resolved only per request is not in the value arm. INHERITANCE only, like the first word.
+            ABSENT = an old server (<= 7.131.x withholds by name only — a same-value copy under another name reaches the child under `"all"`). Gate on `=== true`.
         asyncRuns: { type: boolean }
         artifacts: { type: boolean }
         approvals: { type: boolean }
@@ -10892,7 +10902,19 @@ components:
                     `principalHeader` (both set => 400 request.body_shape); a non-string value => 400 request.field_invalid.
                     7.128.x accepts and carries the declaration but does NOT send an assertion yet (engine seat pending;
                     operator line `mcp_assertion_header_not_sent`).
-        allowTools: { type: array, items: { type: string } }
+        allowTools:
+          type: array
+          items: { type: string }
+          description: >-
+            Which of this server's tools to MOUNT (bare tool names, as the server lists them). Three sentences (server >= 7.132.0 contract; read off the engine's
+            `intakeListedTools`, passed through verbatim, never checked against the live list): ABSENT = every listed tool mounts; `[]` = NONE mounts (the server is
+            still connected, still probed, still on the `GET /v1/capabilities/mcp` status face) — `[]` MUST NOT be folded into absence (two facts on the wire;
+            do not drop an empty array when serializing); a name the server does not list = SILENTLY NO MATCH (no 400, no warning — a narrowing mismatch mounts
+            less, never more; for "loud on a typo" name the same tool in `toolFaces`, which notices an unknown name as `config.tool_face_undeclared`; `toolAxes`
+            checks shape only). The engine's one loud case: a server without the `tools` capability and a non-empty list ⇒ operator warning
+            `mcp.tools_capability_absent`. The list also gates the server's MCP RESOURCES: absent ⇒ list / read stay open; a list ⇒ open only if it names the
+            reserved `list_resources` / `read_resource` (so `[]` closes them too). Bad shape (not a string array) ⇒ 400 `request.field_invalid` naming
+            `mcpServers[i].allowTools`.
         elicitation: { type: boolean }
         toolAxes:
           type: object
@@ -10908,6 +10930,15 @@ components:
             server >= 7.66.0 — per-tool face overlays keyed by BARE tool name (see McpToolFace). Any malformed
             face drops the whole server.
           additionalProperties: { $ref: '#/components/schemas/McpToolFace' }
+        startupTimeoutMs:
+          type: number
+          description: >-
+            server >= 7.132.0 (an accepted key; core `McpServerSpec.startupTimeoutMs`): THIS server's startup bound in whole milliseconds — the handshake
+            (connect + initialize) and the initial tool listing each carry it. One read order: this member, else the process-level `MCP_TIMEOUT`, else the MCP
+            SDK's own 60 000 ms. Range 1 000 – 2 147 483 647. The value-shape judge lives ONLY in the engine: neither server door (new submit / probe) checks
+            it at intake; a bad value (a string, a fraction, 0, a negative, NaN, `null`, out of range) refuses ONLY THIS server at its dial
+            (`config.mcp_startup_timeout_invalid`; siblings mount) — never clamped, never read as the default. A <= 7.131.x server answers `400
+            request.body_shape` (named in `unknownKeys`).
 
     A2aServerSpec:
       type: object
@@ -11836,12 +11867,16 @@ components:
       x-open-enum: true
       description: >-
         A model row's key<->URL pairing posture (core `RoutePairingStatus`; server >= 7.45). OPEN on read —
-        the six words below are today's set, branch on the known ones and keep a `default` arm. NON-SECRET — no
+        the eight words below are today's set (core `RoutePairingStatus`), branch on the known ones and keep a `default` arm. NON-SECRET — no
         URL, no credential.
         `ok:per-model` this model has its own credential · `ok:paired` deployment credential, and the model's URL
         is on the deployment's declared root · `ok:keyless` no credential anywhere (a local unauthenticated
         gateway) · `broken:credential_mismatch` / `broken:credential_missing` a real request WILL be refused by
-        the engine (flag it red) · `unknown` could not be adjudicated — render "unknown", NEVER "good" or "bad".
+        the engine (flag it red) · server >= 7.132.0 / engine 7.52.0 adds two `broken:` words, same reading:
+        `broken:credential_origin_mismatch` (this model's own credential is bound to the host it first went to and the row now points at another
+        host — configure a credential for the new host or point it back; the same refusal on a stream is the `engine_notice`
+        `route.credential_origin_mismatch`) and `broken:credential_answer_conflict` (the per-model credential hook answers the key twice — `apiKey`
+        AND the lane's own key header; answer one of them) · `unknown` could not be adjudicated — render "unknown", NEVER "good" or "bad".
         🔴 sdk 23.0.0 BREAKING (server >= 7.129.0 / engine 7.51.0): `ok:unpinned` (a deployment credential on a deployment that declared no root, so the pairing was unverifiable) is RETIRED with no alias —
         on such a deployment the engine now judges the deployment credential `broken:credential_mismatch`. A server <= 7.128.x still sends `ok:unpinned`: it falls in the open tail, render it as
         "pairing not verified", never as good.
@@ -11851,11 +11886,11 @@ components:
 
     ResumeStartupCause:
       type: string
-      enum: [environment, session_gone, tool_unavailable, configuration, decision_rejected]
+      enum: [environment, session_gone, transcript_corrupt, tool_unavailable, configuration, decision_rejected]
       description: >-
-        WHY a parked resume could not start its approved action — the engine's closed `RESUME_STARTUP_CAUSES` (core 7.51.0), word for word and in order. The body key of the 422 `parked_resume.startup_failed`
+        WHY a parked resume could not start its approved action — the engine's closed `RESUME_STARTUP_CAUSES` (core 7.51.0; six words since core 7.52.0, server >= 7.132.0), word for word and in order. The body key of the 422 `parked_resume.startup_failed`
         (`ErrorResponse.cause`; SDK `ParkedResumeStartupError.startupCause`). Server >= 7.129.0 screens the engine's word against this set before it goes out (a word the engine did not say, or one outside the set => the key is absent).
-        `environment` the leg's infrastructure failed (workspace restore, an abort) — the decision is untouched, retrying replays it · `session_gone` the resumed agent's transcript session is missing ·
+        `environment` the leg's infrastructure failed (workspace restore, an abort) — the decision is untouched, retrying replays it · `session_gone` the resumed agent's transcript session is missing · `transcript_corrupt` (core 7.52.0) the transcript is there but damaged (no header its store wrote, a leaf or parent entry missing, a lost tail the checkpoint was cut inside) — it reopens as `session_gone` does, only the receipt now names it ·
         `tool_unavailable` the approved tool is not available to the resumed leg (gone, or replaced by a different contract) — this approval cannot run, decide afresh · `configuration` the deployment's
         configuration refuses the resumed leg; a retry under the same configuration fails the same way · `decision_rejected` the decision does not fit the checkpoint (another gate's answer, an input the constraints
         refuse) — correct it and resubmit. The shared `ErrorResponse.cause` stays an open string in this document because the key is shared by other codes and by servers <= 7.128.x (which relay the engine's word unscreened).
@@ -13265,7 +13300,11 @@ components:
             🔴 OPEN SET — deliberately NOT an enum: observed values include `human`, `irreversible_ask`,
             `plan_review`, `needs_review`, `resource_limit`, and core keeps adding. Pinning an enum would make a
             new gate kind "not exist" for generated clients.
-            ABSENT on a pre-`gate_kind` legacy row (SQL column NULL) — degrade honestly, never assume `human`.
+            🔴 ALWAYS PRESENT on server >= 7.132.0 (a wire narrowing): every park stamps it, the one-time migration M21 filled the stored rows that lacked it
+            (a row whose gate names no registered kind is expired), and a SQL row that still carries none is NOT LISTED (counted under
+            `server.approvals.queue-row-gate-kind-missing`; no decide route can bind it) rather than served without the key. On a <= 7.131.x server it is
+            absent on a pre-`gate_kind` legacy SQL row (column NULL). Either way the reading of an absent key is "unreadable — fail closed": never assume
+            `human`, never route it. Deliberately still not in `required` while the supported floor (3.0.0) is below 7.132.0.
         input:
           description: >
             The pending tool call's args (post-hook), REDACTED + size-bounded — for a tool gate the write
@@ -13975,23 +14014,67 @@ components:
         message: { description: 'OPEN — the message payload as stored; shape belongs to the transcript format, not to this envelope. server >= 7.125.0: a `role: "user"` message carries the same present-iff rewind handle `taskId` as on the whole-record read (see `SessionRecord.messages`).' }
 
     PromptEpoch:
-      type: object
       description: >
-        A session's prompt-epoch pin (server >=1.220, additive on `GET /v1/sessions/:id`). Identifies WHICH
-        assembled system-prompt artifact this session is pinned to, so a transcript stays reproducible across
-        prompt-pack releases. IDs/digests only — never prompt text. OPEN object.
-      required: [epoch, artifactDigest, packId, assemblyApi, activatedBy]
-      additionalProperties: true
+        A session's prompt-epoch record on `GET /v1/sessions/:id` (absent = a pre-epoch session — never null). 🔴 server >= 7.132.0 BREAKING (no alias): the value
+        is the engine's `StoredPromptEpoch` reading VERBATIM (the server neither reads nor projects it) — a v3 pin `{ kind: "pin", descriptor }`, or a record of a
+        retired shape recognized by its field names `{ kind: "legacy", centerPinned }` (the engine reads only whether it pinned a center artifact; the next run
+        replaces it with a v3 record). The <= 7.131.x shape `{ epoch, artifactDigest, packId, assemblyApi, activatedBy }` is retired: `epoch` / `activatedBy` live
+        in `descriptor`, `descriptor.identity` takes the identity role (a different digest over different inputs — not comparable), `packId` / `assemblyApi` have
+        no successor. IDs / digests only — never prompt text.
+      oneOf:
+        - $ref: '#/components/schemas/PromptEpochPin'
+        - $ref: '#/components/schemas/PromptEpochLegacy'
+      discriminator:
+        propertyName: kind
+        mapping:
+          pin: '#/components/schemas/PromptEpochPin'
+          legacy: '#/components/schemas/PromptEpochLegacy'
+    PromptEpochPin:
+      type: object
+      additionalProperties: false
+      required: [kind, descriptor]
+      properties:
+        kind: { const: pin }
+        descriptor: { $ref: '#/components/schemas/PromptEpochDescriptor' }
+    PromptEpochLegacy:
+      type: object
+      additionalProperties: false
+      required: [kind, centerPinned]
       properties:
-        epoch: { type: integer, description: Monotonic epoch counter within the session. }
-        artifactDigest: { type: string, description: 'Content digest of the assembled artifact (`sha256:<64 hex>`).' }
-        packId: { type: string, description: 'Prompt-pack identity, e.g. `sema-default@1`.' }
-        assemblyApi: { type: integer, description: Assembly-contract version (currently always 1). }
+        kind: { const: legacy }
+        centerPinned: { type: boolean, description: 'whether the retired-shape record pinned a center artifact.' }
+    PromptEpochDescriptor:
+      type: object
+      description: 'A v3 epoch record (core `PromptEpochDescriptor`), persisted as a session entry and restated in every compaction entry.'
+      additionalProperties: false
+      required: [epoch, identity, layers, activatedBy]
+      properties:
+        epoch: { type: integer, description: 'monotonic per-session record counter.' }
+        identity: { type: string, description: 'the run''s prompt identity digest (= the manifest''s `identity.artifact`).' }
+        layers: { $ref: '#/components/schemas/PromptIdentityLayers' }
         activatedBy:
           type: string
-          description: >
-            Open enum — known values `session_start` | `compaction` | `legacy_migration`; treat unknown values as
-            opaque rather than failing closed.
+          enum: [session_start, compaction, code_change, selection_change]
+          description: 'how the record came to be — core `PROMPT_EPOCH_ACTIVATIONS`: `session_start` / `compaction` (legal boundaries), `code_change` (code or input layers moved), `selection_change` (only the selector values moved). CLOSED: the engine''s judge (`normalizePromptEpoch`) checks membership, a record with any other word does not read as a pin.'
+        changed:
+          type: array
+          items: { type: string, enum: [catalog, renderers, deploy, task, published_schema] }
+          description: 'only on a `code_change` record whose changed layers are known — core `PROMPT_EPOCH_CHANGES` (closed, judged by the engine like `activatedBy`).'
+        sourceRevision: { type: string, description: 'opaque publish provenance of the pinned center layer — present only beside `layers.center`; never digested.' }
+    PromptIdentityLayers:
+      type: object
+      description: >
+        The inputs of a run's prompt identity (core `PromptIdentityLayers`; the epoch record's `layers` and the manifest's `identity.layers` are this one shape).
+        Only `center` is pinned (resolved by digest on resume); the rest are what the run computed. Absent `center` / `deploy` / `task` = that layer contributed nothing.
+      additionalProperties: false
+      required: [catalog, renderers, binding]
+      properties:
+        catalog: { type: string }
+        renderers: { type: object, additionalProperties: { type: number }, description: 'renderer id -> version.' }
+        center: { type: string, description: 'the adopted center artifact''s digest.' }
+        deploy: { type: string }
+        task: { type: string }
+        binding: { type: string, description: 'digest of the run''s selector values (the plain form is the manifest''s `selectors`).' }
 
     SessionListPage:
       type: object
@@ -14097,14 +14180,45 @@ components:
       # 封闭(census 批2 第三段,2026-07-30):三个铸造臂(`routes/sessions.ts` 的空面板 / 超时 degraded / 正常)键集并集恰是这 3 键;degraded 只在超时臂铸。
       # sdk 9.4.0:第 4 键 `lastLegMcp`(server ≥7.77.0)—— 同一个铸造点上按调用方裁的可选顶层键,不在
       # 面板那张短 TTL 单飞缓存里(缓存键=场景×principal,与会话无关)。
-      required: [asOf, servers]
+      # server >= 7.131.0:第 5 键 `scenarioRefusal`(场景门拒时在场,此时 `servers` 缺席)⇒ `servers` 出 required。
+      # 两臂恰一(server 7.132.0 三只铸造臂):served = `servers`(+ `degraded` 只在超时臂)/ refused = `scenarioRefusal`(无 `servers` / `degraded`)⇒ `oneOf` 判(sdk `McpStatusPanelServed` / `McpStatusPanelRefused`)。
+      # 每一臂自己禁掉对方的键(不靠「另一臂恰好不过」:混合体 `{ servers, scenarioRefusal, degraded }` 曾因 refused 臂被 `degraded` 判掉而恰一臂过)。
+      required: [asOf]
       additionalProperties: false
+      oneOf:
+        - required: [servers]
+          not: { required: [scenarioRefusal] }
+        - required: [scenarioRefusal]
+          not: { anyOf: [{ required: [servers] }, { required: [degraded] }] }
       properties:
         asOf: { type: string }
         servers:
           type: array
           items: { $ref: '#/components/schemas/McpServerStatus' }
+          description: >-
+            The scenario half: what this principal's scenario would mount NOW. server >= 7.131.0: ABSENT only when the scenario gate refused (then
+            `scenarioRefusal` is present) — distinct from `[]` (the gate passed and that scenario configures no MCP). Always present on older servers.
         degraded: { type: boolean }
+        scenarioRefusal:
+          type: object
+          description: >-
+            server >= 7.131.0 — present ONLY when the scenario gate refused (and then `servers` is absent); the panel still answers 200 because the ledger half
+            (`lastLegMcp`) does not depend on the scenario. Exactly one of `servers` / `scenarioRefusal` is present (the `oneOf` above; `degraded` only beside `servers`). Members = the body of the same refusal answered
+            whole-face (503 on `GET /v1/capabilities/mcp` / `GET /v1/sessions/{id}/a2a`), byte-equal (one sentence builder): today `errorCode`
+            `state.scenario_assignment_unknown`, `error` naming the scenario and this deployment's roster, `detail: { scenario, source }` with `source` one of
+            `ruling` (the center assigned this principal a scenario this deployment does not have) / `deployment` (a dangling `DEFAULT_SCENARIO`; sema-server refuses
+            to boot on it, only an embedder's own `resolveSpec` reaches it). A gate that throws something that is not a typed refusal is still a 500.
+          required: [errorCode, error]
+          additionalProperties: true
+          properties:
+            errorCode: { type: string }
+            error: { type: string }
+            detail:
+              type: object
+              required: [scenario, source]
+              properties:
+                scenario: { type: string }
+                source: { type: string, description: '`ruling` / `deployment` today; read open.' }
         lastLegMcp:
           type: object
           description: >
@@ -14636,6 +14750,10 @@ components:
         row (`status` / `instanceId`) — zero extra reads — and a cross-principal caller never reaches these codes
         (the owner gate answers `not_found.run`, same code and text as the unknown arm). Both dispositions are the
         same: stop retrying the handle, read the run's own outcome via GET /v1/runs/{taskId}.
+    SettingsHooksConfigPath:
+      type: array
+      items: { type: [string, integer] }
+      description: 'the coordinate of a `settings.hooks` verdict — segments relative to the request body''s `settings` (caller-text segments echo-bounded). SDK `SettingsHooksConfigPath`.'
     ErrorResponse:
       type: object
       description: >
@@ -14766,7 +14884,9 @@ components:
             unreadable) / `unreachable` (unreachable / 5xx / timeout / bad body / any status other than 200 / 409 / 400 / 401 / 403 —
             center 404 / 429 / 3xx included). On 400 `request.field_invalid` for a `settings.permissions` bucket (server >= 7.106.0 /
             S-904): `over_cap` (more than `cap` entries; beside `count` + `cap`) / `bad_entry` (a non-string or empty item; beside
-            `index`). On 400 `rules.inert_entry` (server >= 7.129.0): the engine's `ALLOW_ENTRY_INERT_REASONS` (`tool_name` / `wildcard_all` / `namespace_wildcard` / `content_unsupported` / `grammar` / `near_miss` / `earlier_grammar`). Out-of-vocabulary word ⇒ treat as unknown. (Other codes carry their own `reason` words.)
+            `index`); server >= 7.132.0 widens that group to every tool-name list on the body, the agent definitions and the two host-path lists, and adds
+            `too_long` (a text over its character cap; beside `count` + `cap`) — closed three words `over_cap` / `too_long` / `bad_entry` (SDK `RequestFieldRefusalExtra`).
+            On 409 refusals of a resume (server >= 7.132.0): the engine's `CheckpointErrorReason` arm (`detail.reason` passed through; see `blockedBy`). On 400 `rules.inert_entry` (server >= 7.129.0): the engine's `ALLOW_ENTRY_INERT_REASONS` (`tool_name` / `wildcard_all` / `namespace_wildcard` / `content_unsupported` / `grammar` / `near_miss` / `earlier_grammar`). Out-of-vocabulary word ⇒ treat as unknown. (Other codes carry their own `reason` words.)
         retryAfterSec:
           type: number
           description: >-
@@ -14782,7 +14902,10 @@ components:
             carry their own `field`: the bucket on `rules.inert_entry`, the offending key on `rules.invalid_shape`.) Resume legs carry the same group on 409 `resume_blocked_by_policy`
             (`blockedBy: "request.field_invalid"`). Also on 409 `checkpoint.config_refused` (server >= 7.113.0): which part of the
             row's configuration was refused — `taskConfig` (change the configuration, then decide the SAME card again) or
-            `inheritedGate` (the row's recorded mode seed is bad — the run can only be cancelled). Also on 400 `request.field_invalid` for a
+            `inheritedGate` (the row's recorded mode seed is bad — the run can only be cancelled) and — core 7.53.0 / server >= 7.132.0 — `deps` (the deployment's OWN
+            seat is broken: fix the deployment, then decide the SAME card again). server >= 7.132.0: on 400 `request.field_invalid` cap / bad-entry refusals `field` is
+            the IN-BODY COORDINATE of the capped / bad place (`skills[1].allowedTools`, `agents[0].denyTools[3]`, `agents`, `allowTools`, `additionalDirectories` …) —
+            the same group as `reason` / `count` / `cap` / `index`. Also on 400 `request.field_invalid` for a
             `settings.hooks` tool-event matcher that selects an engine alias but not its canonical name (server >= 7.115.0 / S-1025):
             `field` is always the literal `settings.hooks` (see `detail`). Also on 400 `request.body_shape` (server >= 7.119.0), on the THREE
             tool-approval decision doors (`POST /v1/tool-approvals/{id}/respond`, `POST /v1/tasks/{taskId}/asks/{askId}/decision`,
@@ -14800,17 +14923,104 @@ components:
             `request.field_invalid` for a `settings.hooks` tool-event matcher (server >= 7.115.0 / S-1025; additive, the sentence and the code
             are unchanged): an OBJECT `{ event, alias, canonical }` — `event` = the tool event of the refused group (the first refused one when
             several are), `alias` / `canonical` = the engine catalog's alias and canonical name (closed strings, never the caller's raw bytes),
-            beside `field: "settings.hooks"`. On 400 `request.field_invalid` for the two `POST /v1/adoption` principal sentences (adoption):
+            beside `field: "settings.hooks"`; 🔴 server >= 7.126.0 adds `reason` (`dead_alias` / `over_budget` / `invalid_regex`) and server >= 7.132.0 makes EVERY
+            `settings.hooks` refusal carry this object with `path` ALWAYS present (the coordinate of the verdict, a segment array relative to the body's `settings`):
+            the matcher forms (+ `budget_exceeded` with `totalMs`), the config reader's piece codes (+ `key`), `unsupported_entry_type` (+ `type`), the service caps
+            `over_cap` / `too_long` (+ `count` / `cap`) and `unnamed_refusal` — see the hooks branch below and SDK `SettingsHooksRefusalDetail`. On 400
+            `config.user_attachment_invalid` (server >= 7.132.0 / core 7.53.0): an OBJECT `{ path, index? }` — the field the engine names at the head of the sentence,
+            `index` (0-based) only when the sentence names one attachment (SDK `UserAttachmentRefusalExtra`). On 400 `request.field_invalid` for the two `POST /v1/adoption` principal sentences (adoption):
             a human-readable STRING. Other codes (core `checkpoint.*` mirrors; `rules.*` refusals carry no `detail` — their keys are `field` / `entry` / `reason` / `verdict` / `currentName` / `guidance` / `got` at the top level) carry their
             own `detail`; read it by `errorCode`. SDK: `err.extra.detail` (verbatim, unnamed).
           oneOf:
             - type: object
-              required: [event, alias, canonical]
+              description: 'the `settings.hooks` refusal detail (beside `field: "settings.hooks"`), one shape per `reason` — branch on `reason`, exhaustively (SDK `SettingsHooksRefusalDetail`). server >= 7.132.0: every hooks refusal carries it and `path` is always present; in-floor older servers: the three matcher shapes without `path` (7.126.0–7.131.x) and the reason-less dead-alias shape (7.115.0–7.125.x).'
+              oneOf:
+                - type: object
+                  description: 'matcher: selects an engine alias but not its canonical name (`path` absent on server 7.126.0–7.131.x).'
+                  required: [reason, event, alias, canonical]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [dead_alias] }
+                    event: { type: string }
+                    alias: { type: string }
+                    canonical: { type: string }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                - type: object
+                  description: 'matcher: one regex evaluation over the per-evaluation budget (`path` absent on server 7.126.0–7.131.x).'
+                  required: [reason, event, groupIndex, budgetMs]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [over_budget] }
+                    event: { type: string }
+                    groupIndex: { type: integer }
+                    budgetMs: { type: integer }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                - type: object
+                  description: 'matcher (server >= 7.132.0): the completed regex evaluations of one admission summed over `totalMs`.'
+                  required: [reason, event, groupIndex, totalMs, path]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [budget_exceeded] }
+                    event: { type: string }
+                    groupIndex: { type: integer }
+                    totalMs: { type: integer }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                - type: object
+                  description: 'matcher: the regex does not compile (`path` absent on server 7.126.0–7.131.x).'
+                  required: [reason, event, groupIndex]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [invalid_regex] }
+                    event: { type: string }
+                    groupIndex: { type: integer }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                - type: object
+                  description: 'the config reader''s classifier code verbatim (server >= 7.132.0; SDK `SETTINGS_HOOKS_PIECE_CODES`), `key` = the key that broke that piece when named.'
+                  required: [reason, path]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [guard-outside-hooks, hooks-is-matcher, guard-under-unknown-event, guard-event-not-array, guard-matcher-invalid, guard-entry-invalid, hooks-not-object, unknown-event, event-not-array, matcher-invalid, entry-invalid] }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                    key: { type: string }
+                - type: object
+                  description: 'an entry type this service does not execute (server >= 7.132.0).'
+                  required: [reason, path, type]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [unsupported_entry_type] }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                    type: { type: string }
+                - type: object
+                  description: 'a service cap (server >= 7.132.0).'
+                  required: [reason, path, count, cap]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [over_cap, too_long] }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                    count: { type: integer }
+                    cap: { type: integer }
+                - type: object
+                  description: 'the classifier refused without naming a piece — contract drift, fail-closed (server >= 7.132.0).'
+                  required: [reason, path]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [unnamed_refusal] }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                - type: object
+                  description: 'server 7.115.0–7.125.x: the dead-alias matcher refusal before `reason` existed.'
+                  required: [event, alias, canonical]
+                  additionalProperties: false
+                  properties:
+                    event: { type: string }
+                    alias: { type: string }
+                    canonical: { type: string }
+            - type: object
+              description: '400 `config.user_attachment_invalid` (server >= 7.132.0): the field the engine names; `index` only when one attachment is named.'
+              required: [path]
               additionalProperties: false
               properties:
-                event: { type: string }
-                alias: { type: string }
-                canonical: { type: string }
+                path: { type: string }
+                index: { type: integer }
             - type: object
               required: [scenario, source]
               additionalProperties: false
@@ -14820,13 +15030,20 @@ components:
             - type: string
         count:
           type: integer
-          description: 'S-904 `reason: over_cap` only — how many entries the bucket had (server >= 7.106.0). SDK: `err.extra.count`.'
+          description: '`reason: over_cap` / `too_long` only — how much was sent (entries / characters; S-904 since server >= 7.106.0, every capped face since >= 7.132.0). SDK: `err.extra.count`.'
         cap:
           type: integer
-          description: 'S-904 `reason: over_cap` only — the bucket cap (1000). SDK: `err.extra.cap`.'
+          description: '`reason: over_cap` / `too_long` only — the cap (1000 for a permissions bucket; per face otherwise). SDK: `err.extra.cap`.'
         index:
           type: integer
-          description: 'S-904 `reason: bad_entry` only — the index of the first bad item; ABSENT when the bucket itself is not an array. SDK: `err.extra.index`.'
+          description: '`reason: bad_entry` only — the index of the first bad item; ABSENT when the list itself is not an array. SDK: `err.extra.index`.'
+        wallSource:
+          type: string
+          description: >-
+            server >= 7.132.0, on a 413 refused against the database's limits — WHERE THE WALL'S NUMBER CAME FROM. On `request.payload_too_large` (a submit body over
+            the database's single-row / packet wall): `reported` (the database's own number) / `assumed` (not reported — engine facts not established yet, or that
+            wall's read failed and fell back to the documented default; refusing conservatively). On `blob_too_large_for_sql` (`PUT /v1/sessions/{id}/sync/blobs/{hash}`):
+            `operator` (the operator's `SNAPSHOT_BLOB_SQL_MAX_BYTES`) / `reported` / `assumed`. Two closed sets, one per face (SDK `SqlWallSource` / `BlobSqlCapSource`).
         blockedBy:
           type: string
           description: >-
@@ -14837,11 +15054,19 @@ components:
             `ResumeBlockedByPolicyError.blockedBy` (`undefined` when the key is absent or not a string — never defaulted).
             server >= 7.117.0 adds a third fold source: a stored skill `disallowedTools` entry the engine now reads as nothing (the submit leg's 400 `request.field_invalid` sentence)
             ⇒ `blockedBy: "request.field_invalid"`, refused before the claim; the terminal-run steer leg answers it before minting the wake card.
+            server >= 7.132.0 / core 7.52.0: also on an ENGINE-refused resume (the five resume legs, the PARKED redemption seat and the SLA deny sweep share one body):
+            the engine's `detail.code` passes through as `blockedBy` (today only `checkpoint.config_refused` carries it — the closed set is core's
+            `CHECKPOINT_CONFIG_REFUSAL_CODES`, 40 words since core 7.53.0; read it as "the errorCode a fresh run would report for the same bad configuration"),
+            next to `field` and `reason`, absent keys not minted (SDK `ResumeRefusalExtra`).
 
     ResumeLegConflictError:
       description: >
         The 409 body of a RESUME LEG that core refused BEFORE the claim (`POST /v1/approvals/{sessionId}/decide`,
-        `POST /v1/sessions/{sessionId}/wake`): `ErrorResponse` plus the one key those 409s may add, `retriable`. The key is declared HERE and
+        `POST /v1/sessions/{sessionId}/wake`): `ErrorResponse` plus the one key those 409s may add, `retriable`. server >= 7.132.0: ONE writer and one
+        rule — on the three kinds of resume refusal (the server's own stored-body replay refusal, the admission-policy fold `resume_blocked_by_policy`, an
+        engine-refused resume) `retriable: true` is present <=> a pending card is still waiting and the run row stays `suspended`; so `resume_blocked_by_policy`
+        now carries it too, and the terminal-run `POST /v1/runs/{id}/steer` refusal before a wake card is minted carries none (the `checkpoint.unsupported_version`
+        allow-reading / mode-reading arms used to claim `true` there). The key is declared HERE and
         not on the shared `ErrorResponse` on purpose (codex r1 [medium], sdk 16.0.0): `ErrorResponse` is the body of every error
         response in this document, and declaring `retriable` there would offer a retry signal on 401 / 404 / 422 / 5xx bodies where the
         server never mints it. (`ErrorResponse` stays open, so a validator cannot REJECT the key elsewhere; the confinement is that only
@@ -14920,6 +15145,8 @@ components:
         - $ref: '#/components/schemas/Event_message_committed'
         # [2373]A-2(2026-08-03,server 5.0.0):compaction_outcome 三腿同源批的 spec 半场(SDK 臂 20867e1 同批)。
         - $ref: '#/components/schemas/Event_compaction_outcome'
+        # server 7.132.0(core 7.53.0 #2008):压缩开始帧,与 compaction_outcome 同一族的三腿同源白名单构造器。
+        - $ref: '#/components/schemas/Event_compaction_started'
         # [2400] ch2(SDK 4.2.0):CB-1 流控帽帧 + TR-7 durable 五臂 —— 两侧同缺,见各 schema 处的注。
         - $ref: '#/components/schemas/Event_error'
         - $ref: '#/components/schemas/Event_question'
@@ -14990,6 +15217,7 @@ components:
           needs_review: '#/components/schemas/Event_needs_review'
           message_committed: '#/components/schemas/Event_message_committed'
           compaction_outcome: '#/components/schemas/Event_compaction_outcome'
+          compaction_started: '#/components/schemas/Event_compaction_started'
           error: '#/components/schemas/Event_error'
           question: '#/components/schemas/Event_question'
           question_complete: '#/components/schemas/Event_question_complete'
@@ -15936,6 +16164,9 @@ components:
             summaryMs: { type: integer }
             persistMs: { type: integer }
             ptlRetries: { type: integer }
+        pass:
+          type: string
+          description: 'server >= 7.132.0 (core 7.53.0 #2008): the id of the compaction pass that LANDED — the same opaque value its `compaction_started.pass` carried. Pair the start with its end on `pass`, not on "the next `compacted`" (legs interleave on one stream). Absent = an older server / a pass that never announced a start.'
     Event_suggestions:
       type: object
       description: >
@@ -15969,7 +16200,7 @@ components:
         type: { const: status }
         # 🔴 A-057.27:6 员(此前只列 4,漏 recovered/gave_up 两个**终局**值 —— 一段重试序列恒恰一终局帧,
         # 两者对渲染方是同一句话「把重试行撤下来」)。闭集声明、开集读。
-        phase: { type: string, description: "rate_limited | retrying | reconnecting | circuit_open | recovered | gave_up (closed in core, read as open set)" }
+        phase: { type: string, description: "rate_limited | retrying | reconnecting | circuit_open | recovered | gave_up | waiting_first_token (core's seven words since core 7.3.1 — `waiting_first_token` observes a first-token wait before any failure and carries `elapsedMs` / `timeoutMs`, never a retry countdown; closed in core, read as open set)" }
         detail: { type: string, description: "neutral human hint (NO provider/HTTP detail)" }
         retryInSec: { type: number }
         # 🔴 A-057.26:以下四键 server 真在发(builder brainStatusEventData,三腿共享),而本 schema 是
@@ -15978,7 +16209,7 @@ components:
         attempt: { type: number, description: "1-based index of the attempt that just FAILED (this wait precedes attempt+1)" }
         maxRetries: { type: number, description: "retry budget of the lane in force (refused-connect short lane = 2)" }
         retryInMs: { type: number, description: "same number as retryInSec at ms precision (countdown rendering)" }
-        errClass: { type: string, description: "connect_refused | transport | rate_limit | server | http | output_cap — retry-wait frames ONLY; never inferred from phase" }
+        errClass: { type: string, description: "connect_refused | transport | stall | rate_limit | server | http | output_cap (core's seven words since core 7.14.0 — `stall` = this process's own stall watchdog cancelled the request) — retry-wait frames ONLY; never inferred from phase" }
         providerCondition: { type: string, description: "server >= 7.126.0 (core 7.49.0 #1454, passed through verbatim): what the provider said about the account / capacity — core's closed `PROVIDER_CONDITIONS`; a retry frame carries only the three retryable words `throttled | overloaded | unknown` (`quota_exhausted` / `stop_other` do not retry and ride the terminal `detail.providerCondition`). Presence law as `errorStatus`; read as an OPEN set (keep a default arm). ABSENT = not judged, read the same as `unknown` (back off, do not assert quota). Moves with `providerConditionSource`." }
         providerConditionSource: { type: string, description: "server >= 7.126.0 (core 7.49.0 #1454): the evidence the `providerCondition` verdict rests on — `unified_header | provider_code | status`; present exactly when `providerCondition` is; read as an OPEN set." }
         retryAtMs: { type: number, description: "server >= 7.52.0 (core 7.0.0): the WALL-CLOCK end of the wait = `Date.now() + retryInMs` at emit, on the emitting process's clock (not monotonic — never compare it with a local monotonic timer). `retryInMs` stays the authoritative RELATIVE amount; this is the producer's absolute note (a reader several hops away recomputing it would reset the countdown on every replay). Moves with `retryInMs`; absent ⇒ not minted." }
@@ -16101,9 +16332,12 @@ components:
         `message_committed` + stream order). Live emissions PRECEDE the commit and omit `entryId`.
         SERVICE PROJECTION: core's `principal` is deliberately NOT forwarded (the stream is already owner-scoped —
         the frame does not restate the tenant). `issuer` / `actor.id` / `actor.issuer` are host-derived identity
-        strings and arrive SECRET-REDACTED. Server >= 7.127.0 does NOT project core 7.50.0's `attachments` member (always absent here)
-        and does not accept the engine's request-layer `userAttachments` key: a submit / resume body carrying it is 400
-        `request.body_shape` (named in `unknownKeys`).
+        strings and arrive SECRET-REDACTED. REQUEST-LAYER ATTACHMENTS (server >= 7.131.0 / core 7.50.0): the frame of the objective that declared
+        attachments (`carrier: "objective"`, `delivery: "applied"`) carries `attachments` — one item per attachment, in declared order (submit key
+        `TaskRequest.userAttachments`; probe `Capabilities.userAttachments`). It is the ADMISSION outcome, not delivery: each attachment's message lands as its
+        own `message_committed{role:"user"}`. Attachments ride the objective only: a steer door (run / child / workflow child steer, child resume, interrupt
+        bare or with text) carrying `userAttachments` is 400 `request.body_shape` (named in `unsupportedKeys`), and resume / delivery legs do not rebuild it.
+        (7.127.0 – 7.130.x did not accept `userAttachments` and never carried `attachments`; the capability bit is absent there.)
       allOf: [{ $ref: '#/components/schemas/EventIdentity' }]
       additionalProperties: false   # 封闭 + identity 本地镜像:见 Event_reasoning 处的长注
       required: [type, inputId]
@@ -16134,6 +16368,23 @@ components:
             hostAsserted: { type: boolean }
             issuer: { type: string }
         entryId: { type: string, description: 'The committed session entry this input became (absent on the live pre-commit emission).' }
+        attachments:
+          type: array
+          description: >-
+            server >= 7.131.0 (core 7.50.0): the per-attachment ADMISSION outcome of the request-layer attachments this objective declared, one item per
+            attachment in declared order; present only on that objective's frame. The server copies each member key only when well-formed (a non-object member is
+            not minted); `ordinal` / `outcome` / `label` are required members of the engine's `HumanInputAttachment` (core 7.53.0), hence `required` here. `ordinal` 1-based; `kind` the engine-recognized kind (absent when unreadable; read open); `outcome` `attached` / `partial` / `unchanged` /
+            `not_attached` (engine words, verbatim — a file the engine may not read is NOT refused: its message still goes out saying why, and its outcome is
+            `not_attached`); `label` the path or name the caller declared, credential-redacted.
+          items:
+            type: object
+            required: [ordinal, outcome, label]
+            additionalProperties: false
+            properties:
+              ordinal: { type: integer }
+              kind: { type: string }
+              outcome: { type: string }
+              label: { type: string }
         eventId: { type: string }
         parentToolCallId: { type: string }
         sourceTaskId: { type: string }
@@ -16313,19 +16564,22 @@ components:
             already owns the single redaction mint point for it). The actionable cause is `errorCode`.
             A row missing `name` or `status` is dropped individually — the other servers'' rows still ship.
           items: { $ref: '#/components/schemas/WiringManifestMcpEntry' }
-        hooks:
+        mods:
           type: array
           description: >
-            core 7.18.0 (#789), server >= 7.78.0 — TENANT-visible: the hook seats THIS leg wired, one row per
-            family, in core's declaration order. EFFECTIVE half only.
-            🔴 PRESENT IFF at least one seat is wired — core NEVER emits an empty array, so "the key is here"
-            means non-empty. 🔴 ABSENCE READS "this leg wired no hook RECORD of its own", NOT "no hook runs":
-            a delegated child with no local record can still be screened (and refused) by an ANCESTOR's
-            `preToolUse` through the gate's constraint fold, which this face deliberately does not call a hook
-            of this leg. A row missing `family` or `owner` is dropped INDIVIDUALLY (same rule as `mcp[]`); all
-            rows dropped => the key is absent. 🔴 EXCLUDED from `configFingerprint` (the record is a per-task
-            seat), so two legs with the same fingerprint and different `hooks[]` are NOT in contradiction.
-          items: { $ref: '#/components/schemas/WiringManifestHookEntry' }
+            core 7.52.0, server >= 7.132.0 (BREAKING — replaces `hooks[]`, which is gone with no alias) — TENANT-visible: this leg's MODS ADMISSION record, one row
+            per registration of the two seats (deployment, task), in the engine's run order (tier, then deployment before task, then seat order). Two row forms
+            (`WiringManifestModEntry`): a MOUNTED registration `{ name, seat, tier, events, observe?, skipped? }` — `events` / `observe` are the patterns it actually
+            hung (observe-only ones in `observe`), `skipped[]` the judges skipped while it was judged — or a REFUSED one `{ name, seat, tier, refusedBy, reason }`.
+            Registrant strings (`name`, `refusedBy`, `reason`, every `skipped[]` member) go out through the server's one wire-text exit (credential shapes
+            replaced, length-capped) — the same one the `engine_notice` `mods.registration_refused` detail uses, so the same refusal reads byte-equal on both;
+            `seat` / `tier` / `events` / `observe` are engine words passed through verbatim (vocabulary owner core; read open). PRESENT IFF the leg carries a
+            registration — on this server always (it mounts the permission-denied meter on every leg: `server.permission-denied-meter`; `TOOL_TRACE=true` adds
+            `server.tool-trace`, a branded deployment `server.brand-identity`; a single-user request's `settings.hooks` is the task-seat registration
+            `settings.hooks`). 🔴 ABSENCE READS "this leg carries no registration", NOT "no extension judges this leg's calls" (a delegated child can still be
+            screened through an ancestor's chain). A row that reads as neither form is dropped individually; all dropped => key absent. EXCLUDED from
+            `configFingerprint` (the task seat is per task). EFFECTIVE half only.
+          items: { $ref: '#/components/schemas/WiringManifestModEntry' }
         lsp:
           allOf: [{ $ref: '#/components/schemas/WiringManifestLspSeam' }]
           description: >
@@ -16722,6 +16976,26 @@ components:
         was armed but declined/failed (check the store, check authorisation), `false` = there was no lane at all
         (wire one up). The two recovery verbs differ, so a consumer MUST render them apart — NEVER fold them into
         one "nobody approved it".
+        server 7.132.0 adds three codes to the user whitelist (appendix D.3 38 -> 41; all audience `user` in core's register) and changes one value:
+        `config.session_rules_earlier_grammar` (core 7.53.0) — the session's STORED permission rules hold entries the grammar they were written in reads as nothing
+        (an allow entry admits nothing; a `toolDeny` entry this engine reads as no rule makes those rules REFUSE EVERY CALL until an operator rewrites the row
+        without its rev). `{ bucket, storedGrammar, entries: [{ entry, reader }], rewrite: { by, stampsGrammar }, rulesSessionId, sessionId }` — `entries` every
+        one the engine handed over (the session-stream row passes the generic notice-detail bound: at most the first 32, no truncation mark — the full list is on
+        the ops log line), `entry` the redacted rule text (the same reading as `permission.allowed_tool_not_granted`'s `entries[].entry`), `reader` one of
+        `no_rule` / `named_no_tool`, `rewrite.by` = `operator_write_without_rev` (closed words owned by core, echoed — read open); `rulesSessionId` = whose
+        rules (an ancestor's on a delegated child), `sessionId` = the run that read them. Once per distinct entry set per bucket per rule layer.
+        `mods.registration_refused` (core 7.52.0) — an extension registration was NOT mounted (another registration's `plugin.register` judge refused it); the leg
+        runs without it. `{ name, seat, tier, refusedBy, reason, sessionId }` — `seat` / `tier` engine words (echoed), `reason` the refusing registration's own
+        words (UNTRUSTED-for-display); the same strings read byte-equal with the `wiring_manifest.mods[]` refused row. Unreachable on this server today (it wires
+        no `plugin.register` judge). Once per leg per registration.
+        `route.credential_origin_mismatch` (core 7.52.0) — a request was REFUSED and nothing was sent: this model's own credential is bound to the host it first
+        went to and this request goes to another (the entry's `baseUrl` moved host, the credential stayed; a same-host path move does not count). The request's
+        own failure carries the same code. `{ modelId, boundOrigin, requestOrigin, sessionId, runId }` — both origins in display spelling (scheme + host +
+        port, no userinfo / path), never a credential or a digest of one. Once per run per (modelId, boundOrigin, requestOrigin). It replaces the retired
+        operator code `route.base_url_changed_key_unchanged` (never on this whitelist). `config.credential_not_withheld` is operator-audience — ops log only.
+        Value change: `permission.rule_row_dropped`'s `detail.rows[].rule` is, since core 7.53.0, the rule's original text (the same reading as
+        `allowed_tool_not_granted`'s `entries[].entry`: at most 1 024 code points, longer cut to 1 024 + a truncation mark, CONTROL CHARACTERS RIDE AS DATA —
+        neutralize at render); before it was the engine-neutralized single-line form (at most 201 code points). Same keys.
         `server.model_unreachable` (server-minted, audience `user`; server >= 7.108.0, `taskId` added in server 7.121.0) — a model call on
         this leg ended in error and its last request failed AT CONNECT (VPN switched mid-session / the proxy read at boot went stale / the
         gateway is gone) — not the provider's answer. `{ code, targetHost, proxyInUse?, remedy, sessionId, taskId? }`: `code` one of the
@@ -16963,56 +17237,78 @@ components:
             一律按不可分辨处理,消费方不要猜。
 
     PromptManifest:
-      # 新增(2026-07-25 回填批):server ≥1.219 的 prompt-assembly manifest。此前本文件完全没有它(全文 0 次提及),
-      # 尽管它同时是 `AgentEvent.prompt_assembled` 臂和 trace 流 `prompt-assembled` 帧的载荷。
       type: object
       description: >
-        The prompt-assembly manifest (core's `prompt.assembled` trace contract verbatim). Carries ONLY
-        ids/digests/counts — NEVER prompt bodies (privacy boundary). 🔴 Hashes are PROCESS-SALTED: they are NOT
-        comparable across worker restarts, so a UI must never diff them cross-process. `constitution`/`blocks`/
-        `totalChars` are the v1 face; `sections`/`tools` are the v2 ADDITIVE face (absent on a v1-only engine).
-        ⚠️ One task can carry MULTIPLE manifests — a cascade/verify run re-prepares under one taskId and every
-        rung's manifest is persisted in emission order.
-      required: [constitution, blocks, totalChars]
+        The prompt manifest v3 (server >= 7.132.0 = engine 7.52.0 manifest v3; BREAKING): WHICH prompt this leg ran (`identity` + its selector values `selectors`),
+        which blocks and sections it is made of, and where each section's text came from (`chain`; superseded overlays in `superseded`). IDs / sizes / digests
+        only — NEVER prompt text. One row per prepare (cascade / verify re-prepare under one taskId, rows in order). Three exits carry the SAME stored row
+        verbatim: the ledger replay `prompt_assembled`, the turns `prompt-assembled` block, the trace SSE `prompt-assembled` frame. Members = the engine frame
+        minus its envelope (`kind` / `version` / `taskId` / `ts`) and `snapshot` / `lowering` (server `promptManifestRecordOf`).
+        READING: EVERY member may be absent — an optional member absent means "none", never an empty value; a member present but unreadable is not put on the
+        row (`identity` / `selectors` as whole sentences, sections / blocks / `superseded` / tools one row at a time), so a v3 row without `identity` means the
+        engine's identity did not read (dropped and counted), NOT an old row. An empty list is a statement (`tools: []` = zero tools). Words (band names,
+        activations, source classes, renderer ids, host role / form) are engine vocabulary, passed through verbatim — read open.
+        🔴 THE ONE READING OF "WHICH PROMPT DID THIS LEG RUN" IS `identity`. BREAKING (no alias): v2's top-level `constitution` is gone (the constitution band
+        is locked and engine-composed; a prompt carrying locked text verbatim is refused before the run, `prompt.assembled_role_refused`); `sections[]` lost
+        `slot` / `carrier` / `cadence` / `cacheClass`, `hash` became `contentHash` (`sha256:` unsalted for published text, `salted:` for text carrying the task's
+        or the run's own inputs) and gained `band` (always) / `variant?` / `renderer?` / `locale` / `chain`; the row gained `identity` / `selectors` / `superseded?`.
+        ⚠️ Rows written by <= 7.131.x keep the v2 shape (the server neither re-reads nor rewrites them) — see PromptManifestRow: a row carrying `constitution`
+        is such an old row. ⚠️ Block `hash` is a PROCESS-SALTED short digest — not comparable across worker restarts.
+      # 不封闭(`additionalProperties: true`):本 schema 是 `Event_prompt_assembled` 的 allOf 目标(帧上多一个 `type`),封闭会把合法帧判成违约(见 Event_reasoning 处的长注)。
+      # 与旧行的互斥由 `not: { required: [constitution] }` 一句写死(v3 行永不带它),`PromptManifestRow` 的 oneOf 因此恰中一臂。
       additionalProperties: true
+      not: { required: [constitution] }
       properties:
-        constitution:
-          type: string
-          description: 'who owned the constitution layer — `core` is the steady state; anything else is worth eyes.'
-          enum: [core, replaced, provider-assembled, legacy]
-          x-open-enum: true
+        identity: { $ref: '#/components/schemas/PromptManifestIdentity' }
+        selectors:
+          type: object
+          description: 'the run''s selector values (core `PromptManifestSelectors`) — the plain form of `identity.layers.binding`. `binding` = the scenario name (server >= 7.132.0 always writes `TaskSpec.promptBinding`).'
+          additionalProperties: false
+          required: [traits, host, facts]
+          properties:
+            binding: { type: string }
+            traits: { type: array, items: { type: string } }
+            host:
+              type: object
+              additionalProperties: false
+              required: [role, form]
+              properties:
+                role: { type: string, description: 'engine word (`general` / `code` / `coordinator` / `cowork` today); read open.' }
+                form: { type: string, description: 'engine word (`standard` / `minimal` today); read open.' }
+            facts: { type: object, additionalProperties: { type: boolean } }
         blocks:
           type: array
           items:
             type: object
+            additionalProperties: false
             required: [id, chars, hash]
-            additionalProperties: true
             properties:
               id: { type: string }
               chars: { type: integer }
-              hash: { type: string, description: 'process-salted digest — never compare across restarts.' }
+              hash: { type: string, description: 'process-salted short digest — never compare across restarts.' }
         sections:
           type: array
-          description: 'v2 additive face — absent on a v1-only engine.'
+          items: { $ref: '#/components/schemas/PromptManifestSection' }
+        superseded:
+          type: array
+          description: 'every overlay the composition superseded (a later one on the same target won, or it changed nothing this run); absent when none was.'
           items:
             type: object
-            required: [id, slot, carrier, cadence, cacheClass, chars, hash]
-            additionalProperties: true
+            additionalProperties: false
+            required: [id, source, by, target, supersededBy]
             properties:
               id: { type: string }
-              slot: { type: string }
-              carrier: { type: string }
-              cadence: { type: string }
-              cacheClass: { type: string }
-              chars: { type: integer }
-              hash: { type: string }
+              source: { type: string }
+              by: { type: string }
+              target: { type: string }
+              supersededBy: { type: string, description: 'the winning overlay id, or the literal `(absent this run)`.' }
         tools:
           type: array
-          description: 'v2 additive face — the tool contract summary.'
+          description: 'the mounted tools plane — per-tool contract identity, durable-replay aliases, shape digest and full wire-schema digest (initial mount face; deferred activations announce via tools_delta).'
           items:
             type: object
+            additionalProperties: false
             required: [wireName, aliases, contractId, implementationRevision, cardId, shapeDigest, wireSchemaDigest]
-            additionalProperties: true
             properties:
               wireName: { type: string }
               aliases: { type: array, items: { type: string } }
@@ -17021,7 +17317,72 @@ components:
               cardId: { type: string }
               shapeDigest: { type: string }
               wireSchemaDigest: { type: string }
+        toolDisclosure:
+          type: object
+          description: 'the resolved deferred-tool disclosure strategy (core `ToolDisclosureManifest`); absent when the leg deferred nothing.'
+          additionalProperties: false
+          required: [deferredTools, strategy, source]
+          properties:
+            deferredTools: { type: integer }
+            strategy: { type: string, description: '`swap` / `static`; read open.' }
+            source: { type: string, description: '`spec` / `env` / `default` / `degraded_no_direct_lane`; read open.' }
         totalChars: { type: integer }
+    PromptManifestIdentity:
+      type: object
+      description: 'the run''s prompt identity as the manifest reports it (core `PromptManifestIdentity`): `artifact` = the identity digest, `layers` = its inputs, `epoch` / `activatedBy` = the session epoch record that names it.'
+      additionalProperties: false
+      required: [artifact, layers, epoch, activatedBy]
+      properties:
+        artifact: { type: string }
+        layers: { $ref: '#/components/schemas/PromptIdentityLayers' }
+        epoch: { type: integer }
+        activatedBy: { type: string, description: 'core `PROMPT_EPOCH_ACTIVATIONS` word; read open.' }
+    PromptManifestSection:
+      type: object
+      description: 'one rendered section (core `PromptManifestSection`).'
+      additionalProperties: false
+      required: [id, band, rank, chars, locale, contentHash, chain]
+      properties:
+        id: { type: string }
+        band: { type: string }
+        rank: { type: number }
+        variant: { type: string }
+        renderer:
+          type: object
+          additionalProperties: false
+          required: [id, version]
+          properties:
+            id: { type: string, description: 'core `RENDERER_IDS` word; read open.' }
+            version: { type: number }
+        chars: { type: integer }
+        locale: { type: string, description: '`canonical` (the catalog''s text) / `overlay` (text an overlay author wrote); read open.' }
+        contentHash: { type: string, description: '`sha256:<hex>` unsalted for published text, `salted:<hex>` for text carrying the task''s or the run''s own inputs.' }
+        chain:
+          type: array
+          items:
+            type: object
+            additionalProperties: false
+            required: [source]
+            properties:
+              source: { type: string, description: '`bundled` or an overlay source class; read open.' }
+              overlay: { type: string }
+              op: { type: string }
+              superseded: { const: true }
+    PromptManifestRetiredRow:
+      type: object
+      description: >
+        A `prompt_assembled` row written by a <= 7.131.x server (the v2 shape: top-level `constitution` + slot-keyed sections). The server neither re-reads nor
+        rewrites it, so a run parked before the upgrade and resumed after carries both shapes in its ledger. The ONE discriminator (owned by the server contract):
+        `constitution` present <=> an old row (old rows always carry it, v3 rows never do). Its members are deliberately NOT typed here (the v2 reading is retired).
+      required: [constitution]
+      additionalProperties: true
+      properties:
+        constitution: { type: string }
+    PromptManifestRow:
+      description: 'One row on the three manifest exits: a v3 row (PromptManifest) or an old row (PromptManifestRetiredRow) — tell them apart by the presence of `constitution`.'
+      oneOf:
+        - $ref: '#/components/schemas/PromptManifest'
+        - $ref: '#/components/schemas/PromptManifestRetiredRow'
 
     Event_file_link:
       type: object
@@ -17053,7 +17414,7 @@ components:
         manifest's own keys sit at the top level next to `type`, they are NOT nested under a `manifest` key).
         Lands AHEAD of the first event of the turn it prepared. ⚠️ MULTIPLE per task on cascade/verify runs.
       allOf:
-        - $ref: '#/components/schemas/PromptManifest'
+        - $ref: '#/components/schemas/PromptManifestRow'
       required: [type]
       properties:
         type: { const: prompt_assembled }
@@ -17304,15 +17665,16 @@ components:
             (no alias): the allow-layer members that MATCHED this call and could NOT clear this ask, one `{ member, entries, omitted? }` record per
             matching member (see AllowRuleShadow). `member` is one of `hook` / `deployment` / `persisted` / `skill` / `request`; `entries` are the
             entries that member matched, as their source spells them (UNTRUSTED for display like `message`, secret-redacted, <= 512 chars each,
-            <= 32 listed; a `hook` record's `entries` is always the empty list); `omitted` counts the entries not listed.
+            <= 32 listed; a `hook` record's `entries` names the answering registration — server >= 7.132.0 / engine 7.52.0 mods: on this server only the
+            request's own `settings.hooks` answers, so `["settings.hooks"]`; it was always the empty list on <= 7.131.x); `omitted` counts the entries not listed.
 
             The explaining sentence ("... matches this call but does not clear the ask — <reason>") is IN `message` (the engine writes it where it builds
             the card); this key is the structured twin of the same fact. Render a line from it ("your rule matched, but this call must be confirmed each
             time"): without it the only conclusion a user can draw is "my rule broke".
 
             🔴 ABSENT != "you have no rule": present only when a member matched AND could not clear the ask; a match that cleared never becomes an ask.
-            🔴 `member: "hook"` does not say whose hook (a deployment PreToolUse hook and, on the single-user lane, the request's own `settings.hooks`
-            share one member). 🔴 Deliberately SEPARATE from `governanceForced` (that one: "who imposed the gate"; this one: "what happened to YOUR
+            🔴 `member: "hook"` names the answering registration in `entries` (server >= 7.132.0; the deployment seat's registrations are observers and never
+            answer — on <= 7.131.x the record could not say whose hook). 🔴 Deliberately SEPARATE from `governanceForced` (that one: "who imposed the gate"; this one: "what happened to YOUR
             rule"). What the allow layer can NOT clear: any layer's deny / ask rule, operator `APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO` /
             `MANUAL_MODE_SHELL_GATE=always`, write protection, sensitive-path writes, governance, a hook's ask, plan-mode asks. The durable dual is
             `gate.riskDescriptor.allowRuleShadowed` on the parked row (PendingCheckpoint.riskDescriptor). Rolling-upgrade caveat: a card stored by a
@@ -17756,7 +18118,7 @@ components:
           items: { $ref: '#/components/schemas/AllowRuleShadow' }
           description: >
             ADDITIVE (server >= 7.117.0 / core 7.42.0, BREAKING RENAME of the retired `persistedRuleShadowed`): the allow-layer members that matched this
-            call and could not clear this ask. Semantics, the five members, the always-empty `hook` entries, the explaining sentence living in `message`,
+            call and could not clear this ask. Semantics, the five members, the `hook` record naming its registration (server >= 7.132.0; always empty before), the explaining sentence living in `message`,
             the ABSENT != "you have no rule" clause and the separation from `governanceForced` are stated verbatim on ToolApprovalFrame.allowRuleShadowed
             — the live frame, the stored `card_json`, the replayed frame and the `approval_request` card carry the SAME material.
         fromSubagent: { type: boolean, enum: [true], description: 'Present ⇔ the ask comes from a DELEGATED child — the explicit discriminator (a worker cannot forge it).' }
@@ -19067,6 +19429,31 @@ components:
         outcome: { type: string }
         trigger: { type: string, description: 'engine-shaped; current emitters send auto | manual | forced' }
         reason: { type: string }
+        pass:
+          type: string
+          description: >-
+            server >= 7.132.0 (core 7.53.0 #2008): the id of the pass this frame CONCLUDES (= its `compaction_started.pass`). PRESENT <=> that pass announced a start,
+            so only on `failed` / `mooted` (a pass that ran its summary and did not land, or was cut while it ran — `mooted` with `reason: "task_ending"` = the task's
+            own end cut the running summary, a form this frame closes since core 7.53.0). `blocked` / `suppressed` / `disabled` / `noop` and a manual request no
+            boundary served carry none (those passes never started).
+        eventId: { type: string }
+        parentToolCallId: { type: string }
+    Event_compaction_started:
+      type: object
+      description: >
+        server >= 7.132.0 (core 7.53.0 #2008) — a compaction pass is UNDER WAY: announced at the pass's commit point (trigger gate passed, a cut point exists,
+        `preCompact` did not block), BEFORE the summary call, so a summary waiting out a provider's retries is no longer silent on the stream. Projected verbatim by
+        ONE whitelist builder (server `compactionStartedEventData`) on the live stream and both durable ledgers (bg / resume; `GET /v1/runs/{id}/events`); the
+        §2.3 trace stream does not carry it. PAIRING: exactly one frame concludes the pass with the SAME `pass` — `compacted` when it lands,
+        `compaction_outcome` (`failed` / `mooted`) when it does not; "compacting" runs from this frame to that one (or the stream's end), elapsed = now − startedAt.
+        A segment boundary, like `compacted` / `compaction_outcome`. Servers <= 7.131.x never send it. Identity: the same TWO keys as `compaction_outcome`.
+      additionalProperties: false   # 封闭:铸造点 `compactionStartedEventData` 只投这三键 + 身份两键
+      required: [type, trigger, pass, startedAt]
+      properties:
+        type: { const: compaction_started }
+        trigger: { type: string, description: 'the same vocabulary (and the same value) as the frame that concludes the pass — engine-shaped, read open; today auto | manual | forced.' }
+        pass: { type: string, description: 'the pass identity: an opaque engine-minted id, unique across runs — pair on it alone.' }
+        startedAt: { type: integer, description: 'engine clock, epoch ms, at the moment the pass committed.' }
         eventId: { type: string }
         parentToolCallId: { type: string }
     Event_config_assembled:
@@ -19874,7 +20261,7 @@ components:
       description: >
         🔴 ONE RULE FOR EVERY "EFFECTIVE HALF ONLY" KEY (sdk 9.7.0, after a codex adversarial-review [high]):
         this schema's only consumer today is `GET /v1/diagnostics/wiring`'s `static` half, and every key marked
-        "effective half only" (`leg`, `ask.effective`, `configFingerprint`, `tools`, `hooks`, `lsp`,
+        "effective half only" (`leg`, `ask.effective`, `configFingerprint`, `tools`, `mods`, `lsp`,
         `modelGate`, `autoMode`, `writeProtection`, `readDeny`, `autoConsolidation`, `fileHistory`, `instructions`) is ALWAYS ABSENT on that
         wire ⇒ THEIR ABSENCE HERE CARRIES NO INFORMATION. The per-key absence readings ("absent = not armed",
         "absent = a third state", …) hold for the LIVE FRAME (`Event_wiring_manifest`) and must not be carried
@@ -20020,14 +20407,12 @@ components:
           properties:
             armed: { type: boolean }
             reason: { type: string }
-        hooks:
+        mods:
           type: array
           description: >
-            core 7.18.0 (#789), server >= 7.78.0 — the hook seats THIS leg wired, one row per family.
-            EFFECTIVE half only (the diagnostics endpoint's static half never carries it). Present iff at least
-            one seat is wired; absence means "no hook RECORD of this leg", never "no hook runs".
-            Full per-key contract: see Event_wiring_manifest.hooks.
-          items: { $ref: '#/components/schemas/WiringManifestHookEntry' }
+            core 7.52.0, server >= 7.132.0 (BREAKING — replaces `hooks[]`) — the leg's mods admission record, one row per registration. EFFECTIVE half only (the
+            diagnostics endpoint's static half never carries it). Full per-key contract: see Event_wiring_manifest.mods.
+          items: { $ref: '#/components/schemas/WiringManifestModEntry' }
         lsp:
           allOf: [{ $ref: '#/components/schemas/WiringManifestLspSeam' }]
           description: >
@@ -20136,33 +20521,52 @@ components:
           type: array
           description: 'The selected chain member(s), spelled as the chain spells them (relative to the cwd); `[]` = the chain was walked, nothing was selected.'
           items: { type: string, enum: ['CLAUDE.md', '.claude/CLAUDE.md', 'AGENTS.md', '.claude/AGENTS.md'] }
-    WiringManifestHookEntry:
-      # sdk 9.5.0:与 `WiringManifestMcpEntry` 同一条裁定 —— 同一份行形被 live 帧与静态诊断面两处引用,
-      # 内联就是两份会各自漂的镜像,所以一开始就具名。
+    WiringManifestModEntry:
+      # server 7.132.0 / core 7.52.0:取代钩子席位行形(删,零别名)。同一份行形被 live 帧与静态诊断面两处引用 ⇒ 具名;两形各自具名(⑤bis 名单逐形对账)。
+      description: >
+        One row of a leg's MODS ADMISSION record (core 7.52.0 `ModAdmissionRecord`; server >= 7.132.0): a registration that was mounted, or one that was refused.
+        Discriminate on presence — a mounted row carries `events`, a refused row carries `refusedBy` + `reason` (never both).
+      oneOf:
+        - $ref: '#/components/schemas/WiringManifestModMounted'
+        - $ref: '#/components/schemas/WiringManifestModRefused'
+    WiringManifestModMounted:
       type: object
       description: >
-        One row of a leg's HOOK seat manifest (core 7.18.0 #789): which family, where the seat came from, and
-        whether the `preToolUse` row was DECLARED observational.
+        A MOUNTED registration: the patterns it actually hung (`events`), the ones it declared observe-only (`observe`, present iff any), and the judges skipped while it
+        was judged (`skipped`, present iff non-empty — absence and an empty list are both "every judge answered").
       additionalProperties: false
-      required: [family, owner]
+      required: [name, seat, tier, events]
       properties:
-        family:
-          type: string
-          description: >
-            The hook family. core's closed vocabulary today (`preToolUse` / `postToolUse` / `userPromptSubmit` /
-            `stop` / `postToolUseFailure` / `postToolBatch` / `preCompact` / `postCompact` / `stopFailure` /
-            `permissionDenied`) but READ AS OPEN: the server passes it through verbatim and does not enumerate,
-            so a newly minted family must pass through your default arm.
-        owner:
-          type: string
-          description: "Where the seat came from — core's `SeamProvenance` (`spec` / `deps`). Closed today, read as open."
-        observational:
-          type: boolean
-          enum: [true]
-          description: >
-            Only on the `preToolUse` row, and only when the deployment DECLARED the face observational: it still
-            runs on every call but is not folded into a delegated child's inherited constraints.
-            🔴 NEVER-FALSE — core's words: "Absence means 'not declared', never 'declared false'".
+        name: { type: string, description: 'the registration name (registrant text, through the server''s wire-text exit; UNTRUSTED-for-display).' }
+        seat: { type: string, description: 'which seat it came from — core `MOD_SEATS` (`deployment` / `task`). Engine word, passed through verbatim; read open.' }
+        tier: { type: string, description: 'its tier — core `MOD_TIERS` (`prepend` / `user` / `append` / `builtin` / `core`). Engine word, passed through verbatim; read open.' }
+        events: { type: array, items: { type: string }, description: 'the event patterns it actually hung (engine words, verbatim).' }
+        observe: { type: array, items: { type: string }, description: 'the patterns it hung observe-only (engine words, verbatim); absent = none.' }
+        skipped:
+          type: array
+          description: 'judges the dispatch skipped while this registration was judged (core `ModSkip`); present iff non-empty. An element missing a member is dropped individually.'
+          items:
+            type: object
+            additionalProperties: false
+            required: [registration, cause, reason]
+            properties:
+              registration: { type: string, description: 'the skipped judge''s registration name (registrant text).' }
+              cause: { type: string, description: 'why it did not answer for itself — core `MOD_FAILURE_CAUSES` today (`threw` / `timeout` / `violation` / `reentry`); read open.' }
+              reason: { type: string, description: 'the judge''s own words (registrant text, UNTRUSTED-for-display).' }
+    WiringManifestModRefused:
+      type: object
+      description: >
+        A REFUSED registration: another registration's `plugin.register` judge refused it at admission; the leg runs without it. The same refusal also reaches
+        the stream as the `engine_notice` `mods.registration_refused` (its `detail` strings read byte-equal with this row's). This deployment wires no
+        `plugin.register` judge, so it cannot happen here today.
+      additionalProperties: false
+      required: [name, seat, tier, refusedBy, reason]
+      properties:
+        name: { type: string, description: 'the refused registration (registrant text).' }
+        seat: { type: string, description: 'core `MOD_SEATS` word, verbatim; read open.' }
+        tier: { type: string, description: 'core `MOD_TIERS` word, verbatim; read open.' }
+        refusedBy: { type: string, description: 'the registration whose judge refused it (registrant text).' }
+        reason: { type: string, description: 'the refusing judge''s own words (registrant text, UNTRUSTED-for-display).' }
     WiringManifestLspSeam:
       # sdk 9.5.0:同上 —— live 帧与静态面共用一份段形。
       type: object
@@ -20339,7 +20743,9 @@ components:
           description: >
             server >= 7.60 (S-131) — this deployment's SQL engine posture (engine / version / session isolation
             level / TiDB transaction mode), READ BACK off a live connection rather than echoed from env.
-            `null` = no SQL backend. NOT YET MIRRORED KEY-BY-KEY in this SDK generation — read as opaque.
+            `null` = no SQL backend. server >= 7.132.0 adds three keys (additive): `maxRowBytes` / `maxPacketBytes` (the database's single-row / packet
+            wall; `null` = that wall does not exist) and `wallSources` (each wall's provenance, `reported` / `assumed` — what a 413 body's `wallSource` reads).
+            NOT YET MIRRORED KEY-BY-KEY in this SDK generation — read as opaque.
         configApply:
           type: ["object", "null"]
           additionalProperties: true