@sema-agent/sdk 23.1.0 → 25.0.0

package/openapi.yaml

@@ -423,7 +423,7 @@ paths:
         prepare-time refusal code that HAS a status in the server's per-code triage table (`resume_at.*` — `resume_at.not_found` is 404, the rest 422 —, governance codes,
         `rewind.store_unconfigured` / `rewind.capture_disabled` / `rewind.child_scope_unsupported` / `rewind_snapshot.unresolvable`, the
         registered `config.*` codes incl. the three roster-bound ones and — server >= 7.116.0 — `config.invalid_checkpoint_store` (400) and
-        `config.user_invoked_skill_unknown` (400: top-level `userInvokedSkills` named a skill this run does not carry) and — server >= 7.117.0 — `config.image_invalid` (400: an inline image failed the engine's byte admission; `error` starts with `TaskSpec.images: `) and — server >= 7.126.0 — `config.tool_face_control` (400: `allowTools: ["mcp__*"]`, `excludeTools: ["*"]` (and, on server 7.126.0–7.128.x only, a name in `allowTools` / `excludeTools` that no tool of this run answers to — server >= 7.129.0 runs those as written and announces each once with the operator row `runner_config_advisory`), or an `excludeTools` entry that reaches a protocol tool this leg depends on; the engine rejects before the run starts, never silently ignoring the name; `error` is the engine's sentence naming the entry, its list and why), `corrupt_session`; codes outside the table, e.g. `rewind.invalid_spec`, stay
+        `config.user_invoked_skill_unknown` (400: top-level `userInvokedSkills` named a skill this run does not carry) and — server >= 7.117.0 — `config.image_invalid` (400: an inline image failed the engine's byte admission; `error` starts with `TaskSpec.images: `) and — server >= 7.126.0 — `config.tool_face_control` (400: `allowTools: ["mcp__*"]`, `excludeTools: ["*"]` (and, on server 7.126.0–7.128.x only, a name in `allowTools` / `excludeTools` that no tool of this run answers to — server >= 7.129.0 runs those as written and announces each once with the operator row `runner_config_advisory`), or an `excludeTools` entry that reaches a protocol tool this leg depends on; the engine rejects before the run starts, never silently ignoring the name; `error` is the engine's sentence naming the entry, its list and why) and — server >= 7.132.0, BREAKING (200 + failed body before) — `config.agent.unknown_tool` (400: a delegated agent's `allowTools` names a near-miss / a retired name with a successor / an impossible spelling, judged by the engine before the run; the intake refusal of `agents[i].denyTools` entries that read as nothing has answered this 400 since 7.131.0) and `config.legacy_tool_name` (400: a stored session-rule row names a tool the engine reads as nothing) and `prompt.assembled_role_refused` (400: `systemPrompt` / `appendSystemPrompt` — `settings.outputStyle` folded in — carries the engine's locked prompt text verbatim; send role text only) and — server >= 7.131.0 — `config.user_attachment_invalid` (400; server >= 7.132.0 the body adds `detail: { path, index? }`), `corrupt_session`; these registered codes answer 400 on all three submit legs without spending the `Idempotency-Key` (async / live legs: 2xx with the same code on the terminal run row); codes outside the table, e.g. `rewind.invalid_spec`, stay
         200 with a failed body) answers its 4xx / 5xx ERROR BODY only when the whole submission did ZERO WORK (cumulative
         `stats.turns === 0` AND `stats.tokens === 0` — the common case: nothing billed, not idempotency-cached). When a
         `verify` / `cascade` run's earlier tier already ran turns and only the last tier is refused, the SAME code arrives
@@ -3424,7 +3424,7 @@ paths:
         `synced` (and `synced.count` still counts ONLY the durable queue).
         🔴 THE TWO WORDS DELIBERATELY DO NOT REUSE `pending`/`resolved`: those are keyed by
         `(sessionId, toolCallId)` and decided at `POST /v1/approvals/{sessionId}/decide`, while a live row is
-        keyed by `approvalId` and decided at `POST /v1/tool-approvals/{approvalId}/respond`. Sharing one word
+        keyed by `approvalId` and decided at `POST /v1/tool-approvals/{id}/respond`. Sharing one word
         would eventually send a live card to the decide door — a 404 with no wire evidence of the mistake.
         ⚠️ Both live words come from an IN-PROCESS window projection, so their cross-replica reach is exactly
         that of `GET /v1/approvals`'s `livePending` — narrower than the durable pair above. The deployment
@@ -4393,6 +4393,38 @@ paths:
         '404': { description: no pending question for this id (non-owner, answered, expired, or wrong replica) — no existence oracle. }
         '501': { description: AskUserQuestion is not enabled on this worker (ASK_QUESTION_ENABLED). }
 
+  /v1/tool-approvals/{id}:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+      - { name: id, in: path, required: true, schema: { type: string }, description: 'The ask''s `approvalId` (server >= 7.133.0 always equal to its `askId`; an opaque string).' }
+    get:
+      tags: [questions]
+      operationId: toolApprovalRead
+      x-status: live             # server >= 7.133.0; SDK toolApprovals.get consumes it
+      summary: Read ONE live-card ask — where is it now (pending, decided, parked or void)? Pure read.
+      description: >
+        server >= 7.133.0 — the by-ask read door. Same root and same gate as POST /v1/tool-approvals/{id}/respond (one `gatedPrincipal`; an owner-gate miss answers the SAME 404 as an unknown
+        id — no existence oracle), and the state is read the way the answer door reads it: a live registration on THIS replica waiting for the ask => `pending` (the body is the `livePending[]` row projection +
+        `state`); otherwise the row is read by id: `DECIDED` => `decided`, `PARKING` / `PARKED` => `parked`, `DENIED` / `VOID` => `void`. A row still `STREAM_PENDING` with no local registration lives on
+        another replica => 404 `tool_approval.not_pending` + `cause: "unknown_or_other_replica"` (the same answer as a late respond); a deployment with no ask ledger answers the same 404 WITHOUT `cause`.
+        Pure read: zero writes, no settlement, the local registration is untouched. Use it to ask "is this card still alive / was it decided by anyone" instead of inferring it from a respond 404.
+        An older server (<= 7.132.x) has no such door: routing-level 404 `not_found.route` — tell it apart from this door's 404 by `errorCode`, never by status.
+      responses:
+        '200':
+          description: The ask's current state.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ToolApprovalReadBody' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '404':
+          description: >
+            `tool_approval.not_pending` — unknown / not yours (byte-identical) / still pending on another replica (`cause: unknown_or_other_replica`). Past the owner gate the body may carry the additive `cause`
+            (see ToolApprovalNotPendingCause); no ask ledger => no `cause`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ToolApprovalNotPendingBody' }
+        '501': { description: 'Live tool-approval HITL not enabled (TOOL_APPROVAL_ENABLED) — `feature.tool_approval_disabled`.' }
+
   /v1/tool-approvals/{id}/respond:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -5799,6 +5831,70 @@ paths:
         '403': { description: 'Multi-tenant worker: outcomes view is operator-only.' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
+  /v1/config/catalog:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+    get:
+      tags: [admin]
+      operationId: configCatalog
+      x-status: live             # operator lane (capabilities.configCatalog); SDK configCatalog.get consumes it
+      summary: Deployment configuration catalog — every env knob's declaration and this process's effective reading (operator-only).
+      description: >
+        The deployment's configuration catalog (operator lane; probe `capabilities.configCatalog` first). One row per env knob: its declared semantics, which lanes can write it, which lane is in force, the
+        process's effective DISPLAY value and the centre seat (`center`) when the knob is centre-publishable; plus the `retired` tombstone list (env names this process refuses to start on). `Cache-Control: no-store`.
+        Gate: `OPERATOR_PRINCIPALS` — outside the list 403 `auth.operator_only`; empty list on a multi-tenant deployment 501 `capability.operator_principals_required`; `CONFIG_CATALOG_ENABLED=false` 501
+        `feature.config_catalog_disabled`. A server older than 7.53 has no such route (404).
+        `effectiveValue` is a DISPLAY value, never the raw env: `secret` / `opaque` rows report only `{ present, length? }`, a `url` row goes through the display mint (userinfo landed, query values become
+        tokens). Two VERDICT bits on a row are true-only (never `false`; ABSENT = this cell has no such matter): `effectiveValueInvalid` (the effective value falls outside the row's own echo set; `effectiveValue` is then
+        `null`) and, server >= 7.133.0, `effectiveValueWithheld` (a `url` row whose display mint WITHHELD a part — a credential-shaped piece in a query / path segment — so the shown value is not the whole value).
+      responses:
+        '200':
+          description: The catalog.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ConfigCatalog' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '403': { description: 'The caller is not in OPERATOR_PRINCIPALS (`auth.operator_only`).' }
+        '501': { $ref: '#/components/responses/NotImplemented' }
+
+  /v1/principal-inbox/messages:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+    post:
+      tags: [admin]
+      operationId: principalInboxSend
+      x-status: live             # server >= 7.133.0; SDK principalInbox.send consumes it
+      summary: Deliver one letter to another principal's inbox in the same organization (cross-principal delivery; default OFF).
+      description: >
+        server >= 7.133.0 — one letter is appended to the recipient principal's `principal.inbox` ONLY by the organization delivery gate: membership judgement -> mint -> inbox bound -> quota -> append, all inside one gate that answers
+        with a receipt or one of four refusal codes. The SENDER is always your verified identity (`from` is not a body key: sending `from` or any unknown key => 400 `request.body_shape` + `unknownKeys`). DEFAULT OFF: without env
+        `PRINCIPAL_INBOX_ASSISTANT` the route answers 501 `capability.unavailable` (no delivery gate is mounted) — probe `capabilities.principalInboxDelivery` (true <=> this door works). THIS VERSION SHIPS THE DELIVERY HALF ONLY:
+        a delivered letter sits in the recipient's box (at most 50 unconfirmed envelopes) and no read verb exists yet. Judging order: the sender's ATTEMPT bound (every attempt is recorded, succeeded or not, BEFORE membership) ->
+        membership (including the mailbox-key judge) -> mint (a sender that cannot be spelled into the envelope's sender slot answers the same `not_member`, no quota consumed) -> inbox bound -> quota deduction -> append. A refused
+        delivery appends nothing. Not auto-retried by the SDK (every attempt consumes the sender's attempt quota).
+        The four refusal codes: `org_delivery.not_member` 404 (ONE sentence, byte-identical body for: different organization / no such person / directory could not answer / `to` is not a principal shape / the recipient cannot be a
+        mailbox key / the sender cannot be spelled into the envelope — the gate is never an existence probe); `org_delivery.rate_limited` 429 (one sentence for three bounds: 60 attempts per sender per hour — a typo'd recipient costs an
+        attempt —, 10 letters per (sender, recipient) pair per hour, 30 letters per recipient per hour; fixed clock-hour windows, up to double across a boundary; hard-coded, no knob); `org_delivery.inbox_full` 409 (the recipient's box already holds
+        50 unconfirmed envelopes — judged BEFORE quota so a full box burns none); `org_delivery.recipient_tombstoned` 410 (the recipient's mailbox is in its pre-delete state).
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: '#/components/schemas/PrincipalInboxMessage' }
+      responses:
+        '200':
+          description: The letter was appended; `receiptId` is the gate's delivery receipt id.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/PrincipalInboxReceipt' }
+        '400': { description: 'Malformed body: `request.field_invalid` (not an object / empty `to` / empty or over-long `content` / non-boolean `urgent`) or `request.body_shape` (unknown key incl. `from`; body carries `unknownKeys`).' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '404': { description: '`org_delivery.not_member` — one byte-identical body for six causes (see the description); the gate is not an existence probe.' }
+        '409': { description: '`org_delivery.inbox_full` — the recipient''s box holds 50 unconfirmed envelopes.' }
+        '410': { description: '`org_delivery.recipient_tombstoned` — the recipient''s mailbox is in its pre-delete state.' }
+        '429': { description: '`org_delivery.rate_limited` — one sentence for the sender-attempt bound, the pair bound and the recipient aggregate bound.' }
+        '501': { description: 'No delivery gate mounted (`PRINCIPAL_INBOX_ASSISTANT` off) — `capability.unavailable`.' }
+
   /v1/diagnostics/wiring:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -7064,6 +7160,7 @@ components:
         promptSummary: { type: string, description: 'a human-readable prompt DIGEST — NOT the full prompt.' }
         enabled: { type: boolean }
         available: { type: boolean, description: 'whether this deployment can actually RUN the scenario right now — same predicate as the 501 rejection arm on submit; false ⟺ submitting is guaranteed to 501. Independent axis from `enabled` (declared vs runnable).' }
+        attachmentSupplies: { type: array, items: { type: string, enum: [path, content_text, content_image] }, description: 'server >= 7.133.0, always present there: the attachment SUPPLY words this scenario actually carries — a subset of `capabilities.userAttachments.supplies` (`path` only on hands scenarios, where a workspace lives somewhere; a no-hands scenario drops `path`, and a `path` entry is refused by the engine with `config.user_attachment_invalid`). ABSENT = server <= 7.132.x: fall back to `userAttachments.supplies` plus the existing 400 handling.' }
         unavailableReason: { type: string, description: 'machine-readable reason, present ONLY when available:false (absent = no reason). Closed set, currently the single member `git_client_unconfigured`; branch on the key, never match the English prose. Additive-open: treat an unknown word as "unavailable, reason unknown".' }
 
     RunStatus:
@@ -7704,11 +7801,20 @@ components:
             `permissions.defaultMode`'s specific fold is documented on `TaskRequest.permissionMode`.
             🔴 ON THIS SUBMIT FACE THE KEY SET IS CLOSED (server >= 7.57.0 for the sub-tree): accepted top-level keys
             are `env` / `hooks` / `model` / `outputStyle` / `permissions` / `skillListingBudgetFraction` /
-            `skillListingMaxDescChars` / `ultracode` / `webSearch`, and accepted `permissions.*` keys are
-            `allow` / `ask` / `defaultMode` / `deny` / `disableAutoMode`; anything else is 400 `request.body_shape`
+            `skillListingMaxDescChars` / `ultracode` / `webSearch` (server >= 7.133.0 adds the three TIGHTEN-ONLY seats `complianceAdditionalDenies` / `readDenyPatterns` / `writeProtectedExtra`), and accepted `permissions.*` keys are
+            `allow` / `ask` / `defaultMode` / `deny` / `disableAutoMode` (server >= 7.133.0 adds `neverAuto`); anything else is 400 `request.body_shape`
             with the names in the refusal's `unknownKeys` / `unsupportedKeys` arrays (REFUSED, not dropped — a dropped
             key reads as "in effect" to the caller). The object stays OPEN here because the same `SemaSettings`
             schema also serves the local `settings.json` wiring, where deferred CC keys are legal.
+            🔴 TIGHTEN-ONLY SEATS (server >= 7.133.0; probe `capabilities.taskSettings.tightenOnlySeats`, an absent bit = an older server that answers 400 `request.body_shape` for these four keys): `readDenyPatterns` (entries: a bare
+            pattern string, or `{ pattern, caseSensitive? }`), `writeProtectedExtra` (a bare name — no `/` reads as `segment`, a `/` reads as `segment-run` — or `{ name, kind: basename | segment | segment-run }`),
+            `complianceAdditionalDenies` (`mcp_servers` | `workflows` | `web_fetch` | `org_memory_mount`) and `permissions.neverAuto` (tool names that ALWAYS ask a human). Each seat = the deployment table UNION the request list, ONLY EVER GROWING
+            (the request face has no loosening arm); an empty array is the same as not sent. Bad value => 400 `request.field_invalid` with `field` + `reason` (`over_cap` + `count` + `cap` / `bad_entry` + the first bad `index`).
+            Caps: 1000 entries per seat, EXCEPT `readDenyPatterns`: at most 32 entries, at most 2 `*` per path segment and 16 `*` in the whole table (every star counts, nothing is folded). A `neverAuto` name that can never match any tool => 422.
+            A resume replay of a stored body whose seat went bad => 409 `resume_blocked_by_policy`. A compliance deny is a REFUSAL, not a narrowing: a request denying `web_fetch` is refused whole where the default tool surface still mounts `WebFetch` (the single-user default does).
+            🔴 `settings.hooks[]` (server >= 7.133.0; probe `capabilities.taskSettings.pluginHooks` / `managedHookGroups` — an absent or false bit = the keys are STRIPPED SILENTLY): group key `source` (closed: `managedPolicy` / `user` / `project` / `local` / `flag` /
+            `managedPlugin:<name>` / `plugin:<name>`; absent = unmanaged; managed groups run in an independent lane after the unmanaged rewrites), command-entry keys `plugin { name, root, dataDir?, options? }` and exec-form `args`; a malformed one =>
+            400 `request.field_invalid` with `detail: { reason: "wire_key_invalid", key, path }`; the plugin context has one 8192-character budget.
             🔴 `skillListingBudgetFraction` (number in (0,1]) / `skillListingMaxDescChars` (positive integer),
             server >= 7.78.1: the SKILL-LISTING RENDER BUDGET, passed to the engine with ZERO processing
             (no clamping, no conversion, no folding) — ABSENT means the key is not written at all (the server does
@@ -8374,6 +8480,10 @@ components:
         cause (`terminal`), not the eight parallel plane keys — see `TerminalCause`.
       required: [taskId, sessionId, terminal, stats]
       properties:
+        warnings:
+          type: array
+          items: { $ref: '#/components/schemas/EntryProblem' }
+          description: 'server >= 7.133.0, top level of the sync `POST /v1/tasks` 200 body (beside `notice`), present only when non-empty: the accept-time NOTICES for allow-side selector-list entries the engine reads as nothing or that are not in the roster. ABSENT = no notice (older servers too).'
         taskId: { type: string }
         sessionId: { type: string }
         wiringManifest:
@@ -8676,6 +8786,10 @@ components:
         taskId: { type: string }
         sessionId: { type: string }
         status: { $ref: '#/components/schemas/RunStatus' }
+        warnings:
+          type: array
+          items: { $ref: '#/components/schemas/EntryProblem' }
+          description: 'server >= 7.133.0, present only when non-empty: the accept-time NOTICES for allow-side selector-list entries the engine reads as nothing or that are not in the roster (acceptance is unchanged — the engine takes them, only the operator hears afterwards; this makes "this name will not take effect" visible at the call). Same list as the stream `meta` frame''s and the sync 200 body''s. ABSENT = no notice (older servers too).'
 
     SealedKeyCapability:
       type: object
@@ -9657,6 +9771,16 @@ components:
             a child process spawned on this host NEVER inherits a name the deployment declared as its own credential — every `inheritEnv` policy (`"all"` and `"scrub"` alike) subtracts that list first, and an allow list naming one is
             refused. It speaks of INHERITANCE only (the engine process's own environment stays readable to same-user processes on the host; a credential that never enters it remains the root fix).
             ABSENT = an old server (<= 7.128.x) or a word this deployment does not wire: read it as "not promised", not as "absent capability". A shell gates on the word, never on a version number.
+        inherit_env.own_credential_values_withheld:
+          type: boolean
+          description: >-
+            ENGINE CAPABILITY WORD (core `ENGINE_CAPABILITIES`' second word, core 7.52.0; server >= 7.132.0 projects it; the key IS the word, dotted):
+            a child process spawned on this host does NOT inherit a variable whose VALUE equals one of this deployment's credential values (whole-string equality, whatever
+            the variable is called) — a key copied into another variable name is withheld under `inheritEnv: "all"` too. 🔴 A FACT, not a promise — it can be `false`:
+            true <=> every credential variable of the live configuration that has a value in the environment went into the engine's value arm; the engine refuses a value it
+            reads as "not a credential" (blank / a placeholder word / one repeated character / under 8 characters) or "the value of a variable every child process gets"
+            (startup does not refuse; the name arm still withholds) => `false`. A credential resolved only per request is not in the value arm. INHERITANCE only, like the first word.
+            ABSENT = an old server (<= 7.131.x withholds by name only — a same-value copy under another name reaches the child under `"all"`). Gate on `=== true`.
         asyncRuns: { type: boolean }
         artifacts: { type: boolean }
         approvals: { type: boolean }
@@ -9793,6 +9917,11 @@ components:
             store backend deliberately wires no image index (the pool is cloud/fleet-only) ⇒ false there.
             SCOPE: P1 only — `/v1/images/bakes*` (the P2 bake control plane) is a separate dependency and an
             operator/runner-internal face, NOT promised by this bit.
+        principalInboxDelivery:
+          type: boolean
+          description: >-
+            server >= 7.133.0 — the cross-principal delivery door `POST /v1/principal-inbox/messages` is wired (delivery gate present: env `PRINCIPAL_INBOX_ASSISTANT` on and the gate's dependencies in place).
+            True iff that route works; absent gate => the route answers 501 `capability.unavailable`. ABSENT key = server <= 7.132.x (no such route; routing-level 404). Probe this bit; do not trial-by-501.
         sharedMemory:
           type: boolean
           description: >
@@ -9963,6 +10092,12 @@ components:
             lane) or 422 (hosted).
         mcp: { type: boolean, description: "MCP servers can be attached." }
         mcpInjection: { type: boolean, description: "Per-request MCP injection is accepted." }
+        mcpAssertionHeaderSent:
+          type: boolean
+          description: >-
+            server >= 7.133.0 — the SEND seat self-report (a boolean, today ALWAYS `false`): whether `mcpServers[].transport.assertionHeader` (accepted since server 7.128.0, mutually exclusive with `principalHeader`)
+            is actually SENT to the MCP peer. `false` = the declaration is carried but NOT sent (the same switch drives the key stripping, the operator info line and the probe-door refusal; the disclosure sentences leave when it turns true).
+            ABSENT = an older server, which does not send either — treat it as `false`; never rely on the header for peer authentication.
         mcpProbe:
           type: boolean
           description: >
@@ -10002,6 +10137,17 @@ components:
             ⚠️ ABSENT = an older server (<7.87.1) ⇒ cannot tell whether the push face carries the live family;
             do NOT read "no `live_pending` frame arrived yet" as "this deployment never pushes live" — the two
             are indistinguishable on an older server. Fall back to `GET /v1/approvals`'s `livePending` pull face.
+        approvalFrameFamilies:
+          type: array
+          maxItems: 1
+          items: { type: string, enum: [tool_approval, approval_request] }
+          description: >-
+            server >= 7.133.0, ALWAYS present (the projection of the same judgement as `streamApproval`) — which FRAME FAMILY this worker's approval opening frames belong to:
+            a closed-word array with AT MOST ONE member. `["approval_request"]` = the card protocol is on: one ask travels only `approval_request` -> `approval_complete` / `approval_revoke`
+            (the legacy `tool_approval` / `tool_approval_complete` pair is NOT sent — BREAKING vs <= 7.132.x, which sent both families for one ask and relied on `approvalId` de-duplication;
+            remedy on the worker: `STREAM_APPROVAL_ENABLED=false`). `["tool_approval"]` = the card protocol is not on (`STREAM_APPROVAL_ENABLED=false`, no store backend, or no checkpoint store) but the live card leg is.
+            `[]` = per-call approvals are off altogether (`TOOL_APPROVAL_ENABLED=false`): no card is presented. Dispatch frame families off THIS array, never off `streamApproval`.
+            KEY ABSENT (not `[]`) = server <= 7.132.x — there a `streamApproval: true` leg sends BOTH families for one ask.
         streamApproval:
           type: boolean
           description: >
@@ -10056,6 +10202,13 @@ components:
             a server <= 7.118.x returns the archive as written; a 7.119.x server already redacts but does not report the bit. A true
             bit does not mean the read face exists (that is `sessions`; without a session audit face that door answers 501 and this
             bit is still true), nor that the archive holds no credential (the redaction is read-side only).
+        approvalReadRootGrant:
+          type: boolean
+          description: >-
+            server >= 7.133.0, ALWAYS present, a FACT that varies by deployment — whether this deployment accepts the reply-body key `readRootGrant` ("Yes, and add directory": the card's
+            `readRootCandidate.dir` is registered as a read root together with this one allow). True iff the single-user host-lane posture (the same predicate as `projectContext` / the cwd face); false elsewhere.
+            A client shows the option only when the card carries `readRootCandidate` AND this bit is true. On a non-accepting posture a reply carrying `readRootGrant` is refused
+            `400 request.body_shape` (the ask stays unsettled — answer again without the key). ABSENT = server <= 7.132.x = not accepted; do not send the key.
         approvalReach:
           type: boolean
           description: >-
@@ -10168,6 +10321,9 @@ components:
             outputStyle: { type: boolean }
             env: { type: boolean, description: 'TRUE on the single-user host lane (server emits `cwdHonored(config)`). It is NOT hard-coded false any more — the old always-false value predated the per-task shellEnv seam and hid a live capability.' }
             hooks: { type: boolean, description: 'Single-user deployments only (`requirePrincipal !== true`).' }
+            pluginHooks: { type: boolean, description: 'server >= 7.133.0 — the request `settings.hooks[]` PLUGIN-CONTEXT keys (command entry `plugin { name, root, dataDir?, options? }` / exec-form `args`) are accepted; same predicate as `hooks` (single-user true, multi-tenant false). ABSENT or false = the keys are stripped silently — send only on sight of the bit.' }
+            managedHookGroups: { type: boolean, description: 'server >= 7.133.0 — the request `settings.hooks[]` GROUP `source` key (managed lanes `managedPolicy` / `managedPlugin:<name>`) is accepted; same predicate as `hooks`. ABSENT or false = stripped silently (the managed-lane semantics do not apply, it is not a refusal).' }
+            tightenOnlySeats: { type: boolean, description: 'server >= 7.133.0, constant true — the four tighten-only request seats `settings.readDenyPatterns` / `settings.writeProtectedExtra` / `settings.complianceAdditionalDenies` / `settings.permissions.neverAuto` are accepted (each seat = deployment table UNION request list, only ever growing; an empty array is the same as not sent). ABSENT = server <= 7.132.x, which answers 400 `request.body_shape` for those keys — send only on sight of the bit.' }
         settings:
           type: object
           description: >
@@ -10196,6 +10352,7 @@ components:
               properties:
                 allowGrant: { type: boolean, description: 'Constant `true` on server >= 7.115.0: `settings.permissions.allow` is read as allow RULES, not as a list. The whole `settings` key being absent = an older server.' }
                 allowLayer: { type: boolean, description: 'Constant `true` on server >= 7.117.0 (core 7.42.0): the whole `settings.permissions.allow` list goes to the engine allow layer (listed calls are not asked; content forms accepted; entries read as nothing get an `engine_notice` `permission.allowed_tool_not_granted`). Absent = a server without it (7.115.0–7.116.x: allow is a statement; older: a list).' }
+                callerTrust: { type: string, description: 'server >= 7.133.0 — THIS caller''s trust tier (per caller / per credential, NOT a version bit). Request rule tables that take effect without a person answering (`settings.permissions` buckets; a named-invoked skill''s `allowedTools` / `disallowedTools`) are admitted by it: `allow` loosens the no-ask surface and needs `global`; `deny` / `ask` only tighten and are admitted at any tier. Today `global` (single-user turnkey; multi-tenant with the deployment service credential; multi-tenant sign-in token whose scope role >= the governance write role) or `project` (everything else). Read OPEN: an unknown word is treated as `project` (fail-closed). A request below the floor is refused whole with 400 `request.field_invalid` (`detail.problems[].reason: below_trust_floor`, `detail.callerTrust`). ABSENT = server <= 7.132.x: no per-tier admission.' }
         memoryWrite:
           type: boolean
           description: >
@@ -10258,7 +10415,7 @@ components:
               additionalProperties: true
               properties:
                 enabled: { type: boolean, enum: [true] }
-                protocolVersion: { type: integer }
+                protocolVersion: { type: integer, description: 'The protocol REVISION this server speaks (the `challenge` frame carries the same value; accepted window [1, 2] on server >= 7.133.0). Server >= 7.133.0 reads 2 (<= 7.132.x read 1). An executor declares the SMALLER of its own highest revision and this value, and takes its outcome-code set from the declared revision (revision 2 added `liveness_no_output`).' }
                 maxInflightPerDevice: { type: integer }
                 wsPath: { type: string }
                 management: { type: boolean, description: 'server >= 7.88.0. `/v1/devices/*` admin verbs present. PRESENT-IFF — absent means a pre-7.88.0 peer (unknown), not false.' }
@@ -10752,9 +10909,9 @@ components:
         server >= 7.65.0 (S-167) — the READ containment rung of this deployment AND WHO SET IT (operator face
         `GET /v1/diagnostics/wiring` -> `readFace`). `face` is the same boot artefact as the tenant-facing
         `capabilities.readFace` (`null` = nothing pinned by this deployment, the engine default is in force).
-        `source` is a CLOSED four-word set on the server (exhaustive switch — adding a word is a compile error
+        `source` is a CLOSED five-word set on the server (exhaustive switch — adding a word is a compile error
         there): `env` = this machine's READ_FACE env var (wins over everything) · `center` = the config-center
-        readFace domain (restart-to-apply) · `posture` = derived from the single-user turnkey posture
+        readFace domain (restart-to-apply) · `lane` = (server >= 7.133.0) the isolated execution lane's default — with `READ_FACE` absent, e2b / k8s / local-docker mint `open` · `posture` = derived from the single-user turnkey posture
         (REQUIRE_PRINCIPAL unset ⇒ `open`; server >= 7.65.0 behaviour change) · `engine-default` = not pinned.
         `note` is a human-facing pointer for operators. Minimal disclosure: the deny table is never on this face.
       required: [face, source, note]
@@ -10764,7 +10921,7 @@ components:
           enum: [open, roots, null]
         source:
           type: string
-          enum: [env, center, posture, engine-default]
+          enum: [env, center, lane, posture, engine-default]
         note:
           type: string
 
@@ -10781,9 +10938,9 @@ components:
         `DURABLE_APPROVAL` ON and a 24h approval window when neither is set, so a default FLIP has to be visible
         on an operator surface or nobody sees it.
 
-        `source` is the CLOSED four-word set (exhaustive switch on the server — adding a word is a compile error
+        `source` is the CLOSED five-word set (exhaustive switch on the server — adding a word is a compile error
         there), in PRECEDENCE order: `env` = pinned by this machine's env var (deployment sovereignty; beats any
-        published value) · `center` = applied from the config-center (restart-to-apply) · `posture` = derived from
+        published value) · `center` = applied from the config-center (restart-to-apply) · `lane` = (server >= 7.133.0) derived from the isolated execution lane (e2b / k8s / local-docker mint a lane default, e.g. `READ_FACE` -> `open`) · `posture` = derived from
         the deployment shape (single-user turnkey) · `engine-default` = nothing pinned, the built-in default is in
         force. Only `env`/`center` count as "an operator asked for this"; a posture-derived `true` does not.
         `note` is PROSE for a human (per-knob, and on the `posture` arm it is that knob's own fact sentence) —
@@ -10798,7 +10955,7 @@ components:
           description: 'The knob''s effective value. Typed by the referencing site (boolean / integer / …).'
         source:
           type: string
-          enum: [env, center, posture, engine-default]
+          enum: [env, center, lane, posture, engine-default]
         note: { type: string }
 
     SkillSpec:
@@ -10892,7 +11049,19 @@ components:
                     `principalHeader` (both set => 400 request.body_shape); a non-string value => 400 request.field_invalid.
                     7.128.x accepts and carries the declaration but does NOT send an assertion yet (engine seat pending;
                     operator line `mcp_assertion_header_not_sent`).
-        allowTools: { type: array, items: { type: string } }
+        allowTools:
+          type: array
+          items: { type: string }
+          description: >-
+            Which of this server's tools to MOUNT (bare tool names, as the server lists them). Three sentences (server >= 7.132.0 contract; read off the engine's
+            `intakeListedTools`, passed through verbatim, never checked against the live list): ABSENT = every listed tool mounts; `[]` = NONE mounts (the server is
+            still connected, still probed, still on the `GET /v1/capabilities/mcp` status face) — `[]` MUST NOT be folded into absence (two facts on the wire;
+            do not drop an empty array when serializing); a name the server does not list = SILENTLY NO MATCH (no 400, no warning — a narrowing mismatch mounts
+            less, never more; for "loud on a typo" name the same tool in `toolFaces`, which notices an unknown name as `config.tool_face_undeclared`; `toolAxes`
+            checks shape only). The engine's one loud case: a server without the `tools` capability and a non-empty list ⇒ operator warning
+            `mcp.tools_capability_absent`. The list also gates the server's MCP RESOURCES: absent ⇒ list / read stay open; a list ⇒ open only if it names the
+            reserved `list_resources` / `read_resource` (so `[]` closes them too). Bad shape (not a string array) ⇒ 400 `request.field_invalid` naming
+            `mcpServers[i].allowTools`.
         elicitation: { type: boolean }
         toolAxes:
           type: object
@@ -10908,6 +11077,15 @@ components:
             server >= 7.66.0 — per-tool face overlays keyed by BARE tool name (see McpToolFace). Any malformed
             face drops the whole server.
           additionalProperties: { $ref: '#/components/schemas/McpToolFace' }
+        startupTimeoutMs:
+          type: number
+          description: >-
+            server >= 7.132.0 (an accepted key; core `McpServerSpec.startupTimeoutMs`): THIS server's startup bound in whole milliseconds — the handshake
+            (connect + initialize) and the initial tool listing each carry it. One read order: this member, else the process-level `MCP_TIMEOUT`, else the MCP
+            SDK's own 60 000 ms. Range 1 000 – 2 147 483 647. The value-shape judge lives ONLY in the engine: neither server door (new submit / probe) checks
+            it at intake; a bad value (a string, a fraction, 0, a negative, NaN, `null`, out of range) refuses ONLY THIS server at its dial
+            (`config.mcp_startup_timeout_invalid`; siblings mount) — never clamped, never read as the default. A <= 7.131.x server answers `400
+            request.body_shape` (named in `unknownKeys`).
 
     A2aServerSpec:
       type: object
@@ -11599,6 +11777,24 @@ components:
             `"other"`). This is the "where did those 180 404s actually land" cell. Empty object = zero failures;
             key absent = an older server.
 
+    ModelPlane:
+      type: object
+      additionalProperties: false
+      description: >
+        `GET /v1/models.modelPlane` (server >= 7.133.0; always present; conditional keys are absent, never `null` / empty string) — the single read for "which model table is this engine serving".
+        Two axes. SERVED TABLE: `servedTable` = `env` (the env table minted from MODEL_ID / MODEL_CHEAP_ID — no catalog is in charge: none configured / source unreachable with no last-known-good / the candidate was refused /
+        no enabled entry) | `catalog` (a catalog's model plane landed and replaced the whole env table). CANDIDATE OUTCOME: `catalog` = `refused` (the latest candidate was refused whole — by the candidate judge or the model-plane
+        group; with no previous generation the env table serves, with one the catalog table still serves — who serves is `servedTable`'s answer, NOT merged into this field) | `adopted` (no whole refusal and the catalog table
+        serves; NOT "the latest candidate landed" — that question belongs to the /health generation ledger) | `absent` (no whole refusal and the env table serves). START-UP ROUTE VERDICT: `refusalCode` / `gap` (both ABSENT when the
+        judge passes — the normal state of a running process): `refusalCode` = `config.model_route_endpoint_missing` | `config.gateway_fallback_without_primary`; `gap` = `endpoint_missing` (set MODEL_GATEWAY_BASEURL or the entry's
+        own `baseUrl`) | `lane_credential_missing` (an anthropic-lane choice with neither ANTHROPIC_API_KEY nor ANTHROPIC_AUTH_TOKEN fell into the endpoint-less openai leg). No sentence is carried. Words are server-owned — read OPEN
+        (an unknown word is "unknown", never "passed").
+      required: [servedTable, catalog]
+      properties:
+        servedTable: { type: string, description: '`env` | `catalog` (open on read).' }
+        catalog: { type: string, description: '`absent` | `adopted` | `refused` (open on read).' }
+        refusalCode: { type: string, description: '`config.model_route_endpoint_missing` | `config.gateway_fallback_without_primary` (open on read); ABSENT = the judge passed.' }
+        gap: { type: string, description: '`endpoint_missing` | `lane_credential_missing` (open on read); ABSENT = the judge passed.' }
     ModelsResponse:
       type: object
       description: >
@@ -11646,6 +11842,11 @@ components:
             Upgrade window (as it is): an on-disk LKG written by server <= 7.122.x only recorded the dropped entries that had a name AND were
             enabled; while serving from it with the center still unreachable this key lists only those rows (possibly `[]`) and the first pull after the
             center is reachable fills it in. An unknown `reasonCode` word reads as "dropped, reason unknown".
+        modelPlane:
+          allOf: [{ $ref: '#/components/schemas/ModelPlane' }]
+          description: >-
+            server >= 7.133.0, ALWAYS present there (appended last): which model table this engine SERVES, whether the catalog was adopted, and what the start-up route judge says — read this instead of predicting
+            (the judge's inputs are the serving process's facts; mirroring two of its judgements drifts). ABSENT = an earlier server (<= 7.132.x). Field reading: ModelPlane.
         candidateRejected:
           allOf: [{ $ref: '#/components/schemas/CandidateRejected' }]
           description: >
@@ -11836,12 +12037,16 @@ components:
       x-open-enum: true
       description: >-
         A model row's key<->URL pairing posture (core `RoutePairingStatus`; server >= 7.45). OPEN on read —
-        the six words below are today's set, branch on the known ones and keep a `default` arm. NON-SECRET — no
+        the eight words below are today's set (core `RoutePairingStatus`), branch on the known ones and keep a `default` arm. NON-SECRET — no
         URL, no credential.
         `ok:per-model` this model has its own credential · `ok:paired` deployment credential, and the model's URL
         is on the deployment's declared root · `ok:keyless` no credential anywhere (a local unauthenticated
         gateway) · `broken:credential_mismatch` / `broken:credential_missing` a real request WILL be refused by
-        the engine (flag it red) · `unknown` could not be adjudicated — render "unknown", NEVER "good" or "bad".
+        the engine (flag it red) · server >= 7.132.0 / engine 7.52.0 adds two `broken:` words, same reading:
+        `broken:credential_origin_mismatch` (this model's own credential is bound to the host it first went to and the row now points at another
+        host — configure a credential for the new host or point it back; the same refusal on a stream is the `engine_notice`
+        `route.credential_origin_mismatch`) and `broken:credential_answer_conflict` (the per-model credential hook answers the key twice — `apiKey`
+        AND the lane's own key header; answer one of them) · `unknown` could not be adjudicated — render "unknown", NEVER "good" or "bad".
         🔴 sdk 23.0.0 BREAKING (server >= 7.129.0 / engine 7.51.0): `ok:unpinned` (a deployment credential on a deployment that declared no root, so the pairing was unverifiable) is RETIRED with no alias —
         on such a deployment the engine now judges the deployment credential `broken:credential_mismatch`. A server <= 7.128.x still sends `ok:unpinned`: it falls in the open tail, render it as
         "pairing not verified", never as good.
@@ -11851,11 +12056,11 @@ components:
 
     ResumeStartupCause:
       type: string
-      enum: [environment, session_gone, tool_unavailable, configuration, decision_rejected]
+      enum: [environment, session_gone, transcript_corrupt, tool_unavailable, configuration, decision_rejected]
       description: >-
-        WHY a parked resume could not start its approved action — the engine's closed `RESUME_STARTUP_CAUSES` (core 7.51.0), word for word and in order. The body key of the 422 `parked_resume.startup_failed`
+        WHY a parked resume could not start its approved action — the engine's closed `RESUME_STARTUP_CAUSES` (core 7.51.0; six words since core 7.52.0, server >= 7.132.0), word for word and in order. The body key of the 422 `parked_resume.startup_failed`
         (`ErrorResponse.cause`; SDK `ParkedResumeStartupError.startupCause`). Server >= 7.129.0 screens the engine's word against this set before it goes out (a word the engine did not say, or one outside the set => the key is absent).
-        `environment` the leg's infrastructure failed (workspace restore, an abort) — the decision is untouched, retrying replays it · `session_gone` the resumed agent's transcript session is missing ·
+        `environment` the leg's infrastructure failed (workspace restore, an abort) — the decision is untouched, retrying replays it · `session_gone` the resumed agent's transcript session is missing · `transcript_corrupt` (core 7.52.0) the transcript is there but damaged (no header its store wrote, a leaf or parent entry missing, a lost tail the checkpoint was cut inside) — it reopens as `session_gone` does, only the receipt now names it ·
         `tool_unavailable` the approved tool is not available to the resumed leg (gone, or replaced by a different contract) — this approval cannot run, decide afresh · `configuration` the deployment's
         configuration refuses the resumed leg; a retry under the same configuration fails the same way · `decision_rejected` the decision does not fit the checkpoint (another gate's answer, an input the constraints
         refuse) — correct it and resubmit. The shared `ErrorResponse.cause` stays an open string in this document because the key is shared by other codes and by servers <= 7.128.x (which relay the engine's word unscreened).
@@ -12863,14 +13068,14 @@ components:
         ts: { type: integer }
     FleetFrame_hook_notice:
       description: >
-        Hook observability frame, TWO kinds (both pure observe — never block, resume, or inject anything;
+        Hook observability frame, FOUR kinds (server >= 7.133.0 added the third and fourth; all pure observe — never block, resume, or inject anything;
         visibility fail-CLOSED like bg_notification: the owner keys ownerScope/ownerSessionId gate delivery
         and are STRIPPED before send; wire is FLAT — `send("hook_notice", { type, ...wire, ts })`, the
         server-internal `{notice}` nesting never reaches it). codex R1-F4: modeled as the discriminated union
         it really is — the common `{type, ts}` frame base composed with each kind's payload arm — so a
         generated client gets the SAME per-kind narrowing as the TS type (a second-family frame missing
-        hookName/entryType is invalid, not silently accepted). `kind` is CLOSED two-member on the server but
-        OPEN ON READ: degrade an unknown future kind to a generic observability row.
+        hookName/entryType is invalid, not silently accepted). `kind` is CLOSED four-member on the server but
+        OPEN ON READ: degrade an unknown future kind to a generic observability row. DISPATCH on `kind`; never infer a call's outcome from any hook_notice frame (read the tool / approval frames).
       oneOf:
         - allOf:
             - $ref: '#/components/schemas/FleetHookNoticeFrameBase'
@@ -12878,10 +13083,16 @@ components:
         - allOf:
             - $ref: '#/components/schemas/FleetHookNoticeFrameBase'
             - $ref: '#/components/schemas/FleetHookNonBlockingFailure'
+        - allOf:
+            - $ref: '#/components/schemas/FleetHookNoticeFrameBase'
+            - $ref: '#/components/schemas/FleetHookManagedUnrun'
+        - allOf:
+            - $ref: '#/components/schemas/FleetHookNoticeFrameBase'
+            - $ref: '#/components/schemas/FleetHookVerdictUntrusted'
 
     FleetHookNoticeFrameBase:
       type: object
-      description: 'The hook_notice frame envelope shared by both kinds: the SSE frame discriminant and the server timestamp.'
+      description: 'The hook_notice frame envelope shared by all four kinds: the SSE frame discriminant and the server timestamp.'
       required: [type, ts]
       properties:
         type: { const: hook_notice }
@@ -12930,7 +13141,7 @@ components:
       # #315(server ≥7.43):第二顶层键 `livePending` = streamApproval 窗内的流内 ask(此前对轮询消费端
       # 结构性不可见)。ADDITIVE / tolerate-absent:键缺席=「协调器未装配(本部署无 live 审批面)」或
       # 旧 server;空数组=「有面、此刻无待批」——两义可判别,消费端测 presence。**分数组不混编**:
-      # live 行的决议口=POST /v1/tool-approvals/{approvalId}/respond,durable 行=decide 口;数组名即路由判据。
+      # live 行的决议口=POST /v1/tool-approvals/{id}/respond,durable 行=decide 口;数组名即路由判据。
       # 22.0.0:第三、四顶层键此前漏声明 —— 封闭 schema 上一个真键 = 合法信封被严格校验器拒收。
       additionalProperties: false
       required: [pending]
@@ -12985,7 +13196,7 @@ components:
       type: object
       description: >-
         A live (in-stream) pending ask inside its streamApproval window (#315, server ≥7.43). Decide it via
-        POST /v1/tool-approvals/{approvalId}/respond — NOT the /decide route (that is the durable rows' door).
+        POST /v1/tool-approvals/{id}/respond — NOT the /decide route (that is the durable rows' door).
         Optional flags are only-if-true (absent is NEVER encoded as false).
         🔴 THE "tool input/args are NOT listed" NARROWING IS GONE (server >= 7.87.0 / S-454 P1). The old reason
         was "details ride the stream frame" — but a SUSPENDED ask never has a stream frame (at mint time it had
@@ -13003,7 +13214,15 @@ components:
       additionalProperties: true
       required: [approvalId, toolName, ts, expiresAtMs]
       properties:
-        approvalId: { type: string, description: 'The SAME id the respond endpoint takes (wire uuidv7).' }
+        approvalId: { type: string, description: 'The SAME id the respond endpoint takes. server >= 7.133.0: for an ask that has a ledger row it is ALWAYS the row''s key `askId` (a 64-character lowercase hexadecimal string — an OPAQUE string, never a uuid); on <= 7.132.x a wire uuidv7.' }
+        consumerState:
+          type: string
+          enum: [absent]
+          description: >-
+            server >= 7.133.0, TRUE-ONLY (present as `absent`): no engine leg on THIS replica is waiting for this ask. Present <=> the row was ADOPTED from the ask ledger at start-up (minted by a previous
+            process / another replica, the row still undecided — a "zombie card"): it lists and can be answered (the row becomes decided; the answer ack carries the same bit), but that decision resumes
+            nothing running on this replica — read the run surface to learn whether anything continued. The `live_pending` stream frame and the `pending` arm of GET /v1/tool-approvals/{id} carry it too. After a restart an
+            ask still undecided on the ledger RETURNS to `livePending[]` (it used to vanish and answer 404). Absent = this replica has an engine leg waiting, or an older server.
         toolName: { type: string }
         ts: { type: number, description: 'Registration time (ms epoch).' }
         expiresAtMs: { type: number, description: 'Absolute window deadline — the SAME number minted once for the tool_approval frame (never recomputed).' }
@@ -13028,9 +13247,13 @@ components:
           allOf: [{ $ref: '#/components/schemas/ToolApprovalCardWord' }]
           description: 'server >= 7.126.0 (core 7.49.0 #1414): which card this ask renders on — the engine-minted card word, the SAME value as `frame.approvalCard` (the row reads the frame''s own seat, no second read), same layer and shape as the operator queue row''s `approvalCard`. It REPLACES `contentKind` (server <= 7.125.x derived it from the tool name; deleted at 7.126.0, no alias). ABSENT = the engine minted none. Display / triage only; it NEVER takes part in decision routing.'
         frame:
-          allOf: [{ $ref: '#/components/schemas/ToolApprovalFrame' }]
+          oneOf:
+            - $ref: '#/components/schemas/ToolApprovalFrame'
+            - $ref: '#/components/schemas/ApprovalRequestFrame'
           description: >-
-            server >= 7.87.0 (S-454 P1; cli L-397) — THE CARD FRAME THIS ASK WOULD HAVE EMITTED. It is the SAME
+            server >= 7.87.0 (S-454 P1; cli L-397) — THE CARD FRAME THIS ASK WOULD HAVE EMITTED. TWO SHAPES, by leg (sdk 25.0.0 declares the union; discriminant
+            `frame.type`): on a leg that speaks the card protocol (`capabilities.approvalFrameFamilies` contains `approval_request`, server >= 7.133.0) it is the
+            `approval_request` frame (card facts under `frame.card`, the ten off-card live facts flat at the top); on a legacy-family leg it is the `tool_approval` frame. It is the SAME
             OBJECT as the server's `PendingApproval.frame` (the one construction site in `askBroadcast`, already
             redacted / byte-capped / window-keys filled), shared by the suspended and the reachable path — so
             this is NOT a second card projection computed for the list, and there is no second redaction surface.
@@ -13250,6 +13473,7 @@ components:
       required: [sessionId, scope, createdAt]
       additionalProperties: true
       properties:
+        checkpointId: { type: string, minLength: 1, maxLength: 128, description: 'server >= 7.133.0: the NON-SECRET stable identity of the pause this row parks on — the join key where the token cannot go; the SAME value as `PausedCause.checkpointId`. Carried on three durable read surfaces (GET /v1/approvals `pending[]` rows, the /v1/approvals/stream `pending` frame, GET /v1/assistant/inbox rows). A row whose value is unreadable or untrusted (non-string / empty / over 128 / contains the token / an old row / an older server) is STILL LISTED with the key ABSENT — read absence as "this row has no joinable identity", never as a required key.' }
         sessionId: { type: string, description: 'The decide handle: POST /v1/approvals/:sessionId/decide.' }
         scope: { type: string, description: 'Principal; "_" = submitted without one.' }
         taskId: { type: ['string', 'null'], description: 'Suspended run holding the session claim (service-pinned) — join key to trace tool-call blocks + context link.' }
@@ -13265,7 +13489,11 @@ components:
             🔴 OPEN SET — deliberately NOT an enum: observed values include `human`, `irreversible_ask`,
             `plan_review`, `needs_review`, `resource_limit`, and core keeps adding. Pinning an enum would make a
             new gate kind "not exist" for generated clients.
-            ABSENT on a pre-`gate_kind` legacy row (SQL column NULL) — degrade honestly, never assume `human`.
+            🔴 ALWAYS PRESENT on server >= 7.132.0 (a wire narrowing): every park stamps it, the one-time migration M21 filled the stored rows that lacked it
+            (a row whose gate names no registered kind is expired), and a SQL row that still carries none is NOT LISTED (counted under
+            `server.approvals.queue-row-gate-kind-missing`; no decide route can bind it) rather than served without the key. On a <= 7.131.x server it is
+            absent on a pre-`gate_kind` legacy SQL row (column NULL). Either way the reading of an absent key is "unreadable — fail closed": never assume
+            `human`, never route it. Deliberately still not in `required` while the supported floor (3.0.0) is below 7.132.0.
         input:
           description: >
             The pending tool call's args (post-hook), REDACTED + size-bounded — for a tool gate the write
@@ -13457,6 +13685,7 @@ components:
       additionalProperties: false
       properties:
         sessionId: { type: string, description: 'The suspended task/session id.' }
+        checkpointId: { type: string, minLength: 1, maxLength: 128, description: 'server >= 7.133.0: the NON-SECRET stable identity of the pause this row parks on — the join key where the token cannot go; the SAME value as `PausedCause.checkpointId`. Carried on three durable read surfaces (GET /v1/approvals `pending[]` rows, the /v1/approvals/stream `pending` frame, GET /v1/assistant/inbox rows). A row whose value is unreadable or untrusted (non-string / empty / over 128 / contains the token / an old row / an older server) is STILL LISTED with the key ABSENT — read absence as "this row has no joinable identity", never as a required key.' }
         scope: { type: string, description: 'Multi-tenant owner scope.' }
         createdAt: { type: number, description: 'Ask creation time (epoch ms).' }
         gateKind:
@@ -13780,6 +14009,17 @@ components:
             ⚠️ The key name is final: `permissionModeAfter` (the build brief once said `nextPermissionMode`,
             which never shipped — zero aliases).
 
+    SessionAgent:
+      type: object
+      additionalProperties: false
+      description: >-
+        The placement-tuple projection of a delegated subagent's transcript (`SessionRecord.agent`, server >= 7.133.0). Each member is independently optional (only what was stored is projected); `{}` is a legal value
+        (the tuple held only a `kind`). `id` = the tuple's `handle` (the durable agent row's `a…` key — the SAME string as the fleet row's `id` and `GET /v1/agents/roster`'s `handle`); `parentSessionId` = the host
+        session that spawned it; `rootSessionId` = the delegation tree's root host session (a nested grandchild anchors to the root).
+      properties:
+        id: { type: string }
+        parentSessionId: { type: string }
+        rootSessionId: { type: string }
     SessionRecord:
       type: object
       description: >
@@ -13812,6 +14052,14 @@ components:
           $ref: '#/components/schemas/SessionWindow'
         promptEpoch:
           $ref: '#/components/schemas/PromptEpoch'
+        agent:
+          allOf: [{ $ref: '#/components/schemas/SessionAgent' }]
+          description: >-
+            server >= 7.133.0, top-level additive key — WHICH delegated subagent's transcript this session is (read by terminal side-chain projections that join a fleet frame's `transcriptId`). Only the stored placement
+            tuple is projected (minted by the engine when a BACKGROUND subagent with a durable agent row creates the session on a store that declares placements; a synchronously delegated subagent's transcript is not in
+            the host store and has no tuple); the three members are each optional. 🔴 READ IT AS "WAS IT STORED", NEVER AS "IS IT A SUBAGENT": key PRESENT = a delegated subagent's transcript (even `{}` when the tuple held only a
+            kind); key ABSENT has three causes — an older server (<= 7.132.x) / an ordinary session / a deployment whose store keeps no placement tuple (the local backend: the copy parked from the private short-TTL store is an
+            ordinary session row). Absence is NOT "not a subagent": fall back to the identity the fleet row (`id`) / `GET /v1/agents/roster` (`handle`) already carry.
         userInputUndrained:
           type: array
           description: >-
@@ -13975,23 +14223,67 @@ components:
         message: { description: 'OPEN — the message payload as stored; shape belongs to the transcript format, not to this envelope. server >= 7.125.0: a `role: "user"` message carries the same present-iff rewind handle `taskId` as on the whole-record read (see `SessionRecord.messages`).' }
 
     PromptEpoch:
-      type: object
       description: >
-        A session's prompt-epoch pin (server >=1.220, additive on `GET /v1/sessions/:id`). Identifies WHICH
-        assembled system-prompt artifact this session is pinned to, so a transcript stays reproducible across
-        prompt-pack releases. IDs/digests only — never prompt text. OPEN object.
-      required: [epoch, artifactDigest, packId, assemblyApi, activatedBy]
-      additionalProperties: true
+        A session's prompt-epoch record on `GET /v1/sessions/:id` (absent = a pre-epoch session — never null). 🔴 server >= 7.132.0 BREAKING (no alias): the value
+        is the engine's `StoredPromptEpoch` reading VERBATIM (the server neither reads nor projects it) — a v3 pin `{ kind: "pin", descriptor }`, or a record of a
+        retired shape recognized by its field names `{ kind: "legacy", centerPinned }` (the engine reads only whether it pinned a center artifact; the next run
+        replaces it with a v3 record). The <= 7.131.x shape `{ epoch, artifactDigest, packId, assemblyApi, activatedBy }` is retired: `epoch` / `activatedBy` live
+        in `descriptor`, `descriptor.identity` takes the identity role (a different digest over different inputs — not comparable), `packId` / `assemblyApi` have
+        no successor. IDs / digests only — never prompt text.
+      oneOf:
+        - $ref: '#/components/schemas/PromptEpochPin'
+        - $ref: '#/components/schemas/PromptEpochLegacy'
+      discriminator:
+        propertyName: kind
+        mapping:
+          pin: '#/components/schemas/PromptEpochPin'
+          legacy: '#/components/schemas/PromptEpochLegacy'
+    PromptEpochPin:
+      type: object
+      additionalProperties: false
+      required: [kind, descriptor]
       properties:
-        epoch: { type: integer, description: Monotonic epoch counter within the session. }
-        artifactDigest: { type: string, description: 'Content digest of the assembled artifact (`sha256:<64 hex>`).' }
-        packId: { type: string, description: 'Prompt-pack identity, e.g. `sema-default@1`.' }
-        assemblyApi: { type: integer, description: Assembly-contract version (currently always 1). }
+        kind: { const: pin }
+        descriptor: { $ref: '#/components/schemas/PromptEpochDescriptor' }
+    PromptEpochLegacy:
+      type: object
+      additionalProperties: false
+      required: [kind, centerPinned]
+      properties:
+        kind: { const: legacy }
+        centerPinned: { type: boolean, description: 'whether the retired-shape record pinned a center artifact.' }
+    PromptEpochDescriptor:
+      type: object
+      description: 'A v3 epoch record (core `PromptEpochDescriptor`), persisted as a session entry and restated in every compaction entry.'
+      additionalProperties: false
+      required: [epoch, identity, layers, activatedBy]
+      properties:
+        epoch: { type: integer, description: 'monotonic per-session record counter.' }
+        identity: { type: string, description: 'the run''s prompt identity digest (= the manifest''s `identity.artifact`).' }
+        layers: { $ref: '#/components/schemas/PromptIdentityLayers' }
         activatedBy:
           type: string
-          description: >
-            Open enum — known values `session_start` | `compaction` | `legacy_migration`; treat unknown values as
-            opaque rather than failing closed.
+          enum: [session_start, compaction, code_change, selection_change]
+          description: 'how the record came to be — core `PROMPT_EPOCH_ACTIVATIONS`: `session_start` / `compaction` (legal boundaries), `code_change` (code or input layers moved), `selection_change` (only the selector values moved). CLOSED: the engine''s judge (`normalizePromptEpoch`) checks membership, a record with any other word does not read as a pin.'
+        changed:
+          type: array
+          items: { type: string, enum: [catalog, renderers, deploy, task, published_schema] }
+          description: 'only on a `code_change` record whose changed layers are known — core `PROMPT_EPOCH_CHANGES` (closed, judged by the engine like `activatedBy`).'
+        sourceRevision: { type: string, description: 'opaque publish provenance of the pinned center layer — present only beside `layers.center`; never digested.' }
+    PromptIdentityLayers:
+      type: object
+      description: >
+        The inputs of a run's prompt identity (core `PromptIdentityLayers`; the epoch record's `layers` and the manifest's `identity.layers` are this one shape).
+        Only `center` is pinned (resolved by digest on resume); the rest are what the run computed. Absent `center` / `deploy` / `task` = that layer contributed nothing.
+      additionalProperties: false
+      required: [catalog, renderers, binding]
+      properties:
+        catalog: { type: string }
+        renderers: { type: object, additionalProperties: { type: number }, description: 'renderer id -> version.' }
+        center: { type: string, description: 'the adopted center artifact''s digest.' }
+        deploy: { type: string }
+        task: { type: string }
+        binding: { type: string, description: 'digest of the run''s selector values (the plain form is the manifest''s `selectors`).' }
 
     SessionListPage:
       type: object
@@ -14097,14 +14389,45 @@ components:
       # 封闭(census 批2 第三段,2026-07-30):三个铸造臂(`routes/sessions.ts` 的空面板 / 超时 degraded / 正常)键集并集恰是这 3 键;degraded 只在超时臂铸。
       # sdk 9.4.0:第 4 键 `lastLegMcp`(server ≥7.77.0)—— 同一个铸造点上按调用方裁的可选顶层键,不在
       # 面板那张短 TTL 单飞缓存里(缓存键=场景×principal,与会话无关)。
-      required: [asOf, servers]
+      # server >= 7.131.0:第 5 键 `scenarioRefusal`(场景门拒时在场,此时 `servers` 缺席)⇒ `servers` 出 required。
+      # 两臂恰一(server 7.132.0 三只铸造臂):served = `servers`(+ `degraded` 只在超时臂)/ refused = `scenarioRefusal`(无 `servers` / `degraded`)⇒ `oneOf` 判(sdk `McpStatusPanelServed` / `McpStatusPanelRefused`)。
+      # 每一臂自己禁掉对方的键(不靠「另一臂恰好不过」:混合体 `{ servers, scenarioRefusal, degraded }` 曾因 refused 臂被 `degraded` 判掉而恰一臂过)。
+      required: [asOf]
       additionalProperties: false
+      oneOf:
+        - required: [servers]
+          not: { required: [scenarioRefusal] }
+        - required: [scenarioRefusal]
+          not: { anyOf: [{ required: [servers] }, { required: [degraded] }] }
       properties:
         asOf: { type: string }
         servers:
           type: array
           items: { $ref: '#/components/schemas/McpServerStatus' }
+          description: >-
+            The scenario half: what this principal's scenario would mount NOW. server >= 7.131.0: ABSENT only when the scenario gate refused (then
+            `scenarioRefusal` is present) — distinct from `[]` (the gate passed and that scenario configures no MCP). Always present on older servers.
         degraded: { type: boolean }
+        scenarioRefusal:
+          type: object
+          description: >-
+            server >= 7.131.0 — present ONLY when the scenario gate refused (and then `servers` is absent); the panel still answers 200 because the ledger half
+            (`lastLegMcp`) does not depend on the scenario. Exactly one of `servers` / `scenarioRefusal` is present (the `oneOf` above; `degraded` only beside `servers`). Members = the body of the same refusal answered
+            whole-face (503 on `GET /v1/capabilities/mcp` / `GET /v1/sessions/{id}/a2a`), byte-equal (one sentence builder): today `errorCode`
+            `state.scenario_assignment_unknown`, `error` naming the scenario and this deployment's roster, `detail: { scenario, source }` with `source` one of
+            `ruling` (the center assigned this principal a scenario this deployment does not have) / `deployment` (a dangling `DEFAULT_SCENARIO`; sema-server refuses
+            to boot on it, only an embedder's own `resolveSpec` reaches it). A gate that throws something that is not a typed refusal is still a 500.
+          required: [errorCode, error]
+          additionalProperties: true
+          properties:
+            errorCode: { type: string }
+            error: { type: string }
+            detail:
+              type: object
+              required: [scenario, source]
+              properties:
+                scenario: { type: string }
+                source: { type: string, description: '`ruling` / `deployment` today; read open.' }
         lastLegMcp:
           type: object
           description: >
@@ -14636,6 +14959,10 @@ components:
         row (`status` / `instanceId`) — zero extra reads — and a cross-principal caller never reaches these codes
         (the owner gate answers `not_found.run`, same code and text as the unknown arm). Both dispositions are the
         same: stop retrying the handle, read the run's own outcome via GET /v1/runs/{taskId}.
+    SettingsHooksConfigPath:
+      type: array
+      items: { type: [string, integer] }
+      description: 'the coordinate of a `settings.hooks` verdict — segments relative to the request body''s `settings` (caller-text segments echo-bounded). SDK `SettingsHooksConfigPath`.'
     ErrorResponse:
       type: object
       description: >
@@ -14766,7 +15093,9 @@ components:
             unreadable) / `unreachable` (unreachable / 5xx / timeout / bad body / any status other than 200 / 409 / 400 / 401 / 403 —
             center 404 / 429 / 3xx included). On 400 `request.field_invalid` for a `settings.permissions` bucket (server >= 7.106.0 /
             S-904): `over_cap` (more than `cap` entries; beside `count` + `cap`) / `bad_entry` (a non-string or empty item; beside
-            `index`). On 400 `rules.inert_entry` (server >= 7.129.0): the engine's `ALLOW_ENTRY_INERT_REASONS` (`tool_name` / `wildcard_all` / `namespace_wildcard` / `content_unsupported` / `grammar` / `near_miss` / `earlier_grammar`). Out-of-vocabulary word ⇒ treat as unknown. (Other codes carry their own `reason` words.)
+            `index`); server >= 7.132.0 widens that group to every tool-name list on the body, the agent definitions and the two host-path lists, and adds
+            `too_long` (a text over its character cap; beside `count` + `cap`) — closed words `over_cap` / `too_long` / `bad_entry` (SDK `RequestFieldRefusalExtra`); server >= 7.133.0 adds `too_large` (a payload over its BYTE cap, only on 413 `request.payload_too_large`: `{ field: "body", reason: "too_large", cap }` — `count` ABSENT when the read stopped at the cap and cannot measure; a request body over 8 MiB is now always that 413) and the `request.invalid_json` reasons `not_json` | `not_object` (400, every JSON-body door; formerly `request.rejected`/`request.body_shape` by door).
+            On 409 refusals of a resume (server >= 7.132.0): the engine's `CheckpointErrorReason` arm (`detail.reason` passed through; see `blockedBy`). On 400 `rules.inert_entry` (server >= 7.129.0): the engine's `ALLOW_ENTRY_INERT_REASONS` (`tool_name` / `wildcard_all` / `namespace_wildcard` / `content_unsupported` / `grammar` / `near_miss` / `earlier_grammar`). Out-of-vocabulary word ⇒ treat as unknown. (Other codes carry their own `reason` words.)
         retryAfterSec:
           type: number
           description: >-
@@ -14782,7 +15111,10 @@ components:
             carry their own `field`: the bucket on `rules.inert_entry`, the offending key on `rules.invalid_shape`.) Resume legs carry the same group on 409 `resume_blocked_by_policy`
             (`blockedBy: "request.field_invalid"`). Also on 409 `checkpoint.config_refused` (server >= 7.113.0): which part of the
             row's configuration was refused — `taskConfig` (change the configuration, then decide the SAME card again) or
-            `inheritedGate` (the row's recorded mode seed is bad — the run can only be cancelled). Also on 400 `request.field_invalid` for a
+            `inheritedGate` (the row's recorded mode seed is bad — the run can only be cancelled) and — core 7.53.0 / server >= 7.132.0 — `deps` (the deployment's OWN
+            seat is broken: fix the deployment, then decide the SAME card again). server >= 7.132.0: on 400 `request.field_invalid` cap / bad-entry refusals `field` is
+            the IN-BODY COORDINATE of the capped / bad place (`skills[1].allowedTools`, `agents[0].denyTools[3]`, `agents`, `allowTools`, `additionalDirectories` …) —
+            the same group as `reason` / `count` / `cap` / `index`. Also on 400 `request.field_invalid` for a
             `settings.hooks` tool-event matcher that selects an engine alias but not its canonical name (server >= 7.115.0 / S-1025):
             `field` is always the literal `settings.hooks` (see `detail`). Also on 400 `request.body_shape` (server >= 7.119.0), on the THREE
             tool-approval decision doors (`POST /v1/tool-approvals/{id}/respond`, `POST /v1/tasks/{taskId}/asks/{askId}/decision`,
@@ -14800,33 +15132,163 @@ components:
             `request.field_invalid` for a `settings.hooks` tool-event matcher (server >= 7.115.0 / S-1025; additive, the sentence and the code
             are unchanged): an OBJECT `{ event, alias, canonical }` — `event` = the tool event of the refused group (the first refused one when
             several are), `alias` / `canonical` = the engine catalog's alias and canonical name (closed strings, never the caller's raw bytes),
-            beside `field: "settings.hooks"`. On 400 `request.field_invalid` for the two `POST /v1/adoption` principal sentences (adoption):
+            beside `field: "settings.hooks"`; 🔴 server >= 7.126.0 adds `reason` (`dead_alias` / `over_budget` / `invalid_regex`) and server >= 7.132.0 makes EVERY
+            `settings.hooks` refusal carry this object with `path` ALWAYS present (the coordinate of the verdict, a segment array relative to the body's `settings`):
+            the matcher forms (+ `budget_exceeded` with `totalMs`), the config reader's piece codes (+ `key`), `unsupported_entry_type` (+ `type`), the service caps
+            `over_cap` / `too_long` (+ `count` / `cap`) and `unnamed_refusal` — see the hooks branch below and SDK `SettingsHooksRefusalDetail`. On 400
+            `config.user_attachment_invalid` (server >= 7.132.0 / core 7.53.0): an OBJECT `{ path, index? }` — the field the engine names at the head of the sentence,
+            `index` (0-based) only when the sentence names one attachment (SDK `UserAttachmentRefusalExtra`). On 400 `request.field_invalid` for the two `POST /v1/adoption` principal sentences (adoption):
             a human-readable STRING. Other codes (core `checkpoint.*` mirrors; `rules.*` refusals carry no `detail` — their keys are `field` / `entry` / `reason` / `verdict` / `currentName` / `guidance` / `got` at the top level) carry their
             own `detail`; read it by `errorCode`. SDK: `err.extra.detail` (verbatim, unnamed).
           oneOf:
             - type: object
-              required: [event, alias, canonical]
+              description: 'the `settings.hooks` refusal detail (beside `field: "settings.hooks"`), one shape per `reason` — branch on `reason`, exhaustively (SDK `SettingsHooksRefusalDetail`). server >= 7.132.0: every hooks refusal carries it and `path` is always present; in-floor older servers: the three matcher shapes without `path` (7.126.0–7.131.x) and the reason-less dead-alias shape (7.115.0–7.125.x).'
+              oneOf:
+                - type: object
+                  description: 'matcher: selects an engine alias but not its canonical name (`path` absent on server 7.126.0–7.131.x).'
+                  required: [reason, event, alias, canonical]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [dead_alias] }
+                    event: { type: string }
+                    alias: { type: string }
+                    canonical: { type: string }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                - type: object
+                  description: 'matcher: one regex evaluation over the per-evaluation budget (`path` absent on server 7.126.0–7.131.x).'
+                  required: [reason, event, groupIndex, budgetMs]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [over_budget] }
+                    event: { type: string }
+                    groupIndex: { type: integer }
+                    budgetMs: { type: integer }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                - type: object
+                  description: 'matcher (server >= 7.132.0): the completed regex evaluations of one admission summed over `totalMs`.'
+                  required: [reason, event, groupIndex, totalMs, path]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [budget_exceeded] }
+                    event: { type: string }
+                    groupIndex: { type: integer }
+                    totalMs: { type: integer }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                - type: object
+                  description: 'matcher: the regex does not compile (`path` absent on server 7.126.0–7.131.x).'
+                  required: [reason, event, groupIndex]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [invalid_regex] }
+                    event: { type: string }
+                    groupIndex: { type: integer }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                - type: object
+                  description: 'the config reader''s classifier code verbatim (server >= 7.132.0; SDK `SETTINGS_HOOKS_PIECE_CODES`), `key` = the key that broke that piece when named.'
+                  required: [reason, path]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [guard-outside-hooks, hooks-is-matcher, guard-under-unknown-event, guard-event-not-array, guard-matcher-invalid, guard-entry-invalid, hooks-not-object, unknown-event, event-not-array, matcher-invalid, entry-invalid] }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                    key: { type: string }
+                - type: object
+                  description: 'an entry type this service does not execute (server >= 7.132.0).'
+                  required: [reason, path, type]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [unsupported_entry_type] }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                    type: { type: string }
+                - type: object
+                  description: 'a service cap (server >= 7.132.0).'
+                  required: [reason, path, count, cap]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [over_cap, too_long] }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                    count: { type: integer }
+                    cap: { type: integer }
+                - type: object
+                  description: 'the classifier refused without naming a piece — contract drift, fail-closed (server >= 7.132.0).'
+                  required: [reason, path]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [unnamed_refusal] }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                - type: object
+                  description: 'one of the three wire keys this service reads itself is malformed (server >= 7.133.0): the group `source` / a command entry''s `plugin` / `args`; `key` names it, `path` is its coordinate. The whole request is refused (they used to be stripped silently as unknown keys).'
+                  required: [reason, key, path]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [wire_key_invalid] }
+                    key: { type: string }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                - type: object
+                  description: 'server 7.115.0–7.125.x: the dead-alias matcher refusal before `reason` existed.'
+                  required: [event, alias, canonical]
+                  additionalProperties: false
+                  properties:
+                    event: { type: string }
+                    alias: { type: string }
+                    canonical: { type: string }
+            - type: object
+              description: '400 `config.user_attachment_invalid` (server >= 7.132.0): the field the engine names; `index` only when one attachment is named.'
+              required: [path]
               additionalProperties: false
               properties:
-                event: { type: string }
-                alias: { type: string }
-                canonical: { type: string }
+                path: { type: string }
+                index: { type: integer }
             - type: object
               required: [scenario, source]
               additionalProperties: false
               properties:
                 scenario: { type: string }
                 source: { type: string, enum: [ruling, deployment] }
+            - type: object
+              description: >-
+                server >= 7.133.0 — entry problems on a tool-name list / settings-rule refusal (400 `request.field_invalid`, 422): `problems` (at most 1000, each EntryProblem) + `total` (the true count; `total > problems.length` => cut).
+                With `callerTrust` it is the below-trust-floor refusal: the caller's admission tier (`global` | `project`, read open; the same words as `capabilities.settings.permissions.callerTrust`).
+              required: [problems, total]
+              additionalProperties: false
+              properties:
+                problems: { type: array, items: { $ref: '#/components/schemas/EntryProblem' } }
+                total: { type: integer }
+                callerTrust: { type: string }
+            - type: object
+              description: >-
+                server >= 7.133.0 — 400 `request.field_conflict`: the request body contradicts itself. `kind` = which constraint (a CLOSED fourteen-word set, read open: cascade_verify | image_profile | resume_anchor |
+                system_prompt_fold | file_history_restore | skills_disabled | existing_session | scratchpad_root | ask_answer | policy_person_ask | plan_edit | plan_mode_after | bound_call_door | remember_decision);
+                `fields` = the named body coordinates, subject first (at least one; a dynamic index reads `agents[1].skills`); `count` / `cap` only on the fold-cap kind (the folded total and its cap).
+              required: [kind, fields]
+              additionalProperties: false
+              properties:
+                kind: { type: string }
+                fields: { type: array, items: { type: string } }
+                count: { type: integer }
+                cap: { type: integer }
+            - type: object
+              description: '409 `conflict.session_placed` (server >= 7.133.0): the session sync commit targeted a session that holds a delegated agent''s transcript. `placement_kind` is the stored placement kind (today only `subagent`; read open).'
+              required: [placement_kind]
+              additionalProperties: false
+              properties:
+                placement_kind: { type: string }
             - type: string
         count:
           type: integer
-          description: 'S-904 `reason: over_cap` only — how many entries the bucket had (server >= 7.106.0). SDK: `err.extra.count`.'
+          description: '`reason: over_cap` / `too_long` / `too_large` — how much was sent (entries / characters / bytes; every capped face since >= 7.132.0). ABSENT on the unmeasured form (a body read that stopped at the cap). SDK: `err.extra.count`.'
         cap:
           type: integer
-          description: 'S-904 `reason: over_cap` only — the bucket cap (1000). SDK: `err.extra.cap`.'
+          description: '`reason: over_cap` / `too_long` / `too_large` — the cap (1000 for a permissions bucket; per face otherwise; bytes on a too_large 413). SDK: `err.extra.cap`.'
         index:
           type: integer
-          description: 'S-904 `reason: bad_entry` only — the index of the first bad item; ABSENT when the bucket itself is not an array. SDK: `err.extra.index`.'
+          description: '`reason: bad_entry` only — the index of the first bad item; ABSENT when the list itself is not an array. SDK: `err.extra.index`.'
+        wallSource:
+          type: string
+          description: >-
+            server >= 7.132.0, on a 413 refused against the database's limits — WHERE THE WALL'S NUMBER CAME FROM. On `request.payload_too_large` (a submit body over
+            the database's single-row / packet wall): `reported` (the database's own number) / `assumed` (not reported — engine facts not established yet, or that
+            wall's read failed and fell back to the documented default; refusing conservatively). On `blob_too_large_for_sql` (`PUT /v1/sessions/{id}/sync/blobs/{hash}`):
+            `operator` (the operator's `SNAPSHOT_BLOB_SQL_MAX_BYTES`) / `reported` / `assumed`. Two closed sets, one per face (SDK `SqlWallSource` / `BlobSqlCapSource`).
         blockedBy:
           type: string
           description: >-
@@ -14837,11 +15299,19 @@ components:
             `ResumeBlockedByPolicyError.blockedBy` (`undefined` when the key is absent or not a string — never defaulted).
             server >= 7.117.0 adds a third fold source: a stored skill `disallowedTools` entry the engine now reads as nothing (the submit leg's 400 `request.field_invalid` sentence)
             ⇒ `blockedBy: "request.field_invalid"`, refused before the claim; the terminal-run steer leg answers it before minting the wake card.
+            server >= 7.132.0 / core 7.52.0: also on an ENGINE-refused resume (the five resume legs, the PARKED redemption seat and the SLA deny sweep share one body):
+            the engine's `detail.code` passes through as `blockedBy` (today only `checkpoint.config_refused` carries it — the closed set is core's
+            `CHECKPOINT_CONFIG_REFUSAL_CODES`, 40 words since core 7.53.0; read it as "the errorCode a fresh run would report for the same bad configuration"),
+            next to `field` and `reason`, absent keys not minted (SDK `ResumeRefusalExtra`).
 
     ResumeLegConflictError:
       description: >
         The 409 body of a RESUME LEG that core refused BEFORE the claim (`POST /v1/approvals/{sessionId}/decide`,
-        `POST /v1/sessions/{sessionId}/wake`): `ErrorResponse` plus the one key those 409s may add, `retriable`. The key is declared HERE and
+        `POST /v1/sessions/{sessionId}/wake`): `ErrorResponse` plus the one key those 409s may add, `retriable`. server >= 7.132.0: ONE writer and one
+        rule — on the three kinds of resume refusal (the server's own stored-body replay refusal, the admission-policy fold `resume_blocked_by_policy`, an
+        engine-refused resume) `retriable: true` is present <=> a pending card is still waiting and the run row stays `suspended`; so `resume_blocked_by_policy`
+        now carries it too, and the terminal-run `POST /v1/runs/{id}/steer` refusal before a wake card is minted carries none (the `checkpoint.unsupported_version`
+        allow-reading / mode-reading arms used to claim `true` there). The key is declared HERE and
         not on the shared `ErrorResponse` on purpose (codex r1 [medium], sdk 16.0.0): `ErrorResponse` is the body of every error
         response in this document, and declaring `retriable` there would offer a retry signal on 401 / 404 / 422 / 5xx bodies where the
         server never mints it. (`ErrorResponse` stays open, so a validator cannot REJECT the key elsewhere; the confinement is that only
@@ -14920,6 +15390,8 @@ components:
         - $ref: '#/components/schemas/Event_message_committed'
         # [2373]A-2(2026-08-03,server 5.0.0):compaction_outcome 三腿同源批的 spec 半场(SDK 臂 20867e1 同批)。
         - $ref: '#/components/schemas/Event_compaction_outcome'
+        # server 7.132.0(core 7.53.0 #2008):压缩开始帧,与 compaction_outcome 同一族的三腿同源白名单构造器。
+        - $ref: '#/components/schemas/Event_compaction_started'
         # [2400] ch2(SDK 4.2.0):CB-1 流控帽帧 + TR-7 durable 五臂 —— 两侧同缺,见各 schema 处的注。
         - $ref: '#/components/schemas/Event_error'
         - $ref: '#/components/schemas/Event_question'
@@ -14942,6 +15414,11 @@ components:
         - $ref: '#/components/schemas/Event_tool_approval_complete'
         - $ref: '#/components/schemas/Event_approval_request'
         - $ref: '#/components/schemas/Event_approval_revoke'
+        # server >= 7.133.0 (sdk 25.0.0): the card family's single-card CLOSE frame (`approval_complete`; one frame family per leg — it replaces the legacy
+        #   `tool_approval_complete` on a leg where `capabilities.approvalFrameFamilies` = ["approval_request"]) and the LIVE-ONLY `session_titled` frame (a session
+        #   title was written; never ledgered, no eventId).
+        - $ref: '#/components/schemas/Event_approval_complete'
+        - $ref: '#/components/schemas/Event_session_titled'
         # sdk 9.1.0: two LIVE-leg arms the service has been emitting while neither this union nor the
         #   SDK's declared them — `text_end` since server 7.66.0 (segment boundary; retires the idle-flush
         #   heuristic) and `tool_roster_delta` since server 7.70.0 (run-time roster change). A generated client
@@ -14990,6 +15467,7 @@ components:
           needs_review: '#/components/schemas/Event_needs_review'
           message_committed: '#/components/schemas/Event_message_committed'
           compaction_outcome: '#/components/schemas/Event_compaction_outcome'
+          compaction_started: '#/components/schemas/Event_compaction_started'
           error: '#/components/schemas/Event_error'
           question: '#/components/schemas/Event_question'
           question_complete: '#/components/schemas/Event_question_complete'
@@ -15002,6 +15480,8 @@ components:
           tool_approval_complete: '#/components/schemas/Event_tool_approval_complete'
           approval_request: '#/components/schemas/Event_approval_request'
           approval_revoke: '#/components/schemas/Event_approval_revoke'
+          approval_complete: '#/components/schemas/Event_approval_complete'
+          session_titled: '#/components/schemas/Event_session_titled'
           text_end: '#/components/schemas/Event_text_end'
           tool_roster_delta: '#/components/schemas/Event_tool_roster_delta'
           reasoning_end: '#/components/schemas/Event_reasoning_end'
@@ -15031,13 +15511,18 @@ components:
         condition: durable-ledger leg only (no ledger => neither header nor frame). sessionId rides along
         (needed to bind subsequent turns when the server minted a fresh session). Always precedes any content
         frame. NOT an engine event — server-minted, no EventIdentity.
-      # 封闭:铸造点 routes/tasks.ts 是逐字写死的三键字面量(sessionId 条件在场)。
+      # 封闭:铸造点 routes/tasks.ts 是逐字写死的三键字面量(sessionId 条件在场);server >= 7.133.0 起第四个条件键 `warnings`(有才发)。
       additionalProperties: false
       required: [type, taskId]
       properties:
         type: { const: meta }
         taskId: { type: string }
         sessionId: { type: string }
+        warnings:
+          type: array
+          items: { $ref: '#/components/schemas/EntryProblem' }
+          description: 'server >= 7.133.0, present only when non-empty: the accept-time NOTICES for entries of the allow-side selector lists (root / agent `allowTools`) the engine reads as nothing or that are not in the roster. Same list as the 202 receipt''s and the sync 200 body''s `warnings`. ABSENT = no notice (older servers too).'
+
     Event_reasoning:
       type: object
       description: durable stream only — turn-aggregated thinking.
@@ -15629,6 +16114,29 @@ components:
             WHO ASKED. Same-present/same-absent as `settlement` (I1). CLOSED here (archive read, `GateRecordAskOrigin`) — see the
             note above.
 
+    McpProbeFaceRow:
+      # server 7.133.0: the face''s row = the wiring-manifest row projection + TWO face-only optional keys. The manifest row is CLOSED (so an `allOf` over it would reject the two extra keys), hence a
+      # standalone closed schema whose per-key shapes are `$ref`s into WiringManifestMcpEntry's own properties (one source per shape); the key SET is pinned by test (manifest row keys + the two).
+      type: object
+      description: >
+        One row of the no-run MCP status face (GET /v1/capabilities/mcp and POST /v1/capabilities/mcp/probe): the SAME projection a prepared leg pushes onto `wiring_manifest.mcp[]`, PLUS two optional keys only this
+        face carries (server >= 7.133.0). `toolNames` = the tool names this server will mount (the same probe reading `servers[i].tools`, engine namespace form `mcp__<server>__<tool>`, after the schema gate and the per-server
+        allow-list; the server neither composes nor renames), at most 200 per server, the reading-order prefix. ABSENT = an older server or no `tools` in that server's reading — NEVER invent `[]` (it would read as "this server
+        has no tools"); a present `[]` is real. `toolNamesTruncated` = TRUE-ONLY: the list was cut (more than 200; exactly 200 is NOT cut and the key stays absent, never `false`) — when true `toolCount` is the true count, not
+        `toolNames.length`. A misaligned reading (not an array / count differs from the row count) answers 500 `internal.error` on both doors instead of shipping a list that could be paired wrongly.
+      additionalProperties: false
+      required: [name, status]
+      properties:
+        name: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/name' }
+        status: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/status' }
+        source: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/source' }
+        toolCount: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/toolCount' }
+        errorCode: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/errorCode' }
+        delivered: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/delivered' }
+        httpStatus: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/httpStatus' }
+        liveness: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/liveness' }
+        toolNames: { type: array, items: { type: string }, maxItems: 200 }
+        toolNamesTruncated: { type: boolean, enum: [true] }
     McpProbeFace:
       type: object
       description: >
@@ -15654,8 +16162,8 @@ components:
           description: 'How long this reading may be reused (seconds; 30s per identity + declaration set server-side). A hit inside the window does NOT count against the rate limit.'
         servers:
           type: array
-          items: { $ref: '#/components/schemas/WiringManifestMcpEntry' }
-          description: 'One row per declaration, SAME ROW SHAPE as the wiring manifest, index-aligned (see this schema''s description).'
+          items: { $ref: '#/components/schemas/McpProbeFaceRow' }
+          description: 'One row per declaration, the wiring-manifest row shape plus (server >= 7.133.0) this face''s two optional keys, index-aligned (see this schema''s description).'
 
     McpLivenessState:
       type: string
@@ -15936,6 +16444,9 @@ components:
             summaryMs: { type: integer }
             persistMs: { type: integer }
             ptlRetries: { type: integer }
+        pass:
+          type: string
+          description: 'server >= 7.132.0 (core 7.53.0 #2008): the id of the compaction pass that LANDED — the same opaque value its `compaction_started.pass` carried. Pair the start with its end on `pass`, not on "the next `compacted`" (legs interleave on one stream). Absent = an older server / a pass that never announced a start.'
     Event_suggestions:
       type: object
       description: >
@@ -15969,7 +16480,7 @@ components:
         type: { const: status }
         # 🔴 A-057.27:6 员(此前只列 4,漏 recovered/gave_up 两个**终局**值 —— 一段重试序列恒恰一终局帧,
         # 两者对渲染方是同一句话「把重试行撤下来」)。闭集声明、开集读。
-        phase: { type: string, description: "rate_limited | retrying | reconnecting | circuit_open | recovered | gave_up (closed in core, read as open set)" }
+        phase: { type: string, description: "rate_limited | retrying | reconnecting | circuit_open | recovered | gave_up | waiting_first_token (core's seven words since core 7.3.1 — `waiting_first_token` observes a first-token wait before any failure and carries `elapsedMs` / `timeoutMs`, never a retry countdown; closed in core, read as open set)" }
         detail: { type: string, description: "neutral human hint (NO provider/HTTP detail)" }
         retryInSec: { type: number }
         # 🔴 A-057.26:以下四键 server 真在发(builder brainStatusEventData,三腿共享),而本 schema 是
@@ -15978,7 +16489,7 @@ components:
         attempt: { type: number, description: "1-based index of the attempt that just FAILED (this wait precedes attempt+1)" }
         maxRetries: { type: number, description: "retry budget of the lane in force (refused-connect short lane = 2)" }
         retryInMs: { type: number, description: "same number as retryInSec at ms precision (countdown rendering)" }
-        errClass: { type: string, description: "connect_refused | transport | rate_limit | server | http | output_cap — retry-wait frames ONLY; never inferred from phase" }
+        errClass: { type: string, description: "connect_refused | transport | stall | rate_limit | server | http | output_cap (core's seven words since core 7.14.0 — `stall` = this process's own stall watchdog cancelled the request) — retry-wait frames ONLY; never inferred from phase" }
         providerCondition: { type: string, description: "server >= 7.126.0 (core 7.49.0 #1454, passed through verbatim): what the provider said about the account / capacity — core's closed `PROVIDER_CONDITIONS`; a retry frame carries only the three retryable words `throttled | overloaded | unknown` (`quota_exhausted` / `stop_other` do not retry and ride the terminal `detail.providerCondition`). Presence law as `errorStatus`; read as an OPEN set (keep a default arm). ABSENT = not judged, read the same as `unknown` (back off, do not assert quota). Moves with `providerConditionSource`." }
         providerConditionSource: { type: string, description: "server >= 7.126.0 (core 7.49.0 #1454): the evidence the `providerCondition` verdict rests on — `unified_header | provider_code | status`; present exactly when `providerCondition` is; read as an OPEN set." }
         retryAtMs: { type: number, description: "server >= 7.52.0 (core 7.0.0): the WALL-CLOCK end of the wait = `Date.now() + retryInMs` at emit, on the emitting process's clock (not monotonic — never compare it with a local monotonic timer). `retryInMs` stays the authoritative RELATIVE amount; this is the producer's absolute note (a reader several hops away recomputing it would reset the countdown on every replay). Moves with `retryInMs`; absent ⇒ not minted." }
@@ -16101,9 +16612,12 @@ components:
         `message_committed` + stream order). Live emissions PRECEDE the commit and omit `entryId`.
         SERVICE PROJECTION: core's `principal` is deliberately NOT forwarded (the stream is already owner-scoped —
         the frame does not restate the tenant). `issuer` / `actor.id` / `actor.issuer` are host-derived identity
-        strings and arrive SECRET-REDACTED. Server >= 7.127.0 does NOT project core 7.50.0's `attachments` member (always absent here)
-        and does not accept the engine's request-layer `userAttachments` key: a submit / resume body carrying it is 400
-        `request.body_shape` (named in `unknownKeys`).
+        strings and arrive SECRET-REDACTED. REQUEST-LAYER ATTACHMENTS (server >= 7.131.0 / core 7.50.0): the frame of the objective that declared
+        attachments (`carrier: "objective"`, `delivery: "applied"`) carries `attachments` — one item per attachment, in declared order (submit key
+        `TaskRequest.userAttachments`; probe `Capabilities.userAttachments`). It is the ADMISSION outcome, not delivery: each attachment's message lands as its
+        own `message_committed{role:"user"}`. Attachments ride the objective only: a steer door (run / child / workflow child steer, child resume, interrupt
+        bare or with text) carrying `userAttachments` is 400 `request.body_shape` (named in `unsupportedKeys`), and resume / delivery legs do not rebuild it.
+        (7.127.0 – 7.130.x did not accept `userAttachments` and never carried `attachments`; the capability bit is absent there.)
       allOf: [{ $ref: '#/components/schemas/EventIdentity' }]
       additionalProperties: false   # 封闭 + identity 本地镜像:见 Event_reasoning 处的长注
       required: [type, inputId]
@@ -16134,6 +16648,23 @@ components:
             hostAsserted: { type: boolean }
             issuer: { type: string }
         entryId: { type: string, description: 'The committed session entry this input became (absent on the live pre-commit emission).' }
+        attachments:
+          type: array
+          description: >-
+            server >= 7.131.0 (core 7.50.0): the per-attachment ADMISSION outcome of the request-layer attachments this objective declared, one item per
+            attachment in declared order; present only on that objective's frame. The server copies each member key only when well-formed (a non-object member is
+            not minted); `ordinal` / `outcome` / `label` are required members of the engine's `HumanInputAttachment` (core 7.53.0), hence `required` here. `ordinal` 1-based; `kind` the engine-recognized kind (absent when unreadable; read open); `outcome` `attached` / `partial` / `unchanged` /
+            `not_attached` (engine words, verbatim — a file the engine may not read is NOT refused: its message still goes out saying why, and its outcome is
+            `not_attached`); `label` the path or name the caller declared, credential-redacted.
+          items:
+            type: object
+            required: [ordinal, outcome, label]
+            additionalProperties: false
+            properties:
+              ordinal: { type: integer }
+              kind: { type: string }
+              outcome: { type: string }
+              label: { type: string }
         eventId: { type: string }
         parentToolCallId: { type: string }
         sourceTaskId: { type: string }
@@ -16313,19 +16844,22 @@ components:
             already owns the single redaction mint point for it). The actionable cause is `errorCode`.
             A row missing `name` or `status` is dropped individually — the other servers'' rows still ship.
           items: { $ref: '#/components/schemas/WiringManifestMcpEntry' }
-        hooks:
+        mods:
           type: array
           description: >
-            core 7.18.0 (#789), server >= 7.78.0 — TENANT-visible: the hook seats THIS leg wired, one row per
-            family, in core's declaration order. EFFECTIVE half only.
-            🔴 PRESENT IFF at least one seat is wired — core NEVER emits an empty array, so "the key is here"
-            means non-empty. 🔴 ABSENCE READS "this leg wired no hook RECORD of its own", NOT "no hook runs":
-            a delegated child with no local record can still be screened (and refused) by an ANCESTOR's
-            `preToolUse` through the gate's constraint fold, which this face deliberately does not call a hook
-            of this leg. A row missing `family` or `owner` is dropped INDIVIDUALLY (same rule as `mcp[]`); all
-            rows dropped => the key is absent. 🔴 EXCLUDED from `configFingerprint` (the record is a per-task
-            seat), so two legs with the same fingerprint and different `hooks[]` are NOT in contradiction.
-          items: { $ref: '#/components/schemas/WiringManifestHookEntry' }
+            core 7.52.0, server >= 7.132.0 (BREAKING — replaces `hooks[]`, which is gone with no alias) — TENANT-visible: this leg's MODS ADMISSION record, one row
+            per registration of the two seats (deployment, task), in the engine's run order (tier, then deployment before task, then seat order). Two row forms
+            (`WiringManifestModEntry`): a MOUNTED registration `{ name, seat, tier, events, observe?, skipped? }` — `events` / `observe` are the patterns it actually
+            hung (observe-only ones in `observe`), `skipped[]` the judges skipped while it was judged — or a REFUSED one `{ name, seat, tier, refusedBy, reason }`.
+            Registrant strings (`name`, `refusedBy`, `reason`, every `skipped[]` member) go out through the server's one wire-text exit (credential shapes
+            replaced, length-capped) — the same one the `engine_notice` `mods.registration_refused` detail uses, so the same refusal reads byte-equal on both;
+            `seat` / `tier` / `events` / `observe` are engine words passed through verbatim (vocabulary owner core; read open). PRESENT IFF the leg carries a
+            registration — on this server always (it mounts the permission-denied meter on every leg: `server.permission-denied-meter`; `TOOL_TRACE=true` adds
+            `server.tool-trace`, a branded deployment `server.brand-identity`; a single-user request's `settings.hooks` is the task-seat registration
+            `settings.hooks`). 🔴 ABSENCE READS "this leg carries no registration", NOT "no extension judges this leg's calls" (a delegated child can still be
+            screened through an ancestor's chain). A row that reads as neither form is dropped individually; all dropped => key absent. EXCLUDED from
+            `configFingerprint` (the task seat is per task). EFFECTIVE half only.
+          items: { $ref: '#/components/schemas/WiringManifestModEntry' }
         lsp:
           allOf: [{ $ref: '#/components/schemas/WiringManifestLspSeam' }]
           description: >
@@ -16400,6 +16934,12 @@ components:
             (`capabilities.rewindFiles`); only a run the REQUEST word turned off cannot restore itself.
             OPEN on read: the server does not enumerate the word (a present non-string is dropped), a third word passes
             through — treat it as unknown. ABSENT = an older engine / external derivation, never "capturing".
+        permissionMode:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestPermissionMode' }]
+          description: >-
+            server >= 7.133.0 (core 7.53.0; TENANT and OPERATOR faces alike) — this leg's PERMISSION-MODE receipt `{ requested?, effective, foldedBy? }`; the shell renders its mode indicator from `effective`
+            (`foldedBy` present = the requested mode was folded), never from the word it sent. ABSENT = an older engine / server, not an assertion of the default mode. Effective half only (this frame);
+            the same section rides the non-streaming `wiringManifest` receipt and the ledger row. Section shape: WiringManifestPermissionMode.
         instructions:
           allOf: [{ $ref: '#/components/schemas/WiringManifestInstructions' }]
           description: >
@@ -16722,6 +17262,26 @@ components:
         was armed but declined/failed (check the store, check authorisation), `false` = there was no lane at all
         (wire one up). The two recovery verbs differ, so a consumer MUST render them apart — NEVER fold them into
         one "nobody approved it".
+        server 7.132.0 adds three codes to the user whitelist (appendix D.3 38 -> 41; all audience `user` in core's register) and changes one value:
+        `config.session_rules_earlier_grammar` (core 7.53.0) — the session's STORED permission rules hold entries the grammar they were written in reads as nothing
+        (an allow entry admits nothing; a `toolDeny` entry this engine reads as no rule makes those rules REFUSE EVERY CALL until an operator rewrites the row
+        without its rev). `{ bucket, storedGrammar, entries: [{ entry, reader }], rewrite: { by, stampsGrammar }, rulesSessionId, sessionId }` — `entries` every
+        one the engine handed over (the session-stream row passes the generic notice-detail bound: at most the first 32, no truncation mark — the full list is on
+        the ops log line), `entry` the redacted rule text (the same reading as `permission.allowed_tool_not_granted`'s `entries[].entry`), `reader` one of
+        `no_rule` / `named_no_tool`, `rewrite.by` = `operator_write_without_rev` (closed words owned by core, echoed — read open); `rulesSessionId` = whose
+        rules (an ancestor's on a delegated child), `sessionId` = the run that read them. Once per distinct entry set per bucket per rule layer.
+        `mods.registration_refused` (core 7.52.0) — an extension registration was NOT mounted (another registration's `plugin.register` judge refused it); the leg
+        runs without it. `{ name, seat, tier, refusedBy, reason, sessionId }` — `seat` / `tier` engine words (echoed), `reason` the refusing registration's own
+        words (UNTRUSTED-for-display); the same strings read byte-equal with the `wiring_manifest.mods[]` refused row. Unreachable on this server today (it wires
+        no `plugin.register` judge). Once per leg per registration.
+        `route.credential_origin_mismatch` (core 7.52.0) — a request was REFUSED and nothing was sent: this model's own credential is bound to the host it first
+        went to and this request goes to another (the entry's `baseUrl` moved host, the credential stayed; a same-host path move does not count). The request's
+        own failure carries the same code. `{ modelId, boundOrigin, requestOrigin, sessionId, runId }` — both origins in display spelling (scheme + host +
+        port, no userinfo / path), never a credential or a digest of one. Once per run per (modelId, boundOrigin, requestOrigin). It replaces the retired
+        operator code `route.base_url_changed_key_unchanged` (never on this whitelist). `config.credential_not_withheld` is operator-audience — ops log only.
+        Value change: `permission.rule_row_dropped`'s `detail.rows[].rule` is, since core 7.53.0, the rule's original text (the same reading as
+        `allowed_tool_not_granted`'s `entries[].entry`: at most 1 024 code points, longer cut to 1 024 + a truncation mark, CONTROL CHARACTERS RIDE AS DATA —
+        neutralize at render); before it was the engine-neutralized single-line form (at most 201 code points). Same keys.
         `server.model_unreachable` (server-minted, audience `user`; server >= 7.108.0, `taskId` added in server 7.121.0) — a model call on
         this leg ended in error and its last request failed AT CONNECT (VPN switched mid-session / the proxy read at boot went stale / the
         gateway is gone) — not the provider's answer. `{ code, targetHost, proxyInUse?, remedy, sessionId, taskId? }`: `code` one of the
@@ -16963,56 +17523,78 @@ components:
             一律按不可分辨处理,消费方不要猜。
 
     PromptManifest:
-      # 新增(2026-07-25 回填批):server ≥1.219 的 prompt-assembly manifest。此前本文件完全没有它(全文 0 次提及),
-      # 尽管它同时是 `AgentEvent.prompt_assembled` 臂和 trace 流 `prompt-assembled` 帧的载荷。
       type: object
       description: >
-        The prompt-assembly manifest (core's `prompt.assembled` trace contract verbatim). Carries ONLY
-        ids/digests/counts — NEVER prompt bodies (privacy boundary). 🔴 Hashes are PROCESS-SALTED: they are NOT
-        comparable across worker restarts, so a UI must never diff them cross-process. `constitution`/`blocks`/
-        `totalChars` are the v1 face; `sections`/`tools` are the v2 ADDITIVE face (absent on a v1-only engine).
-        ⚠️ One task can carry MULTIPLE manifests — a cascade/verify run re-prepares under one taskId and every
-        rung's manifest is persisted in emission order.
-      required: [constitution, blocks, totalChars]
+        The prompt manifest v3 (server >= 7.132.0 = engine 7.52.0 manifest v3; BREAKING): WHICH prompt this leg ran (`identity` + its selector values `selectors`),
+        which blocks and sections it is made of, and where each section's text came from (`chain`; superseded overlays in `superseded`). IDs / sizes / digests
+        only — NEVER prompt text. One row per prepare (cascade / verify re-prepare under one taskId, rows in order). Three exits carry the SAME stored row
+        verbatim: the ledger replay `prompt_assembled`, the turns `prompt-assembled` block, the trace SSE `prompt-assembled` frame. Members = the engine frame
+        minus its envelope (`kind` / `version` / `taskId` / `ts`) and `snapshot` / `lowering` (server `promptManifestRecordOf`).
+        READING: EVERY member may be absent — an optional member absent means "none", never an empty value; a member present but unreadable is not put on the
+        row (`identity` / `selectors` as whole sentences, sections / blocks / `superseded` / tools one row at a time), so a v3 row without `identity` means the
+        engine's identity did not read (dropped and counted), NOT an old row. An empty list is a statement (`tools: []` = zero tools). Words (band names,
+        activations, source classes, renderer ids, host role / form) are engine vocabulary, passed through verbatim — read open.
+        🔴 THE ONE READING OF "WHICH PROMPT DID THIS LEG RUN" IS `identity`. BREAKING (no alias): v2's top-level `constitution` is gone (the constitution band
+        is locked and engine-composed; a prompt carrying locked text verbatim is refused before the run, `prompt.assembled_role_refused`); `sections[]` lost
+        `slot` / `carrier` / `cadence` / `cacheClass`, `hash` became `contentHash` (`sha256:` unsalted for published text, `salted:` for text carrying the task's
+        or the run's own inputs) and gained `band` (always) / `variant?` / `renderer?` / `locale` / `chain`; the row gained `identity` / `selectors` / `superseded?`.
+        ⚠️ Rows written by <= 7.131.x keep the v2 shape (the server neither re-reads nor rewrites them) — see PromptManifestRow: a row carrying `constitution`
+        is such an old row. ⚠️ Block `hash` is a PROCESS-SALTED short digest — not comparable across worker restarts.
+      # 不封闭(`additionalProperties: true`):本 schema 是 `Event_prompt_assembled` 的 allOf 目标(帧上多一个 `type`),封闭会把合法帧判成违约(见 Event_reasoning 处的长注)。
+      # 与旧行的互斥由 `not: { required: [constitution] }` 一句写死(v3 行永不带它),`PromptManifestRow` 的 oneOf 因此恰中一臂。
       additionalProperties: true
+      not: { required: [constitution] }
       properties:
-        constitution:
-          type: string
-          description: 'who owned the constitution layer — `core` is the steady state; anything else is worth eyes.'
-          enum: [core, replaced, provider-assembled, legacy]
-          x-open-enum: true
+        identity: { $ref: '#/components/schemas/PromptManifestIdentity' }
+        selectors:
+          type: object
+          description: 'the run''s selector values (core `PromptManifestSelectors`) — the plain form of `identity.layers.binding`. `binding` = the scenario name (server >= 7.132.0 always writes `TaskSpec.promptBinding`).'
+          additionalProperties: false
+          required: [traits, host, facts]
+          properties:
+            binding: { type: string }
+            traits: { type: array, items: { type: string } }
+            host:
+              type: object
+              additionalProperties: false
+              required: [role, form]
+              properties:
+                role: { type: string, description: 'engine word (`general` / `code` / `coordinator` / `cowork` today); read open.' }
+                form: { type: string, description: 'engine word (`standard` / `minimal` today); read open.' }
+            facts: { type: object, additionalProperties: { type: boolean } }
         blocks:
           type: array
           items:
             type: object
+            additionalProperties: false
             required: [id, chars, hash]
-            additionalProperties: true
             properties:
               id: { type: string }
               chars: { type: integer }
-              hash: { type: string, description: 'process-salted digest — never compare across restarts.' }
+              hash: { type: string, description: 'process-salted short digest — never compare across restarts.' }
         sections:
           type: array
-          description: 'v2 additive face — absent on a v1-only engine.'
+          items: { $ref: '#/components/schemas/PromptManifestSection' }
+        superseded:
+          type: array
+          description: 'every overlay the composition superseded (a later one on the same target won, or it changed nothing this run); absent when none was.'
           items:
             type: object
-            required: [id, slot, carrier, cadence, cacheClass, chars, hash]
-            additionalProperties: true
+            additionalProperties: false
+            required: [id, source, by, target, supersededBy]
             properties:
               id: { type: string }
-              slot: { type: string }
-              carrier: { type: string }
-              cadence: { type: string }
-              cacheClass: { type: string }
-              chars: { type: integer }
-              hash: { type: string }
+              source: { type: string }
+              by: { type: string }
+              target: { type: string }
+              supersededBy: { type: string, description: 'the winning overlay id, or the literal `(absent this run)`.' }
         tools:
           type: array
-          description: 'v2 additive face — the tool contract summary.'
+          description: 'the mounted tools plane — per-tool contract identity, durable-replay aliases, shape digest and full wire-schema digest (initial mount face; deferred activations announce via tools_delta).'
           items:
             type: object
+            additionalProperties: false
             required: [wireName, aliases, contractId, implementationRevision, cardId, shapeDigest, wireSchemaDigest]
-            additionalProperties: true
             properties:
               wireName: { type: string }
               aliases: { type: array, items: { type: string } }
@@ -17021,7 +17603,72 @@ components:
               cardId: { type: string }
               shapeDigest: { type: string }
               wireSchemaDigest: { type: string }
+        toolDisclosure:
+          type: object
+          description: 'the resolved deferred-tool disclosure strategy (core `ToolDisclosureManifest`); absent when the leg deferred nothing.'
+          additionalProperties: false
+          required: [deferredTools, strategy, source]
+          properties:
+            deferredTools: { type: integer }
+            strategy: { type: string, description: '`swap` / `static`; read open.' }
+            source: { type: string, description: '`spec` / `env` / `default` / `degraded_no_direct_lane`; read open.' }
         totalChars: { type: integer }
+    PromptManifestIdentity:
+      type: object
+      description: 'the run''s prompt identity as the manifest reports it (core `PromptManifestIdentity`): `artifact` = the identity digest, `layers` = its inputs, `epoch` / `activatedBy` = the session epoch record that names it.'
+      additionalProperties: false
+      required: [artifact, layers, epoch, activatedBy]
+      properties:
+        artifact: { type: string }
+        layers: { $ref: '#/components/schemas/PromptIdentityLayers' }
+        epoch: { type: integer }
+        activatedBy: { type: string, description: 'core `PROMPT_EPOCH_ACTIVATIONS` word; read open.' }
+    PromptManifestSection:
+      type: object
+      description: 'one rendered section (core `PromptManifestSection`).'
+      additionalProperties: false
+      required: [id, band, rank, chars, locale, contentHash, chain]
+      properties:
+        id: { type: string }
+        band: { type: string }
+        rank: { type: number }
+        variant: { type: string }
+        renderer:
+          type: object
+          additionalProperties: false
+          required: [id, version]
+          properties:
+            id: { type: string, description: 'core `RENDERER_IDS` word; read open.' }
+            version: { type: number }
+        chars: { type: integer }
+        locale: { type: string, description: '`canonical` (the catalog''s text) / `overlay` (text an overlay author wrote); read open.' }
+        contentHash: { type: string, description: '`sha256:<hex>` unsalted for published text, `salted:<hex>` for text carrying the task''s or the run''s own inputs.' }
+        chain:
+          type: array
+          items:
+            type: object
+            additionalProperties: false
+            required: [source]
+            properties:
+              source: { type: string, description: '`bundled` or an overlay source class; read open.' }
+              overlay: { type: string }
+              op: { type: string }
+              superseded: { const: true }
+    PromptManifestRetiredRow:
+      type: object
+      description: >
+        A `prompt_assembled` row written by a <= 7.131.x server (the v2 shape: top-level `constitution` + slot-keyed sections). The server neither re-reads nor
+        rewrites it, so a run parked before the upgrade and resumed after carries both shapes in its ledger. The ONE discriminator (owned by the server contract):
+        `constitution` present <=> an old row (old rows always carry it, v3 rows never do). Its members are deliberately NOT typed here (the v2 reading is retired).
+      required: [constitution]
+      additionalProperties: true
+      properties:
+        constitution: { type: string }
+    PromptManifestRow:
+      description: 'One row on the three manifest exits: a v3 row (PromptManifest) or an old row (PromptManifestRetiredRow) — tell them apart by the presence of `constitution`.'
+      oneOf:
+        - $ref: '#/components/schemas/PromptManifest'
+        - $ref: '#/components/schemas/PromptManifestRetiredRow'
 
     Event_file_link:
       type: object
@@ -17053,7 +17700,7 @@ components:
         manifest's own keys sit at the top level next to `type`, they are NOT nested under a `manifest` key).
         Lands AHEAD of the first event of the turn it prepared. ⚠️ MULTIPLE per task on cascade/verify runs.
       allOf:
-        - $ref: '#/components/schemas/PromptManifest'
+        - $ref: '#/components/schemas/PromptManifestRow'
       required: [type]
       properties:
         type: { const: prompt_assembled }
@@ -17172,7 +17819,7 @@ components:
         payload carried `type` (the read boundary emits `{type, ...data}`) so runtime discrimination worked,
         but a generated client had nothing to switch on and dropped approval cards. That gap is closed.
         The shell renders `tool_approval` as the three-choice card and dismisses it on `tool_approval_complete`.
-        Respond via POST /v1/tool-approvals/{approvalId}/respond.
+        Respond via POST /v1/tool-approvals/{id}/respond.
       required: [type, approvalId]
       additionalProperties: true
       properties:
@@ -17304,15 +17951,16 @@ components:
             (no alias): the allow-layer members that MATCHED this call and could NOT clear this ask, one `{ member, entries, omitted? }` record per
             matching member (see AllowRuleShadow). `member` is one of `hook` / `deployment` / `persisted` / `skill` / `request`; `entries` are the
             entries that member matched, as their source spells them (UNTRUSTED for display like `message`, secret-redacted, <= 512 chars each,
-            <= 32 listed; a `hook` record's `entries` is always the empty list); `omitted` counts the entries not listed.
+            <= 32 listed; a `hook` record's `entries` names the answering registration — server >= 7.132.0 / engine 7.52.0 mods: on this server only the
+            request's own `settings.hooks` answers, so `["settings.hooks"]`; it was always the empty list on <= 7.131.x); `omitted` counts the entries not listed.
 
             The explaining sentence ("... matches this call but does not clear the ask — <reason>") is IN `message` (the engine writes it where it builds
             the card); this key is the structured twin of the same fact. Render a line from it ("your rule matched, but this call must be confirmed each
             time"): without it the only conclusion a user can draw is "my rule broke".
 
             🔴 ABSENT != "you have no rule": present only when a member matched AND could not clear the ask; a match that cleared never becomes an ask.
-            🔴 `member: "hook"` does not say whose hook (a deployment PreToolUse hook and, on the single-user lane, the request's own `settings.hooks`
-            share one member). 🔴 Deliberately SEPARATE from `governanceForced` (that one: "who imposed the gate"; this one: "what happened to YOUR
+            🔴 `member: "hook"` names the answering registration in `entries` (server >= 7.132.0; the deployment seat's registrations are observers and never
+            answer — on <= 7.131.x the record could not say whose hook). 🔴 Deliberately SEPARATE from `governanceForced` (that one: "who imposed the gate"; this one: "what happened to YOUR
             rule"). What the allow layer can NOT clear: any layer's deny / ask rule, operator `APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO` /
             `MANUAL_MODE_SHELL_GATE=always`, write protection, sensitive-path writes, governance, a hook's ask, plan-mode asks. The durable dual is
             `gate.riskDescriptor.allowRuleShadowed` on the parked row (PendingCheckpoint.riskDescriptor). Rolling-upgrade caveat: a card stored by a
@@ -17567,8 +18215,8 @@ components:
 
     # ── design/172 流内审批协议(#151)—— 已随 server 7.3.0 上线;开关 STREAM_APPROVAL_ENABLED 的默认值
     #    分两段:server ≤7.4.0 默认 OFF,≥7.5.0 默认 ON(BREAKING,见 server CHANGELOG)。──
-    # 与上面的 ToolApprovalFrame 是**并行加帧,不替换**:开关打开时同一只 ask 出两帧(先 tool_approval,
-    # 后 approval_request),两帧同带 `approvalId` ⇒ 消费端按它去重、优先渲染新帧。
+    # 与上面的 ToolApprovalFrame 是两个帧族,**一条腿只走一个**(server >= 7.133.0,capabilities.approvalFrameFamilies):呈卡协议上场的腿上一只 ask 只出本族的帧、
+    # 旧族一帧都不发,消费端不再按 `approvalId` 去重;≤7.132.x 的呈卡腿两族并发(先 tool_approval、后 approval_request,同带 `approvalId`)⇒ 按它去重、优先渲染新帧。
         classifierUnavailable:
           $ref: '#/components/schemas/ClassifierUnavailable'
           description: >-
@@ -17610,6 +18258,14 @@ components:
                 (a malformed shape, or a `dir` over 1024 UTF-16 code units ⇒ the key is ABSENT — never truncated,
                 because a truncated directory is a DIFFERENT directory and adding it would not clear this ask;
                 see the STRING-LENGTH UNIT convention in `info.description` for this `maxLength`'s counting unit).
+            covers:
+              allOf: [{ $ref: '#/components/schemas/ReadRootCover' }]
+              description: >-
+                Optional (engine core 7.22.0 `ReadRootGrantCandidate.covers`; the server carries it through key by key). ABSENT ⇒ `dir` is a DIRECTORY
+                (adding it to the read roots releases what lies under it). `exact` ⇒ `dir` is the path the command NAMED, offered verbatim
+                (a file or one concrete path, not a directory containing it): the consumer ADDS the string itself — expanding it into a
+                pattern grants nothing — and must not render the offer as "add directory". The domain is the single word `exact`
+                (a word outside it makes the server drop the whole candidate). The `approval_request` frame reads this very definition.
             clearsThisAsk:
               type: boolean
               enum: [true]
@@ -17690,8 +18346,23 @@ components:
         approvalId:
           type: string
           description: >
-            Bridge to the legacy frame / dedupe key — same value as the parallel tool_approval frame. During the
-            transition window POST /v1/tool-approvals/{approvalId}/respond still works.
+            The id of POST /v1/tool-approvals/{id}/respond and GET /v1/tool-approvals/{id}. server >= 7.133.0: ALWAYS EQUAL TO `askId` (the row's key is the ask's one wire
+            identity; a 64-character lowercase hexadecimal string — treat it as an OPAQUE string, never parse it as a uuid); the matching close frame `approval_complete` carries it too.
+            On server <= 7.132.x it is the legacy bridge / dedupe key (a uuid, the same value as the parallel tool_approval frame).
+        # ── server >= 7.133.0: the TEN off-card LIVE facts on the opening frame's top level (one frame family per leg) ──────────────────────────
+        #   Same keys, same shapes, same values as on the legacy `tool_approval` frame (each is a `$ref` into ToolApprovalFrame's own property — one
+        #   source per shape). Only the frame minted LIVE carries them (and what the durable ledger recorded of that frame): a disconnect-replay frame
+        #   (rebuilt from `card_json`) never does. Absence means "this frame does not carry it", not "there is none". See APPROVAL_REQUEST_LIVE_FACT_KEYS (sdk) / the server's twin.
+        mandated: { $ref: '#/components/schemas/ToolApprovalFrame/properties/mandated' }
+        mandate: { $ref: '#/components/schemas/ToolApprovalFrame/properties/mandate' }
+        origin: { $ref: '#/components/schemas/ToolApprovalFrame/properties/origin' }
+        boundGrantDigest: { $ref: '#/components/schemas/ToolApprovalFrame/properties/boundGrantDigest' }
+        boundGrants: { $ref: '#/components/schemas/ToolApprovalFrame/properties/boundGrants' }
+        classifierNoRuling: { $ref: '#/components/schemas/ToolApprovalFrame/properties/classifierNoRuling' }
+        boundGrantAbsence: { $ref: '#/components/schemas/ToolApprovalFrame/properties/boundGrantAbsence' }
+        approvalCard: { $ref: '#/components/schemas/ToolApprovalFrame/properties/approvalCard' }
+        readRootCandidate: { $ref: '#/components/schemas/ToolApprovalFrame/properties/readRootCandidate' }
+        probeReason: { $ref: '#/components/schemas/ToolApprovalFrame/properties/probeReason' }
 
     ApprovalCard:
       type: object
@@ -17756,7 +18427,7 @@ components:
           items: { $ref: '#/components/schemas/AllowRuleShadow' }
           description: >
             ADDITIVE (server >= 7.117.0 / core 7.42.0, BREAKING RENAME of the retired `persistedRuleShadowed`): the allow-layer members that matched this
-            call and could not clear this ask. Semantics, the five members, the always-empty `hook` entries, the explaining sentence living in `message`,
+            call and could not clear this ask. Semantics, the five members, the `hook` record naming its registration (server >= 7.132.0; always empty before), the explaining sentence living in `message`,
             the ABSENT != "you have no rule" clause and the separation from `governanceForced` are stated verbatim on ToolApprovalFrame.allowRuleShadowed
             — the live frame, the stored `card_json`, the replayed frame and the `approval_request` card carry the SAME material.
         fromSubagent: { type: boolean, enum: [true], description: 'Present ⇔ the ask comes from a DELEGATED child — the explicit discriminator (a worker cannot forge it).' }
@@ -17954,6 +18625,13 @@ components:
         and a word outside the set all read as ABSENT — a card without this word must not be treated as "approving it grants nothing else"; whether to render "allow for this session" is `rememberRefused`.
         Display metadata, never an adjudication input. CLOSED: the server narrows with the engine's members, anything else reads as absent.
 
+    ReadRootCover:
+      type: string
+      enum: [exact]
+      description: >
+        The closed vocabulary of `readRootCandidate.covers` (engine core 7.22.0 `ReadRootGrantCandidate.covers`; the server's narrow read `readReadRootCandidate` drops the whole
+        candidate for a word outside it). One word today: `exact` — `dir` is the path the command NAMED, not a directory containing it. The SDK exports the same table as
+        `READ_ROOT_COVERS` and its `isApprovalRequestFrameV1` judges `covers` by membership in it; a source-level anchor reads the word off the server's minting site and the engine's type.
     PersistedRuleMandate:
       type: string
       enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved]
@@ -18367,6 +19045,40 @@ components:
         depth: { type: integer, description: 'Delegation depth (a direct child of the host = 1).' }
         agentName: { type: string, description: 'Child agent name. UNTRUSTED — spawning-model free text (server-redacted and length-bounded).' }
 
+    ApprovalCompleteFrame:
+      type: object
+      description: >
+        The CLOSE frame of the card family (`approval_complete`; server >= 7.133.0; SSE, `type` IS the event name; the durable leg appends the same frame, so it replays through
+        GET /v1/runs/:id/events as the `Event_approval_complete` arm). ONE FRAME FAMILY PER LEG: on a leg where the card protocol is on (`capabilities.approvalFrameFamilies`
+        = `["approval_request"]`) one ask travels only `approval_request` -> `approval_complete` / `approval_revoke`; the legacy `tool_approval` / `tool_approval_complete` pair is NOT sent
+        (BREAKING vs <= 7.132.x, which sent both families for one ask; remedy on the worker: `STREAM_APPROVAL_ENABLED=false`).
+        Same meaning as the legacy `tool_approval_complete` (one settle, one verdict: the `outcome` three words, the non-human `cause`, the park-route `parked`); dismiss the card by the opening frame's
+        `askId`. Division of labour with ApprovalRevokeFrame: the revoke frame is BATCH-level (siblings voided by a winner), this one is the SINGLE card's end (answered / window expired / park route / cancelled);
+        one ask can receive both — clearing by `askId` is enough. The gate is "this connection's opening frame was actually delivered". The frame is a notification, the row is the source of truth: a lost
+        frame is compensated by the open-stream preamble (see ApprovalRequestFrame). THIS SCHEMA DESCRIBES v1 ONLY (read it as ApprovalFrameEnvelope first; the SDK's `isApprovalCompleteFrameV1` narrows).
+      required: [type, schemaVersion, askId, taskId, approvalId, outcome, serverNowMs]
+      additionalProperties: true
+      properties:
+        type: { type: string, enum: [approval_complete] }
+        schemaVersion: { type: integer, enum: [1], description: 'This schema describes v1 only (see ApprovalFrameEnvelope for the unknown-version read).' }
+        askId: { type: string, description: 'The durable identity — dismiss the card by it (the same key as the opening frame''s `askId`).' }
+        taskId: { type: string, description: 'wire run id (same as the opening frame).' }
+        approvalId: { type: string, description: 'Always equal to `askId` (same as the opening frame).' }
+        outcome:
+          type: string
+          enum: [allowed, denied, expired]
+          description: 'How the ask settled — the same three words as the legacy frame: `allowed` / `denied` = a decision; `expired` = a non-human ending (the reason is in `cause`).'
+        cause:
+          allOf: [{ $ref: '#/components/schemas/ApprovalSettleCause' }]
+          description: >-
+            The non-human ending''s cause (present only on `outcome: "expired"`; the fourteen words of the approval seat''s ending-cause set, the same word as on the audit settle row). A human answer carries none.
+            ABSENCE IS NOT EVIDENCE.
+        parked:
+          type: boolean
+          enum: [true]
+          description: 'TRUE-ONLY: this ask itself ended on the park route (row moved to PARKING / PARKED; a late answer is reachable). Absent = no evidence — NEVER read as a real denial.'
+        serverNowMs: { type: integer, description: 'Server clock at mint time.' }
+
     ApprovalRevokeFrame:
       type: object
       description: >
@@ -18666,7 +19378,7 @@ components:
       description: >
         server >= 7.126.0 (sdk 21.1.0 `APPROVAL_DECIDE_GATE_KINDS`, verbatim and in order; single owner = server
         `APPROVAL_GATE_KINDS`) — the parked gate kinds the DURABLE decision door `POST /v1/approvals/{sessionId}/decide`
-        accepts (the live `POST /v1/tool-approvals/{approvalId}/respond` answers the same card family). A parked row of
+        accepts (the live `POST /v1/tool-approvals/{id}/respond` answers the same card family). A parked row of
         kind `plan_review` goes to the plan-review door instead (`PlanReviewGateKind`); `resource_limit` / `needs_review` /
         `task_done` have no human decision door (resume / terminal). Clients route a pending row by reading this set,
         never by a hand-written copy of it.
@@ -18681,7 +19393,7 @@ components:
       enum: [person, policy]
       description: >
         server >= 7.118.0 (`APPROVAL_DECIDED_BY`, verbatim and in order) — WHO made an approval decision, one key on all three decision
-        doors (live `POST /v1/tool-approvals/{approvalId}/respond`, durable `POST /v1/tasks/{taskId}/asks/{askId}/decision`, durable
+        doors (live `POST /v1/tool-approvals/{id}/respond`, durable `POST /v1/tasks/{taskId}/asks/{askId}/decision`, durable
         `POST /v1/approvals/{sessionId}/decide`). `person` = a person decided through the approval channel (ABSENT means this);
         `policy` = this deployment's own policy decided (a rule / posture answering on someone's behalf, a headless lane) — BOTH
         directions: the engine records `tool_end.gate.settlement.kind` = `policy_allowed` / `policy_refused` (`who.party: "policy"`).
@@ -18773,6 +19485,20 @@ components:
             `updatedInputForwarded` this field IS persisted, so an idempotent replay DOES promise byte-identity.
             The 409 `conflict.ask_decided` body echoes the same field — and there it is always the FIRST
             decision's note, not the one the rejected request carried.
+        noteRecorded:
+          type: boolean
+          description: >
+            server >= 7.133.0, ADDITIVE: did the `note` THIS request carried land as the row's text? Present ONLY when the request carried a `note`. `true` <=> the row's `decisionNote` is
+            verbatim the text this request submitted (text that happens to be identical counts even if someone else wrote it first); `false` = not confirmed (the row holds another reason /
+            the store could not be read back). Same shape and meaning as `noteRecorded` on the live respond ack and on its replayed arm (one judgement for the three doors). Carried by the
+            first-decision and idempotent-replay forms; the PARKED redemption leg does not carry it (read it as unknown). ABSENT is not `false`.
+        consumerState:
+          type: string
+          enum: [absent]
+          description: >
+            TRUE-ONLY disclosure (present as `absent`): no engine leg on THIS replica is waiting for this ask — the decision is on the row (an idempotent replay will read it, the audit surface keeps it)
+            but nothing running here resumes because of it (the holder of the suspended promise may be another replica, or this replica restarted and its local window is empty). Read the RUN surface to
+            learn whether anything continued; NEVER take a 200 without this key as proof the run continued (older servers never send it). Not a 409 / 410: the decision DID take effect.
 
     QuestionFrame:
       type: object
@@ -19067,6 +19793,31 @@ components:
         outcome: { type: string }
         trigger: { type: string, description: 'engine-shaped; current emitters send auto | manual | forced' }
         reason: { type: string }
+        pass:
+          type: string
+          description: >-
+            server >= 7.132.0 (core 7.53.0 #2008): the id of the pass this frame CONCLUDES (= its `compaction_started.pass`). PRESENT <=> that pass announced a start,
+            so only on `failed` / `mooted` (a pass that ran its summary and did not land, or was cut while it ran — `mooted` with `reason: "task_ending"` = the task's
+            own end cut the running summary, a form this frame closes since core 7.53.0). `blocked` / `suppressed` / `disabled` / `noop` and a manual request no
+            boundary served carry none (those passes never started).
+        eventId: { type: string }
+        parentToolCallId: { type: string }
+    Event_compaction_started:
+      type: object
+      description: >
+        server >= 7.132.0 (core 7.53.0 #2008) — a compaction pass is UNDER WAY: announced at the pass's commit point (trigger gate passed, a cut point exists,
+        `preCompact` did not block), BEFORE the summary call, so a summary waiting out a provider's retries is no longer silent on the stream. Projected verbatim by
+        ONE whitelist builder (server `compactionStartedEventData`) on the live stream and both durable ledgers (bg / resume; `GET /v1/runs/{id}/events`); the
+        §2.3 trace stream does not carry it. PAIRING: exactly one frame concludes the pass with the SAME `pass` — `compacted` when it lands,
+        `compaction_outcome` (`failed` / `mooted`) when it does not; "compacting" runs from this frame to that one (or the stream's end), elapsed = now − startedAt.
+        A segment boundary, like `compacted` / `compaction_outcome`. Servers <= 7.131.x never send it. Identity: the same TWO keys as `compaction_outcome`.
+      additionalProperties: false   # 封闭:铸造点 `compactionStartedEventData` 只投这三键 + 身份两键
+      required: [type, trigger, pass, startedAt]
+      properties:
+        type: { const: compaction_started }
+        trigger: { type: string, description: 'the same vocabulary (and the same value) as the frame that concludes the pass — engine-shaped, read open; today auto | manual | forced.' }
+        pass: { type: string, description: 'the pass identity: an opaque engine-minted id, unique across runs — pair on it alone.' }
+        startedAt: { type: integer, description: 'engine clock, epoch ms, at the moment the pass committed.' }
         eventId: { type: string }
         parentToolCallId: { type: string }
     Event_config_assembled:
@@ -19282,7 +20033,7 @@ components:
     Event_tool_approval:
       description: >
         DURABLE-leg replay of the legacy tool-approval OPEN frame. Same payload as ToolApprovalFrame with the
-        discriminant narrowed to `tool_approval`. Settle it via POST /v1/tool-approvals/{approvalId}/respond.
+        discriminant narrowed to `tool_approval`. Settle it via POST /v1/tool-approvals/{id}/respond.
         Anchor the card on `toolCallId` (NOT `approvalId`); render `governanceForced` as a non-bypassable
         "forced by governance" badge. UNTRUSTED for display: `message`/`args` are redacted but model-authored.
       allOf:
@@ -19305,9 +20056,11 @@ components:
             type: { type: string, enum: [tool_approval_complete] }
     Event_approval_request:
       description: >
-        The design/172 in-stream approval card as an AgentEvent arm. PARALLEL to `tool_approval`, not a
-        replacement: with the protocol on, one ask emits BOTH frames (legacy first) carrying the SAME
-        `approvalId` — dedupe on it and prefer this arm. The decision key is `askId`; settle via
+        The design/172 in-stream approval card as an AgentEvent arm. ONE FRAME FAMILY PER LEG (server >= 7.133.0,
+        `capabilities.approvalFrameFamilies`): on a leg where the card protocol is on, one ask emits only this family
+        (`approval_request` -> `approval_complete` / `approval_revoke`) and none of the legacy `tool_approval` family,
+        so there is nothing to deduplicate. On server <= 7.132.x the two families ran side by side (legacy first) carrying
+        the SAME `approvalId` — there, dedupe on it and prefer this arm. The decision key is `askId`; settle via
         POST /v1/tasks/{taskId}/asks/{askId}/decision.
 
         🔴 THIS ARM IS THE OPEN ENVELOPE, NOT `ApprovalRequestFrame`, AND THAT IS DELIBERATE. The v1 frame
@@ -19354,6 +20107,37 @@ components:
           properties:
             type: { type: string, enum: [approval_revoke] }
 
+    Event_approval_complete:
+      description: >
+        The card family's single-card CLOSE frame as an AgentEvent arm (server >= 7.133.0). One frame family per leg: with `capabilities.approvalFrameFamilies` = `["approval_request"]` this frame
+        REPLACES the legacy `tool_approval_complete` (one ask no longer travels two families). Live SSE and the durable ledger replay carry the same shape (same settle, same verdict: `outcome`,
+        non-human `cause`, `parked`).
+        🔴 THIS ARM IS THE OPEN ENVELOPE, NOT `ApprovalCompleteFrame` — same ruling as Event_approval_request / Event_approval_revoke: narrow with `schemaVersion == 1` (SDK:
+        `isApprovalCompleteFrameV1`) before touching `outcome` / `cause` / `parked`; a frame that does not narrow still dismisses the card by its `askId` (when it has one) — never guess the outcome.
+        🔴 Consumption discipline: (a) dismiss by the opening frame's `askId`; (b) a ledger-replayed frame is for TIMELINE RENDERING ONLY — the card-set baseline stays the open-stream preamble;
+        (c) NEVER derive the run's fate from this frame (read the run row / checkpoint face); (d) it does not conflict with ApprovalRevokeFrame — one ask can receive both.
+      allOf:
+        - $ref: '#/components/schemas/ApprovalFrameEnvelope'
+        - type: object
+          required: [type]
+          properties:
+            type: { type: string, enum: [approval_complete] }
+    Event_session_titled:
+      description: >
+        server >= 7.133.0 — the session title was WRITTEN (contract §4a-ttl): the title generator wrote the title into the session row and minted this frame on THE RUN'S LIVE STREAM afterwards.
+        🔴 LIVE-ONLY, NEVER STORED: the session row (`GET /v1/sessions` list row `title`) is the single source of the title; this frame only says "the row just changed". It is not ledgered
+        (GET /v1/runs/:id/events replay never carries it), not part of any replay surface, and has NO `eventId` (no SSE `id:` line, no part in the `Last-Event-ID` cursor). Only a leg holding a live stream
+        receives it (today `POST /v1/tasks/stream`); the sync-JSON leg and the durable background leg structurally cannot. NOT sent when the session already has a title, on a user rename / pin
+        (`PATCH /v1/sessions/{id}` does not go through the generator), with `SESSION_AUTO_TITLE=false`, after `done`, or once the connection is gone. THE FRAME MAY NOT ARRIVE — the title is whatever
+        the session row says: refresh on the frame, read the row on cold start / another window / reconnect. `title` has passed the generator's redaction and cleaning and is the SAME value as the row's
+        (still UNTRUSTED for display — model-authored text).
+      type: object
+      required: [type, sessionId, title]
+      additionalProperties: false
+      properties:
+        type: { type: string, enum: [session_titled] }
+        sessionId: { type: string, description: 'The session whose row was just written.' }
+        title: { type: string, description: 'The title that landed in the session row (redacted and cleaned; bounded by the server''s TITLE_MAX_CHARS).' }
     # ── resources/*.ts schema backfill, batch 2 (2026-07-28) — the 28-item WIRE_PENDING ratchet zeroed.
     #    Each schema below is cross-checked against the server source (file:line cited in its description
     #    or in the SDK resource JSDoc it mirrors). Wire objects are OPEN sets (additionalProperties: true).
@@ -19378,6 +20162,10 @@ components:
         sessionId: { type: string, description: '`resolved` frames: which pending settled.' }
         toolCallId: { type: string, description: '`resolved` frames: the settled pending''s bound tool-call id (absent when the pending carried none).' }
         count: { type: integer, description: '`synced` frames: how many pendings the connect-time snapshot carried.' }
+        checkpointId: { type: string, description: '`pending` frames only (server >= 7.133.0): the spread PendingCheckpoint row''s `checkpointId` (key absent when the row has no trusted value — read as "no joinable identity").' }
+        consumerState: { type: string, enum: [absent], description: '`live_pending` frames only (server >= 7.133.0): the spread LivePendingRow''s true-only `consumerState` (no engine leg on this replica is waiting for the ask).' }
+        errorCode: { type: string, description: '`error` frames: the machine code (`STREAM_MAX_DURATION` / `draining` / server >= 7.133.0 `approvals.read_unavailable` — the stream STAYS open, do NOT reconnect on it — / `approvals.read_corrupt` — a corrupt row was read, the server closes the stream after the frame).' }
+        message: { type: string, description: '`error` frames: the human sentence (redacted); never match on it.' }
         hasBidiControls:
           type: boolean
           enum: [true]
@@ -19498,20 +20286,24 @@ components:
 
     FleetHookNotice:
       description: >
-        Hook observability payload, TWO kinds (service fleet-bus.ts `HookNotice` minus the wire-stripped
+        Hook observability payload, FOUR kinds (server >= 7.133.0 added `hook_managed_unrun` and `hook_verdict_untrusted`; service fleet-bus.ts `HookNotice` minus the wire-stripped
         ownerScope/ownerSessionId — the payload view of FleetFrame_hook_notice; a discriminated union on
         `kind`, mirroring the SDK type verbatim). Both kinds are pure observe — never block, resume, or
         inject. Visibility is fail-CLOSED: a ?session= subscriber only receives notices provably owned by
-        that session. `kind` is a CLOSED two-member set on the server (exhaustive-switch discipline) but
+        that session. `kind` is a CLOSED four-member set on the server (exhaustive-switch discipline) but
         OPEN ON READ: degrade an unknown future kind to a generic observability row, never crash.
       oneOf:
         - $ref: '#/components/schemas/FleetHookDecisionUnavailable'
         - $ref: '#/components/schemas/FleetHookNonBlockingFailure'
+        - $ref: '#/components/schemas/FleetHookManagedUnrun'
+        - $ref: '#/components/schemas/FleetHookVerdictUntrusted'
       discriminator:
         propertyName: kind
         mapping:
           hook_decision_unavailable: '#/components/schemas/FleetHookDecisionUnavailable'
           hook_non_blocking_failure: '#/components/schemas/FleetHookNonBlockingFailure'
+          hook_managed_unrun: '#/components/schemas/FleetHookManagedUnrun'
+          hook_verdict_untrusted: '#/components/schemas/FleetHookVerdictUntrusted'
 
     FleetHookDecisionUnavailable:
       type: object
@@ -19546,7 +20338,7 @@ components:
         reason:
           # 🔴 NO `enum` — same open-on-read ruling as kind 1 (SDK type is `... | (string & {})`).
           type: string
-          description: 'Machine-branchable failure shape. CLOSED server-side, OPEN ON READ — KNOWN WORDS TODAY: exit_nonzero | timeout | spawn_failed | bad_json.'
+          description: 'Machine-branchable failure shape. CLOSED server-side, OPEN ON READ — KNOWN WORDS TODAY: exit_nonzero | timeout | spawn_failed | bad_json | matcher_over_budget (server >= 7.133.0: the group matcher / the entry `if` name part did not finish evaluating within its 1000 ms budget on this name — NOT a broken hook script but an unevaluable selection condition; the server treats it as selected, the entry still runs; ONE frame per group, `if` one per entry, no exitCode / stderr).'
         hookName: { type: string, description: 'Hook identity (statusMessage, else command/URL/prompt; redacted + bounded, http entries stripped of query/fragment). Always sent.' }
         entryType: { type: string, description: 'command | http | prompt | agent — without it, hookName''s nature is a guess. Closed server-side, open on read. Always sent.' }
         exitCode: { type: integer, description: 'Absent for timeout/spawn_failed (no exit code exists — the server never mints a legit-looking 0).' }
@@ -19554,6 +20346,57 @@ components:
         stderr: { type: string, description: 'Redacted + truncated stderr digest (512-char cap incl. marker). Empty stderr => absent.' }
         detail: { type: string, description: 'Redacted supplement (e.g. where an exit-2 had no venue). Additive / tolerate-absent.' }
 
+    FleetHookManagedUnrun:
+      type: object
+      description: >
+        Kind 3 (server >= 7.133.0): a MANAGED hook did not complete — the group carries a `source`; managed groups (`managedPolicy` / `managedPlugin:<name>`) are the organization policy's guard and run in an independent lane
+        after the unmanaged rewrites, on the final input. A synchronous managed entry that gave neither a legal verdict (exit 0 with no verdict / a closed-set verdict) nor a legal veto (exit 2 / `decision:"block"` /
+        `continue:false`) is "unrun": on `PreToolUse` the conclusion folds to `ask` when nothing vetoed (a person in the loop; unmanaged allows are not trusted; any phase's veto is still the last vote), on other events the
+        conclusion is unchanged — but this frame is ALWAYS sent. One frame per unrun managed entry. The frame does NOT assert how the call ended (read the tool / approval frames).
+      required: [kind, event, reason, source, hookName, entryType]
+      additionalProperties: true
+      properties:
+        kind: { type: string, enum: [hook_managed_unrun] }
+        event: { type: string, description: 'Which hook event. On PreToolUse this entry sets the managed lane: with no veto the call folds to `ask`.' }
+        reason:
+          # NO `enum` — same open-on-read ruling as kinds 1 and 2.
+          type: string
+          description: >-
+            Why it did not complete. CLOSED on the server (thirteen words), OPEN ON READ — KNOWN WORDS TODAY: matcher_invalid | llm_carrier_unavailable | llm_cap | powershell_unsupported | if_unevaluable | budget_exhausted |
+            spawn_failed | timeout | exit_nonzero | bad_json | decision_out_of_set | evidence_unavailable | rewrite_unsettled. `input_truncated` / `matcher_over_budget` are NOT in this kind (they belong to kind 4).
+        source: { type: string, description: 'The group''s source word (`managedPolicy` or `managedPlugin:<name>`; the name is trace only, never a criterion).' }
+        hookName: { type: string, description: 'Hook identity (same rule as kind 2); redacted + bounded.' }
+        entryType: { type: string, description: 'command | http | prompt | agent — closed server-side, open on read.' }
+        toolName: { type: string, description: 'Present on tool events.' }
+        detail: { type: string, description: 'Redacted supplement.' }
+
+    FleetHookVerdictUntrusted:
+      type: object
+      description: >
+        Kind 4 (server >= 7.133.0): a hook's VERDICT IS UNTRUSTED — one rule: an entry that did not get the complete payload, or was pulled in BY SELECTION by an over-budget matcher, has its VETO count (deny / exit 2 /
+        `decision:"block"` / `continue:false` / ask) and its ALLOW and `updatedInput` NOT count. The rule holds on both lanes, so there is one frame; reason, lane and identity are machine fields. Emission condition per lane:
+        managed = the entry ran with an untrusted cause (sent whatever it judged; `PreToolUse` then folds to `ask` when nothing vetoed); unmanaged = it gave an allow or a real rewrite (an identity echo does not count) that was
+        dropped. Today only on `PreToolUse` (the event with an allow word). THE FRAME DOES NOT ASSERT HOW THE CALL ENDED: a managed entry that itself vetoes ends in deny with the frame sent; another trusted allow in the group still
+        lets the call through — read the call's own result. NEVER infer a call outcome from any hook_notice frame.
+      required: [kind, event, reason, lane, hookName, entryType]
+      additionalProperties: true
+      properties:
+        kind: { type: string, enum: [hook_verdict_untrusted] }
+        event: { type: string, description: 'Which hook event (today always PreToolUse).' }
+        reason:
+          # NO `enum` — same open-on-read ruling as kinds 1–3.
+          type: string
+          description: >-
+            Why the verdict is untrusted. CLOSED on the server (two words), OPEN ON READ — KNOWN WORDS TODAY: input_truncated (the entry did not get the full payload: `tool_input` over the cap was replaced by a truncation marker, or a prompt /
+            agent entry''s whole payload text was cut at the same cap) | matcher_over_budget (the group matcher / entry `if` name part ran past its budget and the entry ran BY SELECTION; the same moment also sends a kind-2 frame
+            `matcher_over_budget`).
+        lane: { type: string, description: 'The lane the entry sits in, read off the source table: `managedPolicy` / `managedPlugin:*` => `managed`, everything else and absent => `unmanaged`. Closed (two words) server-side, open on read. Read THIS field, never re-derive from `source`.' }
+        hookName: { type: string, description: 'Hook identity (same rule as kind 2); redacted + bounded.' }
+        entryType: { type: string, description: 'command | http | prompt | agent — closed server-side, open on read.' }
+        toolName: { type: string, description: 'Present on tool events.' }
+        source: { type: string, description: 'The source word the group declared (both lanes give it; ABSENT = the group declared none, so only unmanaged). Trace only, never a criterion.' }
+        detail: { type: string, description: 'Redacted supplement (human-facing; machines read `reason` / `lane`).' }
+
     BakeStatus:
       # 新(census 批2 四段)——server `BakeStatus`(plugins/store-contracts.ts), the COARSE lifecycle
       # bakeView/claimResponse/bakesCreate all key on.
@@ -19874,7 +20717,7 @@ components:
       description: >
         🔴 ONE RULE FOR EVERY "EFFECTIVE HALF ONLY" KEY (sdk 9.7.0, after a codex adversarial-review [high]):
         this schema's only consumer today is `GET /v1/diagnostics/wiring`'s `static` half, and every key marked
-        "effective half only" (`leg`, `ask.effective`, `configFingerprint`, `tools`, `hooks`, `lsp`,
+        "effective half only" (`leg`, `ask.effective`, `configFingerprint`, `tools`, `mods`, `lsp`,
         `modelGate`, `autoMode`, `writeProtection`, `readDeny`, `autoConsolidation`, `fileHistory`, `instructions`) is ALWAYS ABSENT on that
         wire ⇒ THEIR ABSENCE HERE CARRIES NO INFORMATION. The per-key absence readings ("absent = not armed",
         "absent = a third state", …) hold for the LIVE FRAME (`Event_wiring_manifest`) and must not be carried
@@ -20020,14 +20863,12 @@ components:
           properties:
             armed: { type: boolean }
             reason: { type: string }
-        hooks:
+        mods:
           type: array
           description: >
-            core 7.18.0 (#789), server >= 7.78.0 — the hook seats THIS leg wired, one row per family.
-            EFFECTIVE half only (the diagnostics endpoint's static half never carries it). Present iff at least
-            one seat is wired; absence means "no hook RECORD of this leg", never "no hook runs".
-            Full per-key contract: see Event_wiring_manifest.hooks.
-          items: { $ref: '#/components/schemas/WiringManifestHookEntry' }
+            core 7.52.0, server >= 7.132.0 (BREAKING — replaces `hooks[]`) — the leg's mods admission record, one row per registration. EFFECTIVE half only (the
+            diagnostics endpoint's static half never carries it). Full per-key contract: see Event_wiring_manifest.mods.
+          items: { $ref: '#/components/schemas/WiringManifestModEntry' }
         lsp:
           allOf: [{ $ref: '#/components/schemas/WiringManifestLspSeam' }]
           description: >
@@ -20065,6 +20906,11 @@ components:
             K-24 (server >= 7.104.0 / S-724) — does this leg capture file history (`on` / `disabled`, OPEN word). EFFECTIVE
             HALF ONLY ⇒ ALWAYS ABSENT ON THIS ENDPOINT; the deployment-level reading is `capabilities.fileHistoryCapture`.
             Full per-key contract: see Event_wiring_manifest.fileHistory.
+        permissionMode:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestPermissionMode' }]
+          description: >-
+            core 7.53.0, server >= 7.133.0 — the leg's permission-mode receipt (section shape WiringManifestPermissionMode). EFFECTIVE HALF ONLY ⇒ this (static) face NEVER carries it, and absence here carries no
+            information; the reading holds only on a live `wiring_manifest` frame.
         instructions:
           allOf: [{ $ref: '#/components/schemas/WiringManifestInstructions' }]
           description: >
@@ -20136,33 +20982,70 @@ components:
           type: array
           description: 'The selected chain member(s), spelled as the chain spells them (relative to the cwd); `[]` = the chain was walked, nothing was selected.'
           items: { type: string, enum: ['CLAUDE.md', '.claude/CLAUDE.md', 'AGENTS.md', '.claude/AGENTS.md'] }
-    WiringManifestHookEntry:
-      # sdk 9.5.0:与 `WiringManifestMcpEntry` 同一条裁定 —— 同一份行形被 live 帧与静态诊断面两处引用,
-      # 内联就是两份会各自漂的镜像,所以一开始就具名。
+    WiringManifestPermissionMode:
+      # server 7.133.0 / core 7.53.0:同一段形被 live 帧(两张脸)、静态诊断面、`POST /v1/tasks` 的 `wiringManifest` 回执与账本行引用 ⇒ 具名单源(`spec-field-drift-gate` 也按「导出的 interface 必有同名 schema」逼出它)。
+      type: object
+      additionalProperties: false
+      description: >
+        The `wiring_manifest.permissionMode` section (core 7.53.0 `PermissionModeReceipt`; server >= 7.133.0 projects it on BOTH faces — tenant and operator — and the same section rides the `wiringManifest`
+        receipt of the `POST /v1/tasks` 200 body and the `/events` ledger row; the server judges SHAPE only: `effective` a non-empty string, `requested` / `foldedBy` absent or non-empty strings, else the whole section
+        is dropped). The engine gives the same three-member receipt on EVERY mode question: `requested` = the mode word the caller declared (ABSENT = declared nothing — a root inherits `default`, a child inherits its
+        parent); `effective` = the mode the leg actually runs under (the request clamped under a parent's ceiling, then folded to `default` where the deployment denies it or the classifier face is absent) — ALWAYS present,
+        the shell renders its mode indicator from it; `foldedBy` = PRESENT IFF `requested` and `effective` differ — `operator_deny` (the deployment / organization ceiling denies the mode) / `face_absent` (`auto` needs
+        a classifier face this leg lacks) / `inherited_ceiling` (a delegated child clamped under its parent's ceiling); read OPEN (a fourth word passes through as "folded, cause unknown"). ABSENT section = an older
+        engine / server (<= 7.132.x), not an assertion of the default mode. This is ONE added key on a closed object: a consumer validating `wiring_manifest` strictly against sdk <= 24.0.0's spec fails the whole frame
+        on 7.133.0+ — upgrade to sdk 25.0.0 or relax unknown keys on this section.
+      required: [effective]
+      properties:
+        requested: { type: string, description: 'The mode word the caller declared (a PermissionMode word today; read open). ABSENT = declared nothing.' }
+        effective: { type: string, description: 'The mode the leg actually runs under (a PermissionMode word today; read open). Always present.' }
+        foldedBy: { type: string, description: 'Present iff `requested` and `effective` differ: `operator_deny` / `face_absent` / `inherited_ceiling` (engine words; read OPEN — an unknown word means "folded, cause unknown").' }
+    WiringManifestModEntry:
+      # server 7.132.0 / core 7.52.0:取代钩子席位行形(删,零别名)。同一份行形被 live 帧与静态诊断面两处引用 ⇒ 具名;两形各自具名(⑤bis 名单逐形对账)。
+      description: >
+        One row of a leg's MODS ADMISSION record (core 7.52.0 `ModAdmissionRecord`; server >= 7.132.0): a registration that was mounted, or one that was refused.
+        Discriminate on presence — a mounted row carries `events`, a refused row carries `refusedBy` + `reason` (never both).
+      oneOf:
+        - $ref: '#/components/schemas/WiringManifestModMounted'
+        - $ref: '#/components/schemas/WiringManifestModRefused'
+    WiringManifestModMounted:
       type: object
       description: >
-        One row of a leg's HOOK seat manifest (core 7.18.0 #789): which family, where the seat came from, and
-        whether the `preToolUse` row was DECLARED observational.
+        A MOUNTED registration: the patterns it actually hung (`events`), the ones it declared observe-only (`observe`, present iff any), and the judges skipped while it
+        was judged (`skipped`, present iff non-empty — absence and an empty list are both "every judge answered").
       additionalProperties: false
-      required: [family, owner]
+      required: [name, seat, tier, events]
       properties:
-        family:
-          type: string
-          description: >
-            The hook family. core's closed vocabulary today (`preToolUse` / `postToolUse` / `userPromptSubmit` /
-            `stop` / `postToolUseFailure` / `postToolBatch` / `preCompact` / `postCompact` / `stopFailure` /
-            `permissionDenied`) but READ AS OPEN: the server passes it through verbatim and does not enumerate,
-            so a newly minted family must pass through your default arm.
-        owner:
-          type: string
-          description: "Where the seat came from — core's `SeamProvenance` (`spec` / `deps`). Closed today, read as open."
-        observational:
-          type: boolean
-          enum: [true]
-          description: >
-            Only on the `preToolUse` row, and only when the deployment DECLARED the face observational: it still
-            runs on every call but is not folded into a delegated child's inherited constraints.
-            🔴 NEVER-FALSE — core's words: "Absence means 'not declared', never 'declared false'".
+        name: { type: string, description: 'the registration name (registrant text, through the server''s wire-text exit; UNTRUSTED-for-display).' }
+        seat: { type: string, description: 'which seat it came from — core `MOD_SEATS` (`deployment` / `task`). Engine word, passed through verbatim; read open.' }
+        tier: { type: string, description: 'its tier — core `MOD_TIERS` (`prepend` / `user` / `append` / `builtin` / `core`). Engine word, passed through verbatim; read open.' }
+        events: { type: array, items: { type: string }, description: 'the event patterns it actually hung (engine words, verbatim).' }
+        observe: { type: array, items: { type: string }, description: 'the patterns it hung observe-only (engine words, verbatim); absent = none.' }
+        skipped:
+          type: array
+          description: 'judges the dispatch skipped while this registration was judged (core `ModSkip`); present iff non-empty. An element missing a member is dropped individually.'
+          items:
+            type: object
+            additionalProperties: false
+            required: [registration, cause, reason]
+            properties:
+              registration: { type: string, description: 'the skipped judge''s registration name (registrant text).' }
+              cause: { type: string, description: 'why it did not answer for itself — core `MOD_FAILURE_CAUSES` today (`threw` / `timeout` / `violation` / `reentry`); read open.' }
+              reason: { type: string, description: 'the judge''s own words (registrant text, UNTRUSTED-for-display).' }
+    WiringManifestModRefused:
+      type: object
+      description: >
+        A REFUSED registration: another registration's `plugin.register` judge refused it at admission; the leg runs without it. The same refusal also reaches
+        the stream as the `engine_notice` `mods.registration_refused` (its `detail` strings read byte-equal with this row's). This deployment wires no
+        `plugin.register` judge, so it cannot happen here today.
+      additionalProperties: false
+      required: [name, seat, tier, refusedBy, reason]
+      properties:
+        name: { type: string, description: 'the refused registration (registrant text).' }
+        seat: { type: string, description: 'core `MOD_SEATS` word, verbatim; read open.' }
+        tier: { type: string, description: 'core `MOD_TIERS` word, verbatim; read open.' }
+        refusedBy: { type: string, description: 'the registration whose judge refused it (registrant text).' }
+        reason: { type: string, description: 'the refusing judge''s own words (registrant text, UNTRUSTED-for-display).' }
     WiringManifestLspSeam:
       # sdk 9.5.0:同上 —— live 帧与静态面共用一份段形。
       type: object
@@ -20339,7 +21222,9 @@ components:
           description: >
             server >= 7.60 (S-131) — this deployment's SQL engine posture (engine / version / session isolation
             level / TiDB transaction mode), READ BACK off a live connection rather than echoed from env.
-            `null` = no SQL backend. NOT YET MIRRORED KEY-BY-KEY in this SDK generation — read as opaque.
+            `null` = no SQL backend. server >= 7.132.0 adds three keys (additive): `maxRowBytes` / `maxPacketBytes` (the database's single-row / packet
+            wall; `null` = that wall does not exist) and `wallSources` (each wall's provenance, `reported` / `assumed` — what a 413 body's `wallSource` reads).
+            NOT YET MIRRORED KEY-BY-KEY in this SDK generation — read as opaque.
         configApply:
           type: ["object", "null"]
           additionalProperties: true
@@ -20644,10 +21529,218 @@ components:
         remember for this session's category (fs-write tools share ONE category: approving Write covers
         Edit/NotebookEdit; other tools are per-tool) — the CC "don't ask again this session" semantic.
 
+    ConfigCatalog:
+      type: object
+      description: >
+        The 200 body of GET /v1/config/catalog (server `ConfigCatalogWire`) — a PROJECTION, left open on read (the producer ships independently and adds keys additively between SDK releases; the request side has no body).
+      required: [catalogVersion, envLaneTiming, restartSlices, centerDomains, summary, rows, retired]
+      additionalProperties: true
+      properties:
+        catalogVersion: { type: integer, enum: [1] }
+        envLaneTiming: { type: string, description: 'The env lane''s uniform timing (`deploy`: env is immutable at runtime, so changing env = changing the deployment). Open on read.' }
+        restartSlices: { type: array, items: { type: string }, description: 'The restart-slice names a centre write can land in (open on read).' }
+        centerDomains: { type: array, items: { type: string }, description: 'The contract package''s centre-configuration domains.' }
+        summary:
+          type: object
+          required: [total, envHeld, secret, centerManaged]
+          additionalProperties: true
+          properties:
+            total: { type: integer }
+            envHeld: { type: integer }
+            secret: { type: integer }
+            centerManaged: { type: integer }
+        rows: { type: array, items: { $ref: '#/components/schemas/ConfigCatalogRow' } }
+        retired: { type: array, items: { $ref: '#/components/schemas/ConfigCatalogRetiredEnv' }, description: 'Tombstoned env names this process refuses to start on (always present, may be empty). A name is never in `rows` and here at once.' }
+    ConfigCatalogRow:
+      type: object
+      description: >
+        One catalog row (server `ConfigCatalogRow`): a deployment knob's static declaration plus this process's effective reading. OPEN on read (projection). The two VERDICT bits are the true-only family:
+        `effectiveValueInvalid` (the effective value fell outside the row's echo set; `effectiveValue` is `null`) and `effectiveValueWithheld` (server >= 7.133.0) — see the property.
+      required: [name, domain, type, semantics, writeLanes, effectiveLane, envHeld, envTiming, effectiveValue, valueClass, danger]
+      additionalProperties: true
+      properties:
+        name: { type: string, description: 'The knob (env) name; the catalog is sorted by it.' }
+        domain: { type: string, description: 'One of the nine configuration groups (store / modelPlane / approval / memory / auth / orchestration / limitsHttp / observability / integrations). Open on read.' }
+        type: { type: string, description: 'Value type: boolean | number | string | enum | csv | json | path | url | secret | opaque. Open on read.' }
+        semantics: { type: string, description: 'Human sentence (true to the read site).' }
+        writeLanes: { type: array, items: { type: string, enum: [env, center] }, description: 'Which lanes can write this knob.' }
+        effectiveLane: { type: string, description: 'The lane actually in force: env | center | default. Open on read.' }
+        envHeld: { type: boolean, description: 'This machine''s env sets it explicitly.' }
+        envTiming: { type: string, description: '`deploy` (changing env = changing the deployment) | `inert` (retired / zero-consumer key). Open on read.' }
+        staticDefault: { type: string }
+        derivedDefaultNote: { type: string }
+        effectiveValue:
+          description: 'This process''s effective DISPLAY value: a scalar / a word list / `null` (unset) / `{ present, length? }` (`secret` / `opaque` rows report presence and length only).'
+          oneOf:
+            - { type: [string, number, boolean, 'null'] }
+            - { type: array, items: { type: string } }
+            - { type: object, required: [present], additionalProperties: true, properties: { present: { type: boolean }, length: { type: integer } } }
+        valueClass: { type: string, description: '`plain` (echoable) | `secret` | `opaque` (the value never goes on the wire). Open on read.' }
+        danger: { type: array, items: { type: string }, description: 'The risk axes of a wrong setting: security | billing | data (open on read).' }
+        center: { $ref: '#/components/schemas/ConfigCatalogRowCenter' }
+        centerDomain: { type: string }
+        centerPath: { type: string }
+        scope: { type: string, description: '`bootstrap-only` = read only at start-up.' }
+        enumValues: { type: array, items: { type: string }, description: 'An `enum` row''s writable word set.' }
+        effectiveValueInvalid:
+          type: boolean
+          enum: [true]
+          description: 'TRUE-ONLY verdict bit: the effective value fell OUTSIDE the row''s own echo set (or a boolean without a declared mapping) — `effectiveValue` is then `null` (echoing an out-of-set value would teach a consumer to write back an illegal word). Enum rows only. ABSENT = this cell has no such matter.'
+        effectiveValueWithheld:
+          type: boolean
+          enum: [true]
+          description: >-
+            server >= 7.133.0, TRUE-ONLY verdict bit on `type: url` rows (present only when true, never `false`): the display mint judged this cell (single value) or any item of it (list) WITHHELD — a part the position rule
+            would have shown (the whole query / a path segment) was NOT shown because it held a credential-shaped piece. The mint owns the verdict; the catalog does not judge again. So the shown value is not the whole value:
+            a catalog page / `sema config show` marks the row ("part of this value is withheld"), and must not read the shown value as "the value is exactly that". ABSENT = nothing withheld (older servers never send it).
+            The standard position rule (userinfo landed, query values become tokens) holds for every row and is NOT a withholding; a value that became a placeholder as a whole means the row's display rule cannot show it
+            (not a hierarchical URL; the two outbound-proxy rows show only scheme://host[:port]) — also not this bit.
+    ConfigCatalogRowCenter:
+      type: object
+      description: 'A catalog row''s centre seat: whether the knob is centre-publishable, who wins, when it takes effect. Present only on rows with a centre seat.'
+      required: [domain, path, precedence, timing, managedNow, effectiveNow]
+      additionalProperties: true
+      properties:
+        domain: { type: string }
+        path: { type: string, description: 'Path in the domain (`a.b` into objects; `xs[].c` into array elements).' }
+        precedence: { type: string, description: '`center-wins` | `env-wins` (open on read).' }
+        timing: { type: string, description: '`hot` | `restart` | `inert` (open on read; not `deploy`).' }
+        restartSlice: { type: string }
+        restartReason: { type: string }
+        managedNow: { type: boolean, description: 'The centre''s latest effective config currently MANAGES this key (no config pipeline => always false).' }
+        effectiveNow: { type: boolean, description: 'The centre write is in force right now (managed AND not held down by an env placeholder).' }
+    ConfigCatalogRetiredEnv:
+      type: object
+      description: 'A tombstoned env name (the contract package''s RETIRED_ENVS wire projection): a name this process refuses to start on. `renamed` carries only `replacement`; `replaced` carries `replacement` + `reason` (how the value semantics changed); `removed` carries only `reason`.'
+      required: [name, kind]
+      additionalProperties: true
+      properties:
+        name: { type: string }
+        kind: { type: string, description: '`renamed` | `replaced` | `removed` (open on read).' }
+        replacement: { type: string }
+        reason: { type: string }
+    EntryProblem:
+      type: object
+      description: >
+        One ENTRY PROBLEM (server >= 7.133.0): a refusal body's `detail.problems[]` element and an accept-time `warnings[]` element share this shape. `code` = the refusal code the problem belongs to (in `warnings[]`: the engine's
+        reading code for that entry); `field` = the coordinate of the list holding the entry in the request body (`settings.permissions.allow`, `skills[i].allowedTools` …); `entry` = the entry string (passed through the server''s
+        redaction mouth — not a guarantee of your original bytes); `reason` = the machine reason — mostly the ENGINE''s word verbatim (why it read the entry as nothing); the server mints two of its own, `not_in_roster` (accept-time
+        warnings only: the name in an allow-side selector list is not in the roster and is no protocol namespace name — the engine accepts it anyway) and `home_unresolvable` (settings-rule 422: a `~/` path rule on a deployment that cannot
+        resolve the execution environment''s home); and `below_trust_floor` (the caller''s trust tier is below the member''s admission floor — see ErrorResponse.detail.callerTrust). Read OPEN.
+      required: [code, field, entry, reason]
+      additionalProperties: false
+      properties:
+        code: { type: string }
+        field: { type: string }
+        entry: { type: string }
+        reason: { type: string }
+    PrincipalInboxMessage:
+      type: object
+      description: 'The request body of POST /v1/principal-inbox/messages: a CLOSED three-key shape (`from` is minted by the server from the verified identity and cannot be sent).'
+      required: [to, content]
+      additionalProperties: false
+      properties:
+        to: { type: string, minLength: 1, description: 'The recipient principal string. Must belong to the sender''s organization (the membership judgement reads the organization directory); a failed judgement is 404 `org_delivery.not_member`, byte-identical to "no such person".' }
+        content: { type: string, minLength: 1, maxLength: 32000, description: 'The letter body (characters; over 32000 => 400 `request.field_invalid`).' }
+        urgent: { type: boolean, description: 'The urgent flag on the envelope (absent = ordinary).' }
+    PrincipalInboxReceipt:
+      type: object
+      description: 'The 200 receipt: the letter was appended. `receiptId` = the gate-minted delivery receipt id (the envelope''s `gateReceiptId` carries the same value).'
+      required: [receiptId]
+      additionalProperties: false
+      properties:
+        receiptId: { type: string }
+    OrgDeliveryRefusalCode:
+      type: string
+      enum: [org_delivery.not_member, org_delivery.rate_limited, org_delivery.inbox_full, org_delivery.recipient_tombstoned]
+      description: >
+        The four cross-principal delivery refusal codes (server >= 7.133.0; the engine's closed `ORG_DELIVERY_REFUSAL_CODES`, one frozen sentence each — machines read the CODE): `org_delivery.not_member` (404),
+        `org_delivery.rate_limited` (429), `org_delivery.inbox_full` (409), `org_delivery.recipient_tombstoned` (410). See POST /v1/principal-inbox/messages.
+    ToolApprovalReadState:
+      type: string
+      enum: [pending, decided, parked, void]
+      description: >
+        `state` of GET /v1/tool-approvals/{id} (server >= 7.133.0), a CLOSED four-word set — read it exhaustively: `pending` = a live registration on this replica is waiting (answer door open);
+        `decided` = the row is DECIDED; `parked` = PARKING / PARKED (a late answer redeems the parked card); `void` = DENIED / VOID (nobody decided it, the answer has nowhere to land).
+    ApprovalsStreamReadErrorCode:
+      type: string
+      enum: [approvals.read_unavailable, approvals.read_corrupt]
+      description: >
+        The `errorCode` of the two READ-FAILURE `error` frames on GET /v1/approvals/stream (server >= 7.133.0). `approvals.read_unavailable` = this tick's approval read failed (the store was momentarily
+        unreadable) — the stream STAYS open and the next tick reads again; it is NOT a terminal frame and NOT a reconnect signal (do not reconnect on it, and do not read it as "nothing pending").
+        `approvals.read_corrupt` = a corrupt row was read — the server closes the stream after the frame; deal with that row before reopening. Branch on the code, never match the message.
+        Older servers (<= 7.132.x) answer a read failure with nothing but heartbeats.
+    ToolApprovalReadProjection:
+      type: object
+      description: >
+        The row projection shared by the three non-`pending` arms of GET /v1/tool-approvals/{id} (server >= 7.133.0): a SUBSET of the `livePending[]` row keys — one reader, one key set. `frame` = the disconnect-replay
+        opening frame (an `approval_request` frame; ABSENT when the card cannot be read back — never invented).
+      required: [approvalId, ts, expiresAtMs]
+      additionalProperties: true
+      properties:
+        approvalId: { type: string }
+        ts: { type: number, description: 'Registration time (ms epoch).' }
+        expiresAtMs: { type: number, description: 'Absolute window deadline (cast once, never recomputed).' }
+        sessionId: { type: string }
+        toolName: { type: string }
+        frame: { $ref: '#/components/schemas/ApprovalRequestFrame' }
+    ToolApprovalReadBody:
+      description: >
+        The 200 body of GET /v1/tool-approvals/{id} (server >= 7.133.0) — a four-arm union discriminated by `state` (closed, read it exhaustively): `pending` = a live registration on this replica is waiting
+        (the `livePending[]` row + `state`; answer door open); `decided` = the row is DECIDED (`decision` / `decidedAtMs` / `decisionNote?`, the same three keys as the late-replay body); `parked` = PARKING / PARKED
+        (a late answer redeems the parked card; `decidePath?` points at the durable decision path); `void` = DENIED / VOID (nobody decided it, the answer has nowhere to land; `cause?` is the same cause word as the
+        late-answer 404's, see ToolApprovalNotPendingCause).
+      oneOf:
+        - $ref: '#/components/schemas/ToolApprovalReadPending'
+        - $ref: '#/components/schemas/ToolApprovalReadDecided'
+        - $ref: '#/components/schemas/ToolApprovalReadParked'
+        - $ref: '#/components/schemas/ToolApprovalReadVoid'
+      discriminator:
+        propertyName: state
+        mapping:
+          pending: '#/components/schemas/ToolApprovalReadPending'
+          decided: '#/components/schemas/ToolApprovalReadDecided'
+          parked: '#/components/schemas/ToolApprovalReadParked'
+          void: '#/components/schemas/ToolApprovalReadVoid'
+    ToolApprovalReadPending:
+      allOf:
+        - $ref: '#/components/schemas/LivePendingRow'
+        - type: object
+          required: [state]
+          properties:
+            state: { type: string, enum: [pending] }
+    ToolApprovalReadDecided:
+      allOf:
+        - $ref: '#/components/schemas/ToolApprovalReadProjection'
+        - type: object
+          required: [state, decision, decidedAtMs]
+          properties:
+            state: { type: string, enum: [decided] }
+            decision: { type: string, enum: [allow, deny] }
+            decidedAtMs: { type: integer }
+            decisionNote: { type: string }
+    ToolApprovalReadParked:
+      allOf:
+        - $ref: '#/components/schemas/ToolApprovalReadProjection'
+        - type: object
+          required: [state]
+          properties:
+            state: { type: string, enum: [parked] }
+            decidePath: { type: string, description: 'The durable decision path for this ask when it can be built.' }
+    ToolApprovalReadVoid:
+      allOf:
+        - $ref: '#/components/schemas/ToolApprovalReadProjection'
+        - type: object
+          required: [state]
+          properties:
+            state: { type: string, enum: [void] }
+            cause:
+              allOf: [{ $ref: '#/components/schemas/AskRowEndingCause' }]
+              description: 'The row''s recorded ending cause (absent for a legacy row with no cause written — never invented).'
     ToolApprovalRespondApplied:
       type: object
       description: >
-        The APPLIED arm of the 200 ack of POST /v1/tool-approvals/{approvalId}/respond (server tool-approval.ts — exact
+        The APPLIED arm of the 200 ack of POST /v1/tool-approvals/{id}/respond (server tool-approval.ts — exact
         shape, `decision` echoed): the decision settled a live gate. Owner-gated with a 404 and NO existence oracle: non-owner and
         unknown/settled/expired/wrong-replica ids are indistinguishable. See ToolApprovalRespondAck for the replayed arm.
       # 封闭(census 批2 第三段,2026-07-30):铸造点 `tool-approval.ts` 三恒在键 + 两条件键
@@ -20663,6 +21756,13 @@ components:
         approvalId: { type: string }
         delivery: { type: string, enum: [applied] }
         decision: { $ref: '#/components/schemas/ToolApprovalDecision' }
+        consumerState:
+          type: string
+          enum: [absent]
+          description: >-
+            server >= 7.133.0, TRUE-ONLY: no engine leg on THIS replica was waiting for the ask this answer settled — the same bit, with the same meaning, as `LivePendingRow.consumerState` and the
+            durable decision ack's. Present <=> the answered entry was ADOPTED from the ask ledger at start-up. The decision lands on the row as usual, but nothing running here resumes because of it — read the run
+            surface; do not read the 200 as "the run continued". Absent = a local engine leg was waiting, or an older server.
         rememberApplied:
           type: boolean
           description: >
@@ -20754,7 +21854,7 @@ components:
     ToolApprovalRespondReplayed:
       type: object
       description: >
-        The REPLAYED arm of the 200 ack of POST /v1/tool-approvals/{approvalId}/respond: the ask was already DECIDED
+        The REPLAYED arm of the 200 ack of POST /v1/tool-approvals/{id}/respond: the ask was already DECIDED
         (by anyone) when this answer arrived, so the server replays the FIRST decision — `decision` is the row's two-word
         value (`allow_session` was folded to `allow` when it landed), `decidedAtMs` the first decision's clock,
         `decisionNote` only when the row has one, `rememberApplied: false` only when THIS request asked `allow_session`.
@@ -20770,14 +21870,57 @@ components:
         decidedAtMs: { type: integer }
         decisionNote: { type: string }
         rememberApplied: { type: boolean, enum: [false] }
+        noteRecorded: { type: boolean, description: 'server >= 7.133.0 (two doors, one shape): present ONLY when THIS request carried a `note`; `true` <=> the row''s text is verbatim what this request submitted, `false` = not confirmed (another reason is on the row / no store / read-back failed). A late answer''s note never overwrites the first decision''s reason — that is `decisionNote`.' }
+        rulePersisted: { type: boolean, enum: [false], description: 'server >= 7.133.0: present (as `false`) only when this late answer carried `persistRule`: the rule is redeemed on the FIRST decision only, a late answer never saves one.' }
+        ruleRefusal:
+          type: string
+          enum: [rule_lane_unavailable]
+          description: 'with `rulePersisted: false`; on this arm always `rule_lane_unavailable` (the only word the published late-answer path mints).'
+    ToolApprovalRespondParkedRedeemed:
+      type: object
+      description: >
+        The PARKED-REDEEMED arm of the 200 ack of POST /v1/tool-approvals/{id}/respond (server >= 7.133.0; server tool-approval.ts `redeemParkedAsk` /
+        `replayRedeemReceipt`): the card's window had run out and the ask moved to background waiting (PARKED); this late answer — on another replica or after a restart —
+        goes through the EXISTING durable redemption leg (the same CAS as POST /v1/approvals/{sessionId}/decide) instead of the old 404 `tool_approval.not_pending`
+        (`cause: unknown_or_other_replica`). Body = the redemption leg's receipt (ApprovalDecisionResult's keys — `status` / `taskId` / `sessionId` / ... as they come) plus the three keys
+        this door adds: `approvalId` / `askId` (the same 64-hex value) and the discriminant `accepted`. `decision` is the two-word direction on the REPLAY form only (`allow` / `deny`,
+        `allow_session` folded to `allow`); `rememberApplied: false` appears only when this request asked `allow_session` (a parked redemption cannot remember a session grant);
+        `rulePersisted` / `ruleRefusal` / `persistedRule*` are the `persistRule` outcome on the redemption leg (a rule that fails to store NEVER flips the verdict).
+        `idempotent: true` appears only on the REPLAY (the same already-redeemed card answered again returns the first redemption's receipt).
+        CLOSED like its two sibling arms (the census keeps this op's 200 body closed): the key set is ApprovalDecisionResult's own keys (one source per shape, by `$ref`) plus the added ones.
+      required: [approvalId, askId, accepted]
+      additionalProperties: false
+      properties:
+        approvalId: { type: string }
+        askId: { type: string }
+        accepted: { type: string, enum: [parked_redeemed] }
+        status: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/status' }
+        taskId: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/taskId' }
+        sessionId: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/sessionId' }
+        bindingEnforced: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/bindingEnforced' }
+        decision: { type: string, description: 'REPLAY form: `allow` / `deny` (`allow_session` folded to `allow`). FIRST redemption: whatever the redemption leg''s own receipt says (`approve` / `deny` today) — read it open.' }
+        errorCode: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/errorCode' }
+        errorMessage: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/errorMessage' }
+        retriable: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/retriable' }
+        idempotent: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/idempotent' }
+        executionOutcome: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/executionOutcome' }
+        rememberApplied: { type: boolean, enum: [false] }
+        rulePersisted: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/rulePersisted' }
+        ruleRefusal: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/ruleRefusal' }
+        persistedRule: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/persistedRule' }
+        persistedRules: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/persistedRules' }
+        persistedRuleAnchors: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/persistedRuleAnchors' }
     ToolApprovalRespondAck:
       description: >
-        The 200 ack of POST /v1/tool-approvals/{approvalId}/respond — a discriminated union: the decision was APPLIED to a live
+        The 200 ack of POST /v1/tool-approvals/{id}/respond — a discriminated union: the decision was APPLIED to a live
         gate (ToolApprovalRespondApplied, `delivery: "applied"`) or the ask was already decided and the first decision is
-        REPLAYED (ToolApprovalRespondReplayed, `idempotent: true`). The discriminant is `idempotent`.
+        REPLAYED (ToolApprovalRespondReplayed, `idempotent: true`), or (server >= 7.133.0, sdk 25.0.0) the answer REDEEMED a PARKED card through the durable redemption
+        leg (ToolApprovalRespondParkedRedeemed, `accepted: "parked_redeemed"`). The discriminants are `delivery` / `idempotent` / `accepted` (a replayed redemption carries
+        BOTH `accepted: "parked_redeemed"` and `idempotent: true` — read `accepted` first).
       oneOf:
         - $ref: '#/components/schemas/ToolApprovalRespondApplied'
         - $ref: '#/components/schemas/ToolApprovalRespondReplayed'
+        - $ref: '#/components/schemas/ToolApprovalRespondParkedRedeemed'
     UsageMetric:
       type: string
       enum: [tasks, tokensIn, tokensOut, costUsd]
@@ -21735,7 +22878,7 @@ components:
 
     AdoptionNotMigratedFace:
       type: string
-      enum: [usage-window, cost-quota, rate-limit, approval-exemption-grantor, approval-ask-decision-actor, image-bake-requested-by]
+      enum: [usage-window, cost-quota, rate-limit, approval-exemption-grantor, approval-ask-decision-actor, image-bake-requested-by, permission-rule-approval-history, permission-rule-import-ticket, org-delivery-quota]
       description: >
         FROZEN machine-readable vocabulary of the faces the server deliberately does not migrate. Renaming or
         removing a member is a wire break; adding one is a new behaviour face. Consumers assert POSITIVELY on