@sema-agent/sdk 24.0.0 → 25.0.0

package/openapi.yaml

@@ -3424,7 +3424,7 @@ paths:
         `synced` (and `synced.count` still counts ONLY the durable queue).
         🔴 THE TWO WORDS DELIBERATELY DO NOT REUSE `pending`/`resolved`: those are keyed by
         `(sessionId, toolCallId)` and decided at `POST /v1/approvals/{sessionId}/decide`, while a live row is
-        keyed by `approvalId` and decided at `POST /v1/tool-approvals/{approvalId}/respond`. Sharing one word
+        keyed by `approvalId` and decided at `POST /v1/tool-approvals/{id}/respond`. Sharing one word
         would eventually send a live card to the decide door — a 404 with no wire evidence of the mistake.
         ⚠️ Both live words come from an IN-PROCESS window projection, so their cross-replica reach is exactly
         that of `GET /v1/approvals`'s `livePending` — narrower than the durable pair above. The deployment
@@ -4393,6 +4393,38 @@ paths:
         '404': { description: no pending question for this id (non-owner, answered, expired, or wrong replica) — no existence oracle. }
         '501': { description: AskUserQuestion is not enabled on this worker (ASK_QUESTION_ENABLED). }
 
+  /v1/tool-approvals/{id}:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+      - { name: id, in: path, required: true, schema: { type: string }, description: 'The ask''s `approvalId` (server >= 7.133.0 always equal to its `askId`; an opaque string).' }
+    get:
+      tags: [questions]
+      operationId: toolApprovalRead
+      x-status: live             # server >= 7.133.0; SDK toolApprovals.get consumes it
+      summary: Read ONE live-card ask — where is it now (pending, decided, parked or void)? Pure read.
+      description: >
+        server >= 7.133.0 — the by-ask read door. Same root and same gate as POST /v1/tool-approvals/{id}/respond (one `gatedPrincipal`; an owner-gate miss answers the SAME 404 as an unknown
+        id — no existence oracle), and the state is read the way the answer door reads it: a live registration on THIS replica waiting for the ask => `pending` (the body is the `livePending[]` row projection +
+        `state`); otherwise the row is read by id: `DECIDED` => `decided`, `PARKING` / `PARKED` => `parked`, `DENIED` / `VOID` => `void`. A row still `STREAM_PENDING` with no local registration lives on
+        another replica => 404 `tool_approval.not_pending` + `cause: "unknown_or_other_replica"` (the same answer as a late respond); a deployment with no ask ledger answers the same 404 WITHOUT `cause`.
+        Pure read: zero writes, no settlement, the local registration is untouched. Use it to ask "is this card still alive / was it decided by anyone" instead of inferring it from a respond 404.
+        An older server (<= 7.132.x) has no such door: routing-level 404 `not_found.route` — tell it apart from this door's 404 by `errorCode`, never by status.
+      responses:
+        '200':
+          description: The ask's current state.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ToolApprovalReadBody' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '404':
+          description: >
+            `tool_approval.not_pending` — unknown / not yours (byte-identical) / still pending on another replica (`cause: unknown_or_other_replica`). Past the owner gate the body may carry the additive `cause`
+            (see ToolApprovalNotPendingCause); no ask ledger => no `cause`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ToolApprovalNotPendingBody' }
+        '501': { description: 'Live tool-approval HITL not enabled (TOOL_APPROVAL_ENABLED) — `feature.tool_approval_disabled`.' }
+
   /v1/tool-approvals/{id}/respond:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -5799,6 +5831,70 @@ paths:
         '403': { description: 'Multi-tenant worker: outcomes view is operator-only.' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
+  /v1/config/catalog:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+    get:
+      tags: [admin]
+      operationId: configCatalog
+      x-status: live             # operator lane (capabilities.configCatalog); SDK configCatalog.get consumes it
+      summary: Deployment configuration catalog — every env knob's declaration and this process's effective reading (operator-only).
+      description: >
+        The deployment's configuration catalog (operator lane; probe `capabilities.configCatalog` first). One row per env knob: its declared semantics, which lanes can write it, which lane is in force, the
+        process's effective DISPLAY value and the centre seat (`center`) when the knob is centre-publishable; plus the `retired` tombstone list (env names this process refuses to start on). `Cache-Control: no-store`.
+        Gate: `OPERATOR_PRINCIPALS` — outside the list 403 `auth.operator_only`; empty list on a multi-tenant deployment 501 `capability.operator_principals_required`; `CONFIG_CATALOG_ENABLED=false` 501
+        `feature.config_catalog_disabled`. A server older than 7.53 has no such route (404).
+        `effectiveValue` is a DISPLAY value, never the raw env: `secret` / `opaque` rows report only `{ present, length? }`, a `url` row goes through the display mint (userinfo landed, query values become
+        tokens). Two VERDICT bits on a row are true-only (never `false`; ABSENT = this cell has no such matter): `effectiveValueInvalid` (the effective value falls outside the row's own echo set; `effectiveValue` is then
+        `null`) and, server >= 7.133.0, `effectiveValueWithheld` (a `url` row whose display mint WITHHELD a part — a credential-shaped piece in a query / path segment — so the shown value is not the whole value).
+      responses:
+        '200':
+          description: The catalog.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ConfigCatalog' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '403': { description: 'The caller is not in OPERATOR_PRINCIPALS (`auth.operator_only`).' }
+        '501': { $ref: '#/components/responses/NotImplemented' }
+
+  /v1/principal-inbox/messages:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+    post:
+      tags: [admin]
+      operationId: principalInboxSend
+      x-status: live             # server >= 7.133.0; SDK principalInbox.send consumes it
+      summary: Deliver one letter to another principal's inbox in the same organization (cross-principal delivery; default OFF).
+      description: >
+        server >= 7.133.0 — one letter is appended to the recipient principal's `principal.inbox` ONLY by the organization delivery gate: membership judgement -> mint -> inbox bound -> quota -> append, all inside one gate that answers
+        with a receipt or one of four refusal codes. The SENDER is always your verified identity (`from` is not a body key: sending `from` or any unknown key => 400 `request.body_shape` + `unknownKeys`). DEFAULT OFF: without env
+        `PRINCIPAL_INBOX_ASSISTANT` the route answers 501 `capability.unavailable` (no delivery gate is mounted) — probe `capabilities.principalInboxDelivery` (true <=> this door works). THIS VERSION SHIPS THE DELIVERY HALF ONLY:
+        a delivered letter sits in the recipient's box (at most 50 unconfirmed envelopes) and no read verb exists yet. Judging order: the sender's ATTEMPT bound (every attempt is recorded, succeeded or not, BEFORE membership) ->
+        membership (including the mailbox-key judge) -> mint (a sender that cannot be spelled into the envelope's sender slot answers the same `not_member`, no quota consumed) -> inbox bound -> quota deduction -> append. A refused
+        delivery appends nothing. Not auto-retried by the SDK (every attempt consumes the sender's attempt quota).
+        The four refusal codes: `org_delivery.not_member` 404 (ONE sentence, byte-identical body for: different organization / no such person / directory could not answer / `to` is not a principal shape / the recipient cannot be a
+        mailbox key / the sender cannot be spelled into the envelope — the gate is never an existence probe); `org_delivery.rate_limited` 429 (one sentence for three bounds: 60 attempts per sender per hour — a typo'd recipient costs an
+        attempt —, 10 letters per (sender, recipient) pair per hour, 30 letters per recipient per hour; fixed clock-hour windows, up to double across a boundary; hard-coded, no knob); `org_delivery.inbox_full` 409 (the recipient's box already holds
+        50 unconfirmed envelopes — judged BEFORE quota so a full box burns none); `org_delivery.recipient_tombstoned` 410 (the recipient's mailbox is in its pre-delete state).
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: '#/components/schemas/PrincipalInboxMessage' }
+      responses:
+        '200':
+          description: The letter was appended; `receiptId` is the gate's delivery receipt id.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/PrincipalInboxReceipt' }
+        '400': { description: 'Malformed body: `request.field_invalid` (not an object / empty `to` / empty or over-long `content` / non-boolean `urgent`) or `request.body_shape` (unknown key incl. `from`; body carries `unknownKeys`).' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '404': { description: '`org_delivery.not_member` — one byte-identical body for six causes (see the description); the gate is not an existence probe.' }
+        '409': { description: '`org_delivery.inbox_full` — the recipient''s box holds 50 unconfirmed envelopes.' }
+        '410': { description: '`org_delivery.recipient_tombstoned` — the recipient''s mailbox is in its pre-delete state.' }
+        '429': { description: '`org_delivery.rate_limited` — one sentence for the sender-attempt bound, the pair bound and the recipient aggregate bound.' }
+        '501': { description: 'No delivery gate mounted (`PRINCIPAL_INBOX_ASSISTANT` off) — `capability.unavailable`.' }
+
   /v1/diagnostics/wiring:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -7064,6 +7160,7 @@ components:
         promptSummary: { type: string, description: 'a human-readable prompt DIGEST — NOT the full prompt.' }
         enabled: { type: boolean }
         available: { type: boolean, description: 'whether this deployment can actually RUN the scenario right now — same predicate as the 501 rejection arm on submit; false ⟺ submitting is guaranteed to 501. Independent axis from `enabled` (declared vs runnable).' }
+        attachmentSupplies: { type: array, items: { type: string, enum: [path, content_text, content_image] }, description: 'server >= 7.133.0, always present there: the attachment SUPPLY words this scenario actually carries — a subset of `capabilities.userAttachments.supplies` (`path` only on hands scenarios, where a workspace lives somewhere; a no-hands scenario drops `path`, and a `path` entry is refused by the engine with `config.user_attachment_invalid`). ABSENT = server <= 7.132.x: fall back to `userAttachments.supplies` plus the existing 400 handling.' }
         unavailableReason: { type: string, description: 'machine-readable reason, present ONLY when available:false (absent = no reason). Closed set, currently the single member `git_client_unconfigured`; branch on the key, never match the English prose. Additive-open: treat an unknown word as "unavailable, reason unknown".' }
 
     RunStatus:
@@ -7704,11 +7801,20 @@ components:
             `permissions.defaultMode`'s specific fold is documented on `TaskRequest.permissionMode`.
             🔴 ON THIS SUBMIT FACE THE KEY SET IS CLOSED (server >= 7.57.0 for the sub-tree): accepted top-level keys
             are `env` / `hooks` / `model` / `outputStyle` / `permissions` / `skillListingBudgetFraction` /
-            `skillListingMaxDescChars` / `ultracode` / `webSearch`, and accepted `permissions.*` keys are
-            `allow` / `ask` / `defaultMode` / `deny` / `disableAutoMode`; anything else is 400 `request.body_shape`
+            `skillListingMaxDescChars` / `ultracode` / `webSearch` (server >= 7.133.0 adds the three TIGHTEN-ONLY seats `complianceAdditionalDenies` / `readDenyPatterns` / `writeProtectedExtra`), and accepted `permissions.*` keys are
+            `allow` / `ask` / `defaultMode` / `deny` / `disableAutoMode` (server >= 7.133.0 adds `neverAuto`); anything else is 400 `request.body_shape`
             with the names in the refusal's `unknownKeys` / `unsupportedKeys` arrays (REFUSED, not dropped — a dropped
             key reads as "in effect" to the caller). The object stays OPEN here because the same `SemaSettings`
             schema also serves the local `settings.json` wiring, where deferred CC keys are legal.
+            🔴 TIGHTEN-ONLY SEATS (server >= 7.133.0; probe `capabilities.taskSettings.tightenOnlySeats`, an absent bit = an older server that answers 400 `request.body_shape` for these four keys): `readDenyPatterns` (entries: a bare
+            pattern string, or `{ pattern, caseSensitive? }`), `writeProtectedExtra` (a bare name — no `/` reads as `segment`, a `/` reads as `segment-run` — or `{ name, kind: basename | segment | segment-run }`),
+            `complianceAdditionalDenies` (`mcp_servers` | `workflows` | `web_fetch` | `org_memory_mount`) and `permissions.neverAuto` (tool names that ALWAYS ask a human). Each seat = the deployment table UNION the request list, ONLY EVER GROWING
+            (the request face has no loosening arm); an empty array is the same as not sent. Bad value => 400 `request.field_invalid` with `field` + `reason` (`over_cap` + `count` + `cap` / `bad_entry` + the first bad `index`).
+            Caps: 1000 entries per seat, EXCEPT `readDenyPatterns`: at most 32 entries, at most 2 `*` per path segment and 16 `*` in the whole table (every star counts, nothing is folded). A `neverAuto` name that can never match any tool => 422.
+            A resume replay of a stored body whose seat went bad => 409 `resume_blocked_by_policy`. A compliance deny is a REFUSAL, not a narrowing: a request denying `web_fetch` is refused whole where the default tool surface still mounts `WebFetch` (the single-user default does).
+            🔴 `settings.hooks[]` (server >= 7.133.0; probe `capabilities.taskSettings.pluginHooks` / `managedHookGroups` — an absent or false bit = the keys are STRIPPED SILENTLY): group key `source` (closed: `managedPolicy` / `user` / `project` / `local` / `flag` /
+            `managedPlugin:<name>` / `plugin:<name>`; absent = unmanaged; managed groups run in an independent lane after the unmanaged rewrites), command-entry keys `plugin { name, root, dataDir?, options? }` and exec-form `args`; a malformed one =>
+            400 `request.field_invalid` with `detail: { reason: "wire_key_invalid", key, path }`; the plugin context has one 8192-character budget.
             🔴 `skillListingBudgetFraction` (number in (0,1]) / `skillListingMaxDescChars` (positive integer),
             server >= 7.78.1: the SKILL-LISTING RENDER BUDGET, passed to the engine with ZERO processing
             (no clamping, no conversion, no folding) — ABSENT means the key is not written at all (the server does
@@ -8374,6 +8480,10 @@ components:
         cause (`terminal`), not the eight parallel plane keys — see `TerminalCause`.
       required: [taskId, sessionId, terminal, stats]
       properties:
+        warnings:
+          type: array
+          items: { $ref: '#/components/schemas/EntryProblem' }
+          description: 'server >= 7.133.0, top level of the sync `POST /v1/tasks` 200 body (beside `notice`), present only when non-empty: the accept-time NOTICES for allow-side selector-list entries the engine reads as nothing or that are not in the roster. ABSENT = no notice (older servers too).'
         taskId: { type: string }
         sessionId: { type: string }
         wiringManifest:
@@ -8676,6 +8786,10 @@ components:
         taskId: { type: string }
         sessionId: { type: string }
         status: { $ref: '#/components/schemas/RunStatus' }
+        warnings:
+          type: array
+          items: { $ref: '#/components/schemas/EntryProblem' }
+          description: 'server >= 7.133.0, present only when non-empty: the accept-time NOTICES for allow-side selector-list entries the engine reads as nothing or that are not in the roster (acceptance is unchanged — the engine takes them, only the operator hears afterwards; this makes "this name will not take effect" visible at the call). Same list as the stream `meta` frame''s and the sync 200 body''s. ABSENT = no notice (older servers too).'
 
     SealedKeyCapability:
       type: object
@@ -9803,6 +9917,11 @@ components:
             store backend deliberately wires no image index (the pool is cloud/fleet-only) ⇒ false there.
             SCOPE: P1 only — `/v1/images/bakes*` (the P2 bake control plane) is a separate dependency and an
             operator/runner-internal face, NOT promised by this bit.
+        principalInboxDelivery:
+          type: boolean
+          description: >-
+            server >= 7.133.0 — the cross-principal delivery door `POST /v1/principal-inbox/messages` is wired (delivery gate present: env `PRINCIPAL_INBOX_ASSISTANT` on and the gate's dependencies in place).
+            True iff that route works; absent gate => the route answers 501 `capability.unavailable`. ABSENT key = server <= 7.132.x (no such route; routing-level 404). Probe this bit; do not trial-by-501.
         sharedMemory:
           type: boolean
           description: >
@@ -9973,6 +10092,12 @@ components:
             lane) or 422 (hosted).
         mcp: { type: boolean, description: "MCP servers can be attached." }
         mcpInjection: { type: boolean, description: "Per-request MCP injection is accepted." }
+        mcpAssertionHeaderSent:
+          type: boolean
+          description: >-
+            server >= 7.133.0 — the SEND seat self-report (a boolean, today ALWAYS `false`): whether `mcpServers[].transport.assertionHeader` (accepted since server 7.128.0, mutually exclusive with `principalHeader`)
+            is actually SENT to the MCP peer. `false` = the declaration is carried but NOT sent (the same switch drives the key stripping, the operator info line and the probe-door refusal; the disclosure sentences leave when it turns true).
+            ABSENT = an older server, which does not send either — treat it as `false`; never rely on the header for peer authentication.
         mcpProbe:
           type: boolean
           description: >
@@ -10012,6 +10137,17 @@ components:
             ⚠️ ABSENT = an older server (<7.87.1) ⇒ cannot tell whether the push face carries the live family;
             do NOT read "no `live_pending` frame arrived yet" as "this deployment never pushes live" — the two
             are indistinguishable on an older server. Fall back to `GET /v1/approvals`'s `livePending` pull face.
+        approvalFrameFamilies:
+          type: array
+          maxItems: 1
+          items: { type: string, enum: [tool_approval, approval_request] }
+          description: >-
+            server >= 7.133.0, ALWAYS present (the projection of the same judgement as `streamApproval`) — which FRAME FAMILY this worker's approval opening frames belong to:
+            a closed-word array with AT MOST ONE member. `["approval_request"]` = the card protocol is on: one ask travels only `approval_request` -> `approval_complete` / `approval_revoke`
+            (the legacy `tool_approval` / `tool_approval_complete` pair is NOT sent — BREAKING vs <= 7.132.x, which sent both families for one ask and relied on `approvalId` de-duplication;
+            remedy on the worker: `STREAM_APPROVAL_ENABLED=false`). `["tool_approval"]` = the card protocol is not on (`STREAM_APPROVAL_ENABLED=false`, no store backend, or no checkpoint store) but the live card leg is.
+            `[]` = per-call approvals are off altogether (`TOOL_APPROVAL_ENABLED=false`): no card is presented. Dispatch frame families off THIS array, never off `streamApproval`.
+            KEY ABSENT (not `[]`) = server <= 7.132.x — there a `streamApproval: true` leg sends BOTH families for one ask.
         streamApproval:
           type: boolean
           description: >
@@ -10066,6 +10202,13 @@ components:
             a server <= 7.118.x returns the archive as written; a 7.119.x server already redacts but does not report the bit. A true
             bit does not mean the read face exists (that is `sessions`; without a session audit face that door answers 501 and this
             bit is still true), nor that the archive holds no credential (the redaction is read-side only).
+        approvalReadRootGrant:
+          type: boolean
+          description: >-
+            server >= 7.133.0, ALWAYS present, a FACT that varies by deployment — whether this deployment accepts the reply-body key `readRootGrant` ("Yes, and add directory": the card's
+            `readRootCandidate.dir` is registered as a read root together with this one allow). True iff the single-user host-lane posture (the same predicate as `projectContext` / the cwd face); false elsewhere.
+            A client shows the option only when the card carries `readRootCandidate` AND this bit is true. On a non-accepting posture a reply carrying `readRootGrant` is refused
+            `400 request.body_shape` (the ask stays unsettled — answer again without the key). ABSENT = server <= 7.132.x = not accepted; do not send the key.
         approvalReach:
           type: boolean
           description: >-
@@ -10178,6 +10321,9 @@ components:
             outputStyle: { type: boolean }
             env: { type: boolean, description: 'TRUE on the single-user host lane (server emits `cwdHonored(config)`). It is NOT hard-coded false any more — the old always-false value predated the per-task shellEnv seam and hid a live capability.' }
             hooks: { type: boolean, description: 'Single-user deployments only (`requirePrincipal !== true`).' }
+            pluginHooks: { type: boolean, description: 'server >= 7.133.0 — the request `settings.hooks[]` PLUGIN-CONTEXT keys (command entry `plugin { name, root, dataDir?, options? }` / exec-form `args`) are accepted; same predicate as `hooks` (single-user true, multi-tenant false). ABSENT or false = the keys are stripped silently — send only on sight of the bit.' }
+            managedHookGroups: { type: boolean, description: 'server >= 7.133.0 — the request `settings.hooks[]` GROUP `source` key (managed lanes `managedPolicy` / `managedPlugin:<name>`) is accepted; same predicate as `hooks`. ABSENT or false = stripped silently (the managed-lane semantics do not apply, it is not a refusal).' }
+            tightenOnlySeats: { type: boolean, description: 'server >= 7.133.0, constant true — the four tighten-only request seats `settings.readDenyPatterns` / `settings.writeProtectedExtra` / `settings.complianceAdditionalDenies` / `settings.permissions.neverAuto` are accepted (each seat = deployment table UNION request list, only ever growing; an empty array is the same as not sent). ABSENT = server <= 7.132.x, which answers 400 `request.body_shape` for those keys — send only on sight of the bit.' }
         settings:
           type: object
           description: >
@@ -10206,6 +10352,7 @@ components:
               properties:
                 allowGrant: { type: boolean, description: 'Constant `true` on server >= 7.115.0: `settings.permissions.allow` is read as allow RULES, not as a list. The whole `settings` key being absent = an older server.' }
                 allowLayer: { type: boolean, description: 'Constant `true` on server >= 7.117.0 (core 7.42.0): the whole `settings.permissions.allow` list goes to the engine allow layer (listed calls are not asked; content forms accepted; entries read as nothing get an `engine_notice` `permission.allowed_tool_not_granted`). Absent = a server without it (7.115.0–7.116.x: allow is a statement; older: a list).' }
+                callerTrust: { type: string, description: 'server >= 7.133.0 — THIS caller''s trust tier (per caller / per credential, NOT a version bit). Request rule tables that take effect without a person answering (`settings.permissions` buckets; a named-invoked skill''s `allowedTools` / `disallowedTools`) are admitted by it: `allow` loosens the no-ask surface and needs `global`; `deny` / `ask` only tighten and are admitted at any tier. Today `global` (single-user turnkey; multi-tenant with the deployment service credential; multi-tenant sign-in token whose scope role >= the governance write role) or `project` (everything else). Read OPEN: an unknown word is treated as `project` (fail-closed). A request below the floor is refused whole with 400 `request.field_invalid` (`detail.problems[].reason: below_trust_floor`, `detail.callerTrust`). ABSENT = server <= 7.132.x: no per-tier admission.' }
         memoryWrite:
           type: boolean
           description: >
@@ -10268,7 +10415,7 @@ components:
               additionalProperties: true
               properties:
                 enabled: { type: boolean, enum: [true] }
-                protocolVersion: { type: integer }
+                protocolVersion: { type: integer, description: 'The protocol REVISION this server speaks (the `challenge` frame carries the same value; accepted window [1, 2] on server >= 7.133.0). Server >= 7.133.0 reads 2 (<= 7.132.x read 1). An executor declares the SMALLER of its own highest revision and this value, and takes its outcome-code set from the declared revision (revision 2 added `liveness_no_output`).' }
                 maxInflightPerDevice: { type: integer }
                 wsPath: { type: string }
                 management: { type: boolean, description: 'server >= 7.88.0. `/v1/devices/*` admin verbs present. PRESENT-IFF — absent means a pre-7.88.0 peer (unknown), not false.' }
@@ -10762,9 +10909,9 @@ components:
         server >= 7.65.0 (S-167) — the READ containment rung of this deployment AND WHO SET IT (operator face
         `GET /v1/diagnostics/wiring` -> `readFace`). `face` is the same boot artefact as the tenant-facing
         `capabilities.readFace` (`null` = nothing pinned by this deployment, the engine default is in force).
-        `source` is a CLOSED four-word set on the server (exhaustive switch — adding a word is a compile error
+        `source` is a CLOSED five-word set on the server (exhaustive switch — adding a word is a compile error
         there): `env` = this machine's READ_FACE env var (wins over everything) · `center` = the config-center
-        readFace domain (restart-to-apply) · `posture` = derived from the single-user turnkey posture
+        readFace domain (restart-to-apply) · `lane` = (server >= 7.133.0) the isolated execution lane's default — with `READ_FACE` absent, e2b / k8s / local-docker mint `open` · `posture` = derived from the single-user turnkey posture
         (REQUIRE_PRINCIPAL unset ⇒ `open`; server >= 7.65.0 behaviour change) · `engine-default` = not pinned.
         `note` is a human-facing pointer for operators. Minimal disclosure: the deny table is never on this face.
       required: [face, source, note]
@@ -10774,7 +10921,7 @@ components:
           enum: [open, roots, null]
         source:
           type: string
-          enum: [env, center, posture, engine-default]
+          enum: [env, center, lane, posture, engine-default]
         note:
           type: string
 
@@ -10791,9 +10938,9 @@ components:
         `DURABLE_APPROVAL` ON and a 24h approval window when neither is set, so a default FLIP has to be visible
         on an operator surface or nobody sees it.
 
-        `source` is the CLOSED four-word set (exhaustive switch on the server — adding a word is a compile error
+        `source` is the CLOSED five-word set (exhaustive switch on the server — adding a word is a compile error
         there), in PRECEDENCE order: `env` = pinned by this machine's env var (deployment sovereignty; beats any
-        published value) · `center` = applied from the config-center (restart-to-apply) · `posture` = derived from
+        published value) · `center` = applied from the config-center (restart-to-apply) · `lane` = (server >= 7.133.0) derived from the isolated execution lane (e2b / k8s / local-docker mint a lane default, e.g. `READ_FACE` -> `open`) · `posture` = derived from
         the deployment shape (single-user turnkey) · `engine-default` = nothing pinned, the built-in default is in
         force. Only `env`/`center` count as "an operator asked for this"; a posture-derived `true` does not.
         `note` is PROSE for a human (per-knob, and on the `posture` arm it is that knob's own fact sentence) —
@@ -10808,7 +10955,7 @@ components:
           description: 'The knob''s effective value. Typed by the referencing site (boolean / integer / …).'
         source:
           type: string
-          enum: [env, center, posture, engine-default]
+          enum: [env, center, lane, posture, engine-default]
         note: { type: string }
 
     SkillSpec:
@@ -11630,6 +11777,24 @@ components:
             `"other"`). This is the "where did those 180 404s actually land" cell. Empty object = zero failures;
             key absent = an older server.
 
+    ModelPlane:
+      type: object
+      additionalProperties: false
+      description: >
+        `GET /v1/models.modelPlane` (server >= 7.133.0; always present; conditional keys are absent, never `null` / empty string) — the single read for "which model table is this engine serving".
+        Two axes. SERVED TABLE: `servedTable` = `env` (the env table minted from MODEL_ID / MODEL_CHEAP_ID — no catalog is in charge: none configured / source unreachable with no last-known-good / the candidate was refused /
+        no enabled entry) | `catalog` (a catalog's model plane landed and replaced the whole env table). CANDIDATE OUTCOME: `catalog` = `refused` (the latest candidate was refused whole — by the candidate judge or the model-plane
+        group; with no previous generation the env table serves, with one the catalog table still serves — who serves is `servedTable`'s answer, NOT merged into this field) | `adopted` (no whole refusal and the catalog table
+        serves; NOT "the latest candidate landed" — that question belongs to the /health generation ledger) | `absent` (no whole refusal and the env table serves). START-UP ROUTE VERDICT: `refusalCode` / `gap` (both ABSENT when the
+        judge passes — the normal state of a running process): `refusalCode` = `config.model_route_endpoint_missing` | `config.gateway_fallback_without_primary`; `gap` = `endpoint_missing` (set MODEL_GATEWAY_BASEURL or the entry's
+        own `baseUrl`) | `lane_credential_missing` (an anthropic-lane choice with neither ANTHROPIC_API_KEY nor ANTHROPIC_AUTH_TOKEN fell into the endpoint-less openai leg). No sentence is carried. Words are server-owned — read OPEN
+        (an unknown word is "unknown", never "passed").
+      required: [servedTable, catalog]
+      properties:
+        servedTable: { type: string, description: '`env` | `catalog` (open on read).' }
+        catalog: { type: string, description: '`absent` | `adopted` | `refused` (open on read).' }
+        refusalCode: { type: string, description: '`config.model_route_endpoint_missing` | `config.gateway_fallback_without_primary` (open on read); ABSENT = the judge passed.' }
+        gap: { type: string, description: '`endpoint_missing` | `lane_credential_missing` (open on read); ABSENT = the judge passed.' }
     ModelsResponse:
       type: object
       description: >
@@ -11677,6 +11842,11 @@ components:
             Upgrade window (as it is): an on-disk LKG written by server <= 7.122.x only recorded the dropped entries that had a name AND were
             enabled; while serving from it with the center still unreachable this key lists only those rows (possibly `[]`) and the first pull after the
             center is reachable fills it in. An unknown `reasonCode` word reads as "dropped, reason unknown".
+        modelPlane:
+          allOf: [{ $ref: '#/components/schemas/ModelPlane' }]
+          description: >-
+            server >= 7.133.0, ALWAYS present there (appended last): which model table this engine SERVES, whether the catalog was adopted, and what the start-up route judge says — read this instead of predicting
+            (the judge's inputs are the serving process's facts; mirroring two of its judgements drifts). ABSENT = an earlier server (<= 7.132.x). Field reading: ModelPlane.
         candidateRejected:
           allOf: [{ $ref: '#/components/schemas/CandidateRejected' }]
           description: >
@@ -12898,14 +13068,14 @@ components:
         ts: { type: integer }
     FleetFrame_hook_notice:
       description: >
-        Hook observability frame, TWO kinds (both pure observe — never block, resume, or inject anything;
+        Hook observability frame, FOUR kinds (server >= 7.133.0 added the third and fourth; all pure observe — never block, resume, or inject anything;
         visibility fail-CLOSED like bg_notification: the owner keys ownerScope/ownerSessionId gate delivery
         and are STRIPPED before send; wire is FLAT — `send("hook_notice", { type, ...wire, ts })`, the
         server-internal `{notice}` nesting never reaches it). codex R1-F4: modeled as the discriminated union
         it really is — the common `{type, ts}` frame base composed with each kind's payload arm — so a
         generated client gets the SAME per-kind narrowing as the TS type (a second-family frame missing
-        hookName/entryType is invalid, not silently accepted). `kind` is CLOSED two-member on the server but
-        OPEN ON READ: degrade an unknown future kind to a generic observability row.
+        hookName/entryType is invalid, not silently accepted). `kind` is CLOSED four-member on the server but
+        OPEN ON READ: degrade an unknown future kind to a generic observability row. DISPATCH on `kind`; never infer a call's outcome from any hook_notice frame (read the tool / approval frames).
       oneOf:
         - allOf:
             - $ref: '#/components/schemas/FleetHookNoticeFrameBase'
@@ -12913,10 +13083,16 @@ components:
         - allOf:
             - $ref: '#/components/schemas/FleetHookNoticeFrameBase'
             - $ref: '#/components/schemas/FleetHookNonBlockingFailure'
+        - allOf:
+            - $ref: '#/components/schemas/FleetHookNoticeFrameBase'
+            - $ref: '#/components/schemas/FleetHookManagedUnrun'
+        - allOf:
+            - $ref: '#/components/schemas/FleetHookNoticeFrameBase'
+            - $ref: '#/components/schemas/FleetHookVerdictUntrusted'
 
     FleetHookNoticeFrameBase:
       type: object
-      description: 'The hook_notice frame envelope shared by both kinds: the SSE frame discriminant and the server timestamp.'
+      description: 'The hook_notice frame envelope shared by all four kinds: the SSE frame discriminant and the server timestamp.'
       required: [type, ts]
       properties:
         type: { const: hook_notice }
@@ -12965,7 +13141,7 @@ components:
       # #315(server ≥7.43):第二顶层键 `livePending` = streamApproval 窗内的流内 ask(此前对轮询消费端
       # 结构性不可见)。ADDITIVE / tolerate-absent:键缺席=「协调器未装配(本部署无 live 审批面)」或
       # 旧 server;空数组=「有面、此刻无待批」——两义可判别,消费端测 presence。**分数组不混编**:
-      # live 行的决议口=POST /v1/tool-approvals/{approvalId}/respond,durable 行=decide 口;数组名即路由判据。
+      # live 行的决议口=POST /v1/tool-approvals/{id}/respond,durable 行=decide 口;数组名即路由判据。
       # 22.0.0:第三、四顶层键此前漏声明 —— 封闭 schema 上一个真键 = 合法信封被严格校验器拒收。
       additionalProperties: false
       required: [pending]
@@ -13020,7 +13196,7 @@ components:
       type: object
       description: >-
         A live (in-stream) pending ask inside its streamApproval window (#315, server ≥7.43). Decide it via
-        POST /v1/tool-approvals/{approvalId}/respond — NOT the /decide route (that is the durable rows' door).
+        POST /v1/tool-approvals/{id}/respond — NOT the /decide route (that is the durable rows' door).
         Optional flags are only-if-true (absent is NEVER encoded as false).
         🔴 THE "tool input/args are NOT listed" NARROWING IS GONE (server >= 7.87.0 / S-454 P1). The old reason
         was "details ride the stream frame" — but a SUSPENDED ask never has a stream frame (at mint time it had
@@ -13038,7 +13214,15 @@ components:
       additionalProperties: true
       required: [approvalId, toolName, ts, expiresAtMs]
       properties:
-        approvalId: { type: string, description: 'The SAME id the respond endpoint takes (wire uuidv7).' }
+        approvalId: { type: string, description: 'The SAME id the respond endpoint takes. server >= 7.133.0: for an ask that has a ledger row it is ALWAYS the row''s key `askId` (a 64-character lowercase hexadecimal string — an OPAQUE string, never a uuid); on <= 7.132.x a wire uuidv7.' }
+        consumerState:
+          type: string
+          enum: [absent]
+          description: >-
+            server >= 7.133.0, TRUE-ONLY (present as `absent`): no engine leg on THIS replica is waiting for this ask. Present <=> the row was ADOPTED from the ask ledger at start-up (minted by a previous
+            process / another replica, the row still undecided — a "zombie card"): it lists and can be answered (the row becomes decided; the answer ack carries the same bit), but that decision resumes
+            nothing running on this replica — read the run surface to learn whether anything continued. The `live_pending` stream frame and the `pending` arm of GET /v1/tool-approvals/{id} carry it too. After a restart an
+            ask still undecided on the ledger RETURNS to `livePending[]` (it used to vanish and answer 404). Absent = this replica has an engine leg waiting, or an older server.
         toolName: { type: string }
         ts: { type: number, description: 'Registration time (ms epoch).' }
         expiresAtMs: { type: number, description: 'Absolute window deadline — the SAME number minted once for the tool_approval frame (never recomputed).' }
@@ -13063,9 +13247,13 @@ components:
           allOf: [{ $ref: '#/components/schemas/ToolApprovalCardWord' }]
           description: 'server >= 7.126.0 (core 7.49.0 #1414): which card this ask renders on — the engine-minted card word, the SAME value as `frame.approvalCard` (the row reads the frame''s own seat, no second read), same layer and shape as the operator queue row''s `approvalCard`. It REPLACES `contentKind` (server <= 7.125.x derived it from the tool name; deleted at 7.126.0, no alias). ABSENT = the engine minted none. Display / triage only; it NEVER takes part in decision routing.'
         frame:
-          allOf: [{ $ref: '#/components/schemas/ToolApprovalFrame' }]
+          oneOf:
+            - $ref: '#/components/schemas/ToolApprovalFrame'
+            - $ref: '#/components/schemas/ApprovalRequestFrame'
           description: >-
-            server >= 7.87.0 (S-454 P1; cli L-397) — THE CARD FRAME THIS ASK WOULD HAVE EMITTED. It is the SAME
+            server >= 7.87.0 (S-454 P1; cli L-397) — THE CARD FRAME THIS ASK WOULD HAVE EMITTED. TWO SHAPES, by leg (sdk 25.0.0 declares the union; discriminant
+            `frame.type`): on a leg that speaks the card protocol (`capabilities.approvalFrameFamilies` contains `approval_request`, server >= 7.133.0) it is the
+            `approval_request` frame (card facts under `frame.card`, the ten off-card live facts flat at the top); on a legacy-family leg it is the `tool_approval` frame. It is the SAME
             OBJECT as the server's `PendingApproval.frame` (the one construction site in `askBroadcast`, already
             redacted / byte-capped / window-keys filled), shared by the suspended and the reachable path — so
             this is NOT a second card projection computed for the list, and there is no second redaction surface.
@@ -13285,6 +13473,7 @@ components:
       required: [sessionId, scope, createdAt]
       additionalProperties: true
       properties:
+        checkpointId: { type: string, minLength: 1, maxLength: 128, description: 'server >= 7.133.0: the NON-SECRET stable identity of the pause this row parks on — the join key where the token cannot go; the SAME value as `PausedCause.checkpointId`. Carried on three durable read surfaces (GET /v1/approvals `pending[]` rows, the /v1/approvals/stream `pending` frame, GET /v1/assistant/inbox rows). A row whose value is unreadable or untrusted (non-string / empty / over 128 / contains the token / an old row / an older server) is STILL LISTED with the key ABSENT — read absence as "this row has no joinable identity", never as a required key.' }
         sessionId: { type: string, description: 'The decide handle: POST /v1/approvals/:sessionId/decide.' }
         scope: { type: string, description: 'Principal; "_" = submitted without one.' }
         taskId: { type: ['string', 'null'], description: 'Suspended run holding the session claim (service-pinned) — join key to trace tool-call blocks + context link.' }
@@ -13496,6 +13685,7 @@ components:
       additionalProperties: false
       properties:
         sessionId: { type: string, description: 'The suspended task/session id.' }
+        checkpointId: { type: string, minLength: 1, maxLength: 128, description: 'server >= 7.133.0: the NON-SECRET stable identity of the pause this row parks on — the join key where the token cannot go; the SAME value as `PausedCause.checkpointId`. Carried on three durable read surfaces (GET /v1/approvals `pending[]` rows, the /v1/approvals/stream `pending` frame, GET /v1/assistant/inbox rows). A row whose value is unreadable or untrusted (non-string / empty / over 128 / contains the token / an old row / an older server) is STILL LISTED with the key ABSENT — read absence as "this row has no joinable identity", never as a required key.' }
         scope: { type: string, description: 'Multi-tenant owner scope.' }
         createdAt: { type: number, description: 'Ask creation time (epoch ms).' }
         gateKind:
@@ -13819,6 +14009,17 @@ components:
             ⚠️ The key name is final: `permissionModeAfter` (the build brief once said `nextPermissionMode`,
             which never shipped — zero aliases).
 
+    SessionAgent:
+      type: object
+      additionalProperties: false
+      description: >-
+        The placement-tuple projection of a delegated subagent's transcript (`SessionRecord.agent`, server >= 7.133.0). Each member is independently optional (only what was stored is projected); `{}` is a legal value
+        (the tuple held only a `kind`). `id` = the tuple's `handle` (the durable agent row's `a…` key — the SAME string as the fleet row's `id` and `GET /v1/agents/roster`'s `handle`); `parentSessionId` = the host
+        session that spawned it; `rootSessionId` = the delegation tree's root host session (a nested grandchild anchors to the root).
+      properties:
+        id: { type: string }
+        parentSessionId: { type: string }
+        rootSessionId: { type: string }
     SessionRecord:
       type: object
       description: >
@@ -13851,6 +14052,14 @@ components:
           $ref: '#/components/schemas/SessionWindow'
         promptEpoch:
           $ref: '#/components/schemas/PromptEpoch'
+        agent:
+          allOf: [{ $ref: '#/components/schemas/SessionAgent' }]
+          description: >-
+            server >= 7.133.0, top-level additive key — WHICH delegated subagent's transcript this session is (read by terminal side-chain projections that join a fleet frame's `transcriptId`). Only the stored placement
+            tuple is projected (minted by the engine when a BACKGROUND subagent with a durable agent row creates the session on a store that declares placements; a synchronously delegated subagent's transcript is not in
+            the host store and has no tuple); the three members are each optional. 🔴 READ IT AS "WAS IT STORED", NEVER AS "IS IT A SUBAGENT": key PRESENT = a delegated subagent's transcript (even `{}` when the tuple held only a
+            kind); key ABSENT has three causes — an older server (<= 7.132.x) / an ordinary session / a deployment whose store keeps no placement tuple (the local backend: the copy parked from the private short-TTL store is an
+            ordinary session row). Absence is NOT "not a subagent": fall back to the identity the fleet row (`id`) / `GET /v1/agents/roster` (`handle`) already carry.
         userInputUndrained:
           type: array
           description: >-
@@ -14885,7 +15094,7 @@ components:
             center 404 / 429 / 3xx included). On 400 `request.field_invalid` for a `settings.permissions` bucket (server >= 7.106.0 /
             S-904): `over_cap` (more than `cap` entries; beside `count` + `cap`) / `bad_entry` (a non-string or empty item; beside
             `index`); server >= 7.132.0 widens that group to every tool-name list on the body, the agent definitions and the two host-path lists, and adds
-            `too_long` (a text over its character cap; beside `count` + `cap`) — closed three words `over_cap` / `too_long` / `bad_entry` (SDK `RequestFieldRefusalExtra`).
+            `too_long` (a text over its character cap; beside `count` + `cap`) — closed words `over_cap` / `too_long` / `bad_entry` (SDK `RequestFieldRefusalExtra`); server >= 7.133.0 adds `too_large` (a payload over its BYTE cap, only on 413 `request.payload_too_large`: `{ field: "body", reason: "too_large", cap }` — `count` ABSENT when the read stopped at the cap and cannot measure; a request body over 8 MiB is now always that 413) and the `request.invalid_json` reasons `not_json` | `not_object` (400, every JSON-body door; formerly `request.rejected`/`request.body_shape` by door).
             On 409 refusals of a resume (server >= 7.132.0): the engine's `CheckpointErrorReason` arm (`detail.reason` passed through; see `blockedBy`). On 400 `rules.inert_entry` (server >= 7.129.0): the engine's `ALLOW_ENTRY_INERT_REASONS` (`tool_name` / `wildcard_all` / `namespace_wildcard` / `content_unsupported` / `grammar` / `near_miss` / `earlier_grammar`). Out-of-vocabulary word ⇒ treat as unknown. (Other codes carry their own `reason` words.)
         retryAfterSec:
           type: number
@@ -15006,6 +15215,14 @@ components:
                   properties:
                     reason: { type: string, enum: [unnamed_refusal] }
                     path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                - type: object
+                  description: 'one of the three wire keys this service reads itself is malformed (server >= 7.133.0): the group `source` / a command entry''s `plugin` / `args`; `key` names it, `path` is its coordinate. The whole request is refused (they used to be stripped silently as unknown keys).'
+                  required: [reason, key, path]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [wire_key_invalid] }
+                    key: { type: string }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
                 - type: object
                   description: 'server 7.115.0–7.125.x: the dead-alias matcher refusal before `reason` existed.'
                   required: [event, alias, canonical]
@@ -15027,13 +15244,41 @@ components:
               properties:
                 scenario: { type: string }
                 source: { type: string, enum: [ruling, deployment] }
+            - type: object
+              description: >-
+                server >= 7.133.0 — entry problems on a tool-name list / settings-rule refusal (400 `request.field_invalid`, 422): `problems` (at most 1000, each EntryProblem) + `total` (the true count; `total > problems.length` => cut).
+                With `callerTrust` it is the below-trust-floor refusal: the caller's admission tier (`global` | `project`, read open; the same words as `capabilities.settings.permissions.callerTrust`).
+              required: [problems, total]
+              additionalProperties: false
+              properties:
+                problems: { type: array, items: { $ref: '#/components/schemas/EntryProblem' } }
+                total: { type: integer }
+                callerTrust: { type: string }
+            - type: object
+              description: >-
+                server >= 7.133.0 — 400 `request.field_conflict`: the request body contradicts itself. `kind` = which constraint (a CLOSED fourteen-word set, read open: cascade_verify | image_profile | resume_anchor |
+                system_prompt_fold | file_history_restore | skills_disabled | existing_session | scratchpad_root | ask_answer | policy_person_ask | plan_edit | plan_mode_after | bound_call_door | remember_decision);
+                `fields` = the named body coordinates, subject first (at least one; a dynamic index reads `agents[1].skills`); `count` / `cap` only on the fold-cap kind (the folded total and its cap).
+              required: [kind, fields]
+              additionalProperties: false
+              properties:
+                kind: { type: string }
+                fields: { type: array, items: { type: string } }
+                count: { type: integer }
+                cap: { type: integer }
+            - type: object
+              description: '409 `conflict.session_placed` (server >= 7.133.0): the session sync commit targeted a session that holds a delegated agent''s transcript. `placement_kind` is the stored placement kind (today only `subagent`; read open).'
+              required: [placement_kind]
+              additionalProperties: false
+              properties:
+                placement_kind: { type: string }
             - type: string
         count:
           type: integer
-          description: '`reason: over_cap` / `too_long` only — how much was sent (entries / characters; S-904 since server >= 7.106.0, every capped face since >= 7.132.0). SDK: `err.extra.count`.'
+          description: '`reason: over_cap` / `too_long` / `too_large` — how much was sent (entries / characters / bytes; every capped face since >= 7.132.0). ABSENT on the unmeasured form (a body read that stopped at the cap). SDK: `err.extra.count`.'
         cap:
           type: integer
-          description: '`reason: over_cap` / `too_long` only — the cap (1000 for a permissions bucket; per face otherwise). SDK: `err.extra.cap`.'
+          description: '`reason: over_cap` / `too_long` / `too_large` — the cap (1000 for a permissions bucket; per face otherwise; bytes on a too_large 413). SDK: `err.extra.cap`.'
         index:
           type: integer
           description: '`reason: bad_entry` only — the index of the first bad item; ABSENT when the list itself is not an array. SDK: `err.extra.index`.'
@@ -15169,6 +15414,11 @@ components:
         - $ref: '#/components/schemas/Event_tool_approval_complete'
         - $ref: '#/components/schemas/Event_approval_request'
         - $ref: '#/components/schemas/Event_approval_revoke'
+        # server >= 7.133.0 (sdk 25.0.0): the card family's single-card CLOSE frame (`approval_complete`; one frame family per leg — it replaces the legacy
+        #   `tool_approval_complete` on a leg where `capabilities.approvalFrameFamilies` = ["approval_request"]) and the LIVE-ONLY `session_titled` frame (a session
+        #   title was written; never ledgered, no eventId).
+        - $ref: '#/components/schemas/Event_approval_complete'
+        - $ref: '#/components/schemas/Event_session_titled'
         # sdk 9.1.0: two LIVE-leg arms the service has been emitting while neither this union nor the
         #   SDK's declared them — `text_end` since server 7.66.0 (segment boundary; retires the idle-flush
         #   heuristic) and `tool_roster_delta` since server 7.70.0 (run-time roster change). A generated client
@@ -15230,6 +15480,8 @@ components:
           tool_approval_complete: '#/components/schemas/Event_tool_approval_complete'
           approval_request: '#/components/schemas/Event_approval_request'
           approval_revoke: '#/components/schemas/Event_approval_revoke'
+          approval_complete: '#/components/schemas/Event_approval_complete'
+          session_titled: '#/components/schemas/Event_session_titled'
           text_end: '#/components/schemas/Event_text_end'
           tool_roster_delta: '#/components/schemas/Event_tool_roster_delta'
           reasoning_end: '#/components/schemas/Event_reasoning_end'
@@ -15259,13 +15511,18 @@ components:
         condition: durable-ledger leg only (no ledger => neither header nor frame). sessionId rides along
         (needed to bind subsequent turns when the server minted a fresh session). Always precedes any content
         frame. NOT an engine event — server-minted, no EventIdentity.
-      # 封闭:铸造点 routes/tasks.ts 是逐字写死的三键字面量(sessionId 条件在场)。
+      # 封闭:铸造点 routes/tasks.ts 是逐字写死的三键字面量(sessionId 条件在场);server >= 7.133.0 起第四个条件键 `warnings`(有才发)。
       additionalProperties: false
       required: [type, taskId]
       properties:
         type: { const: meta }
         taskId: { type: string }
         sessionId: { type: string }
+        warnings:
+          type: array
+          items: { $ref: '#/components/schemas/EntryProblem' }
+          description: 'server >= 7.133.0, present only when non-empty: the accept-time NOTICES for entries of the allow-side selector lists (root / agent `allowTools`) the engine reads as nothing or that are not in the roster. Same list as the 202 receipt''s and the sync 200 body''s `warnings`. ABSENT = no notice (older servers too).'
+
     Event_reasoning:
       type: object
       description: durable stream only — turn-aggregated thinking.
@@ -15857,6 +16114,29 @@ components:
             WHO ASKED. Same-present/same-absent as `settlement` (I1). CLOSED here (archive read, `GateRecordAskOrigin`) — see the
             note above.
 
+    McpProbeFaceRow:
+      # server 7.133.0: the face''s row = the wiring-manifest row projection + TWO face-only optional keys. The manifest row is CLOSED (so an `allOf` over it would reject the two extra keys), hence a
+      # standalone closed schema whose per-key shapes are `$ref`s into WiringManifestMcpEntry's own properties (one source per shape); the key SET is pinned by test (manifest row keys + the two).
+      type: object
+      description: >
+        One row of the no-run MCP status face (GET /v1/capabilities/mcp and POST /v1/capabilities/mcp/probe): the SAME projection a prepared leg pushes onto `wiring_manifest.mcp[]`, PLUS two optional keys only this
+        face carries (server >= 7.133.0). `toolNames` = the tool names this server will mount (the same probe reading `servers[i].tools`, engine namespace form `mcp__<server>__<tool>`, after the schema gate and the per-server
+        allow-list; the server neither composes nor renames), at most 200 per server, the reading-order prefix. ABSENT = an older server or no `tools` in that server's reading — NEVER invent `[]` (it would read as "this server
+        has no tools"); a present `[]` is real. `toolNamesTruncated` = TRUE-ONLY: the list was cut (more than 200; exactly 200 is NOT cut and the key stays absent, never `false`) — when true `toolCount` is the true count, not
+        `toolNames.length`. A misaligned reading (not an array / count differs from the row count) answers 500 `internal.error` on both doors instead of shipping a list that could be paired wrongly.
+      additionalProperties: false
+      required: [name, status]
+      properties:
+        name: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/name' }
+        status: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/status' }
+        source: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/source' }
+        toolCount: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/toolCount' }
+        errorCode: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/errorCode' }
+        delivered: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/delivered' }
+        httpStatus: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/httpStatus' }
+        liveness: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/liveness' }
+        toolNames: { type: array, items: { type: string }, maxItems: 200 }
+        toolNamesTruncated: { type: boolean, enum: [true] }
     McpProbeFace:
       type: object
       description: >
@@ -15882,8 +16162,8 @@ components:
           description: 'How long this reading may be reused (seconds; 30s per identity + declaration set server-side). A hit inside the window does NOT count against the rate limit.'
         servers:
           type: array
-          items: { $ref: '#/components/schemas/WiringManifestMcpEntry' }
-          description: 'One row per declaration, SAME ROW SHAPE as the wiring manifest, index-aligned (see this schema''s description).'
+          items: { $ref: '#/components/schemas/McpProbeFaceRow' }
+          description: 'One row per declaration, the wiring-manifest row shape plus (server >= 7.133.0) this face''s two optional keys, index-aligned (see this schema''s description).'
 
     McpLivenessState:
       type: string
@@ -16654,6 +16934,12 @@ components:
             (`capabilities.rewindFiles`); only a run the REQUEST word turned off cannot restore itself.
             OPEN on read: the server does not enumerate the word (a present non-string is dropped), a third word passes
             through — treat it as unknown. ABSENT = an older engine / external derivation, never "capturing".
+        permissionMode:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestPermissionMode' }]
+          description: >-
+            server >= 7.133.0 (core 7.53.0; TENANT and OPERATOR faces alike) — this leg's PERMISSION-MODE receipt `{ requested?, effective, foldedBy? }`; the shell renders its mode indicator from `effective`
+            (`foldedBy` present = the requested mode was folded), never from the word it sent. ABSENT = an older engine / server, not an assertion of the default mode. Effective half only (this frame);
+            the same section rides the non-streaming `wiringManifest` receipt and the ledger row. Section shape: WiringManifestPermissionMode.
         instructions:
           allOf: [{ $ref: '#/components/schemas/WiringManifestInstructions' }]
           description: >
@@ -17533,7 +17819,7 @@ components:
         payload carried `type` (the read boundary emits `{type, ...data}`) so runtime discrimination worked,
         but a generated client had nothing to switch on and dropped approval cards. That gap is closed.
         The shell renders `tool_approval` as the three-choice card and dismisses it on `tool_approval_complete`.
-        Respond via POST /v1/tool-approvals/{approvalId}/respond.
+        Respond via POST /v1/tool-approvals/{id}/respond.
       required: [type, approvalId]
       additionalProperties: true
       properties:
@@ -17929,8 +18215,8 @@ components:
 
     # ── design/172 流内审批协议(#151)—— 已随 server 7.3.0 上线;开关 STREAM_APPROVAL_ENABLED 的默认值
     #    分两段:server ≤7.4.0 默认 OFF,≥7.5.0 默认 ON(BREAKING,见 server CHANGELOG)。──
-    # 与上面的 ToolApprovalFrame 是**并行加帧,不替换**:开关打开时同一只 ask 出两帧(先 tool_approval,
-    # 后 approval_request),两帧同带 `approvalId` ⇒ 消费端按它去重、优先渲染新帧。
+    # 与上面的 ToolApprovalFrame 是两个帧族,**一条腿只走一个**(server >= 7.133.0,capabilities.approvalFrameFamilies):呈卡协议上场的腿上一只 ask 只出本族的帧、
+    # 旧族一帧都不发,消费端不再按 `approvalId` 去重;≤7.132.x 的呈卡腿两族并发(先 tool_approval、后 approval_request,同带 `approvalId`)⇒ 按它去重、优先渲染新帧。
         classifierUnavailable:
           $ref: '#/components/schemas/ClassifierUnavailable'
           description: >-
@@ -17972,6 +18258,14 @@ components:
                 (a malformed shape, or a `dir` over 1024 UTF-16 code units ⇒ the key is ABSENT — never truncated,
                 because a truncated directory is a DIFFERENT directory and adding it would not clear this ask;
                 see the STRING-LENGTH UNIT convention in `info.description` for this `maxLength`'s counting unit).
+            covers:
+              allOf: [{ $ref: '#/components/schemas/ReadRootCover' }]
+              description: >-
+                Optional (engine core 7.22.0 `ReadRootGrantCandidate.covers`; the server carries it through key by key). ABSENT ⇒ `dir` is a DIRECTORY
+                (adding it to the read roots releases what lies under it). `exact` ⇒ `dir` is the path the command NAMED, offered verbatim
+                (a file or one concrete path, not a directory containing it): the consumer ADDS the string itself — expanding it into a
+                pattern grants nothing — and must not render the offer as "add directory". The domain is the single word `exact`
+                (a word outside it makes the server drop the whole candidate). The `approval_request` frame reads this very definition.
             clearsThisAsk:
               type: boolean
               enum: [true]
@@ -18052,8 +18346,23 @@ components:
         approvalId:
           type: string
           description: >
-            Bridge to the legacy frame / dedupe key — same value as the parallel tool_approval frame. During the
-            transition window POST /v1/tool-approvals/{approvalId}/respond still works.
+            The id of POST /v1/tool-approvals/{id}/respond and GET /v1/tool-approvals/{id}. server >= 7.133.0: ALWAYS EQUAL TO `askId` (the row's key is the ask's one wire
+            identity; a 64-character lowercase hexadecimal string — treat it as an OPAQUE string, never parse it as a uuid); the matching close frame `approval_complete` carries it too.
+            On server <= 7.132.x it is the legacy bridge / dedupe key (a uuid, the same value as the parallel tool_approval frame).
+        # ── server >= 7.133.0: the TEN off-card LIVE facts on the opening frame's top level (one frame family per leg) ──────────────────────────
+        #   Same keys, same shapes, same values as on the legacy `tool_approval` frame (each is a `$ref` into ToolApprovalFrame's own property — one
+        #   source per shape). Only the frame minted LIVE carries them (and what the durable ledger recorded of that frame): a disconnect-replay frame
+        #   (rebuilt from `card_json`) never does. Absence means "this frame does not carry it", not "there is none". See APPROVAL_REQUEST_LIVE_FACT_KEYS (sdk) / the server's twin.
+        mandated: { $ref: '#/components/schemas/ToolApprovalFrame/properties/mandated' }
+        mandate: { $ref: '#/components/schemas/ToolApprovalFrame/properties/mandate' }
+        origin: { $ref: '#/components/schemas/ToolApprovalFrame/properties/origin' }
+        boundGrantDigest: { $ref: '#/components/schemas/ToolApprovalFrame/properties/boundGrantDigest' }
+        boundGrants: { $ref: '#/components/schemas/ToolApprovalFrame/properties/boundGrants' }
+        classifierNoRuling: { $ref: '#/components/schemas/ToolApprovalFrame/properties/classifierNoRuling' }
+        boundGrantAbsence: { $ref: '#/components/schemas/ToolApprovalFrame/properties/boundGrantAbsence' }
+        approvalCard: { $ref: '#/components/schemas/ToolApprovalFrame/properties/approvalCard' }
+        readRootCandidate: { $ref: '#/components/schemas/ToolApprovalFrame/properties/readRootCandidate' }
+        probeReason: { $ref: '#/components/schemas/ToolApprovalFrame/properties/probeReason' }
 
     ApprovalCard:
       type: object
@@ -18316,6 +18625,13 @@ components:
         and a word outside the set all read as ABSENT — a card without this word must not be treated as "approving it grants nothing else"; whether to render "allow for this session" is `rememberRefused`.
         Display metadata, never an adjudication input. CLOSED: the server narrows with the engine's members, anything else reads as absent.
 
+    ReadRootCover:
+      type: string
+      enum: [exact]
+      description: >
+        The closed vocabulary of `readRootCandidate.covers` (engine core 7.22.0 `ReadRootGrantCandidate.covers`; the server's narrow read `readReadRootCandidate` drops the whole
+        candidate for a word outside it). One word today: `exact` — `dir` is the path the command NAMED, not a directory containing it. The SDK exports the same table as
+        `READ_ROOT_COVERS` and its `isApprovalRequestFrameV1` judges `covers` by membership in it; a source-level anchor reads the word off the server's minting site and the engine's type.
     PersistedRuleMandate:
       type: string
       enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved]
@@ -18729,6 +19045,40 @@ components:
         depth: { type: integer, description: 'Delegation depth (a direct child of the host = 1).' }
         agentName: { type: string, description: 'Child agent name. UNTRUSTED — spawning-model free text (server-redacted and length-bounded).' }
 
+    ApprovalCompleteFrame:
+      type: object
+      description: >
+        The CLOSE frame of the card family (`approval_complete`; server >= 7.133.0; SSE, `type` IS the event name; the durable leg appends the same frame, so it replays through
+        GET /v1/runs/:id/events as the `Event_approval_complete` arm). ONE FRAME FAMILY PER LEG: on a leg where the card protocol is on (`capabilities.approvalFrameFamilies`
+        = `["approval_request"]`) one ask travels only `approval_request` -> `approval_complete` / `approval_revoke`; the legacy `tool_approval` / `tool_approval_complete` pair is NOT sent
+        (BREAKING vs <= 7.132.x, which sent both families for one ask; remedy on the worker: `STREAM_APPROVAL_ENABLED=false`).
+        Same meaning as the legacy `tool_approval_complete` (one settle, one verdict: the `outcome` three words, the non-human `cause`, the park-route `parked`); dismiss the card by the opening frame's
+        `askId`. Division of labour with ApprovalRevokeFrame: the revoke frame is BATCH-level (siblings voided by a winner), this one is the SINGLE card's end (answered / window expired / park route / cancelled);
+        one ask can receive both — clearing by `askId` is enough. The gate is "this connection's opening frame was actually delivered". The frame is a notification, the row is the source of truth: a lost
+        frame is compensated by the open-stream preamble (see ApprovalRequestFrame). THIS SCHEMA DESCRIBES v1 ONLY (read it as ApprovalFrameEnvelope first; the SDK's `isApprovalCompleteFrameV1` narrows).
+      required: [type, schemaVersion, askId, taskId, approvalId, outcome, serverNowMs]
+      additionalProperties: true
+      properties:
+        type: { type: string, enum: [approval_complete] }
+        schemaVersion: { type: integer, enum: [1], description: 'This schema describes v1 only (see ApprovalFrameEnvelope for the unknown-version read).' }
+        askId: { type: string, description: 'The durable identity — dismiss the card by it (the same key as the opening frame''s `askId`).' }
+        taskId: { type: string, description: 'wire run id (same as the opening frame).' }
+        approvalId: { type: string, description: 'Always equal to `askId` (same as the opening frame).' }
+        outcome:
+          type: string
+          enum: [allowed, denied, expired]
+          description: 'How the ask settled — the same three words as the legacy frame: `allowed` / `denied` = a decision; `expired` = a non-human ending (the reason is in `cause`).'
+        cause:
+          allOf: [{ $ref: '#/components/schemas/ApprovalSettleCause' }]
+          description: >-
+            The non-human ending''s cause (present only on `outcome: "expired"`; the fourteen words of the approval seat''s ending-cause set, the same word as on the audit settle row). A human answer carries none.
+            ABSENCE IS NOT EVIDENCE.
+        parked:
+          type: boolean
+          enum: [true]
+          description: 'TRUE-ONLY: this ask itself ended on the park route (row moved to PARKING / PARKED; a late answer is reachable). Absent = no evidence — NEVER read as a real denial.'
+        serverNowMs: { type: integer, description: 'Server clock at mint time.' }
+
     ApprovalRevokeFrame:
       type: object
       description: >
@@ -19028,7 +19378,7 @@ components:
       description: >
         server >= 7.126.0 (sdk 21.1.0 `APPROVAL_DECIDE_GATE_KINDS`, verbatim and in order; single owner = server
         `APPROVAL_GATE_KINDS`) — the parked gate kinds the DURABLE decision door `POST /v1/approvals/{sessionId}/decide`
-        accepts (the live `POST /v1/tool-approvals/{approvalId}/respond` answers the same card family). A parked row of
+        accepts (the live `POST /v1/tool-approvals/{id}/respond` answers the same card family). A parked row of
         kind `plan_review` goes to the plan-review door instead (`PlanReviewGateKind`); `resource_limit` / `needs_review` /
         `task_done` have no human decision door (resume / terminal). Clients route a pending row by reading this set,
         never by a hand-written copy of it.
@@ -19043,7 +19393,7 @@ components:
       enum: [person, policy]
       description: >
         server >= 7.118.0 (`APPROVAL_DECIDED_BY`, verbatim and in order) — WHO made an approval decision, one key on all three decision
-        doors (live `POST /v1/tool-approvals/{approvalId}/respond`, durable `POST /v1/tasks/{taskId}/asks/{askId}/decision`, durable
+        doors (live `POST /v1/tool-approvals/{id}/respond`, durable `POST /v1/tasks/{taskId}/asks/{askId}/decision`, durable
         `POST /v1/approvals/{sessionId}/decide`). `person` = a person decided through the approval channel (ABSENT means this);
         `policy` = this deployment's own policy decided (a rule / posture answering on someone's behalf, a headless lane) — BOTH
         directions: the engine records `tool_end.gate.settlement.kind` = `policy_allowed` / `policy_refused` (`who.party: "policy"`).
@@ -19135,6 +19485,20 @@ components:
             `updatedInputForwarded` this field IS persisted, so an idempotent replay DOES promise byte-identity.
             The 409 `conflict.ask_decided` body echoes the same field — and there it is always the FIRST
             decision's note, not the one the rejected request carried.
+        noteRecorded:
+          type: boolean
+          description: >
+            server >= 7.133.0, ADDITIVE: did the `note` THIS request carried land as the row's text? Present ONLY when the request carried a `note`. `true` <=> the row's `decisionNote` is
+            verbatim the text this request submitted (text that happens to be identical counts even if someone else wrote it first); `false` = not confirmed (the row holds another reason /
+            the store could not be read back). Same shape and meaning as `noteRecorded` on the live respond ack and on its replayed arm (one judgement for the three doors). Carried by the
+            first-decision and idempotent-replay forms; the PARKED redemption leg does not carry it (read it as unknown). ABSENT is not `false`.
+        consumerState:
+          type: string
+          enum: [absent]
+          description: >
+            TRUE-ONLY disclosure (present as `absent`): no engine leg on THIS replica is waiting for this ask — the decision is on the row (an idempotent replay will read it, the audit surface keeps it)
+            but nothing running here resumes because of it (the holder of the suspended promise may be another replica, or this replica restarted and its local window is empty). Read the RUN surface to
+            learn whether anything continued; NEVER take a 200 without this key as proof the run continued (older servers never send it). Not a 409 / 410: the decision DID take effect.
 
     QuestionFrame:
       type: object
@@ -19669,7 +20033,7 @@ components:
     Event_tool_approval:
       description: >
         DURABLE-leg replay of the legacy tool-approval OPEN frame. Same payload as ToolApprovalFrame with the
-        discriminant narrowed to `tool_approval`. Settle it via POST /v1/tool-approvals/{approvalId}/respond.
+        discriminant narrowed to `tool_approval`. Settle it via POST /v1/tool-approvals/{id}/respond.
         Anchor the card on `toolCallId` (NOT `approvalId`); render `governanceForced` as a non-bypassable
         "forced by governance" badge. UNTRUSTED for display: `message`/`args` are redacted but model-authored.
       allOf:
@@ -19692,9 +20056,11 @@ components:
             type: { type: string, enum: [tool_approval_complete] }
     Event_approval_request:
       description: >
-        The design/172 in-stream approval card as an AgentEvent arm. PARALLEL to `tool_approval`, not a
-        replacement: with the protocol on, one ask emits BOTH frames (legacy first) carrying the SAME
-        `approvalId` — dedupe on it and prefer this arm. The decision key is `askId`; settle via
+        The design/172 in-stream approval card as an AgentEvent arm. ONE FRAME FAMILY PER LEG (server >= 7.133.0,
+        `capabilities.approvalFrameFamilies`): on a leg where the card protocol is on, one ask emits only this family
+        (`approval_request` -> `approval_complete` / `approval_revoke`) and none of the legacy `tool_approval` family,
+        so there is nothing to deduplicate. On server <= 7.132.x the two families ran side by side (legacy first) carrying
+        the SAME `approvalId` — there, dedupe on it and prefer this arm. The decision key is `askId`; settle via
         POST /v1/tasks/{taskId}/asks/{askId}/decision.
 
         🔴 THIS ARM IS THE OPEN ENVELOPE, NOT `ApprovalRequestFrame`, AND THAT IS DELIBERATE. The v1 frame
@@ -19741,6 +20107,37 @@ components:
           properties:
             type: { type: string, enum: [approval_revoke] }
 
+    Event_approval_complete:
+      description: >
+        The card family's single-card CLOSE frame as an AgentEvent arm (server >= 7.133.0). One frame family per leg: with `capabilities.approvalFrameFamilies` = `["approval_request"]` this frame
+        REPLACES the legacy `tool_approval_complete` (one ask no longer travels two families). Live SSE and the durable ledger replay carry the same shape (same settle, same verdict: `outcome`,
+        non-human `cause`, `parked`).
+        🔴 THIS ARM IS THE OPEN ENVELOPE, NOT `ApprovalCompleteFrame` — same ruling as Event_approval_request / Event_approval_revoke: narrow with `schemaVersion == 1` (SDK:
+        `isApprovalCompleteFrameV1`) before touching `outcome` / `cause` / `parked`; a frame that does not narrow still dismisses the card by its `askId` (when it has one) — never guess the outcome.
+        🔴 Consumption discipline: (a) dismiss by the opening frame's `askId`; (b) a ledger-replayed frame is for TIMELINE RENDERING ONLY — the card-set baseline stays the open-stream preamble;
+        (c) NEVER derive the run's fate from this frame (read the run row / checkpoint face); (d) it does not conflict with ApprovalRevokeFrame — one ask can receive both.
+      allOf:
+        - $ref: '#/components/schemas/ApprovalFrameEnvelope'
+        - type: object
+          required: [type]
+          properties:
+            type: { type: string, enum: [approval_complete] }
+    Event_session_titled:
+      description: >
+        server >= 7.133.0 — the session title was WRITTEN (contract §4a-ttl): the title generator wrote the title into the session row and minted this frame on THE RUN'S LIVE STREAM afterwards.
+        🔴 LIVE-ONLY, NEVER STORED: the session row (`GET /v1/sessions` list row `title`) is the single source of the title; this frame only says "the row just changed". It is not ledgered
+        (GET /v1/runs/:id/events replay never carries it), not part of any replay surface, and has NO `eventId` (no SSE `id:` line, no part in the `Last-Event-ID` cursor). Only a leg holding a live stream
+        receives it (today `POST /v1/tasks/stream`); the sync-JSON leg and the durable background leg structurally cannot. NOT sent when the session already has a title, on a user rename / pin
+        (`PATCH /v1/sessions/{id}` does not go through the generator), with `SESSION_AUTO_TITLE=false`, after `done`, or once the connection is gone. THE FRAME MAY NOT ARRIVE — the title is whatever
+        the session row says: refresh on the frame, read the row on cold start / another window / reconnect. `title` has passed the generator's redaction and cleaning and is the SAME value as the row's
+        (still UNTRUSTED for display — model-authored text).
+      type: object
+      required: [type, sessionId, title]
+      additionalProperties: false
+      properties:
+        type: { type: string, enum: [session_titled] }
+        sessionId: { type: string, description: 'The session whose row was just written.' }
+        title: { type: string, description: 'The title that landed in the session row (redacted and cleaned; bounded by the server''s TITLE_MAX_CHARS).' }
     # ── resources/*.ts schema backfill, batch 2 (2026-07-28) — the 28-item WIRE_PENDING ratchet zeroed.
     #    Each schema below is cross-checked against the server source (file:line cited in its description
     #    or in the SDK resource JSDoc it mirrors). Wire objects are OPEN sets (additionalProperties: true).
@@ -19765,6 +20162,10 @@ components:
         sessionId: { type: string, description: '`resolved` frames: which pending settled.' }
         toolCallId: { type: string, description: '`resolved` frames: the settled pending''s bound tool-call id (absent when the pending carried none).' }
         count: { type: integer, description: '`synced` frames: how many pendings the connect-time snapshot carried.' }
+        checkpointId: { type: string, description: '`pending` frames only (server >= 7.133.0): the spread PendingCheckpoint row''s `checkpointId` (key absent when the row has no trusted value — read as "no joinable identity").' }
+        consumerState: { type: string, enum: [absent], description: '`live_pending` frames only (server >= 7.133.0): the spread LivePendingRow''s true-only `consumerState` (no engine leg on this replica is waiting for the ask).' }
+        errorCode: { type: string, description: '`error` frames: the machine code (`STREAM_MAX_DURATION` / `draining` / server >= 7.133.0 `approvals.read_unavailable` — the stream STAYS open, do NOT reconnect on it — / `approvals.read_corrupt` — a corrupt row was read, the server closes the stream after the frame).' }
+        message: { type: string, description: '`error` frames: the human sentence (redacted); never match on it.' }
         hasBidiControls:
           type: boolean
           enum: [true]
@@ -19885,20 +20286,24 @@ components:
 
     FleetHookNotice:
       description: >
-        Hook observability payload, TWO kinds (service fleet-bus.ts `HookNotice` minus the wire-stripped
+        Hook observability payload, FOUR kinds (server >= 7.133.0 added `hook_managed_unrun` and `hook_verdict_untrusted`; service fleet-bus.ts `HookNotice` minus the wire-stripped
         ownerScope/ownerSessionId — the payload view of FleetFrame_hook_notice; a discriminated union on
         `kind`, mirroring the SDK type verbatim). Both kinds are pure observe — never block, resume, or
         inject. Visibility is fail-CLOSED: a ?session= subscriber only receives notices provably owned by
-        that session. `kind` is a CLOSED two-member set on the server (exhaustive-switch discipline) but
+        that session. `kind` is a CLOSED four-member set on the server (exhaustive-switch discipline) but
         OPEN ON READ: degrade an unknown future kind to a generic observability row, never crash.
       oneOf:
         - $ref: '#/components/schemas/FleetHookDecisionUnavailable'
         - $ref: '#/components/schemas/FleetHookNonBlockingFailure'
+        - $ref: '#/components/schemas/FleetHookManagedUnrun'
+        - $ref: '#/components/schemas/FleetHookVerdictUntrusted'
       discriminator:
         propertyName: kind
         mapping:
           hook_decision_unavailable: '#/components/schemas/FleetHookDecisionUnavailable'
           hook_non_blocking_failure: '#/components/schemas/FleetHookNonBlockingFailure'
+          hook_managed_unrun: '#/components/schemas/FleetHookManagedUnrun'
+          hook_verdict_untrusted: '#/components/schemas/FleetHookVerdictUntrusted'
 
     FleetHookDecisionUnavailable:
       type: object
@@ -19933,7 +20338,7 @@ components:
         reason:
           # 🔴 NO `enum` — same open-on-read ruling as kind 1 (SDK type is `... | (string & {})`).
           type: string
-          description: 'Machine-branchable failure shape. CLOSED server-side, OPEN ON READ — KNOWN WORDS TODAY: exit_nonzero | timeout | spawn_failed | bad_json.'
+          description: 'Machine-branchable failure shape. CLOSED server-side, OPEN ON READ — KNOWN WORDS TODAY: exit_nonzero | timeout | spawn_failed | bad_json | matcher_over_budget (server >= 7.133.0: the group matcher / the entry `if` name part did not finish evaluating within its 1000 ms budget on this name — NOT a broken hook script but an unevaluable selection condition; the server treats it as selected, the entry still runs; ONE frame per group, `if` one per entry, no exitCode / stderr).'
         hookName: { type: string, description: 'Hook identity (statusMessage, else command/URL/prompt; redacted + bounded, http entries stripped of query/fragment). Always sent.' }
         entryType: { type: string, description: 'command | http | prompt | agent — without it, hookName''s nature is a guess. Closed server-side, open on read. Always sent.' }
         exitCode: { type: integer, description: 'Absent for timeout/spawn_failed (no exit code exists — the server never mints a legit-looking 0).' }
@@ -19941,6 +20346,57 @@ components:
         stderr: { type: string, description: 'Redacted + truncated stderr digest (512-char cap incl. marker). Empty stderr => absent.' }
         detail: { type: string, description: 'Redacted supplement (e.g. where an exit-2 had no venue). Additive / tolerate-absent.' }
 
+    FleetHookManagedUnrun:
+      type: object
+      description: >
+        Kind 3 (server >= 7.133.0): a MANAGED hook did not complete — the group carries a `source`; managed groups (`managedPolicy` / `managedPlugin:<name>`) are the organization policy's guard and run in an independent lane
+        after the unmanaged rewrites, on the final input. A synchronous managed entry that gave neither a legal verdict (exit 0 with no verdict / a closed-set verdict) nor a legal veto (exit 2 / `decision:"block"` /
+        `continue:false`) is "unrun": on `PreToolUse` the conclusion folds to `ask` when nothing vetoed (a person in the loop; unmanaged allows are not trusted; any phase's veto is still the last vote), on other events the
+        conclusion is unchanged — but this frame is ALWAYS sent. One frame per unrun managed entry. The frame does NOT assert how the call ended (read the tool / approval frames).
+      required: [kind, event, reason, source, hookName, entryType]
+      additionalProperties: true
+      properties:
+        kind: { type: string, enum: [hook_managed_unrun] }
+        event: { type: string, description: 'Which hook event. On PreToolUse this entry sets the managed lane: with no veto the call folds to `ask`.' }
+        reason:
+          # NO `enum` — same open-on-read ruling as kinds 1 and 2.
+          type: string
+          description: >-
+            Why it did not complete. CLOSED on the server (thirteen words), OPEN ON READ — KNOWN WORDS TODAY: matcher_invalid | llm_carrier_unavailable | llm_cap | powershell_unsupported | if_unevaluable | budget_exhausted |
+            spawn_failed | timeout | exit_nonzero | bad_json | decision_out_of_set | evidence_unavailable | rewrite_unsettled. `input_truncated` / `matcher_over_budget` are NOT in this kind (they belong to kind 4).
+        source: { type: string, description: 'The group''s source word (`managedPolicy` or `managedPlugin:<name>`; the name is trace only, never a criterion).' }
+        hookName: { type: string, description: 'Hook identity (same rule as kind 2); redacted + bounded.' }
+        entryType: { type: string, description: 'command | http | prompt | agent — closed server-side, open on read.' }
+        toolName: { type: string, description: 'Present on tool events.' }
+        detail: { type: string, description: 'Redacted supplement.' }
+
+    FleetHookVerdictUntrusted:
+      type: object
+      description: >
+        Kind 4 (server >= 7.133.0): a hook's VERDICT IS UNTRUSTED — one rule: an entry that did not get the complete payload, or was pulled in BY SELECTION by an over-budget matcher, has its VETO count (deny / exit 2 /
+        `decision:"block"` / `continue:false` / ask) and its ALLOW and `updatedInput` NOT count. The rule holds on both lanes, so there is one frame; reason, lane and identity are machine fields. Emission condition per lane:
+        managed = the entry ran with an untrusted cause (sent whatever it judged; `PreToolUse` then folds to `ask` when nothing vetoed); unmanaged = it gave an allow or a real rewrite (an identity echo does not count) that was
+        dropped. Today only on `PreToolUse` (the event with an allow word). THE FRAME DOES NOT ASSERT HOW THE CALL ENDED: a managed entry that itself vetoes ends in deny with the frame sent; another trusted allow in the group still
+        lets the call through — read the call's own result. NEVER infer a call outcome from any hook_notice frame.
+      required: [kind, event, reason, lane, hookName, entryType]
+      additionalProperties: true
+      properties:
+        kind: { type: string, enum: [hook_verdict_untrusted] }
+        event: { type: string, description: 'Which hook event (today always PreToolUse).' }
+        reason:
+          # NO `enum` — same open-on-read ruling as kinds 1–3.
+          type: string
+          description: >-
+            Why the verdict is untrusted. CLOSED on the server (two words), OPEN ON READ — KNOWN WORDS TODAY: input_truncated (the entry did not get the full payload: `tool_input` over the cap was replaced by a truncation marker, or a prompt /
+            agent entry''s whole payload text was cut at the same cap) | matcher_over_budget (the group matcher / entry `if` name part ran past its budget and the entry ran BY SELECTION; the same moment also sends a kind-2 frame
+            `matcher_over_budget`).
+        lane: { type: string, description: 'The lane the entry sits in, read off the source table: `managedPolicy` / `managedPlugin:*` => `managed`, everything else and absent => `unmanaged`. Closed (two words) server-side, open on read. Read THIS field, never re-derive from `source`.' }
+        hookName: { type: string, description: 'Hook identity (same rule as kind 2); redacted + bounded.' }
+        entryType: { type: string, description: 'command | http | prompt | agent — closed server-side, open on read.' }
+        toolName: { type: string, description: 'Present on tool events.' }
+        source: { type: string, description: 'The source word the group declared (both lanes give it; ABSENT = the group declared none, so only unmanaged). Trace only, never a criterion.' }
+        detail: { type: string, description: 'Redacted supplement (human-facing; machines read `reason` / `lane`).' }
+
     BakeStatus:
       # 新(census 批2 四段)——server `BakeStatus`(plugins/store-contracts.ts), the COARSE lifecycle
       # bakeView/claimResponse/bakesCreate all key on.
@@ -20450,6 +20906,11 @@ components:
             K-24 (server >= 7.104.0 / S-724) — does this leg capture file history (`on` / `disabled`, OPEN word). EFFECTIVE
             HALF ONLY ⇒ ALWAYS ABSENT ON THIS ENDPOINT; the deployment-level reading is `capabilities.fileHistoryCapture`.
             Full per-key contract: see Event_wiring_manifest.fileHistory.
+        permissionMode:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestPermissionMode' }]
+          description: >-
+            core 7.53.0, server >= 7.133.0 — the leg's permission-mode receipt (section shape WiringManifestPermissionMode). EFFECTIVE HALF ONLY ⇒ this (static) face NEVER carries it, and absence here carries no
+            information; the reading holds only on a live `wiring_manifest` frame.
         instructions:
           allOf: [{ $ref: '#/components/schemas/WiringManifestInstructions' }]
           description: >
@@ -20521,6 +20982,24 @@ components:
           type: array
           description: 'The selected chain member(s), spelled as the chain spells them (relative to the cwd); `[]` = the chain was walked, nothing was selected.'
           items: { type: string, enum: ['CLAUDE.md', '.claude/CLAUDE.md', 'AGENTS.md', '.claude/AGENTS.md'] }
+    WiringManifestPermissionMode:
+      # server 7.133.0 / core 7.53.0:同一段形被 live 帧(两张脸)、静态诊断面、`POST /v1/tasks` 的 `wiringManifest` 回执与账本行引用 ⇒ 具名单源(`spec-field-drift-gate` 也按「导出的 interface 必有同名 schema」逼出它)。
+      type: object
+      additionalProperties: false
+      description: >
+        The `wiring_manifest.permissionMode` section (core 7.53.0 `PermissionModeReceipt`; server >= 7.133.0 projects it on BOTH faces — tenant and operator — and the same section rides the `wiringManifest`
+        receipt of the `POST /v1/tasks` 200 body and the `/events` ledger row; the server judges SHAPE only: `effective` a non-empty string, `requested` / `foldedBy` absent or non-empty strings, else the whole section
+        is dropped). The engine gives the same three-member receipt on EVERY mode question: `requested` = the mode word the caller declared (ABSENT = declared nothing — a root inherits `default`, a child inherits its
+        parent); `effective` = the mode the leg actually runs under (the request clamped under a parent's ceiling, then folded to `default` where the deployment denies it or the classifier face is absent) — ALWAYS present,
+        the shell renders its mode indicator from it; `foldedBy` = PRESENT IFF `requested` and `effective` differ — `operator_deny` (the deployment / organization ceiling denies the mode) / `face_absent` (`auto` needs
+        a classifier face this leg lacks) / `inherited_ceiling` (a delegated child clamped under its parent's ceiling); read OPEN (a fourth word passes through as "folded, cause unknown"). ABSENT section = an older
+        engine / server (<= 7.132.x), not an assertion of the default mode. This is ONE added key on a closed object: a consumer validating `wiring_manifest` strictly against sdk <= 24.0.0's spec fails the whole frame
+        on 7.133.0+ — upgrade to sdk 25.0.0 or relax unknown keys on this section.
+      required: [effective]
+      properties:
+        requested: { type: string, description: 'The mode word the caller declared (a PermissionMode word today; read open). ABSENT = declared nothing.' }
+        effective: { type: string, description: 'The mode the leg actually runs under (a PermissionMode word today; read open). Always present.' }
+        foldedBy: { type: string, description: 'Present iff `requested` and `effective` differ: `operator_deny` / `face_absent` / `inherited_ceiling` (engine words; read OPEN — an unknown word means "folded, cause unknown").' }
     WiringManifestModEntry:
       # server 7.132.0 / core 7.52.0:取代钩子席位行形(删,零别名)。同一份行形被 live 帧与静态诊断面两处引用 ⇒ 具名;两形各自具名(⑤bis 名单逐形对账)。
       description: >
@@ -21050,10 +21529,218 @@ components:
         remember for this session's category (fs-write tools share ONE category: approving Write covers
         Edit/NotebookEdit; other tools are per-tool) — the CC "don't ask again this session" semantic.
 
+    ConfigCatalog:
+      type: object
+      description: >
+        The 200 body of GET /v1/config/catalog (server `ConfigCatalogWire`) — a PROJECTION, left open on read (the producer ships independently and adds keys additively between SDK releases; the request side has no body).
+      required: [catalogVersion, envLaneTiming, restartSlices, centerDomains, summary, rows, retired]
+      additionalProperties: true
+      properties:
+        catalogVersion: { type: integer, enum: [1] }
+        envLaneTiming: { type: string, description: 'The env lane''s uniform timing (`deploy`: env is immutable at runtime, so changing env = changing the deployment). Open on read.' }
+        restartSlices: { type: array, items: { type: string }, description: 'The restart-slice names a centre write can land in (open on read).' }
+        centerDomains: { type: array, items: { type: string }, description: 'The contract package''s centre-configuration domains.' }
+        summary:
+          type: object
+          required: [total, envHeld, secret, centerManaged]
+          additionalProperties: true
+          properties:
+            total: { type: integer }
+            envHeld: { type: integer }
+            secret: { type: integer }
+            centerManaged: { type: integer }
+        rows: { type: array, items: { $ref: '#/components/schemas/ConfigCatalogRow' } }
+        retired: { type: array, items: { $ref: '#/components/schemas/ConfigCatalogRetiredEnv' }, description: 'Tombstoned env names this process refuses to start on (always present, may be empty). A name is never in `rows` and here at once.' }
+    ConfigCatalogRow:
+      type: object
+      description: >
+        One catalog row (server `ConfigCatalogRow`): a deployment knob's static declaration plus this process's effective reading. OPEN on read (projection). The two VERDICT bits are the true-only family:
+        `effectiveValueInvalid` (the effective value fell outside the row's echo set; `effectiveValue` is `null`) and `effectiveValueWithheld` (server >= 7.133.0) — see the property.
+      required: [name, domain, type, semantics, writeLanes, effectiveLane, envHeld, envTiming, effectiveValue, valueClass, danger]
+      additionalProperties: true
+      properties:
+        name: { type: string, description: 'The knob (env) name; the catalog is sorted by it.' }
+        domain: { type: string, description: 'One of the nine configuration groups (store / modelPlane / approval / memory / auth / orchestration / limitsHttp / observability / integrations). Open on read.' }
+        type: { type: string, description: 'Value type: boolean | number | string | enum | csv | json | path | url | secret | opaque. Open on read.' }
+        semantics: { type: string, description: 'Human sentence (true to the read site).' }
+        writeLanes: { type: array, items: { type: string, enum: [env, center] }, description: 'Which lanes can write this knob.' }
+        effectiveLane: { type: string, description: 'The lane actually in force: env | center | default. Open on read.' }
+        envHeld: { type: boolean, description: 'This machine''s env sets it explicitly.' }
+        envTiming: { type: string, description: '`deploy` (changing env = changing the deployment) | `inert` (retired / zero-consumer key). Open on read.' }
+        staticDefault: { type: string }
+        derivedDefaultNote: { type: string }
+        effectiveValue:
+          description: 'This process''s effective DISPLAY value: a scalar / a word list / `null` (unset) / `{ present, length? }` (`secret` / `opaque` rows report presence and length only).'
+          oneOf:
+            - { type: [string, number, boolean, 'null'] }
+            - { type: array, items: { type: string } }
+            - { type: object, required: [present], additionalProperties: true, properties: { present: { type: boolean }, length: { type: integer } } }
+        valueClass: { type: string, description: '`plain` (echoable) | `secret` | `opaque` (the value never goes on the wire). Open on read.' }
+        danger: { type: array, items: { type: string }, description: 'The risk axes of a wrong setting: security | billing | data (open on read).' }
+        center: { $ref: '#/components/schemas/ConfigCatalogRowCenter' }
+        centerDomain: { type: string }
+        centerPath: { type: string }
+        scope: { type: string, description: '`bootstrap-only` = read only at start-up.' }
+        enumValues: { type: array, items: { type: string }, description: 'An `enum` row''s writable word set.' }
+        effectiveValueInvalid:
+          type: boolean
+          enum: [true]
+          description: 'TRUE-ONLY verdict bit: the effective value fell OUTSIDE the row''s own echo set (or a boolean without a declared mapping) — `effectiveValue` is then `null` (echoing an out-of-set value would teach a consumer to write back an illegal word). Enum rows only. ABSENT = this cell has no such matter.'
+        effectiveValueWithheld:
+          type: boolean
+          enum: [true]
+          description: >-
+            server >= 7.133.0, TRUE-ONLY verdict bit on `type: url` rows (present only when true, never `false`): the display mint judged this cell (single value) or any item of it (list) WITHHELD — a part the position rule
+            would have shown (the whole query / a path segment) was NOT shown because it held a credential-shaped piece. The mint owns the verdict; the catalog does not judge again. So the shown value is not the whole value:
+            a catalog page / `sema config show` marks the row ("part of this value is withheld"), and must not read the shown value as "the value is exactly that". ABSENT = nothing withheld (older servers never send it).
+            The standard position rule (userinfo landed, query values become tokens) holds for every row and is NOT a withholding; a value that became a placeholder as a whole means the row's display rule cannot show it
+            (not a hierarchical URL; the two outbound-proxy rows show only scheme://host[:port]) — also not this bit.
+    ConfigCatalogRowCenter:
+      type: object
+      description: 'A catalog row''s centre seat: whether the knob is centre-publishable, who wins, when it takes effect. Present only on rows with a centre seat.'
+      required: [domain, path, precedence, timing, managedNow, effectiveNow]
+      additionalProperties: true
+      properties:
+        domain: { type: string }
+        path: { type: string, description: 'Path in the domain (`a.b` into objects; `xs[].c` into array elements).' }
+        precedence: { type: string, description: '`center-wins` | `env-wins` (open on read).' }
+        timing: { type: string, description: '`hot` | `restart` | `inert` (open on read; not `deploy`).' }
+        restartSlice: { type: string }
+        restartReason: { type: string }
+        managedNow: { type: boolean, description: 'The centre''s latest effective config currently MANAGES this key (no config pipeline => always false).' }
+        effectiveNow: { type: boolean, description: 'The centre write is in force right now (managed AND not held down by an env placeholder).' }
+    ConfigCatalogRetiredEnv:
+      type: object
+      description: 'A tombstoned env name (the contract package''s RETIRED_ENVS wire projection): a name this process refuses to start on. `renamed` carries only `replacement`; `replaced` carries `replacement` + `reason` (how the value semantics changed); `removed` carries only `reason`.'
+      required: [name, kind]
+      additionalProperties: true
+      properties:
+        name: { type: string }
+        kind: { type: string, description: '`renamed` | `replaced` | `removed` (open on read).' }
+        replacement: { type: string }
+        reason: { type: string }
+    EntryProblem:
+      type: object
+      description: >
+        One ENTRY PROBLEM (server >= 7.133.0): a refusal body's `detail.problems[]` element and an accept-time `warnings[]` element share this shape. `code` = the refusal code the problem belongs to (in `warnings[]`: the engine's
+        reading code for that entry); `field` = the coordinate of the list holding the entry in the request body (`settings.permissions.allow`, `skills[i].allowedTools` …); `entry` = the entry string (passed through the server''s
+        redaction mouth — not a guarantee of your original bytes); `reason` = the machine reason — mostly the ENGINE''s word verbatim (why it read the entry as nothing); the server mints two of its own, `not_in_roster` (accept-time
+        warnings only: the name in an allow-side selector list is not in the roster and is no protocol namespace name — the engine accepts it anyway) and `home_unresolvable` (settings-rule 422: a `~/` path rule on a deployment that cannot
+        resolve the execution environment''s home); and `below_trust_floor` (the caller''s trust tier is below the member''s admission floor — see ErrorResponse.detail.callerTrust). Read OPEN.
+      required: [code, field, entry, reason]
+      additionalProperties: false
+      properties:
+        code: { type: string }
+        field: { type: string }
+        entry: { type: string }
+        reason: { type: string }
+    PrincipalInboxMessage:
+      type: object
+      description: 'The request body of POST /v1/principal-inbox/messages: a CLOSED three-key shape (`from` is minted by the server from the verified identity and cannot be sent).'
+      required: [to, content]
+      additionalProperties: false
+      properties:
+        to: { type: string, minLength: 1, description: 'The recipient principal string. Must belong to the sender''s organization (the membership judgement reads the organization directory); a failed judgement is 404 `org_delivery.not_member`, byte-identical to "no such person".' }
+        content: { type: string, minLength: 1, maxLength: 32000, description: 'The letter body (characters; over 32000 => 400 `request.field_invalid`).' }
+        urgent: { type: boolean, description: 'The urgent flag on the envelope (absent = ordinary).' }
+    PrincipalInboxReceipt:
+      type: object
+      description: 'The 200 receipt: the letter was appended. `receiptId` = the gate-minted delivery receipt id (the envelope''s `gateReceiptId` carries the same value).'
+      required: [receiptId]
+      additionalProperties: false
+      properties:
+        receiptId: { type: string }
+    OrgDeliveryRefusalCode:
+      type: string
+      enum: [org_delivery.not_member, org_delivery.rate_limited, org_delivery.inbox_full, org_delivery.recipient_tombstoned]
+      description: >
+        The four cross-principal delivery refusal codes (server >= 7.133.0; the engine's closed `ORG_DELIVERY_REFUSAL_CODES`, one frozen sentence each — machines read the CODE): `org_delivery.not_member` (404),
+        `org_delivery.rate_limited` (429), `org_delivery.inbox_full` (409), `org_delivery.recipient_tombstoned` (410). See POST /v1/principal-inbox/messages.
+    ToolApprovalReadState:
+      type: string
+      enum: [pending, decided, parked, void]
+      description: >
+        `state` of GET /v1/tool-approvals/{id} (server >= 7.133.0), a CLOSED four-word set — read it exhaustively: `pending` = a live registration on this replica is waiting (answer door open);
+        `decided` = the row is DECIDED; `parked` = PARKING / PARKED (a late answer redeems the parked card); `void` = DENIED / VOID (nobody decided it, the answer has nowhere to land).
+    ApprovalsStreamReadErrorCode:
+      type: string
+      enum: [approvals.read_unavailable, approvals.read_corrupt]
+      description: >
+        The `errorCode` of the two READ-FAILURE `error` frames on GET /v1/approvals/stream (server >= 7.133.0). `approvals.read_unavailable` = this tick's approval read failed (the store was momentarily
+        unreadable) — the stream STAYS open and the next tick reads again; it is NOT a terminal frame and NOT a reconnect signal (do not reconnect on it, and do not read it as "nothing pending").
+        `approvals.read_corrupt` = a corrupt row was read — the server closes the stream after the frame; deal with that row before reopening. Branch on the code, never match the message.
+        Older servers (<= 7.132.x) answer a read failure with nothing but heartbeats.
+    ToolApprovalReadProjection:
+      type: object
+      description: >
+        The row projection shared by the three non-`pending` arms of GET /v1/tool-approvals/{id} (server >= 7.133.0): a SUBSET of the `livePending[]` row keys — one reader, one key set. `frame` = the disconnect-replay
+        opening frame (an `approval_request` frame; ABSENT when the card cannot be read back — never invented).
+      required: [approvalId, ts, expiresAtMs]
+      additionalProperties: true
+      properties:
+        approvalId: { type: string }
+        ts: { type: number, description: 'Registration time (ms epoch).' }
+        expiresAtMs: { type: number, description: 'Absolute window deadline (cast once, never recomputed).' }
+        sessionId: { type: string }
+        toolName: { type: string }
+        frame: { $ref: '#/components/schemas/ApprovalRequestFrame' }
+    ToolApprovalReadBody:
+      description: >
+        The 200 body of GET /v1/tool-approvals/{id} (server >= 7.133.0) — a four-arm union discriminated by `state` (closed, read it exhaustively): `pending` = a live registration on this replica is waiting
+        (the `livePending[]` row + `state`; answer door open); `decided` = the row is DECIDED (`decision` / `decidedAtMs` / `decisionNote?`, the same three keys as the late-replay body); `parked` = PARKING / PARKED
+        (a late answer redeems the parked card; `decidePath?` points at the durable decision path); `void` = DENIED / VOID (nobody decided it, the answer has nowhere to land; `cause?` is the same cause word as the
+        late-answer 404's, see ToolApprovalNotPendingCause).
+      oneOf:
+        - $ref: '#/components/schemas/ToolApprovalReadPending'
+        - $ref: '#/components/schemas/ToolApprovalReadDecided'
+        - $ref: '#/components/schemas/ToolApprovalReadParked'
+        - $ref: '#/components/schemas/ToolApprovalReadVoid'
+      discriminator:
+        propertyName: state
+        mapping:
+          pending: '#/components/schemas/ToolApprovalReadPending'
+          decided: '#/components/schemas/ToolApprovalReadDecided'
+          parked: '#/components/schemas/ToolApprovalReadParked'
+          void: '#/components/schemas/ToolApprovalReadVoid'
+    ToolApprovalReadPending:
+      allOf:
+        - $ref: '#/components/schemas/LivePendingRow'
+        - type: object
+          required: [state]
+          properties:
+            state: { type: string, enum: [pending] }
+    ToolApprovalReadDecided:
+      allOf:
+        - $ref: '#/components/schemas/ToolApprovalReadProjection'
+        - type: object
+          required: [state, decision, decidedAtMs]
+          properties:
+            state: { type: string, enum: [decided] }
+            decision: { type: string, enum: [allow, deny] }
+            decidedAtMs: { type: integer }
+            decisionNote: { type: string }
+    ToolApprovalReadParked:
+      allOf:
+        - $ref: '#/components/schemas/ToolApprovalReadProjection'
+        - type: object
+          required: [state]
+          properties:
+            state: { type: string, enum: [parked] }
+            decidePath: { type: string, description: 'The durable decision path for this ask when it can be built.' }
+    ToolApprovalReadVoid:
+      allOf:
+        - $ref: '#/components/schemas/ToolApprovalReadProjection'
+        - type: object
+          required: [state]
+          properties:
+            state: { type: string, enum: [void] }
+            cause:
+              allOf: [{ $ref: '#/components/schemas/AskRowEndingCause' }]
+              description: 'The row''s recorded ending cause (absent for a legacy row with no cause written — never invented).'
     ToolApprovalRespondApplied:
       type: object
       description: >
-        The APPLIED arm of the 200 ack of POST /v1/tool-approvals/{approvalId}/respond (server tool-approval.ts — exact
+        The APPLIED arm of the 200 ack of POST /v1/tool-approvals/{id}/respond (server tool-approval.ts — exact
         shape, `decision` echoed): the decision settled a live gate. Owner-gated with a 404 and NO existence oracle: non-owner and
         unknown/settled/expired/wrong-replica ids are indistinguishable. See ToolApprovalRespondAck for the replayed arm.
       # 封闭(census 批2 第三段,2026-07-30):铸造点 `tool-approval.ts` 三恒在键 + 两条件键
@@ -21069,6 +21756,13 @@ components:
         approvalId: { type: string }
         delivery: { type: string, enum: [applied] }
         decision: { $ref: '#/components/schemas/ToolApprovalDecision' }
+        consumerState:
+          type: string
+          enum: [absent]
+          description: >-
+            server >= 7.133.0, TRUE-ONLY: no engine leg on THIS replica was waiting for the ask this answer settled — the same bit, with the same meaning, as `LivePendingRow.consumerState` and the
+            durable decision ack's. Present <=> the answered entry was ADOPTED from the ask ledger at start-up. The decision lands on the row as usual, but nothing running here resumes because of it — read the run
+            surface; do not read the 200 as "the run continued". Absent = a local engine leg was waiting, or an older server.
         rememberApplied:
           type: boolean
           description: >
@@ -21160,7 +21854,7 @@ components:
     ToolApprovalRespondReplayed:
       type: object
       description: >
-        The REPLAYED arm of the 200 ack of POST /v1/tool-approvals/{approvalId}/respond: the ask was already DECIDED
+        The REPLAYED arm of the 200 ack of POST /v1/tool-approvals/{id}/respond: the ask was already DECIDED
         (by anyone) when this answer arrived, so the server replays the FIRST decision — `decision` is the row's two-word
         value (`allow_session` was folded to `allow` when it landed), `decidedAtMs` the first decision's clock,
         `decisionNote` only when the row has one, `rememberApplied: false` only when THIS request asked `allow_session`.
@@ -21176,14 +21870,57 @@ components:
         decidedAtMs: { type: integer }
         decisionNote: { type: string }
         rememberApplied: { type: boolean, enum: [false] }
+        noteRecorded: { type: boolean, description: 'server >= 7.133.0 (two doors, one shape): present ONLY when THIS request carried a `note`; `true` <=> the row''s text is verbatim what this request submitted, `false` = not confirmed (another reason is on the row / no store / read-back failed). A late answer''s note never overwrites the first decision''s reason — that is `decisionNote`.' }
+        rulePersisted: { type: boolean, enum: [false], description: 'server >= 7.133.0: present (as `false`) only when this late answer carried `persistRule`: the rule is redeemed on the FIRST decision only, a late answer never saves one.' }
+        ruleRefusal:
+          type: string
+          enum: [rule_lane_unavailable]
+          description: 'with `rulePersisted: false`; on this arm always `rule_lane_unavailable` (the only word the published late-answer path mints).'
+    ToolApprovalRespondParkedRedeemed:
+      type: object
+      description: >
+        The PARKED-REDEEMED arm of the 200 ack of POST /v1/tool-approvals/{id}/respond (server >= 7.133.0; server tool-approval.ts `redeemParkedAsk` /
+        `replayRedeemReceipt`): the card's window had run out and the ask moved to background waiting (PARKED); this late answer — on another replica or after a restart —
+        goes through the EXISTING durable redemption leg (the same CAS as POST /v1/approvals/{sessionId}/decide) instead of the old 404 `tool_approval.not_pending`
+        (`cause: unknown_or_other_replica`). Body = the redemption leg's receipt (ApprovalDecisionResult's keys — `status` / `taskId` / `sessionId` / ... as they come) plus the three keys
+        this door adds: `approvalId` / `askId` (the same 64-hex value) and the discriminant `accepted`. `decision` is the two-word direction on the REPLAY form only (`allow` / `deny`,
+        `allow_session` folded to `allow`); `rememberApplied: false` appears only when this request asked `allow_session` (a parked redemption cannot remember a session grant);
+        `rulePersisted` / `ruleRefusal` / `persistedRule*` are the `persistRule` outcome on the redemption leg (a rule that fails to store NEVER flips the verdict).
+        `idempotent: true` appears only on the REPLAY (the same already-redeemed card answered again returns the first redemption's receipt).
+        CLOSED like its two sibling arms (the census keeps this op's 200 body closed): the key set is ApprovalDecisionResult's own keys (one source per shape, by `$ref`) plus the added ones.
+      required: [approvalId, askId, accepted]
+      additionalProperties: false
+      properties:
+        approvalId: { type: string }
+        askId: { type: string }
+        accepted: { type: string, enum: [parked_redeemed] }
+        status: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/status' }
+        taskId: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/taskId' }
+        sessionId: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/sessionId' }
+        bindingEnforced: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/bindingEnforced' }
+        decision: { type: string, description: 'REPLAY form: `allow` / `deny` (`allow_session` folded to `allow`). FIRST redemption: whatever the redemption leg''s own receipt says (`approve` / `deny` today) — read it open.' }
+        errorCode: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/errorCode' }
+        errorMessage: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/errorMessage' }
+        retriable: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/retriable' }
+        idempotent: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/idempotent' }
+        executionOutcome: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/executionOutcome' }
+        rememberApplied: { type: boolean, enum: [false] }
+        rulePersisted: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/rulePersisted' }
+        ruleRefusal: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/ruleRefusal' }
+        persistedRule: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/persistedRule' }
+        persistedRules: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/persistedRules' }
+        persistedRuleAnchors: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/persistedRuleAnchors' }
     ToolApprovalRespondAck:
       description: >
-        The 200 ack of POST /v1/tool-approvals/{approvalId}/respond — a discriminated union: the decision was APPLIED to a live
+        The 200 ack of POST /v1/tool-approvals/{id}/respond — a discriminated union: the decision was APPLIED to a live
         gate (ToolApprovalRespondApplied, `delivery: "applied"`) or the ask was already decided and the first decision is
-        REPLAYED (ToolApprovalRespondReplayed, `idempotent: true`). The discriminant is `idempotent`.
+        REPLAYED (ToolApprovalRespondReplayed, `idempotent: true`), or (server >= 7.133.0, sdk 25.0.0) the answer REDEEMED a PARKED card through the durable redemption
+        leg (ToolApprovalRespondParkedRedeemed, `accepted: "parked_redeemed"`). The discriminants are `delivery` / `idempotent` / `accepted` (a replayed redemption carries
+        BOTH `accepted: "parked_redeemed"` and `idempotent: true` — read `accepted` first).
       oneOf:
         - $ref: '#/components/schemas/ToolApprovalRespondApplied'
         - $ref: '#/components/schemas/ToolApprovalRespondReplayed'
+        - $ref: '#/components/schemas/ToolApprovalRespondParkedRedeemed'
     UsageMetric:
       type: string
       enum: [tasks, tokensIn, tokensOut, costUsd]
@@ -22141,7 +22878,7 @@ components:
 
     AdoptionNotMigratedFace:
       type: string
-      enum: [usage-window, cost-quota, rate-limit, approval-exemption-grantor, approval-ask-decision-actor, image-bake-requested-by]
+      enum: [usage-window, cost-quota, rate-limit, approval-exemption-grantor, approval-ask-decision-actor, image-bake-requested-by, permission-rule-approval-history, permission-rule-import-ticket, org-delivery-quota]
       description: >
         FROZEN machine-readable vocabulary of the faces the server deliberately does not migrate. Renaming or
         removing a member is a wire break; adding one is a new behaviour face. Consumers assert POSITIVELY on