@sema-agent/sdk 24.0.0 → 26.0.0

package/openapi.yaml

@@ -172,7 +172,7 @@ tags:
       themself said yes"), never operator. GATED AND OFF BY DEFAULT: the whole lane hangs on
       PERMISSION_RULES_ENABLED (default false) plus a wired rule store — so on a stock deployment BOTH doors
       answer 501 `capability.rule_store_required`, and so does the single-card half (the ask frame simply
-      carries no `ruleSuggestions`). Read the observed frame / an actual response, never a version number.
+      carries no `ruleOffers`). Read the observed frame / an actual response, never a version number.
       The SINGLE-CARD half of the same lane is `persistRule` on POST /v1/tool-approvals/{id}/respond.
   - name: adoption
     description: >
@@ -2280,38 +2280,16 @@ paths:
     get:
       tags: [workspace]
       operationId: workspaceList
-      x-status: retired          # S-15/design/381 (server 7.52.0): whole-tree snapshot epoch retired — every ≥7.52 deployment answers 501 capability.workspace_retired.
-      summary: 'RETIRED (server 7.52.0, S-15) — snapshot listing; ≥7.52 answers 501 capability.workspace_retired. Live on 1.299–7.51 only.'
-      description: >
-        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this
-        face projected was replaced by per-edited-file rewind HISTORY, which holds only files the agent edited
-        — structurally there is no "whole workspace" manifest to browse anymore. The route SHAPE is kept
-        server-side as a tombstone: every ≥7.52 deployment answers 501 `capability.workspace_retired` (a named
-        refusal, not a 404 that reads like a typo), and `capabilities.workspace` is always false (same
-        predicate). There is NO 1:1 replacement path — a future "rewind coverage" browse would be a NEW face
-        with tracked-set semantics, not this name wired back. Related live faces: rewind restore rides
-        `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file history blobs ride
-        `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`.
-        Historical shape (servers 1.299–7.51): read-only projection over the E19 snapshot store. Rows carry
-        `{key, files, bytes?}`; `latest` = the newest snapshot key. Owner-scoped (non-owner → 404, no
-        oracle); 501 without the snapshot-store read faces (probe `capabilities.workspace`).
-      parameters:
-        - in: query
-          name: limit
-          required: false
-          schema: { type: integer, minimum: 1, maximum: 100 }
+      x-status: retired          # server 7.52.0: whole-tree snapshot epoch retired; sdk 26.0.0 deleted the verb (support floor 7.52.0).
+      summary: 'RETIRED (server 7.52.0, S-15) — snapshot listing; every supported server (>= 7.52.0) answers 501 capability.workspace_retired.'
+      description: >
+        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this face projected was replaced by per-edited-file
+        rewind HISTORY (only files the agent edited — there is no "whole workspace" manifest to browse). The route SHAPE is kept server-side as a tombstone:
+        every supported server answers 501 `capability.workspace_retired` (a named refusal, not a 404 that reads like a typo), and `capabilities.workspace` is
+        always `false` (same predicate). No 1:1 replacement: rewind restore rides `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file
+        history blobs ride `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`. sdk 26.0.0 deleted `client.workspace` (its 200 shapes only existed on 1.299–7.51).
       responses:
-        '200':
-          description: The snapshot listing.
-          content:
-            application/json:
-              # 封闭两层(census 批2 第三段,2026-07-30):铸造点 `routes/sessions.ts`(信封与行两处)。条件键=信封 `latest`(零快照即省略)、行 `bytes`(blobSizes 面缺席=诚实省略)。
-              # 4.3.0:形提成具名 `WorkspaceSnapshotPage`(SDK 同批把返回位的内联字面量也提成了 exported type,
-              # 让 spec-resource-schema-gate 罩得住 —— CAPS-OPS-8)。
-              schema: { $ref: '#/components/schemas/WorkspaceSnapshotPage' }
-        '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
   /v1/sessions/{sessionId}/workspace/{key}/tree:
@@ -2325,38 +2303,19 @@ paths:
         name: key
         required: true
         schema: { type: string }
-        description: 'Snapshot key (entryId), or the alias `latest` = the newest snapshot.'
     get:
       tags: [workspace]
       operationId: workspaceTree
-      x-status: retired          # S-15 (server 7.52.0): retired with the family — see workspaceList's retirement note.
-      summary: 'RETIRED (server 7.52.0, S-15) — snapshot file tree; ≥7.52 answers 501 capability.workspace_retired.'
-      description: >
-        🔴 RETIRED as of server 7.52.0 — same retirement (and same replacement pointers) as `workspaceList`
-        above: every ≥7.52 deployment answers 501 `capability.workspace_retired`; `capabilities.workspace` is
-        always false. Historical shape (1.299–7.51): entries carry `{path, hash, size?}` — `hash` is the
-        sha256 content-address (cross-snapshot change highlighting, [1894]②); `size` only when the SQL size
-        index is available. `limit` 1..2000 default 500, `offset` cursor; `nextOffset` present = more pages.
-      parameters:
-        - in: query
-          name: limit
-          required: false
-          schema: { type: integer, minimum: 1, maximum: 2000 }
-        - in: query
-          name: offset
-          required: false
-          schema: { type: integer, minimum: 0 }
+      x-status: retired          # server 7.52.0: whole-tree snapshot epoch retired; sdk 26.0.0 deleted the verb (support floor 7.52.0).
+      summary: 'RETIRED (server 7.52.0, S-15) — snapshot file tree; every supported server (>= 7.52.0) answers 501 capability.workspace_retired.'
+      description: >
+        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this face projected was replaced by per-edited-file
+        rewind HISTORY (only files the agent edited — there is no "whole workspace" manifest to browse). The route SHAPE is kept server-side as a tombstone:
+        every supported server answers 501 `capability.workspace_retired` (a named refusal, not a 404 that reads like a typo), and `capabilities.workspace` is
+        always `false` (same predicate). No 1:1 replacement: rewind restore rides `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file
+        history blobs ride `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`. sdk 26.0.0 deleted `client.workspace` (its 200 shapes only existed on 1.299–7.51).
       responses:
-        '200':
-          description: One page of the tree.
-          content:
-            application/json:
-              # 封闭两层(census 批2 第三段,2026-07-30):铸造点 `routes/sessions.ts`(信封与行两处)。条件键=信封 `nextOffset`(尾页省略)、行 `size`(blobSizes 面缺席省略)。
-              # 4.3.0:形提成具名 `WorkspaceTreePage`(理由同 list 腿 —— CAPS-OPS-8)。
-              schema: { $ref: '#/components/schemas/WorkspaceTreePage' }
-        '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
   /v1/sessions/{sessionId}/workspace/{key}/file:
@@ -2373,46 +2332,16 @@ paths:
     get:
       tags: [workspace]
       operationId: workspaceFile
-      x-status: retired          # S-15 (server 7.52.0): retired with the family — ≥7.52 the tombstone rejects BEFORE any size check, so the 413 envelope below is unreachable there.
-      summary: 'RETIRED (server 7.52.0, S-15) — single-file read; ≥7.52 answers 501 capability.workspace_retired.'
-      description: >
-        🔴 RETIRED as of server 7.52.0 — same retirement (and replacement pointers) as `workspaceList` above.
-        On ≥7.52 the tombstone 501 fires BEFORE any size check, so the 413 `workspace_file_too_large`
-        envelope below is UNREACHABLE there (the SDK keeps its typed WorkspaceFileTooLargeError for
-        1.299–7.51 servers still inside the support range). Historical shape (1.299–7.51): raw bytes with a
-        CONSERVATIVE content-type table (html/svg etc. deliberately serve as octet-stream — agent output is
-        untrusted; `x-content-type-options: nosniff` always set) + the `x-sema-content-binary` discriminator
-        header (first-8KiB NUL sniff, [1894]③). Capped at `capabilities.workspace.maxFileBytes` (default
-        8MiB, WORKSPACE_FILE_MAX_BYTES) — over-cap ⇒ 413 STRUCTURED envelope
-        `{errorCode: "workspace_file_too_large", sizeBytes, limit}` ([1894]①; archive was the escape hatch).
-        With the SQL size index the 413 fired BEFORE fetching the bytes.
-      parameters:
-        - in: query
-          name: path
-          required: true
-          schema: { type: string }
-          description: The tree's relPath, verbatim.
+      x-status: retired          # server 7.52.0: whole-tree snapshot epoch retired; sdk 26.0.0 deleted the verb (support floor 7.52.0).
+      summary: 'RETIRED (server 7.52.0, S-15) — snapshot single file; every supported server (>= 7.52.0) answers 501 capability.workspace_retired.'
+      description: >
+        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this face projected was replaced by per-edited-file
+        rewind HISTORY (only files the agent edited — there is no "whole workspace" manifest to browse). The route SHAPE is kept server-side as a tombstone:
+        every supported server answers 501 `capability.workspace_retired` (a named refusal, not a 404 that reads like a typo), and `capabilities.workspace` is
+        always `false` (same predicate). No 1:1 replacement: rewind restore rides `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file
+        history blobs ride `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`. sdk 26.0.0 deleted `client.workspace` (its 200 shapes only existed on 1.299–7.51).
       responses:
-        '200':
-          description: The file bytes.
-          content:
-            application/octet-stream:
-              schema: { type: string, format: binary }
-        '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
-        '413':
-          description: 'Structured over-cap envelope: {error, errorCode: "workspace_file_too_large", sizeBytes, limit}.'
-          content:
-            application/json:
-              schema:
-                type: object
-                required: [error, errorCode, sizeBytes, limit]
-                properties:
-                  error: { type: string }
-                  errorCode: { type: string, enum: [workspace_file_too_large] }
-                  sizeBytes: { type: integer }
-                  limit: { type: integer }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
   /v1/sessions/{sessionId}/workspace/{key}/archive:
@@ -2429,28 +2358,17 @@ paths:
     get:
       tags: [workspace]
       operationId: workspaceArchive
-      x-status: retired          # S-15 (server 7.52.0): retired with the family — see workspaceList's retirement note.
-      summary: 'RETIRED (server 7.52.0, S-15) — whole-snapshot tar; ≥7.52 answers 501 capability.workspace_retired.'
-      description: >
-        🔴 RETIRED as of server 7.52.0 — same retirement (and replacement pointers) as `workspaceList` above:
-        every ≥7.52 deployment answers 501 `capability.workspace_retired`. Historical shape (1.299–7.51):
-        streamed ustar (`content-disposition: attachment`), entries in stable path order, blob-by-blob with
-        backpressure — server memory stays O(1 file). Pre-flight checks BEFORE the headers went out: paths
-        not representable in ustar ⇒ 422 naming the first offenders; missing blobs (raced a reap / partial
-        import) ⇒ 502 (retryable). A blob vanishing MID-stream destroyed the connection (honest truncation)
-        rather than faking a complete archive.
+      x-status: retired          # server 7.52.0: whole-tree snapshot epoch retired; sdk 26.0.0 deleted the verb (support floor 7.52.0).
+      summary: 'RETIRED (server 7.52.0, S-15) — snapshot tar archive; every supported server (>= 7.52.0) answers 501 capability.workspace_retired.'
+      description: >
+        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this face projected was replaced by per-edited-file
+        rewind HISTORY (only files the agent edited — there is no "whole workspace" manifest to browse). The route SHAPE is kept server-side as a tombstone:
+        every supported server answers 501 `capability.workspace_retired` (a named refusal, not a 404 that reads like a typo), and `capabilities.workspace` is
+        always `false` (same predicate). No 1:1 replacement: rewind restore rides `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file
+        history blobs ride `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`. sdk 26.0.0 deleted `client.workspace` (its 200 shapes only existed on 1.299–7.51).
       responses:
-        '200':
-          description: The tar stream.
-          content:
-            application/x-tar:
-              schema: { type: string, format: binary }
-        '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
-        '422': { description: 'Snapshot contains paths not representable in ustar (names the first 5).' }
         '501': { $ref: '#/components/responses/NotImplemented' }
-        '502': { description: 'Snapshot is missing blobs (raced a reap or a partial import) — retry or pick another snapshot.' }
 
   /v1/sessions/{sessionId}/policy:
     parameters:
@@ -3040,50 +2958,6 @@ paths:
         '404': { $ref: '#/components/responses/NotFound' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
-  /v1/sessions/{sessionId}/sync/snapshots/{key}/blobs/{hash}:
-    parameters:
-      - $ref: '#/components/parameters/PrincipalHeader'
-      - in: path
-        name: sessionId
-        required: true
-        schema: { type: string }
-      - in: path
-        name: key
-        required: true
-        schema: { type: string }
-        description: The snapshot key (= a `SessionTreeEntry.id`).
-      - in: path
-        name: hash
-        required: true
-        schema: { type: string, pattern: '^[0-9a-f]{64}$' }
-        description: The content-address (SHA-256, 64 lowercase-hex).
-    get:
-      tags: [sessions]
-      operationId: sessionSyncGetBlob
-      x-status: retired          # S-15 (server 7.52.0): the E19-era snapshot-scoped PULL arm was REPLACED by GET …/sync/history/blobs/{hash} — ≥7.52 this path 404s (not_found.route).
-      summary: 'RETIRED (server 7.52.0, S-15) — snapshot-scoped blob PULL; use GET …/sync/history/blobs/{hash}. Live on ≤7.51 only.'
-      description: >
-        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): a blob is scoped by the session's
-        HISTORY GRAPH now, not by a per-snapshot manifest key, so this arm was replaced by
-        `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}` (sessionSyncGetHistoryBlob — same
-        octet-stream body, same no-oracle 404 posture, scope check = "referenced by this session's
-        exportHistory envelope"). On ≥7.52 this path no longer matches the sync route family and answers 404
-        `not_found.route`. SDK: `sessions.sync.getHistoryBlob` (the legacy `getBlob` verb stays, deprecated,
-        for ≤7.51 servers inside the support range).
-        Historical shape (≤7.51): one content-addressed blob's RAW bytes; the cloud served a hash ONLY if
-        THIS session's `:key` manifest referenced it (foreign/unreferenced → 404 `blob not found`). 400 on a
-        non-64-hex hash or an undecodable key/hash. Owner-scoped (404).
-      responses:
-        '200':
-          description: The blob bytes.
-          content:
-            application/octet-stream:
-              schema: { type: string, format: binary }
-        '400': { $ref: '#/components/responses/BadRequest' }
-        '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
-        '501': { $ref: '#/components/responses/NotImplemented' }
-
   /v1/sessions/{sessionId}/sync/history/blobs/{hash}:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -3109,7 +2983,7 @@ paths:
         → 404 `not_found.blob`, never a blind read; a server whose file-history store has no blob faces
         (e.g. the local file backend) answers the SAME 404 shape (no oracle — "nothing servable" and "not
         referenced" are deliberately indistinguishable). 400 `request.id_invalid` on a non-64-hex hash.
-        Owner-scoped (404). Replaces the retired `GET …/sync/snapshots/{key}/blobs/{hash}`.
+        Owner-scoped (404). Replaces the retired snapshot-scoped PULL arm of servers <= 7.51 (below the support floor; sdk 26.0.0 deleted `getBlob` and its path).
       responses:
         '200':
           description: The blob bytes.
@@ -3142,12 +3016,10 @@ paths:
         body). The cloud verifies `sha256(body) === :hash` (the content-address integrity guard) BEFORE storing — a
         mismatch → 400 `blob hash mismatch`. own-or-FRESH gate. Per-blob cap 64 MiB → 413 mid-stream beyond it. A
         backend write failure (e.g. a MinIO non-2xx) → 502 `blob store write failed`. 204 on success (no body). The
-        PUSH path is the BARE `blobs/:hash` (the PULL is `history/blobs/:hash` since server 7.52,
-        `snapshots/:key/blobs/:hash` before). 🔴 server ≥7.52 (S-15 换店): the blob faces ride the
+        PUSH path is the BARE `blobs/:hash` (the PULL is `history/blobs/:hash`). The blob faces ride the
         file-HISTORY store — a deployment whose store has no blob faces (the local file backend) answers 501
         `capability.snapshot_store_required` ("blob upload requires a durable file-history store") while the
-        rest of the sync surface keeps working; on ≤7.51 the same code meant a missing snapshot store. Same
-        code, same operator disposition (wire a backend with blob faces).
+        rest of the sync surface keeps working (operator disposition: wire a backend with blob faces).
       requestBody:
         required: true
         content:
@@ -3217,14 +3089,12 @@ paths:
       x-status: live
       summary: PUSH Phase A — classify + stage (mint a stagingId).
       description: >
-        2c session-sync PUSH Phase A — a SMALL metadata body (`entryIds, snapshots, policy, anchors, resolution?`); the
+        2c session-sync PUSH Phase A — a SMALL metadata body (`entryIds, fileHistory?, policy, anchors, resolution?, logDigest?, title?, pinned?`); the
         entries stream in Phase B. The cloud classifies (§7), pre-checks blob presence (a missing referenced hash →
         422 `missing_blob` — PUT it first), guards the import lease + any active run (409), then mints a stagingId.
-        ⚠️ S-15 EPOCH: server ≥7.52's Phase A consumes `{entryIds, fileHistory?, policy, anchors, resolution?,
-        logDigest?}` (routes/session-sync.ts) — the `snapshots` key is SILENTLY IGNORED there (an unknown body key); the
-        file history rides `fileHistory` (a `FileHistoryExport` envelope, `null` / absent = none) and every blob it references must have been
-        `PUT …/sync/blobs/{hash}` first. ≤7.51 servers consume `snapshots` and do not know `fileHistory`. SDK 16.2.0 carries
-        `fileHistory` in `pushSessionBundle` / `importSessionBundle` (and fills `snapshots: []` on the pull side when the manifest omits it); a hand-rolled
+        The file history rides `fileHistory` (a `FileHistoryExport` envelope, `null` / absent = none) and every blob it references must have been
+        `PUT …/sync/blobs/{hash}` first (the `snapshots` key of servers <= 7.51 is outside the support range; a supported server ignores it and sdk 26.0.0
+        no longer declares it). The SDK carries `fileHistory` in `pushSessionBundle` / `importSessionBundle`; a hand-rolled
         push must send `fileHistory` itself, and only to a peer whose `capabilities.sessionSyncFileHistory` is not false (server >= 7.116.0 — else the
         commit 422s `missing_blob`).
         `identical` → `{ relation:"identical", basis, payloadVerified }` with NO stagingId (skip Phase B);
@@ -3239,15 +3109,14 @@ paths:
           application/json:
             schema:
               type: object
-              required: [entryIds, snapshots, policy, anchors]
+              required: [entryIds, policy, anchors]
               properties:
                 entryIds: { type: array, items: { type: string } }
-                snapshots: { type: array, items: { $ref: '#/components/schemas/SyncSnapshot' } }
                 fileHistory:
                   oneOf:
                     - { $ref: '#/components/schemas/FileHistoryExport' }
                     - { type: 'null' }
-                  description: 'server >= 7.52: the file-history envelope (replaces `snapshots`); `null` / absent = none. Every blob it references must already be PUT.'
+                  description: 'the file-history envelope; `null` / absent = none. Every blob it references must already be PUT.'
                 policy: { type: array, items: { $ref: '#/components/schemas/SessionRulesRecord' } }
                 anchors: { type: array, items: { $ref: '#/components/schemas/SyncAnchor' } }
                 title:
@@ -3324,7 +3193,7 @@ paths:
       description: >
         2c session-sync PUSH Phase B — stream the entry log as an NDJSON REQUEST body into the staged shadow id; the
         cloud validates per-line (the streaming invariant gate) then `finish()` (exactly-one-root + leaf-resolvable) →
-        commits (the atomic swap) → replays snapshots/policy/anchors. Returns `{ relation }` (the AUTHORITATIVE in-txn
+        commits (the atomic swap) → replays fileHistory/policy/anchors. Returns `{ relation }` (the AUTHORITATIVE in-txn
         re-classify). Re-POSTing the same stagingId is idempotent. Typed errors: a per-entry / structural violation →
         422 `invalid_entries`; a line too large → 413; a commit-time TOCTOU flip to fork/stale → 409 `conflict`
         (SyncConflictError); a refused policy loosen → 403 `loosen_forbidden`; a wrong/foreign stagingId → 404.
@@ -3385,6 +3254,15 @@ paths:
             application/json:
               schema: { $ref: '#/components/schemas/PendingList' }
         '401': { $ref: '#/components/responses/Unauthorized' }
+        '500':
+          description: >-
+            server >= 7.134.0: a queue row whose stored body cannot be read (the store's refusal contract — a retry fails the same way; an operator has to repair
+            or delete that row) answers `500` + `errorCode: "approvals.read_corrupt"` (body `{ error, errorCode }`; the bad row's coordinates stay off the wire) —
+            the same judge and the same code as `GET /v1/approvals/stream`. Do NOT retry it as-is (the SDK's GET retry arm exempts the code). Every other read
+            failure (connection / timeout / store hiccup) is still `500 internal.error`. Older servers answered the corrupt row with `internal.error`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/approvals/stream:
     parameters:
@@ -3424,7 +3302,7 @@ paths:
         `synced` (and `synced.count` still counts ONLY the durable queue).
         🔴 THE TWO WORDS DELIBERATELY DO NOT REUSE `pending`/`resolved`: those are keyed by
         `(sessionId, toolCallId)` and decided at `POST /v1/approvals/{sessionId}/decide`, while a live row is
-        keyed by `approvalId` and decided at `POST /v1/tool-approvals/{approvalId}/respond`. Sharing one word
+        keyed by `approvalId` and decided at `POST /v1/tool-approvals/{id}/respond`. Sharing one word
         would eventually send a live card to the decide door — a 404 with no wire evidence of the mistake.
         ⚠️ Both live words come from an IN-PROCESS window projection, so their cross-replica reach is exactly
         that of `GET /v1/approvals`'s `livePending` — narrower than the durable pair above. The deployment
@@ -4393,6 +4271,38 @@ paths:
         '404': { description: no pending question for this id (non-owner, answered, expired, or wrong replica) — no existence oracle. }
         '501': { description: AskUserQuestion is not enabled on this worker (ASK_QUESTION_ENABLED). }
 
+  /v1/tool-approvals/{id}:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+      - { name: id, in: path, required: true, schema: { type: string }, description: 'The ask''s `approvalId` (server >= 7.133.0 always equal to its `askId`; an opaque string).' }
+    get:
+      tags: [questions]
+      operationId: toolApprovalRead
+      x-status: live             # server >= 7.133.0; SDK toolApprovals.get consumes it
+      summary: Read ONE live-card ask — where is it now (pending, decided, parked or void)? Pure read.
+      description: >
+        server >= 7.133.0 — the by-ask read door. Same root and same gate as POST /v1/tool-approvals/{id}/respond (one `gatedPrincipal`; an owner-gate miss answers the SAME 404 as an unknown
+        id — no existence oracle), and the state is read the way the answer door reads it: a live registration on THIS replica waiting for the ask => `pending` (the body is the `livePending[]` row projection +
+        `state`); otherwise the row is read by id: `DECIDED` => `decided`, `PARKING` / `PARKED` => `parked`, `DENIED` / `VOID` => `void`. A row still `STREAM_PENDING` with no local registration lives on
+        another replica => 404 `tool_approval.not_pending` + `cause: "unknown_or_other_replica"` (the same answer as a late respond); a deployment with no ask ledger answers the same 404 WITHOUT `cause`.
+        Pure read: zero writes, no settlement, the local registration is untouched. Use it to ask "is this card still alive / was it decided by anyone" instead of inferring it from a respond 404.
+        An older server (<= 7.132.x) has no such door: routing-level 404 `not_found.route` — tell it apart from this door's 404 by `errorCode`, never by status.
+      responses:
+        '200':
+          description: The ask's current state.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ToolApprovalReadBody' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '404':
+          description: >
+            `tool_approval.not_pending` — unknown / not yours (byte-identical) / still pending on another replica (`cause: unknown_or_other_replica`). Past the owner gate the body may carry the additive `cause`
+            (see ToolApprovalNotPendingCause); no ask ledger => no `cause`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ToolApprovalNotPendingBody' }
+        '501': { description: 'Live tool-approval HITL not enabled (TOOL_APPROVAL_ENABLED) — `feature.tool_approval_disabled`.' }
+
   /v1/tool-approvals/{id}/respond:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -4426,7 +4336,7 @@ paths:
                     verbatim 400 texts, the two capability bits to probe first and the `deny` posture are on
                     the PersistRuleSelection schema. Allow-family only (on `deny` the whole field is ignored).
 
-                    ⚠️ If the frame carried neither `ruleOffers` nor `ruleSuggestions`, do not send this key —
+                    ⚠️ If the frame carried no `ruleOffers`, do not send this key —
                     there is nothing redeemable for THIS card and the answer is necessarily
                     `rulePersisted:false` + `rule_lane_unavailable` (the missing material short-circuits BEFORE
                     any candidate comparison, so it is never `rule_not_offered`). Absence has several causes —
@@ -5295,39 +5205,6 @@ paths:
                   error: { type: string }
                   missing: { type: array, items: { type: string } }
 
-  /v1/approvals/{approvalId}:
-    parameters:
-      - $ref: '#/components/parameters/PrincipalHeader'
-      - in: path
-        name: approvalId
-        required: true
-        schema: { type: string }
-    get:
-      tags: [approvals]
-      operationId: approvalsGet
-      x-status: retired          # 5.0.0: legacy approval-store leg deleted — NO deployment serves this route.
-      summary: 'RETIRED (server 5.0.0) — by-id approval read; every deployment answers 404. Use GET /v1/approvals.'
-      description: >
-        🔴 RETIRED as of `@sema-agent/server` 5.0.0 ([2354]/[2356] A-5): the legacy approval-store polling leg
-        that served this route was deleted whole, and the durable checkpoint lane never had a by-id read
-        (it can list by scope or look up by capability token — there is no simple-id query). A worker WITH a
-        checkpoint store answers 404 `not_found.route`; a worker WITHOUT one never matches the `/v1/approvals*`
-        prefix at all. Either way: 404 on every deployment, and that 404 is indistinguishable from "no such
-        approval", which is exactly why the SDK stopped calling it (4.0.1 — `approvals.get` now reads
-        `GET /v1/approvals` and filters by `sessionId`, one round trip instead of a guaranteed-404 probe plus
-        the same list call).
-        Kept in the spec as a tombstone rather than deleted: consumers generated against an older spec need to
-        see WHY the path went away. Decide via `POST /v1/approvals/{sessionId}/decide`; list via `GET /v1/approvals`.
-        Historical shape (below) is left intact for the same reason; it describes no live behavior.
-      responses:
-        '200':
-          description: The approval row (full args projection).
-          content:
-            application/json:
-              schema: { $ref: '#/components/schemas/ApprovalRow' }
-        '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
-
   /v1/memory/export:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -5799,6 +5676,70 @@ paths:
         '403': { description: 'Multi-tenant worker: outcomes view is operator-only.' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
+  /v1/config/catalog:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+    get:
+      tags: [admin]
+      operationId: configCatalog
+      x-status: live             # operator lane (capabilities.configCatalog); SDK configCatalog.get consumes it
+      summary: Deployment configuration catalog — every env knob's declaration and this process's effective reading (operator-only).
+      description: >
+        The deployment's configuration catalog (operator lane; probe `capabilities.configCatalog` first). One row per env knob: its declared semantics, which lanes can write it, which lane is in force, the
+        process's effective DISPLAY value and the centre seat (`center`) when the knob is centre-publishable; plus the `retired` tombstone list (env names this process refuses to start on). `Cache-Control: no-store`.
+        Gate: `OPERATOR_PRINCIPALS` — outside the list 403 `auth.operator_only`; empty list on a multi-tenant deployment 501 `capability.operator_principals_required`; `CONFIG_CATALOG_ENABLED=false` 501
+        `feature.config_catalog_disabled`. A server older than 7.53 has no such route (404).
+        `effectiveValue` is a DISPLAY value, never the raw env: `secret` / `opaque` rows report only `{ present, length? }`, a `url` row goes through the display mint (userinfo landed, query values become
+        tokens). Two VERDICT bits on a row are true-only (never `false`; ABSENT = this cell has no such matter): `effectiveValueInvalid` (the effective value falls outside the row's own echo set; `effectiveValue` is then
+        `null`) and, server >= 7.133.0, `effectiveValueWithheld` (a `url` row whose display mint WITHHELD a part — a credential-shaped piece in a query / path segment — so the shown value is not the whole value).
+      responses:
+        '200':
+          description: The catalog.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ConfigCatalog' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '403': { description: 'The caller is not in OPERATOR_PRINCIPALS (`auth.operator_only`).' }
+        '501': { $ref: '#/components/responses/NotImplemented' }
+
+  /v1/principal-inbox/messages:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+    post:
+      tags: [admin]
+      operationId: principalInboxSend
+      x-status: live             # server >= 7.133.0; SDK principalInbox.send consumes it
+      summary: Deliver one letter to another principal's inbox in the same organization (cross-principal delivery; default OFF).
+      description: >
+        server >= 7.133.0 — one letter is appended to the recipient principal's `principal.inbox` ONLY by the organization delivery gate: membership judgement -> mint -> inbox bound -> quota -> append, all inside one gate that answers
+        with a receipt or one of four refusal codes. The SENDER is always your verified identity (`from` is not a body key: sending `from` or any unknown key => 400 `request.body_shape` + `unknownKeys`). DEFAULT OFF: without env
+        `PRINCIPAL_INBOX_ASSISTANT` the route answers 501 `capability.unavailable` (no delivery gate is mounted) — probe `capabilities.principalInboxDelivery` (true <=> this door works). THIS VERSION SHIPS THE DELIVERY HALF ONLY:
+        a delivered letter sits in the recipient's box (at most 50 unconfirmed envelopes) and no read verb exists yet. Judging order: the sender's ATTEMPT bound (every attempt is recorded, succeeded or not, BEFORE membership) ->
+        membership (including the mailbox-key judge) -> mint (a sender that cannot be spelled into the envelope's sender slot answers the same `not_member`, no quota consumed) -> inbox bound -> quota deduction -> append. A refused
+        delivery appends nothing. Not auto-retried by the SDK (every attempt consumes the sender's attempt quota).
+        The four refusal codes: `org_delivery.not_member` 404 (ONE sentence, byte-identical body for: different organization / no such person / directory could not answer / `to` is not a principal shape / the recipient cannot be a
+        mailbox key / the sender cannot be spelled into the envelope — the gate is never an existence probe); `org_delivery.rate_limited` 429 (one sentence for three bounds: 60 attempts per sender per hour — a typo'd recipient costs an
+        attempt —, 10 letters per (sender, recipient) pair per hour, 30 letters per recipient per hour; fixed clock-hour windows, up to double across a boundary; hard-coded, no knob); `org_delivery.inbox_full` 409 (the recipient's box already holds
+        50 unconfirmed envelopes — judged BEFORE quota so a full box burns none); `org_delivery.recipient_tombstoned` 410 (the recipient's mailbox is in its pre-delete state).
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: '#/components/schemas/PrincipalInboxMessage' }
+      responses:
+        '200':
+          description: The letter was appended; `receiptId` is the gate's delivery receipt id.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/PrincipalInboxReceipt' }
+        '400': { description: 'Malformed body: `request.field_invalid` (not an object / empty `to` / empty or over-long `content` / non-boolean `urgent`) or `request.body_shape` (unknown key incl. `from`; body carries `unknownKeys`).' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '404': { description: '`org_delivery.not_member` — one byte-identical body for six causes (see the description); the gate is not an existence probe.' }
+        '409': { description: '`org_delivery.inbox_full` — the recipient''s box holds 50 unconfirmed envelopes.' }
+        '410': { description: '`org_delivery.recipient_tombstoned` — the recipient''s mailbox is in its pre-delete state.' }
+        '429': { description: '`org_delivery.rate_limited` — one sentence for the sender-attempt bound, the pair bound and the recipient aggregate bound.' }
+        '501': { description: 'No delivery gate mounted (`PRINCIPAL_INBOX_ASSISTANT` off) — `capability.unavailable`.' }
+
   /v1/diagnostics/wiring:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -7064,6 +7005,7 @@ components:
         promptSummary: { type: string, description: 'a human-readable prompt DIGEST — NOT the full prompt.' }
         enabled: { type: boolean }
         available: { type: boolean, description: 'whether this deployment can actually RUN the scenario right now — same predicate as the 501 rejection arm on submit; false ⟺ submitting is guaranteed to 501. Independent axis from `enabled` (declared vs runnable).' }
+        attachmentSupplies: { type: array, items: { type: string, enum: [path, content_text, content_image] }, description: 'server >= 7.133.0, always present there: the attachment SUPPLY words this scenario actually carries — a subset of `capabilities.userAttachments.supplies` (`path` only on hands scenarios, where a workspace lives somewhere; a no-hands scenario drops `path`, and a `path` entry is refused by the engine with `config.user_attachment_invalid`). ABSENT = server <= 7.132.x: fall back to `userAttachments.supplies` plus the existing 400 handling.' }
         unavailableReason: { type: string, description: 'machine-readable reason, present ONLY when available:false (absent = no reason). Closed set, currently the single member `git_client_unconfigured`; branch on the key, never match the English prose. Additive-open: treat an unknown word as "unavailable, reason unknown".' }
 
     RunStatus:
@@ -7704,11 +7646,29 @@ components:
             `permissions.defaultMode`'s specific fold is documented on `TaskRequest.permissionMode`.
             🔴 ON THIS SUBMIT FACE THE KEY SET IS CLOSED (server >= 7.57.0 for the sub-tree): accepted top-level keys
             are `env` / `hooks` / `model` / `outputStyle` / `permissions` / `skillListingBudgetFraction` /
-            `skillListingMaxDescChars` / `ultracode` / `webSearch`, and accepted `permissions.*` keys are
-            `allow` / `ask` / `defaultMode` / `deny` / `disableAutoMode`; anything else is 400 `request.body_shape`
+            `skillListingMaxDescChars` / `ultracode` / `webSearch` (server >= 7.133.0 adds the three TIGHTEN-ONLY seats `complianceAdditionalDenies` / `readDenyPatterns` / `writeProtectedExtra`; server >= 7.134.0 adds `approvalFrameFamilies`), and accepted `permissions.*` keys are
+            `allow` / `ask` / `defaultMode` / `deny` / `disableAutoMode` (server >= 7.133.0 adds `neverAuto`); anything else is 400 `request.body_shape`
             with the names in the refusal's `unknownKeys` / `unsupportedKeys` arrays (REFUSED, not dropped — a dropped
             key reads as "in effect" to the caller). The object stays OPEN here because the same `SemaSettings`
             schema also serves the local `settings.json` wiring, where deferred CC keys are legal.
+            🔴 TIGHTEN-ONLY SEATS (server >= 7.133.0; probe `capabilities.taskSettings.tightenOnlySeats`, an absent bit = an older server that answers 400 `request.body_shape` for these four keys): `readDenyPatterns` (entries: a bare
+            pattern string, or `{ pattern, caseSensitive? }`), `writeProtectedExtra` (a bare name — no `/` reads as `segment`, a `/` reads as `segment-run` — or `{ name, kind: basename | segment | segment-run }`),
+            `complianceAdditionalDenies` (`mcp_servers` | `workflows` | `web_fetch` | `org_memory_mount`) and `permissions.neverAuto` (tool names that ALWAYS ask a human). Each seat = the deployment table UNION the request list, ONLY EVER GROWING
+            (the request face has no loosening arm); an empty array is the same as not sent. Bad value => 400 `request.field_invalid` with `field` + `reason` (`over_cap` + `count` + `cap` / `bad_entry` + the first bad `index`).
+            Caps: 1000 entries per seat, EXCEPT `readDenyPatterns`: at most 32 entries, at most 2 `*` per path segment and 16 `*` in the whole table (every star counts, nothing is folded). A `neverAuto` name that can never match any tool => 422.
+            A resume replay of a stored body whose seat went bad => 409 `resume_blocked_by_policy`. A compliance deny is a REFUSAL, not a narrowing: a request denying `web_fetch` is refused whole where the default tool surface still mounts `WebFetch` (the single-user default does).
+            🔴 `settings.approvalFrameFamilies` (server >= 7.134.0; send it on sight of `capabilities.taskSettings.approvalFrameFamilies === true` — NOT of the top-level
+            `capabilities.approvalFrameFamilies`, which <= 7.133.x already has while answering 400 `request.body_shape` for this key): the approval opening-frame FAMILIES this
+            run's client RENDERS — an array of `tool_approval` / `approval_request`, each once (`[]` reads as absent). Bad value (not an array / a word outside the set / a
+            repeat) => 400 `request.field_invalid` with `field: "settings.approvalFrameFamilies"`, `reason: "bad_entry"` and `index` (absent for a non-array). BEHAVIOR (BREAKING, wire):
+            a run whose declaration does not contain the family this worker presents (`capabilities.approvalFrameFamilies`) has NO live approval channel — no card of either
+            family (no fallback, no double send), no replay in the stream preamble of the sync stream or of `GET /v1/runs/{taskId}/events`; every ask goes to the unattended
+            policy at once: with a durable store (`capabilities.approvals`) it parks per the operator policy (default; answer through `POST /v1/approvals/{sessionId}/decide`)
+            or is refused naming the missing family; with NO durable store the gated tool is refused on the spot and the run finishes (no card, no decide). The declaration
+            rides the persisted body onto resume legs.
+            🔴 `settings.hooks[]` (server >= 7.133.0; probe `capabilities.taskSettings.pluginHooks` / `managedHookGroups` — an absent or false bit = the keys are STRIPPED SILENTLY): group key `source` (closed: `managedPolicy` / `user` / `project` / `local` / `flag` /
+            `managedPlugin:<name>` / `plugin:<name>`; absent = unmanaged; managed groups run in an independent lane after the unmanaged rewrites), command-entry keys `plugin { name, root, dataDir?, options? }` and exec-form `args`; a malformed one =>
+            400 `request.field_invalid` with `detail: { reason: "wire_key_invalid", key, path }`; the plugin context has one 8192-character budget.
             🔴 `skillListingBudgetFraction` (number in (0,1]) / `skillListingMaxDescChars` (positive integer),
             server >= 7.78.1: the SKILL-LISTING RENDER BUDGET, passed to the engine with ZERO processing
             (no clamping, no conversion, no folding) — ABSENT means the key is not written at all (the server does
@@ -8374,6 +8334,10 @@ components:
         cause (`terminal`), not the eight parallel plane keys — see `TerminalCause`.
       required: [taskId, sessionId, terminal, stats]
       properties:
+        warnings:
+          type: array
+          items: { $ref: '#/components/schemas/EntryProblem' }
+          description: 'server >= 7.133.0, top level of the sync `POST /v1/tasks` 200 body (beside `notice`), present only when non-empty: the accept-time NOTICES for allow-side selector-list entries the engine reads as nothing or that are not in the roster. ABSENT = no notice (older servers too).'
         taskId: { type: string }
         sessionId: { type: string }
         wiringManifest:
@@ -8676,6 +8640,10 @@ components:
         taskId: { type: string }
         sessionId: { type: string }
         status: { $ref: '#/components/schemas/RunStatus' }
+        warnings:
+          type: array
+          items: { $ref: '#/components/schemas/EntryProblem' }
+          description: 'server >= 7.133.0, present only when non-empty: the accept-time NOTICES for allow-side selector-list entries the engine reads as nothing or that are not in the roster (acceptance is unchanged — the engine takes them, only the operator hears afterwards; this makes "this name will not take effect" visible at the call). Same list as the stream `meta` frame''s and the sync 200 body''s. ABSENT = no notice (older servers too).'
 
     SealedKeyCapability:
       type: object
@@ -9545,6 +9513,14 @@ components:
             redispatched: { type: array, items: { type: string } }
             collapsed: { type: string }
 
+    ApprovalFrameFamily:
+      type: string
+      enum: [tool_approval, approval_request]
+      description: >-
+        The approval opening-frame FAMILY words (closed; the server's `APPROVAL_FRAME_FAMILIES` verbatim and in order): `tool_approval` = the legacy family
+        (live card `tool_approval` / close `tool_approval_complete`); `approval_request` = the card family (`approval_request` / `approval_complete` /
+        batch revoke `approval_revoke`). ONE vocabulary for two faces: the capability `approvalFrameFamilies` (which family this worker presents) and, server >= 7.134.0,
+        the request key `settings.approvalFrameFamilies` (which families this run's client renders).
     ApprovalDecision:
       type: object
       description: HITL decision (`POST /v1/approvals/:sessionId/decide`).
@@ -9612,30 +9588,17 @@ components:
             refused by the ENGINE before the CAS (409 `resume_outcome_invalid` + `field: "hostDecision"`, the card stays
             pending); outside the closed set ⇒ 400 `request.field_invalid`; any value on a direct-door worker ⇒ 400
             `decided_by_not_in_proof`. An older server (no `approvalDecidedBy` bit) refuses the key (400 `request.body_shape`).
-
-    ApprovalRow:
-      type: object
-      description: >
-        The legacy D-lane approval row of GET /v1/approvals/{approvalId} (server `ApprovalRow`,
-        plugins/approval-store-sql.ts — the row is `sendJson`'d verbatim, approvals-assistant.ts).
-        Present only on deployments running the legacy `approvalStore` leg (no `checkpointStore` wired);
-        the durable F4 lane has no by-id GET (only list + decide).
-      # 🔴 census 批2 五段:CLOSED — byte-identical to the server row type, no extra keys.
-      required: [id, taskId, sessionId, owner, scope, toolName, args, status, reason, decidedBy, createdAt, decidedAt]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-        taskId: { type: [string, 'null'] }
-        sessionId: { type: [string, 'null'] }
-        owner: { type: [string, 'null'] }
-        scope: { type: [string, 'null'], description: 'Single-DB fleet scope guard (tenant identity, owner-sourced).' }
-        toolName: { type: string }
-        args: { description: 'The reviewed tool-call args — full fidelity, not redacted (this IS the review surface).' }
-        status: { type: string, enum: [pending, approved, denied, expired] }
-        reason: { type: [string, 'null'] }
-        decidedBy: { type: [string, 'null'] }
-        createdAt: { type: string }
-        decidedAt: { type: [string, 'null'] }
+        feedback:
+          type: string
+          description: >-
+            server >= 7.134.0 (core 7.54.0) — what the approving PERSON writes in the card's "and tell the agent what to do next" input: on the resumed
+            leg it reaches the model as the user's own words (unfenced, unbounded — like the reference's accepted-prompt feedback). ONLY on a person's approve
+            (`decision: "approve"`, `decidedBy` absent or `person`): on a deny or a `decidedBy: "policy"` decision ⇒ 400 `request.field_conflict` with
+            `detail.kind: "approval_feedback"` and `detail.fields` `["feedback", "decision"]` / `["feedback", "decidedBy"]` (a denial's words go in `reason`);
+            a non-string ⇒ 400 `request.field_invalid`; any value on a direct-door worker ⇒ 400 `feedback_not_in_proof` (not inside the signed proof); words
+            carrying `<system-reminder>` ⇒ 409 `approval_binding_mismatch` (the engine's sentence; the card stays pending — ask the person to change the words,
+            do not auto-refetch and re-decide on the code). The same door serves parked background-agent cards and workflow child cards; the live
+            `POST /v1/tool-approvals/{id}/respond` does NOT take it. Servers <= 7.133.x refuse the key (400 `request.body_shape`, `unknownKeys: ["feedback"]`).
 
     Capabilities:
       type: object
@@ -9803,6 +9766,11 @@ components:
             store backend deliberately wires no image index (the pool is cloud/fleet-only) ⇒ false there.
             SCOPE: P1 only — `/v1/images/bakes*` (the P2 bake control plane) is a separate dependency and an
             operator/runner-internal face, NOT promised by this bit.
+        principalInboxDelivery:
+          type: boolean
+          description: >-
+            server >= 7.133.0 — the cross-principal delivery door `POST /v1/principal-inbox/messages` is wired (delivery gate present: env `PRINCIPAL_INBOX_ASSISTANT` on and the gate's dependencies in place).
+            True iff that route works; absent gate => the route answers 501 `capability.unavailable`. ABSENT key = server <= 7.132.x (no such route; routing-level 404). Probe this bit; do not trial-by-501.
         sharedMemory:
           type: boolean
           description: >
@@ -9910,25 +9878,12 @@ components:
                 leaseClient: { type: boolean, description: 'server >= 7.121.0, a version bit (always true, rides with the `fleet` object): this binary carries the serving-lease CLIENT — when the engine is a fleet member (`FLEET_GENERATION`) and the center declares in its heartbeat reply that it answers renewals (`servingLease`), the engine renews and is governed by the lease. Deliberately NOT named `servingLease` (that is the center''s bit): this says the client exists, not that a lease is in force — read `/health.leaseState` for that. Absent = an older worker.' }
                 generationEcho: { type: boolean, description: 'server >= 7.121.0, a version bit (always true, rides with the `fleet` object): this binary echoes env `FLEET_GENERATION` as `generation` on the heartbeat and on `/health` (with `leaseState` / `leaseUntil`), and the drain endpoint `POST /v1/admin/drain` compares the four-part identity including `expectedGeneration`. Absent = an older worker.' }
         workspace:
+          type: boolean
+          enum: [false]
           description: >
-            #3 (server 1.299–7.51): workspace-browse capability family — an OBJECT when the E19 snapshot-store
-            read faces + a durable session store are wired ({browse, archive, maxFileBytes}); `false`/absent
-            otherwise (same predicate as the routes' 501). `maxFileBytes` = the single-file read cap (over-cap
-            ⇒ 413 workspace_file_too_large envelope; the archive endpoint is the escape hatch).
-            🔴 RETIRED (server ≥7.52, S-15/design/381): the whole-tree snapshot epoch this face projected was
-            replaced by per-edited-file rewind history, so this key is now ALWAYS false and the four
-            /v1/sessions/{sessionId}/workspace* routes answer 501 `capability.workspace_retired` (route shape
-            kept as a tombstone — a named refusal, not a 404 that reads like a typo). Consumption posture
-            unchanged: probe this bit, false ⇒ don't render the panel.
-          oneOf:
-            - type: boolean
-              enum: [false]
-            - type: object
-              additionalProperties: true
-              properties:
-                browse: { type: boolean }
-                archive: { type: boolean }
-                maxFileBytes: { type: integer }
+            The workspace-browse bit — ALWAYS `false` on every supported server (>= 7.52.0: the whole-tree snapshot epoch was replaced by
+            per-edited-file rewind history; the four /v1/sessions/{sessionId}/workspace* routes answer 501 `capability.workspace_retired`, route shape kept as a
+            tombstone). sdk 26.0.0 deleted the object arm `{ browse, archive, maxFileBytes }` (servers 1.299–7.51, below the support floor).
         sessionEvents:
           type: boolean
           description: >
@@ -9973,6 +9928,12 @@ components:
             lane) or 422 (hosted).
         mcp: { type: boolean, description: "MCP servers can be attached." }
         mcpInjection: { type: boolean, description: "Per-request MCP injection is accepted." }
+        mcpAssertionHeaderSent:
+          type: boolean
+          description: >-
+            server >= 7.133.0 — the SEND seat self-report (a boolean, today ALWAYS `false`): whether `mcpServers[].transport.assertionHeader` (accepted since server 7.128.0, mutually exclusive with `principalHeader`)
+            is actually SENT to the MCP peer. `false` = the declaration is carried but NOT sent (the same switch drives the key stripping, the operator info line and the probe-door refusal; the disclosure sentences leave when it turns true).
+            ABSENT = an older server, which does not send either — treat it as `false`; never rely on the header for peer authentication.
         mcpProbe:
           type: boolean
           description: >
@@ -10012,6 +9973,20 @@ components:
             ⚠️ ABSENT = an older server (<7.87.1) ⇒ cannot tell whether the push face carries the live family;
             do NOT read "no `live_pending` frame arrived yet" as "this deployment never pushes live" — the two
             are indistinguishable on an older server. Fall back to `GET /v1/approvals`'s `livePending` pull face.
+        approvalFrameFamilies:
+          type: array
+          maxItems: 1
+          items: { $ref: '#/components/schemas/ApprovalFrameFamily' }
+          description: >-
+            server >= 7.133.0, ALWAYS present (the projection of the same judgement as `streamApproval`) — which FRAME FAMILY this worker's approval opening frames belong to:
+            a closed-word array with AT MOST ONE member. `["approval_request"]` = the card protocol is on: one ask travels only `approval_request` -> `approval_complete` / `approval_revoke`
+            (the legacy `tool_approval` / `tool_approval_complete` pair is NOT sent — BREAKING vs <= 7.132.x, which sent both families for one ask and relied on `approvalId` de-duplication;
+            remedy on the worker: `STREAM_APPROVAL_ENABLED=false`). `["tool_approval"]` = the card protocol is not on (`STREAM_APPROVAL_ENABLED=false`, no store backend, or no checkpoint store) but the live card leg is.
+            `[]` = per-call approvals are off altogether (`TOOL_APPROVAL_ENABLED=false`): no card is presented. Dispatch frame families off THIS array, never off `streamApproval`.
+            KEY ABSENT (not `[]`) = server <= 7.132.x — there a `streamApproval: true` leg sends BOTH families for one ask.
+            🔴 server >= 7.134.0: this bit says which family THIS WORKER presents, no longer that you will receive cards — a run has a live approval channel only when
+            its submit body declared that family in `settings.approvalFrameFamilies` (send it on sight of `taskSettings.approvalFrameFamilies`, not of this bit — <= 7.133.x
+            already had this bit yet answers 400 `request.body_shape` for the key). The value does not change with a declaration. The words are the request key's words.
         streamApproval:
           type: boolean
           description: >
@@ -10066,6 +10041,13 @@ components:
             a server <= 7.118.x returns the archive as written; a 7.119.x server already redacts but does not report the bit. A true
             bit does not mean the read face exists (that is `sessions`; without a session audit face that door answers 501 and this
             bit is still true), nor that the archive holds no credential (the redaction is read-side only).
+        approvalReadRootGrant:
+          type: boolean
+          description: >-
+            server >= 7.133.0, ALWAYS present, a FACT that varies by deployment — whether this deployment accepts the reply-body key `readRootGrant` ("Yes, and add directory": the card's
+            `readRootCandidate.dir` is registered as a read root together with this one allow). True iff the single-user host-lane posture (the same predicate as `projectContext` / the cwd face); false elsewhere.
+            A client shows the option only when the card carries `readRootCandidate` AND this bit is true. On a non-accepting posture a reply carrying `readRootGrant` is refused
+            `400 request.body_shape` (the ask stays unsettled — answer again without the key). ABSENT = server <= 7.132.x = not accepted; do not send the key.
         approvalReach:
           type: boolean
           description: >-
@@ -10178,6 +10160,10 @@ components:
             outputStyle: { type: boolean }
             env: { type: boolean, description: 'TRUE on the single-user host lane (server emits `cwdHonored(config)`). It is NOT hard-coded false any more — the old always-false value predated the per-task shellEnv seam and hid a live capability.' }
             hooks: { type: boolean, description: 'Single-user deployments only (`requirePrincipal !== true`).' }
+            pluginHooks: { type: boolean, description: 'server >= 7.133.0 — the request `settings.hooks[]` PLUGIN-CONTEXT keys (command entry `plugin { name, root, dataDir?, options? }` / exec-form `args`) are accepted; same predicate as `hooks` (single-user true, multi-tenant false). ABSENT or false = the keys are stripped silently — send only on sight of the bit.' }
+            managedHookGroups: { type: boolean, description: 'server >= 7.133.0 — the request `settings.hooks[]` GROUP `source` key (managed lanes `managedPolicy` / `managedPlugin:<name>`) is accepted; same predicate as `hooks`. ABSENT or false = stripped silently (the managed-lane semantics do not apply, it is not a refusal).' }
+            tightenOnlySeats: { type: boolean, description: 'server >= 7.133.0, constant true — the four tighten-only request seats `settings.readDenyPatterns` / `settings.writeProtectedExtra` / `settings.complianceAdditionalDenies` / `settings.permissions.neverAuto` are accepted (each seat = deployment table UNION request list, only ever growing; an empty array is the same as not sent). ABSENT = server <= 7.132.x, which answers 400 `request.body_shape` for those keys — send only on sight of the bit.' }
+            approvalFrameFamilies: { type: boolean, description: 'server >= 7.134.0, constant true — the request key `settings.approvalFrameFamilies` (which approval opening-frame families this run''s client renders) is accepted. THIS is the trigger bit for that key, NOT the top-level `approvalFrameFamilies`: servers <= 7.133.x already carry the top-level bit yet answer 400 `request.body_shape` (`unknownKeys: ["settings.approvalFrameFamilies"]`) for the key. ABSENT = do not send it.' }
         settings:
           type: object
           description: >
@@ -10206,6 +10192,7 @@ components:
               properties:
                 allowGrant: { type: boolean, description: 'Constant `true` on server >= 7.115.0: `settings.permissions.allow` is read as allow RULES, not as a list. The whole `settings` key being absent = an older server.' }
                 allowLayer: { type: boolean, description: 'Constant `true` on server >= 7.117.0 (core 7.42.0): the whole `settings.permissions.allow` list goes to the engine allow layer (listed calls are not asked; content forms accepted; entries read as nothing get an `engine_notice` `permission.allowed_tool_not_granted`). Absent = a server without it (7.115.0–7.116.x: allow is a statement; older: a list).' }
+                callerTrust: { type: string, description: 'server >= 7.133.0 — THIS caller''s trust tier (per caller / per credential, NOT a version bit). Request rule tables that take effect without a person answering (`settings.permissions` buckets; a named-invoked skill''s `allowedTools` / `disallowedTools`) are admitted by it: `allow` loosens the no-ask surface and needs `global`; `deny` / `ask` only tighten and are admitted at any tier. Today `global` (single-user turnkey; multi-tenant with the deployment service credential; multi-tenant sign-in token whose scope role >= the governance write role) or `project` (everything else). Read OPEN: an unknown word is treated as `project` (fail-closed). A request below the floor is refused whole with 400 `request.field_invalid` (`detail.problems[].reason: below_trust_floor`, `detail.callerTrust`). ABSENT = server <= 7.132.x: no per-tier admission.' }
         memoryWrite:
           type: boolean
           description: >
@@ -10268,7 +10255,7 @@ components:
               additionalProperties: true
               properties:
                 enabled: { type: boolean, enum: [true] }
-                protocolVersion: { type: integer }
+                protocolVersion: { type: integer, description: 'The protocol REVISION this server speaks (the `challenge` frame carries the same value; accepted window [1, 2] on server >= 7.133.0). Server >= 7.133.0 reads 2 (<= 7.132.x read 1). An executor declares the SMALLER of its own highest revision and this value, and takes its outcome-code set from the declared revision (revision 2 added `liveness_no_output`).' }
                 maxInflightPerDevice: { type: integer }
                 wsPath: { type: string }
                 management: { type: boolean, description: 'server >= 7.88.0. `/v1/devices/*` admin verbs present. PRESENT-IFF — absent means a pre-7.88.0 peer (unknown), not false.' }
@@ -10762,9 +10749,9 @@ components:
         server >= 7.65.0 (S-167) — the READ containment rung of this deployment AND WHO SET IT (operator face
         `GET /v1/diagnostics/wiring` -> `readFace`). `face` is the same boot artefact as the tenant-facing
         `capabilities.readFace` (`null` = nothing pinned by this deployment, the engine default is in force).
-        `source` is a CLOSED four-word set on the server (exhaustive switch — adding a word is a compile error
+        `source` is a CLOSED five-word set on the server (exhaustive switch — adding a word is a compile error
         there): `env` = this machine's READ_FACE env var (wins over everything) · `center` = the config-center
-        readFace domain (restart-to-apply) · `posture` = derived from the single-user turnkey posture
+        readFace domain (restart-to-apply) · `lane` = (server >= 7.133.0) the isolated execution lane's default — with `READ_FACE` absent, e2b / k8s / local-docker mint `open` · `posture` = derived from the single-user turnkey posture
         (REQUIRE_PRINCIPAL unset ⇒ `open`; server >= 7.65.0 behaviour change) · `engine-default` = not pinned.
         `note` is a human-facing pointer for operators. Minimal disclosure: the deny table is never on this face.
       required: [face, source, note]
@@ -10774,7 +10761,7 @@ components:
           enum: [open, roots, null]
         source:
           type: string
-          enum: [env, center, posture, engine-default]
+          enum: [env, center, lane, posture, engine-default]
         note:
           type: string
 
@@ -10791,9 +10778,9 @@ components:
         `DURABLE_APPROVAL` ON and a 24h approval window when neither is set, so a default FLIP has to be visible
         on an operator surface or nobody sees it.
 
-        `source` is the CLOSED four-word set (exhaustive switch on the server — adding a word is a compile error
+        `source` is the CLOSED five-word set (exhaustive switch on the server — adding a word is a compile error
         there), in PRECEDENCE order: `env` = pinned by this machine's env var (deployment sovereignty; beats any
-        published value) · `center` = applied from the config-center (restart-to-apply) · `posture` = derived from
+        published value) · `center` = applied from the config-center (restart-to-apply) · `lane` = (server >= 7.133.0) derived from the isolated execution lane (e2b / k8s / local-docker mint a lane default, e.g. `READ_FACE` -> `open`) · `posture` = derived from
         the deployment shape (single-user turnkey) · `engine-default` = nothing pinned, the built-in default is in
         force. Only `env`/`center` count as "an operator asked for this"; a posture-derived `true` does not.
         `note` is PROSE for a human (per-knob, and on the `posture` arm it is that knob's own fact sentence) —
@@ -10808,7 +10795,7 @@ components:
           description: 'The knob''s effective value. Typed by the referencing site (boolean / integer / …).'
         source:
           type: string
-          enum: [env, center, posture, engine-default]
+          enum: [env, center, lane, posture, engine-default]
         note: { type: string }
 
     SkillSpec:
@@ -11630,6 +11617,24 @@ components:
             `"other"`). This is the "where did those 180 404s actually land" cell. Empty object = zero failures;
             key absent = an older server.
 
+    ModelPlane:
+      type: object
+      additionalProperties: false
+      description: >
+        `GET /v1/models.modelPlane` (server >= 7.133.0; always present; conditional keys are absent, never `null` / empty string) — the single read for "which model table is this engine serving".
+        Two axes. SERVED TABLE: `servedTable` = `env` (the env table minted from MODEL_ID / MODEL_CHEAP_ID — no catalog is in charge: none configured / source unreachable with no last-known-good / the candidate was refused /
+        no enabled entry) | `catalog` (a catalog's model plane landed and replaced the whole env table). CANDIDATE OUTCOME: `catalog` = `refused` (the latest candidate was refused whole — by the candidate judge or the model-plane
+        group; with no previous generation the env table serves, with one the catalog table still serves — who serves is `servedTable`'s answer, NOT merged into this field) | `adopted` (no whole refusal and the catalog table
+        serves; NOT "the latest candidate landed" — that question belongs to the /health generation ledger) | `absent` (no whole refusal and the env table serves). START-UP ROUTE VERDICT: `refusalCode` / `gap` (both ABSENT when the
+        judge passes — the normal state of a running process): `refusalCode` = `config.model_route_endpoint_missing` | `config.gateway_fallback_without_primary`; `gap` = `endpoint_missing` (set MODEL_GATEWAY_BASEURL or the entry's
+        own `baseUrl`) | `lane_credential_missing` (an anthropic-lane choice with neither ANTHROPIC_API_KEY nor ANTHROPIC_AUTH_TOKEN fell into the endpoint-less openai leg). No sentence is carried. Words are server-owned — read OPEN
+        (an unknown word is "unknown", never "passed").
+      required: [servedTable, catalog]
+      properties:
+        servedTable: { type: string, description: '`env` | `catalog` (open on read).' }
+        catalog: { type: string, description: '`absent` | `adopted` | `refused` (open on read).' }
+        refusalCode: { type: string, description: '`config.model_route_endpoint_missing` | `config.gateway_fallback_without_primary` (open on read); ABSENT = the judge passed.' }
+        gap: { type: string, description: '`endpoint_missing` | `lane_credential_missing` (open on read); ABSENT = the judge passed.' }
     ModelsResponse:
       type: object
       description: >
@@ -11677,6 +11682,11 @@ components:
             Upgrade window (as it is): an on-disk LKG written by server <= 7.122.x only recorded the dropped entries that had a name AND were
             enabled; while serving from it with the center still unreachable this key lists only those rows (possibly `[]`) and the first pull after the
             center is reachable fills it in. An unknown `reasonCode` word reads as "dropped, reason unknown".
+        modelPlane:
+          allOf: [{ $ref: '#/components/schemas/ModelPlane' }]
+          description: >-
+            server >= 7.133.0, ALWAYS present there (appended last): which model table this engine SERVES, whether the catalog was adopted, and what the start-up route judge says — read this instead of predicting
+            (the judge's inputs are the serving process's facts; mirroring two of its judgements drifts). ABSENT = an earlier server (<= 7.132.x). Field reading: ModelPlane.
         candidateRejected:
           allOf: [{ $ref: '#/components/schemas/CandidateRejected' }]
           description: >
@@ -11761,7 +11771,8 @@ components:
       # 没声明 ⇒ 键缺席 ⇒ 不再是必有键(此前由 `input` 恒算成布尔,对没声明的条目报 false)。
       # 🔴 server 7.131.0 起 `reasoning` 同样三态:env 车道 `MODEL_REASONING` / `MODEL_VISION` 缺省 true 退役、中心名册条目不写即不声明
       # ⇒ 两键都「未声明 = 键缺席」,`required` 只剩 name / id / provider(sdk 23.1.0;TS 型 `ModelInfo.reasoning?` 早已可选)。
-      required: [name, id, provider]
+      # sdk 26.0.0(支持底线 7.52.0):`routePairing` 进 required(≥7.45 恒铸,此前因地板 3.0.0 不进)。
+      required: [name, id, provider, routePairing]
       additionalProperties: false
       properties:
         name: { type: string, description: 'the @mention handle (user-pickable model name).' }
@@ -11785,8 +11796,8 @@ components:
             adjudicated" must stay distinguishable on the wire). Declared here 2026-09-10 alongside `compat`:
             this schema is CLOSED, and the key has been minted unconditionally since 7.45 — so every real
             /v1/models response has been structurally rejected by a strict validator for the whole time (same
-            class as `hasBidiControls` on InboxRow). Optional here because the SDK's supported server floor is
-            3.0.0; the discriminant is the PEER'S VERSION, not this key's presence.
+            class as `hasBidiControls` on InboxRow). REQUIRED since sdk 26.0.0 (the support floor 7.52.0 is above 7.45; it
+            was optional only while the floor was 3.0.0).
         compat:
           $ref: '#/components/schemas/ModelCompat'
           description: >-
@@ -12596,19 +12607,6 @@ components:
         startedAt: { type: integer }
         elapsedMs: { type: integer }
         tokens: { type: integer }
-        # tokenDir REMOVED (engine ruling 2026-06-28): dead field, 0 producer / 0 consumer — spec caught up 2026-07-26.
-        queuedCount:
-          type: integer
-          description: >-
-            🔴 PHANTOM KEY — NO server version ever emits it (verified against the published 7.87.0 bytes:
-            the row type declares it and the fleet route's per-key table forwards it, but NO producer writes it
-            — not `publishTask`'s call sites, not core's bg-sink tick, not the durable reconcile leg — and the
-            wire contract does not mention it either). The server deleted it as a DEAD KEY (S-459, zero
-            behavioural impact since `!== undefined` was always false). It stays declared here only because
-            removing an exported field is BREAKING = major-only; it is registered with its deletion condition
-            in `test/_keyset-divergence.ts` (`FLEET_TASK_ROW_PHANTOM_KEYS`) and goes with the next major.
-            DO NOT read it as "queue depth is already reported" — a permanently absent optional key is a FALSE
-            LEAD. Real queue depth needs a NEW key WITH a producer, not this one resurrected.
         awaitingPlanApproval: { type: boolean }
         currentAction: { type: string, description: "The child's most recent tool intent as one human-readable line (UNTRUSTED argument head, redacted server-side)." }
         currentTool:
@@ -12722,6 +12720,13 @@ components:
         failedCount: { type: integer }
         elapsedMs: { type: integer }
         tokens: { type: integer }
+        errorCode:
+          type: string
+          description: >-
+            server >= 7.134.0 — the workflow run's MACHINE code (open set; the same words as the same-named slot on `GET /v1/workflows/{id}`): carried verbatim when the
+            run row has one, the key ABSENT otherwise (never an empty string). A parked workflow run reads `status: "failed"` + `errorCode: "workflow.agent_parked"`
+            (parked, not failed; the `status` vocabulary gains no word). Snapshot rows, `workflow` upsert frames and rows merged from the terminal window share one mint
+            point; a `?session=` subscriber's demoted rows carry it too. ABSENT = an older server, or no code on this row — fall back to `status`.
     FleetFrame:
       description: >
         One decoded frame off GET /v1/fleet/stream (service streamFleet emit set, src/http/routes/fleet.ts). On the
@@ -12898,14 +12903,14 @@ components:
         ts: { type: integer }
     FleetFrame_hook_notice:
       description: >
-        Hook observability frame, TWO kinds (both pure observe — never block, resume, or inject anything;
+        Hook observability frame, FOUR kinds (server >= 7.133.0 added the third and fourth; all pure observe — never block, resume, or inject anything;
         visibility fail-CLOSED like bg_notification: the owner keys ownerScope/ownerSessionId gate delivery
         and are STRIPPED before send; wire is FLAT — `send("hook_notice", { type, ...wire, ts })`, the
         server-internal `{notice}` nesting never reaches it). codex R1-F4: modeled as the discriminated union
         it really is — the common `{type, ts}` frame base composed with each kind's payload arm — so a
         generated client gets the SAME per-kind narrowing as the TS type (a second-family frame missing
-        hookName/entryType is invalid, not silently accepted). `kind` is CLOSED two-member on the server but
-        OPEN ON READ: degrade an unknown future kind to a generic observability row.
+        hookName/entryType is invalid, not silently accepted). `kind` is CLOSED four-member on the server but
+        OPEN ON READ: degrade an unknown future kind to a generic observability row. DISPATCH on `kind`; never infer a call's outcome from any hook_notice frame (read the tool / approval frames).
       oneOf:
         - allOf:
             - $ref: '#/components/schemas/FleetHookNoticeFrameBase'
@@ -12913,10 +12918,16 @@ components:
         - allOf:
             - $ref: '#/components/schemas/FleetHookNoticeFrameBase'
             - $ref: '#/components/schemas/FleetHookNonBlockingFailure'
+        - allOf:
+            - $ref: '#/components/schemas/FleetHookNoticeFrameBase'
+            - $ref: '#/components/schemas/FleetHookManagedUnrun'
+        - allOf:
+            - $ref: '#/components/schemas/FleetHookNoticeFrameBase'
+            - $ref: '#/components/schemas/FleetHookVerdictUntrusted'
 
     FleetHookNoticeFrameBase:
       type: object
-      description: 'The hook_notice frame envelope shared by both kinds: the SSE frame discriminant and the server timestamp.'
+      description: 'The hook_notice frame envelope shared by all four kinds: the SSE frame discriminant and the server timestamp.'
       required: [type, ts]
       properties:
         type: { const: hook_notice }
@@ -12929,7 +12940,8 @@ components:
         DISTINCT vocabulary from AgentEvent (the durable log is BLOCK-grained, each frame is a delta to append).
         Resumable (each `id:` = the durable task_event.seq; on 416 the server returns `{retainedFrom}` and the SDK
         resumes from there after a turns full-sync). Known events: meta / block-thinking-delta / block-content-delta
-        / tool-call / tool-result / turn / done / error (+ heartbeat keep-alives the SDK swallows). Open set.
+        / tool-call / tool-result / prompt-assembled / cross-boundary-taint (server >= 7.134.0: the device lane's taint row + `seq`, see
+        `Event_cross_boundary_taint`) / turn / done / error (+ heartbeat keep-alives the SDK swallows). Open set.
         NOTE: SSE framing on the wire (event name + JSON data + optional id), not a JSON body.
       required: [event, data]
       additionalProperties: true
@@ -12946,10 +12958,11 @@ components:
               description: >
                 契约调和车1 G(2026-08-02;server [2373]C-12, `src/trace/project.ts` + the meta frame at
                 `routes/trace-usage.ts`): the frame's own event name, DOUBLE-EMITTED inside `data`. Always
-                present on server >= 5.0.0; OPTIONAL here because the SDK's supported floor is server 3.0.0
-                (where only the `error` frame carried it). Equal to the SSE `event:` line verbatim — its reason
-                to exist is the proxy/relay case that strips the `event:` line and forwards only the data JSON,
-                where this is the only key left to dispatch on. Heartbeats (`data: {}`) carry none.
+                present on every named frame of a supported server (>= 7.52.0; minted since server 5.0.0) — the SDK's
+                typed arms declare it REQUIRED since 26.0.0; it is not in this schema's `required` only because the one
+                schema also covers heartbeats (`data: {}`, which carry none and which the SDK swallows). Equal to the SSE
+                `event:` line verbatim — its reason to exist is the proxy/relay case that strips the `event:` line and
+                forwards only the data JSON, where this is the only key left to dispatch on.
             output:
               allOf: [{ $ref: '#/components/schemas/ToolOutput' }]
               description: >
@@ -12965,7 +12978,7 @@ components:
       # #315(server ≥7.43):第二顶层键 `livePending` = streamApproval 窗内的流内 ask(此前对轮询消费端
       # 结构性不可见)。ADDITIVE / tolerate-absent:键缺席=「协调器未装配(本部署无 live 审批面)」或
       # 旧 server;空数组=「有面、此刻无待批」——两义可判别,消费端测 presence。**分数组不混编**:
-      # live 行的决议口=POST /v1/tool-approvals/{approvalId}/respond,durable 行=decide 口;数组名即路由判据。
+      # live 行的决议口=POST /v1/tool-approvals/{id}/respond,durable 行=decide 口;数组名即路由判据。
       # 22.0.0:第三、四顶层键此前漏声明 —— 封闭 schema 上一个真键 = 合法信封被严格校验器拒收。
       additionalProperties: false
       required: [pending]
@@ -13020,7 +13033,7 @@ components:
       type: object
       description: >-
         A live (in-stream) pending ask inside its streamApproval window (#315, server ≥7.43). Decide it via
-        POST /v1/tool-approvals/{approvalId}/respond — NOT the /decide route (that is the durable rows' door).
+        POST /v1/tool-approvals/{id}/respond — NOT the /decide route (that is the durable rows' door).
         Optional flags are only-if-true (absent is NEVER encoded as false).
         🔴 THE "tool input/args are NOT listed" NARROWING IS GONE (server >= 7.87.0 / S-454 P1). The old reason
         was "details ride the stream frame" — but a SUSPENDED ask never has a stream frame (at mint time it had
@@ -13038,7 +13051,15 @@ components:
       additionalProperties: true
       required: [approvalId, toolName, ts, expiresAtMs]
       properties:
-        approvalId: { type: string, description: 'The SAME id the respond endpoint takes (wire uuidv7).' }
+        approvalId: { type: string, description: 'The SAME id the respond endpoint takes. server >= 7.133.0: for an ask that has a ledger row it is ALWAYS the row''s key `askId` (a 64-character lowercase hexadecimal string — an OPAQUE string, never a uuid); on <= 7.132.x a wire uuidv7.' }
+        consumerState:
+          type: string
+          enum: [absent]
+          description: >-
+            server >= 7.133.0, TRUE-ONLY (present as `absent`): no engine leg on THIS replica is waiting for this ask. Present <=> the row was ADOPTED from the ask ledger at start-up (minted by a previous
+            process / another replica, the row still undecided — a "zombie card"): it lists and can be answered (the row becomes decided; the answer ack carries the same bit), but that decision resumes
+            nothing running on this replica — read the run surface to learn whether anything continued. The `live_pending` stream frame and the `pending` arm of GET /v1/tool-approvals/{id} carry it too. After a restart an
+            ask still undecided on the ledger RETURNS to `livePending[]` (it used to vanish and answer 404). Absent = this replica has an engine leg waiting, or an older server.
         toolName: { type: string }
         ts: { type: number, description: 'Registration time (ms epoch).' }
         expiresAtMs: { type: number, description: 'Absolute window deadline — the SAME number minted once for the tool_approval frame (never recomputed).' }
@@ -13063,9 +13084,13 @@ components:
           allOf: [{ $ref: '#/components/schemas/ToolApprovalCardWord' }]
           description: 'server >= 7.126.0 (core 7.49.0 #1414): which card this ask renders on — the engine-minted card word, the SAME value as `frame.approvalCard` (the row reads the frame''s own seat, no second read), same layer and shape as the operator queue row''s `approvalCard`. It REPLACES `contentKind` (server <= 7.125.x derived it from the tool name; deleted at 7.126.0, no alias). ABSENT = the engine minted none. Display / triage only; it NEVER takes part in decision routing.'
         frame:
-          allOf: [{ $ref: '#/components/schemas/ToolApprovalFrame' }]
+          oneOf:
+            - $ref: '#/components/schemas/ToolApprovalFrame'
+            - $ref: '#/components/schemas/ApprovalRequestFrame'
           description: >-
-            server >= 7.87.0 (S-454 P1; cli L-397) — THE CARD FRAME THIS ASK WOULD HAVE EMITTED. It is the SAME
+            server >= 7.87.0 (S-454 P1; cli L-397) — THE CARD FRAME THIS ASK WOULD HAVE EMITTED. TWO SHAPES, by leg (sdk 25.0.0 declares the union; discriminant
+            `frame.type`): on a leg that speaks the card protocol (`capabilities.approvalFrameFamilies` contains `approval_request`, server >= 7.133.0) it is the
+            `approval_request` frame (card facts under `frame.card`, the ten off-card live facts flat at the top); on a legacy-family leg it is the `tool_approval` frame. It is the SAME
             OBJECT as the server's `PendingApproval.frame` (the one construction site in `askBroadcast`, already
             redacted / byte-capped / window-keys filled), shared by the suspended and the reachable path — so
             this is NOT a second card projection computed for the list, and there is no second redaction surface.
@@ -13285,6 +13310,7 @@ components:
       required: [sessionId, scope, createdAt]
       additionalProperties: true
       properties:
+        checkpointId: { type: string, minLength: 1, maxLength: 128, description: 'server >= 7.133.0: the NON-SECRET stable identity of the pause this row parks on — the join key where the token cannot go; the SAME value as `PausedCause.checkpointId`. Carried on three durable read surfaces (GET /v1/approvals `pending[]` rows, the /v1/approvals/stream `pending` frame, GET /v1/assistant/inbox rows). A row whose value is unreadable or untrusted (non-string / empty / over 128 / contains the token / an old row / an older server) is STILL LISTED with the key ABSENT — read absence as "this row has no joinable identity", never as a required key.' }
         sessionId: { type: string, description: 'The decide handle: POST /v1/approvals/:sessionId/decide.' }
         scope: { type: string, description: 'Principal; "_" = submitted without one.' }
         taskId: { type: ['string', 'null'], description: 'Suspended run holding the session claim (service-pinned) — join key to trace tool-call blocks + context link.' }
@@ -13339,26 +13365,13 @@ components:
                 is RETIRED: the SQL backend rewrote its parked rows once at the 7.117.0 boot to `[{ member: "persisted", entries: [<old value>] }]`, but the
                 file backend's pre-upgrade parked rows and run results already on disk (`checkpointGate.riskDescriptor`) keep the old key verbatim
                 (text still redacted, no structured disclosure) — a consumer reading those must still tolerate the old string.
-        # server 7.16.0 [3684]② — durable 队列行归因两键(与活卡 tool_approval 帧的同名键语义同族、判据不同源;
-        # 两条腿对同一只 ask 的在场性可以不一致,两侧都只认在场、都禁把缺席读成否定)。
-        ruleSuggestions:
-          type: array
-          minItems: 1
-          items: { $ref: '#/components/schemas/RuleSuggestion' }
-          description: >
-            server 7.16.0 ([3684]②), ADDITIVE: the rule candidates minted for this ask, replayed off the durable
-            row (checkpoint.rule_suggestions). DISPLAY-ONLY on this leg — the durable queue has no persistRule
-            redemption; the only redemption path is the LIVE card leg (respond + persistRule). Array order =
-            display order; an EXACT entry, when present, is always first. core contract caps candidates at 2;
-            the server enforces a tolerance cap of 4 on read-back — lay out for 4. Absent = pre-column row
-            (parked before the column existed) OR no candidates; render both as "no candidates", never an error.
         ruleOffers:
           type: array
           minItems: 1
           items: { $ref: '#/components/schemas/RuleOffer' }
           description: >
             server >= 7.46.0 (core 5.58.0, design/375) — the discriminated-union successor of the retired
-            `ruleSuggestions` above on the DURABLE queue row (core `PendingAction.ruleOffers`, the same
+            `ruleSuggestions` (servers <= 7.45; sdk 26.0.0 deleted it) on the DURABLE queue row (core `PendingAction.ruleOffers`, the same
             contract as the sync leg's `AskRequest.ruleOffers`). A >= 7.46.0 row carries only the new key;
             pre-5.58 rows fail the new narrow read entry by entry and land as "no supply" (no compatibility
             read — a stale schema means re-ask).
@@ -13496,6 +13509,7 @@ components:
       additionalProperties: false
       properties:
         sessionId: { type: string, description: 'The suspended task/session id.' }
+        checkpointId: { type: string, minLength: 1, maxLength: 128, description: 'server >= 7.133.0: the NON-SECRET stable identity of the pause this row parks on — the join key where the token cannot go; the SAME value as `PausedCause.checkpointId`. Carried on three durable read surfaces (GET /v1/approvals `pending[]` rows, the /v1/approvals/stream `pending` frame, GET /v1/assistant/inbox rows). A row whose value is unreadable or untrusted (non-string / empty / over 128 / contains the token / an old row / an older server) is STILL LISTED with the key ABSENT — read absence as "this row has no joinable identity", never as a required key.' }
         scope: { type: string, description: 'Multi-tenant owner scope.' }
         createdAt: { type: number, description: 'Ask creation time (epoch ms).' }
         gateKind:
@@ -13582,25 +13596,20 @@ components:
             one-off question. The value comes WHOLE from core (`summarizeCheckpoint` echoes it only when the
             cause is a member of the engine's set), so the server neither recomputes nor re-screens it. See
             ClassifierUnavailable for the open-`cause` rule and the three shapes absence covers.
-            RETIRED: server >= 7.72.0 (core 7.14.0 #688) never mints this key on any of the three faces; its
+            RETIRED: server >= 7.72.0 (core 7.14.0) never mints this key on any of the three faces; its
             successor is `disposition.cause` on the gate record (`unavailable` / `parse_error` — a different
-            question, so an old switch does not port). Kept for servers in [7.69.0, 7.72.0) only (sdk 9.2.0).
+            question, so an old switch does not port). Kept for servers in [7.69.0, 7.72.0) only (sdk 9.2.0); the row key retires
+            together with the frame key (floor ≥ 7.106.0, next major); why the frame still declares it: `ToolApprovalFrame.classifierUnavailable`.
         ruleStoreUnreadable:
           type: string
           enum: [store, call]
           description: >-
-            server >= 7.72.0 (core 7.14.0 #688 C3), ADDITIVE — WHICH HALF of the rule lane could not be read.
-            Present iff `origin === "rule_store_unavailable"`: `store` = the wired rule store could not be read
-            (look at the store / network); `call` = the store was read but THIS command could not be read against
-            the person's deny/ask rows (look at the command spelling). One `origin` word covers both facts, and
-            their recovery verbs live in different places (ops vs prompt). Carried on the live `tool_approval`
-            frame and the inbox row; the `card_json` card deliberately does NOT carry it (it travels with `origin`,
-            which is not on the card). Absence = `origin` is not that word — NOT an assertion that the rule store
-            is healthy.
-            RETIRED: server >= 7.106.0 (core 7.34.0 C-R172, BREAKING — wire) never mints this key on either face — an
-            unreadable rule store no longer raises a card: that read's rows are SKIPPED by partition and the session
-            stream gets the user-facing `engine_notice` `permission.rule_store_unavailable` (`detail.at` = `prepare` /
-            `call`). Kept for servers in [7.72.0, 7.106.0) only (sdk K-32); `origin: rule_store_unavailable` itself stays.
+            server >= 7.72.0 (core 7.14.0 #688 C3), ADDITIVE — WHICH HALF of the rule lane could not be read (`store` / `call`).
+            The same key, with the same two words and the same reading, as on the live frame; the authoritative statement of the shape, the presence
+            rule, what the two words mean and the retirement wording is on `ToolApprovalFrame.ruleStoreUnreadable`, and this description points to it.
+            RETIRED: server >= 7.106.0 never mints this key on either face (the frame's description names the successor). Kept for
+            servers in [7.72.0, 7.106.0) only (sdk K-32); the row key retires together with the frame key (floor ≥ 7.106.0, next major);
+            `origin: rule_store_unavailable` itself stays.
 
     InboxList:
       type: object
@@ -13819,6 +13828,17 @@ components:
             ⚠️ The key name is final: `permissionModeAfter` (the build brief once said `nextPermissionMode`,
             which never shipped — zero aliases).
 
+    SessionAgent:
+      type: object
+      additionalProperties: false
+      description: >-
+        The placement-tuple projection of a delegated subagent's transcript (`SessionRecord.agent`, server >= 7.133.0). Each member is independently optional (only what was stored is projected); `{}` is a legal value
+        (the tuple held only a `kind`). `id` = the tuple's `handle` (the durable agent row's `a…` key — the SAME string as the fleet row's `id` and `GET /v1/agents/roster`'s `handle`); `parentSessionId` = the host
+        session that spawned it; `rootSessionId` = the delegation tree's root host session (a nested grandchild anchors to the root).
+      properties:
+        id: { type: string }
+        parentSessionId: { type: string }
+        rootSessionId: { type: string }
     SessionRecord:
       type: object
       description: >
@@ -13851,6 +13871,14 @@ components:
           $ref: '#/components/schemas/SessionWindow'
         promptEpoch:
           $ref: '#/components/schemas/PromptEpoch'
+        agent:
+          allOf: [{ $ref: '#/components/schemas/SessionAgent' }]
+          description: >-
+            server >= 7.133.0, top-level additive key — WHICH delegated subagent's transcript this session is (read by terminal side-chain projections that join a fleet frame's `transcriptId`). Only the stored placement
+            tuple is projected (minted by the engine when a BACKGROUND subagent with a durable agent row creates the session on a store that declares placements; a synchronously delegated subagent's transcript is not in
+            the host store and has no tuple); the three members are each optional. 🔴 READ IT AS "WAS IT STORED", NEVER AS "IS IT A SUBAGENT": key PRESENT = a delegated subagent's transcript (even `{}` when the tuple held only a
+            kind); key ABSENT has three causes — an older server (<= 7.132.x) / an ordinary session / a deployment whose store keeps no placement tuple (the local backend: the copy parked from the private short-TTL store is an
+            ordinary session row). Absence is NOT "not a subagent": fall back to the identity the fleet row (`id`) / `GET /v1/agents/roster` (`handle`) already carry.
         userInputUndrained:
           type: array
           description: >-
@@ -14476,26 +14504,6 @@ components:
         parentId: { type: [string, 'null'] }
         type: { type: string, description: Entry discriminator (message / leaf / compaction / …) — opaque to the SDK. }
 
-    SyncSnapshot:
-      type: object
-      description: >
-        One E19 file snapshot keyed by a `SessionTreeEntry.id`. `manifest` = `[relPath, blobHash]` tuples; the blob
-        BYTES are NOT inlined (they ride the content-addressed blob routes).
-      # 封闭(census 批2 第三段,2026-07-30):server 侧类型+铸造点(`session-sync.ts` PULL 出 /
-      # `routes/session-sync.ts` PUSH 校验形)都恰是这两键。
-      additionalProperties: false
-      required: [key, manifest]
-      properties:
-        key: { type: string }
-        manifest:
-          type: array
-          items:
-            type: array
-            minItems: 2
-            maxItems: 2
-            items: { type: string }
-            description: A `[relPath, blobHash]` tuple.
-
     SyncAnchor:
       type: object
       description: One E18 resume-at anchor. `owner` is RE-KEYED to the importing principal on a PUSH (§9).
@@ -14523,31 +14531,28 @@ components:
       description: >
         2c session-sync `GET …/sync/manifest` payload (wrapped server-side as `{ manifest }`). The THIN cross-backend
         snapshot: entry IDS (oldest-first, NOT payloads) + the file-history envelope + policy + anchors + leaf.
-        🔴 server >= 7.52 (S-15, design/381; re-read byte for byte against 7.116.0): the key `snapshots` (per-snapshot
-        relPath→blobHash, the retired E19 whole-tree snapshot epoch) is NO LONGER SENT — the server's `exportSessionManifest` mints
-        `{ sessionId, entryIds, entryCount, leafId, fileHistory, policy, anchors }` (server >= 7.125.0 adds the session row's two writable bits `title` / `pinned`,
-        present-iff the session is a row of the list face — see the two properties) and `fileHistory` (core's versioned
-        `FileHistoryExport` envelope; `null` = no history / the source store cannot export) replaces it. <= 7.51 servers still send
-        `snapshots` and no `fileHistory`. The blob BYTES never ride the manifest: content-addressed, via the history blob faces
-        (`GET …/sync/history/blobs/{hash}` / `PUT …/sync/blobs/{hash}`; probe `capabilities.sessionSyncFileHistory` on BOTH ends).
-        The SDK's `manifest()` fills `snapshots: []` when the wire omits it.
+        The server's `exportSessionManifest` mints `{ sessionId, entryIds, entryCount, leafId, fileHistory, policy, anchors }` (server >= 7.125.0 adds the
+        session row's two writable bits `title` / `pinned`, present-iff the session is a row of the list face — see the two properties). `fileHistory`
+        (core's versioned `FileHistoryExport` envelope; `null` = no history / the source store cannot export) is ALWAYS present on a supported server
+        (>= 7.52.0); the retired E19 whole-tree snapshot key `snapshots` of servers <= 7.51 is below the support floor (sdk 26.0.0 deleted it). The blob BYTES
+        never ride the manifest: content-addressed, via the history blob faces (`GET …/sync/history/blobs/{hash}` / `PUT …/sync/blobs/{hash}`; probe
+        `capabilities.sessionSyncFileHistory` on BOTH ends). The SDK returns the wire verbatim.
       # 封闭(census 批2 第三段,2026-07-30;16.2.0 按 7.116.0 发布字节重核):铸造点 `session-sync.ts`(exportSessionManifest 尾部
       # 字面量)恰是 `{ sessionId, entryIds, entryCount, leafId, fileHistory, policy, anchors }` 7 键(≥7.52),无 `snapshots`;
       # server ≥7.125.0 另有 `title` / `pinned` 两键(会话行可写位,present-iff 会话是列表面上的行;条件展开,不进 required);
-      # ≤7.51 老 server 发 `snapshots`、无 `fileHistory` ⇒ 两键都不进 required(支持底线 3.0.0)。
+      # sdk 26.0.0(支持底线 7.52.0):`fileHistory` 进 required(支持面内恒铸),`snapshots` 删(≤7.51 才发)。
       additionalProperties: false
-      required: [sessionId, entryIds, entryCount, leafId, policy, anchors]
+      required: [sessionId, entryIds, entryCount, leafId, fileHistory, policy, anchors]
       properties:
         sessionId: { type: string }
         entryIds: { type: array, items: { type: string }, description: Oldest-first, verbatim cross-backend. }
         entryCount: { type: integer, description: '= entryIds.length (the `/sync/entries` trailer count).' }
         leafId: { type: [string, 'null'] }
-        snapshots: { type: array, items: { $ref: '#/components/schemas/SyncSnapshot' }, description: 'server <= 7.51 ONLY (the retired E19 snapshot epoch); server >= 7.52 does not send it — see `fileHistory`.' }
         fileHistory:
           oneOf:
             - { $ref: '#/components/schemas/FileHistoryExport' }
             - { type: 'null' }
-          description: 'server >= 7.52: the per-edited-file rewind history envelope; `null` = no history / the source store cannot export; key ABSENT = a <= 7.51 server (that generation sends `snapshots`).'
+          description: 'the per-edited-file rewind history envelope; `null` = no history / the source store cannot export. Always present on a supported server.'
         policy: { type: array, items: { $ref: '#/components/schemas/SessionRulesRecord' } }
         anchors: { type: array, items: { $ref: '#/components/schemas/SyncAnchor' } }
         title:
@@ -14610,20 +14615,18 @@ components:
     SessionBundle:
       type: object
       description: >
-        The portable state of ONE session, ready to replay into another backend. Blobs are NOT inlined (each
-        snapshot carries only its `manifest`; the bytes stream through the content-addressed blob routes). The SDK
-        assembles this from a manifest + the streamed entries for a PUSH. server >= 7.52: the file history rides `fileHistory`
-        (the `FileHistoryExport` envelope) instead of `snapshots`.
-      required: [sessionId, entries, snapshots, policy, anchors]
+        The portable state of ONE session, ready to replay into another backend. Blobs are NOT inlined (the file-history
+        envelope carries only blob hashes; the bytes stream through the content-addressed blob routes). The SDK
+        assembles this from a manifest + the streamed entries for a PUSH.
+      required: [sessionId, entries, fileHistory, policy, anchors]
       properties:
         sessionId: { type: string }
         entries: { type: array, items: { $ref: '#/components/schemas/SyncEntry' } }
-        snapshots: { type: array, items: { $ref: '#/components/schemas/SyncSnapshot' } }
         fileHistory:
           oneOf:
             - { $ref: '#/components/schemas/FileHistoryExport' }
             - { type: 'null' }
-          description: 'server >= 7.52 file-history envelope (same as `SessionManifest.fileHistory`); key absent = the source is a <= 7.51 server.'
+          description: 'the file-history envelope (same as `SessionManifest.fileHistory`; `null` = none, or the pull did not carry it because the source has no blob faces).'
         policy: { type: array, items: { $ref: '#/components/schemas/SessionRulesRecord' } }
         anchors: { type: array, items: { $ref: '#/components/schemas/SyncAnchor' } }
 
@@ -14811,8 +14814,9 @@ components:
             <= 7.105.0 answered the synchronous leg 200 + a failed body), `corrupt` (500 — the session rule store
             cannot read its own bytes), `internal.memory_control_plane_corrupt` (500 — the memory control plane refuses
             fail-closed) and `state.scenario_assignment_unknown` (503, server >= 7.119.0 — the center's scenario assignment for the
-            principal is dangling; only re-pointing the assignment, or adding the scenario back to the deployment, helps). Every other 5xx
-            code keeps the status-based retry.
+            principal is dangling; only re-pointing the assignment, or adding the scenario back to the deployment, helps) and
+            `approvals.read_corrupt` (500, server >= 7.134.0 on `GET /v1/approvals` — a queue row's stored body cannot be read; an operator has to repair or
+            delete the row). Every other 5xx code keeps the status-based retry.
             🔴 `request.host_posture_refused` (422) has TWO triggers (same code, same status — "you wrote it right, this
             deployment will not grant that host posture"): (1) the write-containment face (`permissionMode: bypassPermissions` ⇒
             `writeFace: open`; read `capabilities.taskWriteFaceOpen` first); (2) server >= 7.106.0 / S-895: `inheritEnv: "all"` on a
@@ -14885,8 +14889,8 @@ components:
             center 404 / 429 / 3xx included). On 400 `request.field_invalid` for a `settings.permissions` bucket (server >= 7.106.0 /
             S-904): `over_cap` (more than `cap` entries; beside `count` + `cap`) / `bad_entry` (a non-string or empty item; beside
             `index`); server >= 7.132.0 widens that group to every tool-name list on the body, the agent definitions and the two host-path lists, and adds
-            `too_long` (a text over its character cap; beside `count` + `cap`) — closed three words `over_cap` / `too_long` / `bad_entry` (SDK `RequestFieldRefusalExtra`).
-            On 409 refusals of a resume (server >= 7.132.0): the engine's `CheckpointErrorReason` arm (`detail.reason` passed through; see `blockedBy`). On 400 `rules.inert_entry` (server >= 7.129.0): the engine's `ALLOW_ENTRY_INERT_REASONS` (`tool_name` / `wildcard_all` / `namespace_wildcard` / `content_unsupported` / `grammar` / `near_miss` / `earlier_grammar`). Out-of-vocabulary word ⇒ treat as unknown. (Other codes carry their own `reason` words.)
+            `too_long` (a text over its character cap; beside `count` + `cap`) — closed words `over_cap` / `too_long` / `bad_entry` (SDK `RequestFieldRefusalExtra`); server >= 7.133.0 adds `too_large` (a payload over its BYTE cap, only on 413 `request.payload_too_large`: `{ field: "body", reason: "too_large", cap }` — `count` ABSENT when the read stopped at the cap and cannot measure; a request body over 8 MiB is now always that 413) and the `request.invalid_json` reasons `not_json` | `not_object` (400, every JSON-body door; formerly `request.rejected`/`request.body_shape` by door).
+            On 409 refusals of a resume (server >= 7.132.0) and on 422 `parked_resume.startup_failed` (server >= 7.134.0 — the parked background agent's pre-claim failure; absent when the engine gave none): the engine's `CheckpointErrorReason` arm (`detail.reason` passed through; see `blockedBy`). On 409 `conflict.checkpoint_ctx_unsealable` (server >= 7.134.0): why the request's credentials cannot be sealed into, or unsealed from, the stored resume context — a closed five-word set (SDK `CHECKPOINT_CTX_UNSEALABLE_REASONS`); which doors can answer which word is written once, in the SDK documentation of `CHECKPOINT_CTX_UNSEALABLE_REASONS`, not here: `no_key_store` (this server has no sealed-key store) / `key_not_held` (sealed with a key this server does not hold — another replica's, or a replaced sealed-key directory) / `unopenable` (the sealed value is damaged or belongs to another session) / `plaintext` (an older server stored it unsealed) / `unrecognized_seal` (a seal format this version does not know) — the way out depends on the door and the `reason`: `key_not_held` (a resume door) — have the operator restore the sealed-key directory that sealed it and restart that replica (it reads its keys only at startup), then resend the same request; `no_key_store` on the submit door — give the service a writable sealed-key directory (`<data root>/sealed-key/`, read at startup), or resubmit WITHOUT those credentials — resending the same submit body is refused again; `no_key_store` on a resume door — the same way out as `key_not_held`: restore the directory that sealed it and restart, then resend (a fresh empty directory does not help: it holds no such key, so the next read says `key_not_held`); `unopenable` / `plaintext` / `unrecognized_seal` — submit the work as a new task (cancel the still-suspended one first); never auto-retry, never match the sentence. A resume door's refusal decides nothing and starts no resume (the card stays pending; the known exception is a terminal run's steer race arm, which first opens a wake card and, when the second read fails for any of the five reasons, withdraws it and then answers 409 — if the withdrawal fails the server only logs it); a submit door's refusal lands before the task runs (nothing runs; a run row already opened for it is closed as `failed` and its idempotency key released, both best-effort — a failed step is only logged by the server and the answer is still the 409). On 400 `rules.inert_entry` (server >= 7.129.0): the engine's `ALLOW_ENTRY_INERT_REASONS` (`tool_name` / `wildcard_all` / `namespace_wildcard` / `content_unsupported` / `grammar` / `near_miss` / `earlier_grammar`). Out-of-vocabulary word ⇒ treat as unknown. (Other codes carry their own `reason` words.)
         retryAfterSec:
           type: number
           description: >-
@@ -14913,6 +14917,10 @@ components:
             `null` and `""` count), the refusal landed before any decision, and `field` is the literal `settledBy`; the three doors now answer
             the SAME sentence. Every such 400 carries it, even when another defect in the same body was hit first (the sentence then names that
             defect). Branch on the code plus `field`, never on the sentence; a bad body WITHOUT that key carries no `field`. SDK: `err.extra.field`.
+            server >= 7.134.0: on 409 `conflict.checkpoint_ctx_unsealable` `field` is the SUBMIT-BODY PATH of the credential slot that cannot be sealed or unsealed (arrays
+            `[i]`, record members `.key`: `mcpServers[0].transport.headers.Authorization`, `settings.hooks.PreToolUse[0].hooks[0].headers.Authorization`; the key
+            name is not a secret, the value never enters the refusal); on 400 `request.field_invalid` for the request key `settings.approvalFrameFamilies` it is
+            that literal (with `reason: "bad_entry"` and the bad `index`; no `index` for a non-array).
         detail:
           description: >
             🔴 SHAPES differ by code — branch on `field` (or the `errorCode`), never guess from the type of `detail`. On 503
@@ -15006,6 +15014,14 @@ components:
                   properties:
                     reason: { type: string, enum: [unnamed_refusal] }
                     path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
+                - type: object
+                  description: 'one of the three wire keys this service reads itself is malformed (server >= 7.133.0): the group `source` / a command entry''s `plugin` / `args`; `key` names it, `path` is its coordinate. The whole request is refused (they used to be stripped silently as unknown keys).'
+                  required: [reason, key, path]
+                  additionalProperties: false
+                  properties:
+                    reason: { type: string, enum: [wire_key_invalid] }
+                    key: { type: string }
+                    path: { $ref: '#/components/schemas/SettingsHooksConfigPath' }
                 - type: object
                   description: 'server 7.115.0–7.125.x: the dead-alias matcher refusal before `reason` existed.'
                   required: [event, alias, canonical]
@@ -15027,13 +15043,42 @@ components:
               properties:
                 scenario: { type: string }
                 source: { type: string, enum: [ruling, deployment] }
+            - type: object
+              description: >-
+                server >= 7.133.0 — entry problems on a tool-name list / settings-rule refusal (400 `request.field_invalid`, 422): `problems` (at most 1000, each EntryProblem) + `total` (the true count; `total > problems.length` => cut).
+                With `callerTrust` it is the below-trust-floor refusal: the caller's admission tier (`global` | `project`, read open; the same words as `capabilities.settings.permissions.callerTrust`).
+              required: [problems, total]
+              additionalProperties: false
+              properties:
+                problems: { type: array, items: { $ref: '#/components/schemas/EntryProblem' } }
+                total: { type: integer }
+                callerTrust: { type: string }
+            - type: object
+              description: >-
+                server >= 7.133.0 — 400 `request.field_conflict`: the request body contradicts itself. `kind` = which constraint (a CLOSED set — fourteen words, fifteen from server >= 7.134.0 — read open: cascade_verify | image_profile | resume_anchor |
+                system_prompt_fold | file_history_restore | skills_disabled | existing_session | scratchpad_root | ask_answer | policy_person_ask | plan_edit | plan_mode_after | bound_call_door | remember_decision |
+                approval_feedback (server >= 7.134.0: `feedback` on a deny — fields `["feedback", "decision"]` — or on a policy decision — `["feedback", "decidedBy"]`));
+                `fields` = the named body coordinates, subject first (at least one; a dynamic index reads `agents[1].skills`); `count` / `cap` only on the fold-cap kind (the folded total and its cap).
+              required: [kind, fields]
+              additionalProperties: false
+              properties:
+                kind: { type: string }
+                fields: { type: array, items: { type: string } }
+                count: { type: integer }
+                cap: { type: integer }
+            - type: object
+              description: '409 `conflict.session_placed` (server >= 7.133.0): the session sync commit targeted a session that holds a delegated agent''s transcript. `placement_kind` is the stored placement kind (today only `subagent`; read open).'
+              required: [placement_kind]
+              additionalProperties: false
+              properties:
+                placement_kind: { type: string }
             - type: string
         count:
           type: integer
-          description: '`reason: over_cap` / `too_long` only — how much was sent (entries / characters; S-904 since server >= 7.106.0, every capped face since >= 7.132.0). SDK: `err.extra.count`.'
+          description: '`reason: over_cap` / `too_long` / `too_large` — how much was sent (entries / characters / bytes; every capped face since >= 7.132.0). ABSENT on the unmeasured form (a body read that stopped at the cap). SDK: `err.extra.count`.'
         cap:
           type: integer
-          description: '`reason: over_cap` / `too_long` only — the cap (1000 for a permissions bucket; per face otherwise). SDK: `err.extra.cap`.'
+          description: '`reason: over_cap` / `too_long` / `too_large` — the cap (1000 for a permissions bucket; per face otherwise; bytes on a too_large 413). SDK: `err.extra.cap`.'
         index:
           type: integer
           description: '`reason: bad_entry` only — the index of the first bad item; ABSENT when the list itself is not an array. SDK: `err.extra.index`.'
@@ -15058,6 +15103,8 @@ components:
             the engine's `detail.code` passes through as `blockedBy` (today only `checkpoint.config_refused` carries it — the closed set is core's
             `CHECKPOINT_CONFIG_REFUSAL_CODES`, 40 words since core 7.53.0; read it as "the errorCode a fresh run would report for the same bad configuration"),
             next to `field` and `reason`, absent keys not minted (SDK `ResumeRefusalExtra`).
+            server >= 7.134.0 / core 7.54.0: the SAME three keys on 422 `parked_resume.startup_failed` (a parked background agent's leg refused before the claim — the
+            engine now hands the failure's code / field / reason to the redemption receipt; absent when the engine gave none; <= 7.133.x carried only `cause` there).
 
     ResumeLegConflictError:
       description: >
@@ -15141,6 +15188,9 @@ components:
         # 🔴 census 轴一(2026-07-30)补的 4 臂:server 今天就真发,spec/SDK 两侧此前同缺(详见各 schema 处的注)。
         - $ref: '#/components/schemas/Event_context_usage'
         - $ref: '#/components/schemas/Event_config_assembled'
+        # server >= 7.134.0 (core 7.54.0): the device lane's cross-boundary taint row — DURABLE only (the `GET /v1/runs/{taskId}/events` ledger replay), never
+        #   on the live stream and never on the `GET /v1/runs/{taskId}` poll object; the trace SSE twin is the `cross-boundary-taint` frame.
+        - $ref: '#/components/schemas/Event_cross_boundary_taint'
         - $ref: '#/components/schemas/Event_needs_review'
         - $ref: '#/components/schemas/Event_message_committed'
         # [2373]A-2(2026-08-03,server 5.0.0):compaction_outcome 三腿同源批的 spec 半场(SDK 臂 20867e1 同批)。
@@ -15169,6 +15219,11 @@ components:
         - $ref: '#/components/schemas/Event_tool_approval_complete'
         - $ref: '#/components/schemas/Event_approval_request'
         - $ref: '#/components/schemas/Event_approval_revoke'
+        # server >= 7.133.0 (sdk 25.0.0): the card family's single-card CLOSE frame (`approval_complete`; one frame family per leg — it replaces the legacy
+        #   `tool_approval_complete` on a leg where `capabilities.approvalFrameFamilies` = ["approval_request"]) and the LIVE-ONLY `session_titled` frame (a session
+        #   title was written; never ledgered, no eventId).
+        - $ref: '#/components/schemas/Event_approval_complete'
+        - $ref: '#/components/schemas/Event_session_titled'
         # sdk 9.1.0: two LIVE-leg arms the service has been emitting while neither this union nor the
         #   SDK's declared them — `text_end` since server 7.66.0 (segment boundary; retires the idle-flush
         #   heuristic) and `tool_roster_delta` since server 7.70.0 (run-time roster change). A generated client
@@ -15214,6 +15269,7 @@ components:
           failed: '#/components/schemas/Event_failed'
           context_usage: '#/components/schemas/Event_context_usage'
           config_assembled: '#/components/schemas/Event_config_assembled'
+          cross_boundary_taint: '#/components/schemas/Event_cross_boundary_taint'
           needs_review: '#/components/schemas/Event_needs_review'
           message_committed: '#/components/schemas/Event_message_committed'
           compaction_outcome: '#/components/schemas/Event_compaction_outcome'
@@ -15230,6 +15286,8 @@ components:
           tool_approval_complete: '#/components/schemas/Event_tool_approval_complete'
           approval_request: '#/components/schemas/Event_approval_request'
           approval_revoke: '#/components/schemas/Event_approval_revoke'
+          approval_complete: '#/components/schemas/Event_approval_complete'
+          session_titled: '#/components/schemas/Event_session_titled'
           text_end: '#/components/schemas/Event_text_end'
           tool_roster_delta: '#/components/schemas/Event_tool_roster_delta'
           reasoning_end: '#/components/schemas/Event_reasoning_end'
@@ -15259,13 +15317,18 @@ components:
         condition: durable-ledger leg only (no ledger => neither header nor frame). sessionId rides along
         (needed to bind subsequent turns when the server minted a fresh session). Always precedes any content
         frame. NOT an engine event — server-minted, no EventIdentity.
-      # 封闭:铸造点 routes/tasks.ts 是逐字写死的三键字面量(sessionId 条件在场)。
+      # 封闭:铸造点 routes/tasks.ts 是逐字写死的三键字面量(sessionId 条件在场);server >= 7.133.0 起第四个条件键 `warnings`(有才发)。
       additionalProperties: false
       required: [type, taskId]
       properties:
         type: { const: meta }
         taskId: { type: string }
         sessionId: { type: string }
+        warnings:
+          type: array
+          items: { $ref: '#/components/schemas/EntryProblem' }
+          description: 'server >= 7.133.0, present only when non-empty: the accept-time NOTICES for entries of the allow-side selector lists (root / agent `allowTools`) the engine reads as nothing or that are not in the roster. Same list as the 202 receipt''s and the sync 200 body''s `warnings`. ABSENT = no notice (older servers too).'
+
     Event_reasoning:
       type: object
       description: durable stream only — turn-aggregated thinking.
@@ -15433,10 +15496,10 @@ components:
     # 每只闭集 = 引擎今天的词 ∪ 引擎退役词表里那一集。这五张 enum 与引擎 `RETIRED_MEMBERS` 逐集逐词同(由 `server-7129-wire` 对拍);卡面 / 队列行 / 请求面的同名闭集只取今天的词。
     GateRecordAskClass:
       type: string
-      enum: [content_question, hook, ancestor, dangerous_delete, unverifiable_delete, unverifiable_shell_text, transcript_write, org_rule, rule_unreadable, ask_rule, denial_limit_fallback, classifier_no_ruling, requires_user_interaction, operator_forced, shell_floor, target_unresolved, probe, write_protection, tool_marks_mcp, tool_marks_a2a, policy_rra, artifact_shared_read, mode, unstated, ordinary, write_protection_unresolved, governance_unavailable]
+      enum: [content_question, hook, ancestor, dangerous_delete, unverifiable_delete, unverifiable_shell_text, transcript_write, org_rule, rule_unreadable, ask_rule, denial_limit_fallback, classifier_no_ruling, requires_user_interaction, cross_boundary, operator_forced, shell_floor, target_unresolved, probe, write_protection, tool_marks_mcp, tool_marks_a2a, policy_rra, artifact_shared_read, mode, unstated, ordinary, write_protection_unresolved, governance_unavailable]
       description: >-
         The class word on a GATE RECORD (`tool_end.gate.disposition.askClass` / `.classes` on the mode-refusal arm, `ModeRelease.askClass` / `.classes`) — server >= 7.129.0 reads the record as an ARCHIVE:
-        today's `AskClass` set (twenty-five words) PLUS the words the engine retired (`write_protection_unresolved`, retired in core 7.49.0 — renamed `target_unresolved`; `governance_unavailable`,
+        today's `AskClass` set (twenty-six words; `cross_boundary` from server >= 7.134.0) PLUS the words the engine retired (`write_protection_unresolved`, retired in core 7.49.0 — renamed `target_unresolved`; `governance_unavailable`,
         retired in core 7.51.0 — merged into `rule_unreadable`). A record the previous engine generation legally wrote is replayed byte for byte (a 7.50.x mode refusal can carry `governance_unavailable`);
         a word NO engine generation ever minted (a case variant, the empty string, a future word) withholds the whole `gate` and counts `server.trace.gate-outcome-defective`.
         Render a known archive word normally and an unknown one generically; never drop the record because the word is not in today's set.
@@ -15454,9 +15517,9 @@ components:
         OMITTED `reason` for the two retired words (`released` was still sent); from 7.129.0 they arrive verbatim on the replay faces. Same reading as `GateRecordAskClass`.
     GateRecordPersistedRuleMandate:
       type: string
-      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved, write_protection_unresolved]
+      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved, cross_boundary_taint, write_protection_unresolved]
       description: >-
-        `released.mandate` on a GATE RECORD (archive read, server >= 7.129.0): today's six `PersistedRuleMandate` words PLUS the retired `write_protection_unresolved` (core 7.49.0 rename). Same reading as `GateRecordAskClass`.
+        `released.mandate` on a GATE RECORD (archive read, server >= 7.129.0): today's seven `PersistedRuleMandate` words (`cross_boundary_taint` from server >= 7.134.0) PLUS the retired `write_protection_unresolved` (core 7.49.0 rename). Same reading as `GateRecordAskClass`.
     GateRecordAskOrigin:
       type: string
       enum: [content_question, plan_review, ancestor_marked, org_unavailable, org_rule, rule_store_unavailable, hook, ask_rule, denial_limit_fallback, shell_gate_tighten, safety_tighten, policy, unresolvable]
@@ -15687,9 +15750,10 @@ components:
         `UNATTENDED_PERMISSION_MODE=dontAsk`).
     AskClass:
       type: string
-      enum: [content_question, hook, ancestor, dangerous_delete, unverifiable_delete, unverifiable_shell_text, transcript_write, org_rule, rule_unreadable, ask_rule, denial_limit_fallback, classifier_no_ruling, requires_user_interaction, operator_forced, shell_floor, target_unresolved, probe, write_protection, tool_marks_mcp, tool_marks_a2a, policy_rra, artifact_shared_read, mode, unstated, ordinary]
+      enum: [content_question, hook, ancestor, dangerous_delete, unverifiable_delete, unverifiable_shell_text, transcript_write, org_rule, rule_unreadable, ask_rule, denial_limit_fallback, classifier_no_ruling, requires_user_interaction, cross_boundary, operator_forced, shell_floor, target_unresolved, probe, write_protection, tool_marks_mcp, tool_marks_a2a, policy_rra, artifact_shared_read, mode, unstated, ordinary]
       description: >
-        core `ASK_CLASSES` (TWENTY-FIVE words as of core 7.51.0 / server >= 7.129.0: `governance_unavailable` was merged into `rule_unreadable`, no alias — sdk 23.0.0; a stored card / parked row written by server <= 7.128.x is rewritten once by the server at boot. The gate record reads the ARCHIVE form, see `GateRecordAskClass`. History: twenty-two words as of core 7.40.0, twenty-three as of core 7.41.0, twenty-four as of core 7.43.0, twenty-five as of core 7.45.0, twenty-six as of core 7.49.0 — 7.34.0 minted twenty; `unverifiable_shell_text` joined in 7.49.0 #1505 and rides server >= 7.126.0, where the
+        core `ASK_CLASSES` (TWENTY-SIX words as of core 7.54.0 / server >= 7.134.0: `cross_boundary` joined after `requires_user_interaction` — the device lane's
+        cross-boundary confirmation, see below; TWENTY-FIVE as of core 7.51.0 / server >= 7.129.0: `governance_unavailable` was merged into `rule_unreadable`, no alias — sdk 23.0.0; a stored card / parked row written by server <= 7.128.x is rewritten once by the server at boot. The gate record reads the ARCHIVE form, see `GateRecordAskClass`. History: twenty-two words as of core 7.40.0, twenty-three as of core 7.41.0, twenty-four as of core 7.43.0, twenty-five as of core 7.45.0, twenty-six as of core 7.49.0 — 7.34.0 minted twenty; `unverifiable_shell_text` joined in 7.49.0 #1505 and rides server >= 7.126.0, where the
         unresolved-write-target class was also RENAMED to `target_unresolved` (#955; zero alias — the previous spelling is in the SDK README's 22.0.0 migration table); `shell_floor` joined in 7.39.0 #1260 and rides
         server >= 7.113.0; `unstated` joined in 7.40.0 and rides server >= 7.115.0; `requires_user_interaction` joined in 7.41.0 and rides
         server >= 7.116.0; `classifier_no_ruling` joined in 7.43.0 #1353 and rides server >= 7.118.0; `dangerous_delete` joined in 7.45.0 and rides
@@ -15857,6 +15921,29 @@ components:
             WHO ASKED. Same-present/same-absent as `settlement` (I1). CLOSED here (archive read, `GateRecordAskOrigin`) — see the
             note above.
 
+    McpProbeFaceRow:
+      # server 7.133.0: the face''s row = the wiring-manifest row projection + TWO face-only optional keys. The manifest row is CLOSED (so an `allOf` over it would reject the two extra keys), hence a
+      # standalone closed schema whose per-key shapes are `$ref`s into WiringManifestMcpEntry's own properties (one source per shape); the key SET is pinned by test (manifest row keys + the two).
+      type: object
+      description: >
+        One row of the no-run MCP status face (GET /v1/capabilities/mcp and POST /v1/capabilities/mcp/probe): the SAME projection a prepared leg pushes onto `wiring_manifest.mcp[]`, PLUS two optional keys only this
+        face carries (server >= 7.133.0). `toolNames` = the tool names this server will mount (the same probe reading `servers[i].tools`, engine namespace form `mcp__<server>__<tool>`, after the schema gate and the per-server
+        allow-list; the server neither composes nor renames), at most 200 per server, the reading-order prefix. ABSENT = an older server or no `tools` in that server's reading — NEVER invent `[]` (it would read as "this server
+        has no tools"); a present `[]` is real. `toolNamesTruncated` = TRUE-ONLY: the list was cut (more than 200; exactly 200 is NOT cut and the key stays absent, never `false`) — when true `toolCount` is the true count, not
+        `toolNames.length`. A misaligned reading (not an array / count differs from the row count) answers 500 `internal.error` on both doors instead of shipping a list that could be paired wrongly.
+      additionalProperties: false
+      required: [name, status]
+      properties:
+        name: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/name' }
+        status: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/status' }
+        source: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/source' }
+        toolCount: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/toolCount' }
+        errorCode: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/errorCode' }
+        delivered: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/delivered' }
+        httpStatus: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/httpStatus' }
+        liveness: { $ref: '#/components/schemas/WiringManifestMcpEntry/properties/liveness' }
+        toolNames: { type: array, items: { type: string }, maxItems: 200 }
+        toolNamesTruncated: { type: boolean, enum: [true] }
     McpProbeFace:
       type: object
       description: >
@@ -15882,8 +15969,8 @@ components:
           description: 'How long this reading may be reused (seconds; 30s per identity + declaration set server-side). A hit inside the window does NOT count against the rate limit.'
         servers:
           type: array
-          items: { $ref: '#/components/schemas/WiringManifestMcpEntry' }
-          description: 'One row per declaration, SAME ROW SHAPE as the wiring manifest, index-aligned (see this schema''s description).'
+          items: { $ref: '#/components/schemas/McpProbeFaceRow' }
+          description: 'One row per declaration, the wiring-manifest row shape plus (server >= 7.133.0) this face''s two optional keys, index-aligned (see this schema''s description).'
 
     McpLivenessState:
       type: string
@@ -16654,6 +16741,12 @@ components:
             (`capabilities.rewindFiles`); only a run the REQUEST word turned off cannot restore itself.
             OPEN on read: the server does not enumerate the word (a present non-string is dropped), a third word passes
             through — treat it as unknown. ABSENT = an older engine / external derivation, never "capturing".
+        permissionMode:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestPermissionMode' }]
+          description: >-
+            server >= 7.133.0 (core 7.53.0; TENANT and OPERATOR faces alike) — this leg's PERMISSION-MODE receipt `{ requested?, effective, foldedBy? }`; the shell renders its mode indicator from `effective`
+            (`foldedBy` present = the requested mode was folded), never from the word it sent. ABSENT = an older engine / server, not an assertion of the default mode. Effective half only (this frame);
+            the same section rides the non-streaming `wiringManifest` receipt and the ledger row. Section shape: WiringManifestPermissionMode.
         instructions:
           allOf: [{ $ref: '#/components/schemas/WiringManifestInstructions' }]
           description: >
@@ -16878,6 +16971,16 @@ components:
         pathTarget: { $ref: '#/components/schemas/McpToolPathTarget' }
         ruleFace: { $ref: '#/components/schemas/McpToolRuleFace' }
         renderHints: { $ref: '#/components/schemas/McpToolRenderHints' }
+        boundaryLegs:
+          description: >-
+            core 7.54.0 / server >= 7.134.0 (a REQUIRED engine member: every row of `wiring_manifest.tools.entries[]` and of a `tool_roster_delta` frame's
+            `delta.roster.entries[]` carries it) — the LEGS a call of this tool travels (core `BOUNDARY_LEGS`, in that order: `env` = inside the execution
+            environment / on the device, `outside_read` = a read beyond it, `outside_write` = a write beyond it), or `per_call` when its dispatch gives the legs
+            per call (the engine's own definitions and the protocol tools state them; every other row follows its `effect`). The device lane's launch gate reads
+            it. ABSENT = an older server (<= 7.133.x).
+          oneOf:
+            - { type: string, const: per_call }
+            - { type: array, items: { type: string, enum: [env, outside_read, outside_write] } }
     McpToolPathTarget:
       type: object
       required: [param, access]
@@ -17533,7 +17636,7 @@ components:
         payload carried `type` (the read boundary emits `{type, ...data}`) so runtime discrimination worked,
         but a generated client had nothing to switch on and dropped approval cards. That gap is closed.
         The shell renders `tool_approval` as the three-choice card and dismisses it on `tool_approval_complete`.
-        Respond via POST /v1/tool-approvals/{approvalId}/respond.
+        Respond via POST /v1/tool-approvals/{id}/respond.
       required: [type, approvalId]
       additionalProperties: true
       properties:
@@ -17579,44 +17682,6 @@ components:
             governance shell gate sits at the "classify" tier, a shell ask may come from the classifier or from
             another gate; the server leaves the key absent rather than guessing). Never render absence as
             "this gate can be bypassed by a posture".
-        ruleSuggestions:
-          type: array
-          minItems: 1   # 空数组不可能出现:server 的合取项②要求 `req.ruleSuggestions` **非空**,否则整键省略(缺席 = 本卡无此选项)
-          # 刻意**不**声明 maxItems:server 的 `.max(4)` 是**卡** schema(`ApprovalCardSchema`)上的约束,这条
-          # live 帧腿没有它。在这里抄一个上界 = 声明一条 server 并不执行的约束(照 spec 生成的严格客户端会
-          # 拒收一条合法帧)。数量上界的真源是引擎:core 5.22.0 的 `suggestRulesForCommand` **至多铸一条,且恒
-          # `match: "exact"`**(不写死上界是给将来的 miner 留位,不是暗示今天会有更多)。
-          items: { $ref: '#/components/schemas/RuleSuggestion' }
-          description: >
-            server #154 车二 (core 5.18.0, design/179), ADDITIVE, "tool_approval" only: the rule candidates
-            the ENGINE minted for this ask. Render them as the "don't ask again" options and echo the chosen
-            one back as `persistRule.rule` on POST /v1/tool-approvals/{id}/respond.
-
-            🔴 PRESENCE IS THE PROMISE: the key is present ONLY on a deployment that actually has a
-            permission-rule store wired (the same object behind the engine's `permissionRules.storeWired`
-            manifest bit). A deployment without one OMITS it rather than offering an option with nowhere to
-            redeem — an unredeemable "don't ask again" is a wire lie, worse than absence.
-
-            🔴 THE CONVERSE DOES NOT HOLD: absence means "THIS CARD has no redeemable candidate", and three
-            causes produce it — no rule store wired, the engine minted no candidate for this command (compound /
-            redirect / substitution), or the command bytes were unreadable. One frame cannot tell them apart, so
-            never diagnose the deployment's rule lane from a single absence, and never synthesize a candidate.
-
-            📏 HOW MANY, TODAY: core 5.22.0's miner (`suggestRulesForCommand`) emits AT MOST ONE candidate and
-            always `match: "exact"` — no shipped producer mints the broader prefix option. `prefix` stays in the
-            closed vocabulary because the wire validator accepts it and a later miner may emit it; render what
-            arrives, but do NOT build a UI that assumes a narrow/broad PAIR is on offer.
-
-            🔴 The values are the engine's VERBATIM (closed `match` vocabulary + engine-minted text); the
-            server neither re-mints nor re-orders them. A hand-built rule string is refused at redemption
-            (`ruleRefusal: "rule_not_offered"`) — by construction, so a click on a harmless command cannot be
-            turned into a rule for something else.
-
-            ⚠️ REDEMPTION SCOPE: the key also rides the durable card replay, but its only redemption channel is
-            the LIVE respond leg keyed by this frame's `approvalId` — an in-process map on ONE replica. Same
-            replica ⇒ redeemable; after a restart / on another replica that `approvalId` 404s and the person
-            must use the durable decide leg, which carries NO rule field in v1 (its body is strict — an extra
-            `persistRule` is a loud 400, not a silent drop).
         ruleOffers:
           type: array
           minItems: 1
@@ -17624,8 +17689,8 @@ components:
           description: >
             server >= 7.46.0 (core 5.58.0, design/375), "tool_approval" only — the ENGINE-minted "don't ask
             again" OPTIONS for this ask, as a DISCRIMINATED UNION (`single` | `batch`). It is the BREAKING
-            REPLACEMENT of `ruleSuggestions` above: a >= 7.46.0 engine mints the old key nowhere, there is no
-            alias, and the two keys are declared side by side only so one type surface covers both generations.
+            REPLACEMENT of the triple-shaped `ruleSuggestions` of servers <= 7.45: a >= 7.46.0 engine mints the old key nowhere and there is no
+            alias (sdk 26.0.0 deleted the old key with the support floor 7.52.0).
 
             🔴 READ `kind` TO TELL THE ARMS APART, never a positional assumption. ORDER IS CONTRACT: a
             whole-string exact `single` is index 0 when present and a `batch` is always last; core's own
@@ -17640,23 +17705,15 @@ components:
             suppress its persistence actions entirely (core's normative clause) — a compacted index means the
             k-th option the person clicked is not the k-th rule the server redeems.
 
-            🔴 PRESENCE IS THE PROMISE (same as `ruleSuggestions`): present only where a permission-rule store
+            🔴 PRESENCE IS THE PROMISE: present only where a permission-rule store
             is really wired. The converse does not hold — a wired deployment still omits it for mandated /
             requiresRealApproval / allow_outranked / ask_rule_matched / hook-produced / inherited-unresolved / ancestor-resolved /
             anonymous asks. Absence reads as "THIS CARD has no such option", never as "this deployment has no
             rule lane" (that is `capabilities.permissionRules`) and never as "your rule broke" (that is
-            `allowRuleShadowed`; `persistedRuleShadowed` on a server <= 7.116.x).
+            `allowRuleShadowed`).
 
             ⚠️ REDEMPTION SCOPE is the live respond leg keyed by this frame's `approvalId` only; a replayed
             offer on another replica is not a promise that it is still redeemable.
-        persistedRuleShadowed:
-          type: string
-          description: >-
-            server >= 7.13.0 (core 5.25.0 #144), ADDITIVE, "tool_approval" only — this ask MATCHED one of the caller's persisted allow
-            rules and that rule COULD NOT silence it; the value is the rule's VERBATIM text (secret-redacted + length-bounded; UNTRUSTED
-            for display, like `message`). Absent != "you have no rule"; deliberately separate from `governanceForced`.
-            RETIRED: server >= 7.117.0 (core 7.42.0, BREAKING rename, no alias) never mints this key on any face; its successor is
-            `allowRuleShadowed` (all five allow-layer members, not just the rule store). Kept for servers in [7.13.0, 7.117.0) only (sdk 16.3.0).
         allowRuleShadowed:
           type: array
           items: { $ref: '#/components/schemas/AllowRuleShadow' }
@@ -17929,22 +17986,23 @@ components:
 
     # ── design/172 流内审批协议(#151)—— 已随 server 7.3.0 上线;开关 STREAM_APPROVAL_ENABLED 的默认值
     #    分两段:server ≤7.4.0 默认 OFF,≥7.5.0 默认 ON(BREAKING,见 server CHANGELOG)。──
-    # 与上面的 ToolApprovalFrame 是**并行加帧,不替换**:开关打开时同一只 ask 出两帧(先 tool_approval,
-    # 后 approval_request),两帧同带 `approvalId` ⇒ 消费端按它去重、优先渲染新帧。
+    # 与上面的 ToolApprovalFrame 是两个帧族,**一条腿只走一个**(server >= 7.133.0,capabilities.approvalFrameFamilies):呈卡协议上场的腿上一只 ask 只出本族的帧、
+    # 旧族一帧都不发,消费端不再按 `approvalId` 去重;≤7.132.x 的呈卡腿两族并发(先 tool_approval、后 approval_request,同带 `approvalId`)⇒ 按它去重、优先渲染新帧。
         classifierUnavailable:
           $ref: '#/components/schemas/ClassifierUnavailable'
           description: >-
-            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE, present only when the classifier was consulted and
+            server >= 7.69.0 (core 7.10.0), ADDITIVE, present only when the classifier was consulted and
             could not run — WHY this ask reached a human. See ClassifierUnavailable for the open-`cause` rule and
             the three shapes absence covers.
-            RETIRED: server >= 7.72.0 (core 7.14.0 #688) never mints this key on any of the three faces; its
+            RETIRED: server >= 7.72.0 (core 7.14.0) never mints this key on any of the three faces; its
             successor is `disposition.cause` on the gate record (`unavailable` / `parse_error` — a different
-            question, so an old switch does not port). Kept for servers in [7.69.0, 7.72.0) only (sdk 9.2.0).
+            question, so an old switch does not port). Kept on the frame because servers 7.69–7.71 are inside the supported range and still
+            send it, and the closed inbox row declares the same key (frame and row read the same); it goes with the next major once the support floor is >= 7.106.0.
         ruleStoreUnreadable:
           type: string
           enum: [store, call]
           description: >-
-            server >= 7.72.0 (core 7.14.0 #688 C3), ADDITIVE — WHICH HALF of the rule lane could not be read.
+            server >= 7.72.0 (core 7.14.0), ADDITIVE — WHICH HALF of the rule lane could not be read.
             Present iff `origin === "rule_store_unavailable"`: `store` = the wired rule store could not be read
             (look at the store / network); `call` = the store was read but THIS command could not be read against
             the person's deny/ask rows (look at the command spelling). One `origin` word covers both facts, and
@@ -17952,10 +18010,11 @@ components:
             frame and the inbox row; the `card_json` card deliberately does NOT carry it (it travels with `origin`,
             which is not on the card). Absence = `origin` is not that word — NOT an assertion that the rule store
             is healthy.
-            RETIRED: server >= 7.106.0 (core 7.34.0 C-R172, BREAKING — wire) never mints this key on either face — an
-            unreadable rule store no longer raises a card: that read's rows are SKIPPED by partition and the session
-            stream gets the user-facing `engine_notice` `permission.rule_store_unavailable` (`detail.at` = `prepare` /
-            `call`). Kept for servers in [7.72.0, 7.106.0) only (sdk K-32); `origin: rule_store_unavailable` itself stays.
+            RETIRED: server >= 7.106.0 (core 7.34.0, BREAKING — wire) never mints this key on either face — an
+            unreadable rule store no longer raises a card; the signal moved to the session stream's user-facing
+            `engine_notice` `permission.rule_store_unavailable` (`detail.at` = `prepare` / `call`; what the run does while the rules cannot be read is
+            that notice's own text). Kept on the frame because servers 7.72–7.105 are inside the supported range and still send it, and the closed inbox row
+            declares the same key; it goes with the next major once the support floor is >= 7.106.0 (`origin: rule_store_unavailable` itself stays).
         readRootCandidate:
           type: object
           required: [dir, clearsThisAsk]
@@ -17972,6 +18031,14 @@ components:
                 (a malformed shape, or a `dir` over 1024 UTF-16 code units ⇒ the key is ABSENT — never truncated,
                 because a truncated directory is a DIFFERENT directory and adding it would not clear this ask;
                 see the STRING-LENGTH UNIT convention in `info.description` for this `maxLength`'s counting unit).
+            covers:
+              allOf: [{ $ref: '#/components/schemas/ReadRootCover' }]
+              description: >-
+                Optional (engine core 7.22.0 `ReadRootGrantCandidate.covers`; the server carries it through key by key). ABSENT ⇒ `dir` is a DIRECTORY
+                (adding it to the read roots releases what lies under it). `exact` ⇒ `dir` is the path the command NAMED, offered verbatim
+                (a file or one concrete path, not a directory containing it): the consumer ADDS the string itself — expanding it into a
+                pattern grants nothing — and must not render the offer as "add directory". The domain is the single word `exact`
+                (a word outside it makes the server drop the whole candidate). The `approval_request` frame reads this very definition.
             clearsThisAsk:
               type: boolean
               enum: [true]
@@ -18052,8 +18119,23 @@ components:
         approvalId:
           type: string
           description: >
-            Bridge to the legacy frame / dedupe key — same value as the parallel tool_approval frame. During the
-            transition window POST /v1/tool-approvals/{approvalId}/respond still works.
+            The id of POST /v1/tool-approvals/{id}/respond and GET /v1/tool-approvals/{id}. server >= 7.133.0: ALWAYS EQUAL TO `askId` (the row's key is the ask's one wire
+            identity; a 64-character lowercase hexadecimal string — treat it as an OPAQUE string, never parse it as a uuid); the matching close frame `approval_complete` carries it too.
+            On server <= 7.132.x it is the legacy bridge / dedupe key (a uuid, the same value as the parallel tool_approval frame).
+        # ── server >= 7.133.0: the TEN off-card LIVE facts on the opening frame's top level (one frame family per leg) ──────────────────────────
+        #   Same keys, same shapes, same values as on the legacy `tool_approval` frame (each is a `$ref` into ToolApprovalFrame's own property — one
+        #   source per shape). Only the frame minted LIVE carries them (and what the durable ledger recorded of that frame): a disconnect-replay frame
+        #   (rebuilt from `card_json`) never does. Absence means "this frame does not carry it", not "there is none". See APPROVAL_REQUEST_LIVE_FACT_KEYS (sdk) / the server's twin.
+        mandated: { $ref: '#/components/schemas/ToolApprovalFrame/properties/mandated' }
+        mandate: { $ref: '#/components/schemas/ToolApprovalFrame/properties/mandate' }
+        origin: { $ref: '#/components/schemas/ToolApprovalFrame/properties/origin' }
+        boundGrantDigest: { $ref: '#/components/schemas/ToolApprovalFrame/properties/boundGrantDigest' }
+        boundGrants: { $ref: '#/components/schemas/ToolApprovalFrame/properties/boundGrants' }
+        classifierNoRuling: { $ref: '#/components/schemas/ToolApprovalFrame/properties/classifierNoRuling' }
+        boundGrantAbsence: { $ref: '#/components/schemas/ToolApprovalFrame/properties/boundGrantAbsence' }
+        approvalCard: { $ref: '#/components/schemas/ToolApprovalFrame/properties/approvalCard' }
+        readRootCandidate: { $ref: '#/components/schemas/ToolApprovalFrame/properties/readRootCandidate' }
+        probeReason: { $ref: '#/components/schemas/ToolApprovalFrame/properties/probeReason' }
 
     ApprovalCard:
       type: object
@@ -18086,33 +18168,15 @@ components:
             posture. Semantics, the ABSENT != false clause and the discrimination boundary are stated verbatim on
             ToolApprovalFrame.governanceForced. It sits at the card's top level rather than inside `risk` because
             `risk` describes the ENGINE's judgement of the call, while this key says WHO imposed the gate.
-        ruleSuggestions:
-          type: array
-          minItems: 1   # 同帧腿:空数组不可能出现(素材同源),缺席才是「本卡无此选项」
-          maxItems: 4   # 卡形上**真有**这条上界(server `ApprovalCardSchema` 的 `.max(4)`);live 帧腿没有,故只写在这里
-          items: { $ref: '#/components/schemas/RuleSuggestion' }
-          description: >
-            ADDITIVE (#154 车二 / core 5.18.0 design/179): the rule candidates the ENGINE minted for this ask —
-            the card's "don't ask again" options; echo the chosen one back as `persistRule.rule`. Semantics,
-            the PRESENCE-IS-THE-PROMISE clause (present only where a rule store is wired) and the redemption
-            scope are stated verbatim on ToolApprovalFrame.ruleSuggestions — the live frame, the stored
-            `card_json` and the replayed frame carry the SAME material.
         ruleOffers:
           type: array
           minItems: 1
           items: { $ref: '#/components/schemas/RuleOffer' }
           description: >
-            server >= 7.46.0 (core 5.58.0, design/375) — the discriminated-union replacement of
-            `ruleSuggestions` above. Same material as the live frame and the stored `card_json` (the server
+            server >= 7.46.0 (core 5.58.0, design/375) — the discriminated-union replacement of the retired
+            `ruleSuggestions` (servers <= 7.45; sdk 26.0.0 deleted it). Same material as the live frame and the stored `card_json` (the server
             projects all three through one `copyRuleOffer`), so semantics, order-is-contract, presence-is-the-
             promise and the per-leg index rules are stated verbatim on ToolApprovalFrame.ruleOffers.
-        persistedRuleShadowed:
-          type: string
-          description: >-
-            server >= 7.13.0 (core 5.25.0 #144), ADDITIVE — the persisted rule this ask matched but which could not silence it; frame and
-            card carry the SAME material (see ToolApprovalFrame.persistedRuleShadowed).
-            RETIRED: server >= 7.117.0 (core 7.42.0) never mints this key on any face (its strict card schema even refuses a stored card
-            carrying it); its successor is `allowRuleShadowed`. Kept for servers in [7.13.0, 7.117.0) only (sdk 16.3.0).
         allowRuleShadowed:
           type: array
           items: { $ref: '#/components/schemas/AllowRuleShadow' }
@@ -18147,35 +18211,13 @@ components:
         classifierUnavailable:
           $ref: '#/components/schemas/ClassifierUnavailable'
           description: >-
-            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE — WHY this ask reached a human. Frame and card carry
-            the SAME value (one narrow-read function server-side). See ClassifierUnavailable for the open-`cause`
-            rule and the three shapes absence covers.
-            RETIRED: server >= 7.72.0 (core 7.14.0 #688) never mints this key on any of the three faces; its
+            (minted by servers [7.69.0, 7.72.0), core 7.10.0 #616) WHY this ask reached a human. See ClassifierUnavailable for the open-`cause` rule and the three
+            shapes absence covers.
+            RETIRED: server >= 7.72.0 (core 7.14.0) never mints this key on any of the three faces; its
             successor is `disposition.cause` on the gate record (`unavailable` / `parse_error` — a different
-            question, so an old switch does not port). Kept for servers in [7.69.0, 7.72.0) only (sdk 9.2.0).
-
-    RuleSuggestion:
-      type: object
-      description: >
-        One ENGINE-minted rule candidate (#154 车二 / core 5.18.0 `RuleSuggestion`) — what a single click on
-        "don't ask again" would persist.
-
-        🔴 THE TEXT COMES FROM THE ENGINE, NOT THE SHELL: the server derives it from the adjudicated command's
-        own bytes; a client may only echo one of these back verbatim (`persistRule.rule`). Reporting text that
-        is not among the candidates is refused (`ruleRefusal: "rule_not_offered"`) rather than guessed at, so
-        "click on a harmless command, get a rule for something else" is not spellable on this path.
-      # 封闭:core `RuleSuggestion` 恰三键(rule/match/command),server 逐字透传不重铸。
-      additionalProperties: false
-      required: [rule, match, command]
-      properties:
-        rule: { type: string, maxLength: 512, description: 'The canonical rule text to echo back on redemption (server MAX_RULE_TEXT_CHARS = 512).' }
-        match:
-          type: string
-          enum: [exact, prefix]
-          description: '`exact` = this one command only (`Bash(git status)`); `prefix` = word-boundary prefix (`Bash(git status:*)`). Closed vocabulary — an unknown value is not a candidate this contract describes; do not render it as redeemable.'
-        command: { type: string, maxLength: 512, description: 'The command pattern inside the rule, for a shell that would rather not re-parse `rule`.' }
+            question, so an old switch does not port). It stays declared on the CARD because the pinned server's card schema (`ApprovalCardSchema`, server 7.134.0) still accepts it: a still-pending `card_json` row a
+            7.69–7.71 server wrote replays verbatim onto `approval_request.card` / the replay frame. (The FRAME's same-named key stays declared too; why, and until when: `ToolApprovalFrame.classifierUnavailable`.)
 
-    # ─── S-139(sdk 8.3.0):对 server 7.60.0 整体重对账带进来的四张型面 ───────────────────────
     ClassifierUnavailable:
       # 8.9.0:三面(tool_approval 帧 / ApprovalCard / InboxRow)同形同值 ⇒ 具名单源,内联三份会各自漂。
       type: object
@@ -18290,7 +18332,7 @@ components:
         `ApprovalCard.ruleOffersAbsence`; server >= 7.55.0 / core #490 fix ②, S-15). The engine names which
         door is shut: `mandated` = this ask must be confirmed every time (🔴 this arm must NOT point the user
         at writing a rule — a rule would not silence it, and saying so sends them into a loop); `allow_outranked` = an
-        allow-layer member matched this call but the ask sits at a higher tier, so another allow rule cannot clear it (the machine-readable twin of `allowRuleShadowed`; `persistedRuleShadowed` on a server <= 7.116.x);
+        allow-layer member matched this call but the ask sits at a higher tier, so another allow rule cannot clear it (the machine-readable twin of `allowRuleShadowed`);
         `ask_rule_matched` = an explicit `ask` rule matched this call (same frame `origin: ask_rule`): it keeps asking, an allow rule would not silence it either; a card from the deployment name-list gate
         `APPROVAL_REQUIRE` / the supervisor route that reports an explicit ask-rule hit lands here too; `lane_cannot_speak` = a rule COULD clear this ask but the lane cannot speak this time (the engine could mint no coverable form for this command).
         🔴 sdk 23.0.0 BREAKING (server >= 7.129.0 / engine 7.51.0, `RULE_OFFERS_ABSENCES`): the former `shadowed` meant two things and is split into the middle two words, no alias; a card / parked row that a server <= 7.128.x
@@ -18316,12 +18358,21 @@ components:
         and a word outside the set all read as ABSENT — a card without this word must not be treated as "approving it grants nothing else"; whether to render "allow for this session" is `rememberRefused`.
         Display metadata, never an adjudication input. CLOSED: the server narrows with the engine's members, anything else reads as absent.
 
+    ReadRootCover:
+      type: string
+      enum: [exact]
+      description: >
+        The closed vocabulary of `readRootCandidate.covers` (engine core 7.22.0 `ReadRootGrantCandidate.covers`; the server's narrow read `readReadRootCandidate` drops the whole
+        candidate for a word outside it). One word today: `exact` — `dir` is the path the command NAMED, not a directory containing it. The SDK exports the same table as
+        `READ_ROOT_COVERS` and its `isApprovalRequestFrameV1` judges `covers` by membership in it; a source-level anchor reads the word off the server's minting site and the engine's type.
     PersistedRuleMandate:
       type: string
-      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved]
+      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved, cross_boundary_taint]
       description: >
         WHICH WORD a mandated ask stands on (server >= 7.102.0 / S-721 / core 7.32.0 #1092) — core's
-        `PERSISTED_RULE_MANDATES` six words, transcribed verbatim and in order (core 7.32.1
+        `PERSISTED_RULE_MANDATES` (seven words since core 7.54.0 / server >= 7.134.0: `cross_boundary_taint` — the run executes on a device outside the deployment's
+        trust boundary and the deployment is multi-tenant, so an org-side write, or after an off-target read a call bound for the device, is confirmed by the deployment's
+        approver per call; no standing allow rule and no automatic lane answers it; core puts it at the HEAD of the mandate ladder, the array keeps core's constant order), transcribed verbatim and in order (core 7.32.1
         `dist/core/ask-origin.d.ts:349`; the vocabulary's owner is core; the sixth word is `target_unresolved` from core 7.49.0 #955 / server >= 7.126.0 —
         server 7.122.0–7.125.x sent the previous spelling, which reads as out of set here, see the SDK README's 22.0.0 migration table). Rides FOUR faces with one value: the
         `tool_approval` frame, the `livePending` row top level, the operator queue row (`GET /v1/approvals`
@@ -18375,9 +18426,9 @@ components:
     RuleOfferMatch:
       type: string
       description: >
-        The MATCH FORM of a persisted rule — the server's `PERSISTED_RULE_MATCHES`, verbatim and in order (the vocabulary
-        is OWNED BY CORE; the server only transcribes it and pins set equality, so core adding a member turns
-        the server red at compile time). ONE vocabulary for two faces: a card's rule offer (`RuleOffer.match`, the
+        The MATCH FORM of a persisted rule — core's `PERSISTED_RULE_MATCHES`, verbatim and in order (the vocabulary is OWNED BY CORE: a package-root
+        value since core 7.54.0, which server >= 7.134.0 reads directly instead of keeping its own transcription; earlier servers transcribed it and pinned set
+        equality). ONE vocabulary for two faces: a card's rule offer (`RuleOffer.match`, the
         server's card schema validates it with this very enum) and a persisted rule row (`GET /v1/rules`).
 
         `exact` = this one command only (`Bash(git status)`). `prefix` = the historical colon-star
@@ -18580,8 +18631,7 @@ components:
               maxLength: 512
               description: >
                 With `edited` absent or false this is the CANDIDATE ARM: echo back, VERBATIM, the `rule` of the
-                chosen `kind: "single"` entry of the frame's `ruleOffers` (or, against a <= 7.45 server, of
-                `ruleSuggestions`). Do not hand-build it, re-case it or append `:*` — the server locates it by
+                chosen `kind: "single"` entry of the frame's `ruleOffers`. Do not hand-build it, re-case it or append `:*` — the server locates it by
                 text and refuses otherwise (`rule_not_offered`). With `edited: true` this is the FREE-TEXT ARM
                 and the string is whatever the person typed.
             edited:
@@ -18729,6 +18779,40 @@ components:
         depth: { type: integer, description: 'Delegation depth (a direct child of the host = 1).' }
         agentName: { type: string, description: 'Child agent name. UNTRUSTED — spawning-model free text (server-redacted and length-bounded).' }
 
+    ApprovalCompleteFrame:
+      type: object
+      description: >
+        The CLOSE frame of the card family (`approval_complete`; server >= 7.133.0; SSE, `type` IS the event name; the durable leg appends the same frame, so it replays through
+        GET /v1/runs/:id/events as the `Event_approval_complete` arm). ONE FRAME FAMILY PER LEG: on a leg where the card protocol is on (`capabilities.approvalFrameFamilies`
+        = `["approval_request"]`) one ask travels only `approval_request` -> `approval_complete` / `approval_revoke`; the legacy `tool_approval` / `tool_approval_complete` pair is NOT sent
+        (BREAKING vs <= 7.132.x, which sent both families for one ask; remedy on the worker: `STREAM_APPROVAL_ENABLED=false`).
+        Same meaning as the legacy `tool_approval_complete` (one settle, one verdict: the `outcome` three words, the non-human `cause`, the park-route `parked`); dismiss the card by the opening frame's
+        `askId`. Division of labour with ApprovalRevokeFrame: the revoke frame is BATCH-level (siblings voided by a winner), this one is the SINGLE card's end (answered / window expired / park route / cancelled);
+        one ask can receive both — clearing by `askId` is enough. The gate is "this connection's opening frame was actually delivered". The frame is a notification, the row is the source of truth: a lost
+        frame is compensated by the open-stream preamble (see ApprovalRequestFrame). THIS SCHEMA DESCRIBES v1 ONLY (read it as ApprovalFrameEnvelope first; the SDK's `isApprovalCompleteFrameV1` narrows).
+      required: [type, schemaVersion, askId, taskId, approvalId, outcome, serverNowMs]
+      additionalProperties: true
+      properties:
+        type: { type: string, enum: [approval_complete] }
+        schemaVersion: { type: integer, enum: [1], description: 'This schema describes v1 only (see ApprovalFrameEnvelope for the unknown-version read).' }
+        askId: { type: string, description: 'The durable identity — dismiss the card by it (the same key as the opening frame''s `askId`).' }
+        taskId: { type: string, description: 'wire run id (same as the opening frame).' }
+        approvalId: { type: string, description: 'Always equal to `askId` (same as the opening frame).' }
+        outcome:
+          type: string
+          enum: [allowed, denied, expired]
+          description: 'How the ask settled — the same three words as the legacy frame: `allowed` / `denied` = a decision; `expired` = a non-human ending (the reason is in `cause`).'
+        cause:
+          allOf: [{ $ref: '#/components/schemas/ApprovalSettleCause' }]
+          description: >-
+            The non-human ending''s cause (present only on `outcome: "expired"`; the fourteen words of the approval seat''s ending-cause set, the same word as on the audit settle row). A human answer carries none.
+            ABSENCE IS NOT EVIDENCE.
+        parked:
+          type: boolean
+          enum: [true]
+          description: 'TRUE-ONLY: this ask itself ended on the park route (row moved to PARKING / PARKED; a late answer is reachable). Absent = no evidence — NEVER read as a real denial.'
+        serverNowMs: { type: integer, description: 'Server clock at mint time.' }
+
     ApprovalRevokeFrame:
       type: object
       description: >
@@ -19028,7 +19112,7 @@ components:
       description: >
         server >= 7.126.0 (sdk 21.1.0 `APPROVAL_DECIDE_GATE_KINDS`, verbatim and in order; single owner = server
         `APPROVAL_GATE_KINDS`) — the parked gate kinds the DURABLE decision door `POST /v1/approvals/{sessionId}/decide`
-        accepts (the live `POST /v1/tool-approvals/{approvalId}/respond` answers the same card family). A parked row of
+        accepts (the live `POST /v1/tool-approvals/{id}/respond` answers the same card family). A parked row of
         kind `plan_review` goes to the plan-review door instead (`PlanReviewGateKind`); `resource_limit` / `needs_review` /
         `task_done` have no human decision door (resume / terminal). Clients route a pending row by reading this set,
         never by a hand-written copy of it.
@@ -19043,7 +19127,7 @@ components:
       enum: [person, policy]
       description: >
         server >= 7.118.0 (`APPROVAL_DECIDED_BY`, verbatim and in order) — WHO made an approval decision, one key on all three decision
-        doors (live `POST /v1/tool-approvals/{approvalId}/respond`, durable `POST /v1/tasks/{taskId}/asks/{askId}/decision`, durable
+        doors (live `POST /v1/tool-approvals/{id}/respond`, durable `POST /v1/tasks/{taskId}/asks/{askId}/decision`, durable
         `POST /v1/approvals/{sessionId}/decide`). `person` = a person decided through the approval channel (ABSENT means this);
         `policy` = this deployment's own policy decided (a rule / posture answering on someone's behalf, a headless lane) — BOTH
         directions: the engine records `tool_end.gate.settlement.kind` = `policy_allowed` / `policy_refused` (`who.party: "policy"`).
@@ -19135,6 +19219,20 @@ components:
             `updatedInputForwarded` this field IS persisted, so an idempotent replay DOES promise byte-identity.
             The 409 `conflict.ask_decided` body echoes the same field — and there it is always the FIRST
             decision's note, not the one the rejected request carried.
+        noteRecorded:
+          type: boolean
+          description: >
+            server >= 7.133.0, ADDITIVE: did the `note` THIS request carried land as the row's text? Present ONLY when the request carried a `note`. `true` <=> the row's `decisionNote` is
+            verbatim the text this request submitted (text that happens to be identical counts even if someone else wrote it first); `false` = not confirmed (the row holds another reason /
+            the store could not be read back). Same shape and meaning as `noteRecorded` on the live respond ack and on its replayed arm (one judgement for the three doors). Carried by the
+            first-decision and idempotent-replay forms; the PARKED redemption leg does not carry it (read it as unknown). ABSENT is not `false`.
+        consumerState:
+          type: string
+          enum: [absent]
+          description: >
+            TRUE-ONLY disclosure (present as `absent`): no engine leg on THIS replica is waiting for this ask — the decision is on the row (an idempotent replay will read it, the audit surface keeps it)
+            but nothing running here resumes because of it (the holder of the suspended promise may be another replica, or this replica restarted and its local window is empty). Read the RUN surface to
+            learn whether anything continued; NEVER take a 200 without this key as proof the run continued (older servers never send it). Not a 409 / 410: the decision DID take effect.
 
     QuestionFrame:
       type: object
@@ -19471,6 +19569,38 @@ components:
         fields: {}
         overrideReasons: {}
         ts: {}
+    CrossBoundaryTaintRow:
+      type: object
+      description: >
+        server >= 7.134.0 / core 7.54.0 — the device lane's CROSS-BOUNDARY TAINT row: the engine's `permission.cross_boundary_taint` frame minus its envelope
+        (`kind` / `version` / `taskId` / `ts`). Metadata only. Emitted ONLY on a tree that executes on a target device (one row when an armed tree prepares a
+        leg — `prepare`, one on a durable resume leg — `resume`, one when this leg first lets an off-target read into the tree — `observed`, with that call);
+        the host lane never emits it. Two exits, one row: the ledger event `cross_boundary_taint` on `GET /v1/runs/{taskId}/events` (`Event_cross_boundary_taint`)
+        and the trace SSE `cross-boundary-taint` frame on `GET /v1/tasks/{taskId}/stream` (the row + `seq`). The `GET /v1/runs/{taskId}` poll object carries NO
+        such key.
+      # 不封闭(`additionalProperties: true`):本 schema 是 `Event_cross_boundary_taint` 的 allOf 目标(帧上多一个 `type`),封闭会把合法帧判成违约(同 PromptManifestRow)。
+      additionalProperties: true
+      required: [runId, phase, taint, governed]
+      properties:
+        runId: { type: string, description: 'the leg''s run id.' }
+        phase: { type: string, enum: [prepare, resume, observed], description: 'core `permission.cross_boundary_taint` `phase` (engine closed set).' }
+        taint:
+          type: array
+          description: 'The tree''s taint bits after the event — core `CROSS_BOUNDARY_TAINT_BITS` (`targetExecutionArmed` = the tree is armed to execute on the target; `offTargetReadObserved` = off-target read content was let into the tree).'
+          items: { type: string, enum: [targetExecutionArmed, offTargetReadObserved] }
+        governed: { type: boolean, description: 'the tree has run under the `multi_tenant` posture since it armed (derived from `REQUIRE_PRINCIPAL`).' }
+        toolName: { type: string, description: '`observed` only: the call that let the off-target read in.' }
+        toolCallId: { type: string, description: '`observed` only: that call''s id.' }
+    Event_cross_boundary_taint:
+      description: >
+        DURABLE only (server >= 7.134.0 / core 7.54.0) — the ledger event of a `CrossBoundaryTaintRow` on `GET /v1/runs/{taskId}/events` (SSE `id:` = the row's
+        seq). Never on the live stream, never on the `GET /v1/runs/{taskId}` poll object; an older server drops the frame on the spot.
+      allOf:
+        - $ref: '#/components/schemas/CrossBoundaryTaintRow'
+        - type: object
+          required: [type]
+          properties:
+            type: { const: cross_boundary_taint }
     Event_needs_review:
       type: object
       description: >
@@ -19669,7 +19799,7 @@ components:
     Event_tool_approval:
       description: >
         DURABLE-leg replay of the legacy tool-approval OPEN frame. Same payload as ToolApprovalFrame with the
-        discriminant narrowed to `tool_approval`. Settle it via POST /v1/tool-approvals/{approvalId}/respond.
+        discriminant narrowed to `tool_approval`. Settle it via POST /v1/tool-approvals/{id}/respond.
         Anchor the card on `toolCallId` (NOT `approvalId`); render `governanceForced` as a non-bypassable
         "forced by governance" badge. UNTRUSTED for display: `message`/`args` are redacted but model-authored.
       allOf:
@@ -19692,9 +19822,11 @@ components:
             type: { type: string, enum: [tool_approval_complete] }
     Event_approval_request:
       description: >
-        The design/172 in-stream approval card as an AgentEvent arm. PARALLEL to `tool_approval`, not a
-        replacement: with the protocol on, one ask emits BOTH frames (legacy first) carrying the SAME
-        `approvalId` — dedupe on it and prefer this arm. The decision key is `askId`; settle via
+        The design/172 in-stream approval card as an AgentEvent arm. ONE FRAME FAMILY PER LEG (server >= 7.133.0,
+        `capabilities.approvalFrameFamilies`): on a leg where the card protocol is on, one ask emits only this family
+        (`approval_request` -> `approval_complete` / `approval_revoke`) and none of the legacy `tool_approval` family,
+        so there is nothing to deduplicate. On server <= 7.132.x the two families ran side by side (legacy first) carrying
+        the SAME `approvalId` — there, dedupe on it and prefer this arm. The decision key is `askId`; settle via
         POST /v1/tasks/{taskId}/asks/{askId}/decision.
 
         🔴 THIS ARM IS THE OPEN ENVELOPE, NOT `ApprovalRequestFrame`, AND THAT IS DELIBERATE. The v1 frame
@@ -19741,6 +19873,37 @@ components:
           properties:
             type: { type: string, enum: [approval_revoke] }
 
+    Event_approval_complete:
+      description: >
+        The card family's single-card CLOSE frame as an AgentEvent arm (server >= 7.133.0). One frame family per leg: with `capabilities.approvalFrameFamilies` = `["approval_request"]` this frame
+        REPLACES the legacy `tool_approval_complete` (one ask no longer travels two families). Live SSE and the durable ledger replay carry the same shape (same settle, same verdict: `outcome`,
+        non-human `cause`, `parked`).
+        🔴 THIS ARM IS THE OPEN ENVELOPE, NOT `ApprovalCompleteFrame` — same ruling as Event_approval_request / Event_approval_revoke: narrow with `schemaVersion == 1` (SDK:
+        `isApprovalCompleteFrameV1`) before touching `outcome` / `cause` / `parked`; a frame that does not narrow still dismisses the card by its `askId` (when it has one) — never guess the outcome.
+        🔴 Consumption discipline: (a) dismiss by the opening frame's `askId`; (b) a ledger-replayed frame is for TIMELINE RENDERING ONLY — the card-set baseline stays the open-stream preamble;
+        (c) NEVER derive the run's fate from this frame (read the run row / checkpoint face); (d) it does not conflict with ApprovalRevokeFrame — one ask can receive both.
+      allOf:
+        - $ref: '#/components/schemas/ApprovalFrameEnvelope'
+        - type: object
+          required: [type]
+          properties:
+            type: { type: string, enum: [approval_complete] }
+    Event_session_titled:
+      description: >
+        server >= 7.133.0 — the session title was WRITTEN (contract §4a-ttl): the title generator wrote the title into the session row and minted this frame on THE RUN'S LIVE STREAM afterwards.
+        🔴 LIVE-ONLY, NEVER STORED: the session row (`GET /v1/sessions` list row `title`) is the single source of the title; this frame only says "the row just changed". It is not ledgered
+        (GET /v1/runs/:id/events replay never carries it), not part of any replay surface, and has NO `eventId` (no SSE `id:` line, no part in the `Last-Event-ID` cursor). Only a leg holding a live stream
+        receives it (today `POST /v1/tasks/stream`); the sync-JSON leg and the durable background leg structurally cannot. NOT sent when the session already has a title, on a user rename / pin
+        (`PATCH /v1/sessions/{id}` does not go through the generator), with `SESSION_AUTO_TITLE=false`, after `done`, or once the connection is gone. THE FRAME MAY NOT ARRIVE — the title is whatever
+        the session row says: refresh on the frame, read the row on cold start / another window / reconnect. `title` has passed the generator's redaction and cleaning and is the SAME value as the row's
+        (still UNTRUSTED for display — model-authored text).
+      type: object
+      required: [type, sessionId, title]
+      additionalProperties: false
+      properties:
+        type: { type: string, enum: [session_titled] }
+        sessionId: { type: string, description: 'The session whose row was just written.' }
+        title: { type: string, description: 'The title that landed in the session row (redacted and cleaned; bounded by the server''s TITLE_MAX_CHARS).' }
     # ── resources/*.ts schema backfill, batch 2 (2026-07-28) — the 28-item WIRE_PENDING ratchet zeroed.
     #    Each schema below is cross-checked against the server source (file:line cited in its description
     #    or in the SDK resource JSDoc it mirrors). Wire objects are OPEN sets (additionalProperties: true).
@@ -19765,6 +19928,10 @@ components:
         sessionId: { type: string, description: '`resolved` frames: which pending settled.' }
         toolCallId: { type: string, description: '`resolved` frames: the settled pending''s bound tool-call id (absent when the pending carried none).' }
         count: { type: integer, description: '`synced` frames: how many pendings the connect-time snapshot carried.' }
+        checkpointId: { type: string, description: '`pending` frames only (server >= 7.133.0): the spread PendingCheckpoint row''s `checkpointId` (key absent when the row has no trusted value — read as "no joinable identity").' }
+        consumerState: { type: string, enum: [absent], description: '`live_pending` frames only (server >= 7.133.0): the spread LivePendingRow''s true-only `consumerState` (no engine leg on this replica is waiting for the ask).' }
+        errorCode: { type: string, description: '`error` frames: the machine code (`STREAM_MAX_DURATION` / `draining` / server >= 7.133.0 `approvals.read_unavailable` — the stream STAYS open, do NOT reconnect on it — / `approvals.read_corrupt` — a corrupt row was read, the server closes the stream after the frame).' }
+        message: { type: string, description: '`error` frames: the human sentence (redacted); never match on it.' }
         hasBidiControls:
           type: boolean
           enum: [true]
@@ -19885,20 +20052,24 @@ components:
 
     FleetHookNotice:
       description: >
-        Hook observability payload, TWO kinds (service fleet-bus.ts `HookNotice` minus the wire-stripped
+        Hook observability payload, FOUR kinds (server >= 7.133.0 added `hook_managed_unrun` and `hook_verdict_untrusted`; service fleet-bus.ts `HookNotice` minus the wire-stripped
         ownerScope/ownerSessionId — the payload view of FleetFrame_hook_notice; a discriminated union on
         `kind`, mirroring the SDK type verbatim). Both kinds are pure observe — never block, resume, or
         inject. Visibility is fail-CLOSED: a ?session= subscriber only receives notices provably owned by
-        that session. `kind` is a CLOSED two-member set on the server (exhaustive-switch discipline) but
+        that session. `kind` is a CLOSED four-member set on the server (exhaustive-switch discipline) but
         OPEN ON READ: degrade an unknown future kind to a generic observability row, never crash.
       oneOf:
         - $ref: '#/components/schemas/FleetHookDecisionUnavailable'
         - $ref: '#/components/schemas/FleetHookNonBlockingFailure'
+        - $ref: '#/components/schemas/FleetHookManagedUnrun'
+        - $ref: '#/components/schemas/FleetHookVerdictUntrusted'
       discriminator:
         propertyName: kind
         mapping:
           hook_decision_unavailable: '#/components/schemas/FleetHookDecisionUnavailable'
           hook_non_blocking_failure: '#/components/schemas/FleetHookNonBlockingFailure'
+          hook_managed_unrun: '#/components/schemas/FleetHookManagedUnrun'
+          hook_verdict_untrusted: '#/components/schemas/FleetHookVerdictUntrusted'
 
     FleetHookDecisionUnavailable:
       type: object
@@ -19933,7 +20104,7 @@ components:
         reason:
           # 🔴 NO `enum` — same open-on-read ruling as kind 1 (SDK type is `... | (string & {})`).
           type: string
-          description: 'Machine-branchable failure shape. CLOSED server-side, OPEN ON READ — KNOWN WORDS TODAY: exit_nonzero | timeout | spawn_failed | bad_json.'
+          description: 'Machine-branchable failure shape. CLOSED server-side, OPEN ON READ — KNOWN WORDS TODAY: exit_nonzero | timeout | spawn_failed | bad_json | matcher_over_budget (server >= 7.133.0: the group matcher / the entry `if` name part did not finish evaluating within its 1000 ms budget on this name — NOT a broken hook script but an unevaluable selection condition; the server treats it as selected, the entry still runs; ONE frame per group, `if` one per entry, no exitCode / stderr).'
         hookName: { type: string, description: 'Hook identity (statusMessage, else command/URL/prompt; redacted + bounded, http entries stripped of query/fragment). Always sent.' }
         entryType: { type: string, description: 'command | http | prompt | agent — without it, hookName''s nature is a guess. Closed server-side, open on read. Always sent.' }
         exitCode: { type: integer, description: 'Absent for timeout/spawn_failed (no exit code exists — the server never mints a legit-looking 0).' }
@@ -19941,6 +20112,57 @@ components:
         stderr: { type: string, description: 'Redacted + truncated stderr digest (512-char cap incl. marker). Empty stderr => absent.' }
         detail: { type: string, description: 'Redacted supplement (e.g. where an exit-2 had no venue). Additive / tolerate-absent.' }
 
+    FleetHookManagedUnrun:
+      type: object
+      description: >
+        Kind 3 (server >= 7.133.0): a MANAGED hook did not complete — the group carries a `source`; managed groups (`managedPolicy` / `managedPlugin:<name>`) are the organization policy's guard and run in an independent lane
+        after the unmanaged rewrites, on the final input. A synchronous managed entry that gave neither a legal verdict (exit 0 with no verdict / a closed-set verdict) nor a legal veto (exit 2 / `decision:"block"` /
+        `continue:false`) is "unrun": on `PreToolUse` the conclusion folds to `ask` when nothing vetoed (a person in the loop; unmanaged allows are not trusted; any phase's veto is still the last vote), on other events the
+        conclusion is unchanged — but this frame is ALWAYS sent. One frame per unrun managed entry. The frame does NOT assert how the call ended (read the tool / approval frames).
+      required: [kind, event, reason, source, hookName, entryType]
+      additionalProperties: true
+      properties:
+        kind: { type: string, enum: [hook_managed_unrun] }
+        event: { type: string, description: 'Which hook event. On PreToolUse this entry sets the managed lane: with no veto the call folds to `ask`.' }
+        reason:
+          # NO `enum` — same open-on-read ruling as kinds 1 and 2.
+          type: string
+          description: >-
+            Why it did not complete. CLOSED on the server (thirteen words), OPEN ON READ — KNOWN WORDS TODAY: matcher_invalid | llm_carrier_unavailable | llm_cap | powershell_unsupported | if_unevaluable | budget_exhausted |
+            spawn_failed | timeout | exit_nonzero | bad_json | decision_out_of_set | evidence_unavailable | rewrite_unsettled. `input_truncated` / `matcher_over_budget` are NOT in this kind (they belong to kind 4).
+        source: { type: string, description: 'The group''s source word (`managedPolicy` or `managedPlugin:<name>`; the name is trace only, never a criterion).' }
+        hookName: { type: string, description: 'Hook identity (same rule as kind 2); redacted + bounded.' }
+        entryType: { type: string, description: 'command | http | prompt | agent — closed server-side, open on read.' }
+        toolName: { type: string, description: 'Present on tool events.' }
+        detail: { type: string, description: 'Redacted supplement.' }
+
+    FleetHookVerdictUntrusted:
+      type: object
+      description: >
+        Kind 4 (server >= 7.133.0): a hook's VERDICT IS UNTRUSTED — one rule: an entry that did not get the complete payload, or was pulled in BY SELECTION by an over-budget matcher, has its VETO count (deny / exit 2 /
+        `decision:"block"` / `continue:false` / ask) and its ALLOW and `updatedInput` NOT count. The rule holds on both lanes, so there is one frame; reason, lane and identity are machine fields. Emission condition per lane:
+        managed = the entry ran with an untrusted cause (sent whatever it judged; `PreToolUse` then folds to `ask` when nothing vetoed); unmanaged = it gave an allow or a real rewrite (an identity echo does not count) that was
+        dropped. Today only on `PreToolUse` (the event with an allow word). THE FRAME DOES NOT ASSERT HOW THE CALL ENDED: a managed entry that itself vetoes ends in deny with the frame sent; another trusted allow in the group still
+        lets the call through — read the call's own result. NEVER infer a call outcome from any hook_notice frame.
+      required: [kind, event, reason, lane, hookName, entryType]
+      additionalProperties: true
+      properties:
+        kind: { type: string, enum: [hook_verdict_untrusted] }
+        event: { type: string, description: 'Which hook event (today always PreToolUse).' }
+        reason:
+          # NO `enum` — same open-on-read ruling as kinds 1–3.
+          type: string
+          description: >-
+            Why the verdict is untrusted. CLOSED on the server (two words), OPEN ON READ — KNOWN WORDS TODAY: input_truncated (the entry did not get the full payload: `tool_input` over the cap was replaced by a truncation marker, or a prompt /
+            agent entry''s whole payload text was cut at the same cap) | matcher_over_budget (the group matcher / entry `if` name part ran past its budget and the entry ran BY SELECTION; the same moment also sends a kind-2 frame
+            `matcher_over_budget`).
+        lane: { type: string, description: 'The lane the entry sits in, read off the source table: `managedPolicy` / `managedPlugin:*` => `managed`, everything else and absent => `unmanaged`. Closed (two words) server-side, open on read. Read THIS field, never re-derive from `source`.' }
+        hookName: { type: string, description: 'Hook identity (same rule as kind 2); redacted + bounded.' }
+        entryType: { type: string, description: 'command | http | prompt | agent — closed server-side, open on read.' }
+        toolName: { type: string, description: 'Present on tool events.' }
+        source: { type: string, description: 'The source word the group declared (both lanes give it; ABSENT = the group declared none, so only unmanaged). Trace only, never a criterion.' }
+        detail: { type: string, description: 'Redacted supplement (human-facing; machines read `reason` / `lane`).' }
+
     BakeStatus:
       # 新(census 批2 四段)——server `BakeStatus`(plugins/store-contracts.ts), the COARSE lifecycle
       # bakeView/claimResponse/bakesCreate all key on.
@@ -20450,6 +20672,11 @@ components:
             K-24 (server >= 7.104.0 / S-724) — does this leg capture file history (`on` / `disabled`, OPEN word). EFFECTIVE
             HALF ONLY ⇒ ALWAYS ABSENT ON THIS ENDPOINT; the deployment-level reading is `capabilities.fileHistoryCapture`.
             Full per-key contract: see Event_wiring_manifest.fileHistory.
+        permissionMode:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestPermissionMode' }]
+          description: >-
+            core 7.53.0, server >= 7.133.0 — the leg's permission-mode receipt (section shape WiringManifestPermissionMode). EFFECTIVE HALF ONLY ⇒ this (static) face NEVER carries it, and absence here carries no
+            information; the reading holds only on a live `wiring_manifest` frame.
         instructions:
           allOf: [{ $ref: '#/components/schemas/WiringManifestInstructions' }]
           description: >
@@ -20521,6 +20748,24 @@ components:
           type: array
           description: 'The selected chain member(s), spelled as the chain spells them (relative to the cwd); `[]` = the chain was walked, nothing was selected.'
           items: { type: string, enum: ['CLAUDE.md', '.claude/CLAUDE.md', 'AGENTS.md', '.claude/AGENTS.md'] }
+    WiringManifestPermissionMode:
+      # server 7.133.0 / core 7.53.0:同一段形被 live 帧(两张脸)、静态诊断面、`POST /v1/tasks` 的 `wiringManifest` 回执与账本行引用 ⇒ 具名单源(`spec-field-drift-gate` 也按「导出的 interface 必有同名 schema」逼出它)。
+      type: object
+      additionalProperties: false
+      description: >
+        The `wiring_manifest.permissionMode` section (core 7.53.0 `PermissionModeReceipt`; server >= 7.133.0 projects it on BOTH faces — tenant and operator — and the same section rides the `wiringManifest`
+        receipt of the `POST /v1/tasks` 200 body and the `/events` ledger row; the server judges SHAPE only: `effective` a non-empty string, `requested` / `foldedBy` absent or non-empty strings, else the whole section
+        is dropped). The engine gives the same three-member receipt on EVERY mode question: `requested` = the mode word the caller declared (ABSENT = declared nothing — a root inherits `default`, a child inherits its
+        parent); `effective` = the mode the leg actually runs under (the request clamped under a parent's ceiling, then folded to `default` where the deployment denies it or the classifier face is absent) — ALWAYS present,
+        the shell renders its mode indicator from it; `foldedBy` = PRESENT IFF `requested` and `effective` differ — `operator_deny` (the deployment / organization ceiling denies the mode) / `face_absent` (`auto` needs
+        a classifier face this leg lacks) / `inherited_ceiling` (a delegated child clamped under its parent's ceiling); read OPEN (a fourth word passes through as "folded, cause unknown"). ABSENT section = an older
+        engine / server (<= 7.132.x), not an assertion of the default mode. This is ONE added key on a closed object: a consumer validating `wiring_manifest` strictly against sdk <= 24.0.0's spec fails the whole frame
+        on 7.133.0+ — upgrade to sdk 25.0.0 or relax unknown keys on this section.
+      required: [effective]
+      properties:
+        requested: { type: string, description: 'The mode word the caller declared (a PermissionMode word today; read open). ABSENT = declared nothing.' }
+        effective: { type: string, description: 'The mode the leg actually runs under (a PermissionMode word today; read open). Always present.' }
+        foldedBy: { type: string, description: 'Present iff `requested` and `effective` differ: `operator_deny` / `face_absent` / `inherited_ceiling` (engine words; read OPEN — an unknown word means "folded, cause unknown").' }
     WiringManifestModEntry:
       # server 7.132.0 / core 7.52.0:取代钩子席位行形(删,零别名)。同一份行形被 live 帧与静态诊断面两处引用 ⇒ 具名;两形各自具名(⑤bis 名单逐形对账)。
       description: >
@@ -21050,10 +21295,225 @@ components:
         remember for this session's category (fs-write tools share ONE category: approving Write covers
         Edit/NotebookEdit; other tools are per-tool) — the CC "don't ask again this session" semantic.
 
+    ConfigCatalog:
+      type: object
+      description: >
+        The 200 body of GET /v1/config/catalog (server `ConfigCatalogWire`) — a PROJECTION, left open on read (the producer ships independently and adds keys additively between SDK releases; the request side has no body).
+      required: [catalogVersion, envLaneTiming, restartSlices, centerDomains, summary, rows, retired]
+      additionalProperties: true
+      properties:
+        catalogVersion: { type: integer, enum: [1] }
+        envLaneTiming: { type: string, description: 'The env lane''s uniform timing (`deploy`: env is immutable at runtime, so changing env = changing the deployment). Open on read.' }
+        restartSlices: { type: array, items: { type: string }, description: 'The restart-slice names a centre write can land in (open on read).' }
+        centerDomains: { type: array, items: { type: string }, description: 'The contract package''s centre-configuration domains.' }
+        summary:
+          type: object
+          required: [total, envHeld, secret, centerManaged]
+          additionalProperties: true
+          properties:
+            total: { type: integer }
+            envHeld: { type: integer }
+            secret: { type: integer }
+            centerManaged: { type: integer }
+        rows: { type: array, items: { $ref: '#/components/schemas/ConfigCatalogRow' } }
+        retired: { type: array, items: { $ref: '#/components/schemas/ConfigCatalogRetiredEnv' }, description: 'Tombstoned env names this process refuses to start on (always present, may be empty). A name is never in `rows` and here at once.' }
+    ConfigCatalogRow:
+      type: object
+      description: >
+        One catalog row (server `ConfigCatalogRow`): a deployment knob's static declaration plus this process's effective reading. OPEN on read (projection). The two VERDICT bits are the true-only family:
+        `effectiveValueInvalid` (the effective value fell outside the row's echo set; `effectiveValue` is `null`) and `effectiveValueWithheld` (server >= 7.133.0) — see the property.
+      required: [name, domain, type, semantics, writeLanes, effectiveLane, envHeld, envTiming, effectiveValue, valueClass, danger]
+      additionalProperties: true
+      properties:
+        name: { type: string, description: 'The knob (env) name; the catalog is sorted by it.' }
+        domain: { type: string, description: 'One of the nine configuration groups (store / modelPlane / approval / memory / auth / orchestration / limitsHttp / observability / integrations). Open on read.' }
+        type: { type: string, description: 'Value type: boolean | number | string | enum | csv | json | path | url | secret | opaque. Open on read.' }
+        semantics: { type: string, description: 'Human sentence (true to the read site).' }
+        writeLanes: { type: array, items: { type: string, enum: [env, center] }, description: 'Which lanes can write this knob.' }
+        effectiveLane: { type: string, description: 'The lane actually in force: env | center | default. Open on read.' }
+        envHeld: { type: boolean, description: 'This machine''s env sets it explicitly.' }
+        envTiming: { type: string, description: '`deploy` (changing env = changing the deployment) | `inert` (retired / zero-consumer key). Open on read.' }
+        staticDefault: { type: string }
+        derivedDefaultNote: { type: string }
+        effectiveValue:
+          description: 'This process''s effective DISPLAY value: a scalar / a word list / `null` (unset) / `{ present, length? }` (`secret` / `opaque` rows report presence and length only).'
+          oneOf:
+            - { type: [string, number, boolean, 'null'] }
+            - { type: array, items: { type: string } }
+            - { type: object, required: [present], additionalProperties: true, properties: { present: { type: boolean }, length: { type: integer } } }
+        valueClass: { type: string, description: '`plain` (echoable) | `secret` | `opaque` (the value never goes on the wire). Open on read.' }
+        danger: { type: array, items: { type: string }, description: 'The risk axes of a wrong setting: security | billing | data (open on read).' }
+        center: { $ref: '#/components/schemas/ConfigCatalogRowCenter' }
+        centerDomain: { type: string }
+        centerPath: { type: string }
+        scope: { type: string, description: '`bootstrap-only` = read only at start-up.' }
+        enumValues: { type: array, items: { type: string }, description: 'An `enum` row''s writable word set.' }
+        effectiveValueInvalid:
+          type: boolean
+          enum: [true]
+          description: 'TRUE-ONLY verdict bit: the effective value fell OUTSIDE the row''s own echo set (or a boolean without a declared mapping) — `effectiveValue` is then `null` (echoing an out-of-set value would teach a consumer to write back an illegal word). Enum rows only. ABSENT = this cell has no such matter.'
+        effectiveValueWithheld:
+          type: boolean
+          enum: [true]
+          description: >-
+            server >= 7.133.0, TRUE-ONLY verdict bit on `type: url` rows (present only when true, never `false`): the display mint judged this cell (single value) or any item of it (list) WITHHELD — a part the position rule
+            would have shown (the whole query / a path segment) was NOT shown because it held a credential-shaped piece. The mint owns the verdict; the catalog does not judge again. So the shown value is not the whole value:
+            a catalog page / `sema config show` marks the row ("part of this value is withheld"), and must not read the shown value as "the value is exactly that". ABSENT = nothing withheld (older servers never send it).
+            The standard position rule (userinfo landed, query values become tokens) holds for every row and is NOT a withholding; a value that became a placeholder as a whole means the row's display rule cannot show it
+            (not a hierarchical URL; the two outbound-proxy rows show only scheme://host[:port]) — also not this bit.
+    ConfigCatalogRowCenter:
+      type: object
+      description: 'A catalog row''s centre seat: whether the knob is centre-publishable, who wins, when it takes effect. Present only on rows with a centre seat.'
+      required: [domain, path, precedence, timing, managedNow, effectiveNow]
+      additionalProperties: true
+      properties:
+        domain: { type: string }
+        path: { type: string, description: 'Path in the domain (`a.b` into objects; `xs[].c` into array elements).' }
+        precedence: { type: string, description: '`center-wins` | `env-wins` (open on read).' }
+        timing: { type: string, description: '`hot` | `restart` | `inert` (open on read; not `deploy`).' }
+        restartSlice: { type: string }
+        restartReason: { type: string }
+        managedNow: { type: boolean, description: 'The centre''s latest effective config currently MANAGES this key (no config pipeline => always false).' }
+        effectiveNow: { type: boolean, description: 'The centre write is in force right now (managed AND not held down by an env placeholder).' }
+    ConfigCatalogRetiredEnv:
+      type: object
+      description: 'A tombstoned env name (the contract package''s RETIRED_ENVS wire projection): a name this process refuses to start on. `renamed` carries only `replacement`; `replaced` carries `replacement` + `reason` (how the value semantics changed); `removed` carries only `reason`.'
+      required: [name, kind]
+      additionalProperties: true
+      properties:
+        name: { type: string }
+        kind: { type: string, description: '`renamed` | `replaced` | `removed` (open on read).' }
+        replacement: { type: string }
+        reason: { type: string }
+    EntryProblem:
+      type: object
+      description: >
+        One ENTRY PROBLEM (server >= 7.133.0): a refusal body's `detail.problems[]` element and an accept-time `warnings[]` element share this shape. `code` = the refusal code the problem belongs to (in `warnings[]`: the engine's
+        reading code for that entry); `field` = the coordinate of the list holding the entry in the request body (`settings.permissions.allow`, `skills[i].allowedTools` …); `entry` = the entry string (passed through the server''s
+        redaction mouth — not a guarantee of your original bytes); `reason` = the machine reason — mostly the ENGINE''s word verbatim (why it read the entry as nothing); the server mints two of its own, `not_in_roster` (accept-time
+        warnings only: the name in an allow-side selector list is not in the roster and is no protocol namespace name — the engine accepts it anyway) and `home_unresolvable` (settings-rule 422: a `~/` path rule on a deployment that cannot
+        resolve the execution environment''s home); and `below_trust_floor` (the caller''s trust tier is below the member''s admission floor — see ErrorResponse.detail.callerTrust). Read OPEN.
+      required: [code, field, entry, reason]
+      additionalProperties: false
+      properties:
+        code: { type: string }
+        field: { type: string }
+        entry: { type: string }
+        reason: { type: string }
+    PrincipalInboxMessage:
+      type: object
+      description: 'The request body of POST /v1/principal-inbox/messages: a CLOSED three-key shape (`from` is minted by the server from the verified identity and cannot be sent).'
+      required: [to, content]
+      additionalProperties: false
+      properties:
+        to: { type: string, minLength: 1, description: 'The recipient principal string. Must belong to the sender''s organization (the membership judgement reads the organization directory); a failed judgement is 404 `org_delivery.not_member`, byte-identical to "no such person".' }
+        content: { type: string, minLength: 1, maxLength: 32000, description: 'The letter body (characters; over 32000 => 400 `request.field_invalid`).' }
+        urgent: { type: boolean, description: 'The urgent flag on the envelope (absent = ordinary).' }
+    PrincipalInboxReceipt:
+      type: object
+      description: 'The 200 receipt: the letter was appended. `receiptId` = the gate-minted delivery receipt id (the envelope''s `gateReceiptId` carries the same value).'
+      required: [receiptId]
+      additionalProperties: false
+      properties:
+        receiptId: { type: string }
+    OrgDeliveryRefusalCode:
+      type: string
+      enum: [org_delivery.not_member, org_delivery.rate_limited, org_delivery.inbox_full, org_delivery.recipient_tombstoned]
+      description: >
+        The four cross-principal delivery refusal codes (server >= 7.133.0; the engine's closed `ORG_DELIVERY_REFUSAL_CODES`, one frozen sentence each — machines read the CODE): `org_delivery.not_member` (404),
+        `org_delivery.rate_limited` (429), `org_delivery.inbox_full` (409), `org_delivery.recipient_tombstoned` (410). See POST /v1/principal-inbox/messages.
+    ToolApprovalReadState:
+      type: string
+      enum: [pending, decided, parked, void]
+      description: >
+        `state` of GET /v1/tool-approvals/{id} (server >= 7.133.0), a CLOSED four-word set — read it exhaustively: `pending` = a live registration on this replica is waiting (answer door open);
+        `decided` = the row is DECIDED; `parked` = PARKING / PARKED (a late answer redeems the parked card); `void` = DENIED / VOID (nobody decided it, the answer has nowhere to land).
+    ApprovalsStreamReadErrorCode:
+      type: string
+      enum: [approvals.read_unavailable, approvals.read_corrupt]
+      description: >
+        The `errorCode` of the two READ-FAILURE `error` frames on GET /v1/approvals/stream (server >= 7.133.0). `approvals.read_unavailable` = this tick's approval read failed (the store was momentarily
+        unreadable) — the stream STAYS open and the next tick reads again; it is NOT a terminal frame and NOT a reconnect signal (do not reconnect on it, and do not read it as "nothing pending").
+        `approvals.read_corrupt` = a corrupt row was read — the server closes the stream after the frame; deal with that row before reopening. Branch on the code, never match the message.
+        Older servers (<= 7.132.x) answer a read failure with nothing but heartbeats.
+    ToolApprovalReadProjection:
+      type: object
+      description: >
+        The row projection shared by the three non-`pending` arms of GET /v1/tool-approvals/{id} (server >= 7.133.0): a SUBSET of the `livePending[]` row keys — one reader, one key set. `frame` = the disconnect-replay
+        opening frame (an `approval_request` frame; ABSENT when the card cannot be read back — never invented).
+      required: [approvalId, ts, expiresAtMs]
+      additionalProperties: true
+      properties:
+        approvalId: { type: string }
+        ts: { type: number, description: 'Registration time (ms epoch).' }
+        expiresAtMs: { type: number, description: 'Absolute window deadline (cast once, never recomputed).' }
+        sessionId: { type: string }
+        toolName: { type: string }
+        frame: { $ref: '#/components/schemas/ApprovalRequestFrame' }
+    ToolApprovalReadBody:
+      description: >
+        The 200 body of GET /v1/tool-approvals/{id} (server >= 7.133.0) — a four-arm union discriminated by `state` (closed, read it exhaustively): `pending` = a live registration on this replica is waiting
+        (the `livePending[]` row + `state`; answer door open); `decided` = the row is DECIDED (`decision` / `decidedAtMs` / `decisionNote?`, the same three keys as the late-replay body); `parked` = PARKING / PARKED
+        (a late answer redeems the parked card; `decidePath?` points at the durable decision path); `void` = DENIED / VOID (nobody decided it, the answer has nowhere to land; `cause?` is the same cause word as the
+        late-answer 404's, see ToolApprovalNotPendingCause).
+        🔴 server >= 7.134.0: a PARKED row passes the gate judge (the same one the answer door's 409 `approval_stale` reads) — the gate still open ⇒ `parked`
+        (+ `decidePath`; ONLY this state renders "go decide"); the gate settled by a person / policy ⇒ `decided` (no `decidePath`); the gate expired (a cancel expires it
+        first) / superseded / settled by the host SLA sweep, the window or nobody-to-answer ⇒ `void` WITHOUT `cause`; the checkpoint row gone, or settled without a
+        readable direction / time ⇒ 404 `tool_approval.not_pending` WITHOUT `cause`; the gate unreadable (store failure) ⇒ falls back to `parked`. Known boundary (re-read
+        to settle it): a parked row's `decided` can return to `parked` when the resume leg fails before the approved action starts (the engine reopens the same gate), and
+        a cancelled resume reads `void` once the server collects the reopened gate (`parked` in between, or `void` for an instant during the reopen).
+        Older servers answered all of these with `parked` + `decidePath`.
+      oneOf:
+        - $ref: '#/components/schemas/ToolApprovalReadPending'
+        - $ref: '#/components/schemas/ToolApprovalReadDecided'
+        - $ref: '#/components/schemas/ToolApprovalReadParked'
+        - $ref: '#/components/schemas/ToolApprovalReadVoid'
+      discriminator:
+        propertyName: state
+        mapping:
+          pending: '#/components/schemas/ToolApprovalReadPending'
+          decided: '#/components/schemas/ToolApprovalReadDecided'
+          parked: '#/components/schemas/ToolApprovalReadParked'
+          void: '#/components/schemas/ToolApprovalReadVoid'
+    ToolApprovalReadPending:
+      allOf:
+        - $ref: '#/components/schemas/LivePendingRow'
+        - type: object
+          required: [state]
+          properties:
+            state: { type: string, enum: [pending] }
+    ToolApprovalReadDecided:
+      allOf:
+        - $ref: '#/components/schemas/ToolApprovalReadProjection'
+        - type: object
+          required: [state, decision, decidedAtMs]
+          properties:
+            state: { type: string, enum: [decided] }
+            decision: { type: string, enum: [allow, deny] }
+            decidedAtMs: { type: integer }
+            decisionNote: { type: string }
+    ToolApprovalReadParked:
+      allOf:
+        - $ref: '#/components/schemas/ToolApprovalReadProjection'
+        - type: object
+          required: [state]
+          properties:
+            state: { type: string, enum: [parked] }
+            decidePath: { type: string, description: 'The durable decision path for this ask when it can be built.' }
+    ToolApprovalReadVoid:
+      allOf:
+        - $ref: '#/components/schemas/ToolApprovalReadProjection'
+        - type: object
+          required: [state]
+          properties:
+            state: { type: string, enum: [void] }
+            cause:
+              allOf: [{ $ref: '#/components/schemas/AskRowEndingCause' }]
+              description: 'The row''s recorded ending cause (absent for a legacy row with no cause written — never invented).'
     ToolApprovalRespondApplied:
       type: object
       description: >
-        The APPLIED arm of the 200 ack of POST /v1/tool-approvals/{approvalId}/respond (server tool-approval.ts — exact
+        The APPLIED arm of the 200 ack of POST /v1/tool-approvals/{id}/respond (server tool-approval.ts — exact
         shape, `decision` echoed): the decision settled a live gate. Owner-gated with a 404 and NO existence oracle: non-owner and
         unknown/settled/expired/wrong-replica ids are indistinguishable. See ToolApprovalRespondAck for the replayed arm.
       # 封闭(census 批2 第三段,2026-07-30):铸造点 `tool-approval.ts` 三恒在键 + 两条件键
@@ -21069,6 +21529,13 @@ components:
         approvalId: { type: string }
         delivery: { type: string, enum: [applied] }
         decision: { $ref: '#/components/schemas/ToolApprovalDecision' }
+        consumerState:
+          type: string
+          enum: [absent]
+          description: >-
+            server >= 7.133.0, TRUE-ONLY: no engine leg on THIS replica was waiting for the ask this answer settled — the same bit, with the same meaning, as `LivePendingRow.consumerState` and the
+            durable decision ack's. Present <=> the answered entry was ADOPTED from the ask ledger at start-up. The decision lands on the row as usual, but nothing running here resumes because of it — read the run
+            surface; do not read the 200 as "the run continued". Absent = a local engine leg was waiting, or an older server.
         rememberApplied:
           type: boolean
           description: >
@@ -21160,7 +21627,7 @@ components:
     ToolApprovalRespondReplayed:
       type: object
       description: >
-        The REPLAYED arm of the 200 ack of POST /v1/tool-approvals/{approvalId}/respond: the ask was already DECIDED
+        The REPLAYED arm of the 200 ack of POST /v1/tool-approvals/{id}/respond: the ask was already DECIDED
         (by anyone) when this answer arrived, so the server replays the FIRST decision — `decision` is the row's two-word
         value (`allow_session` was folded to `allow` when it landed), `decidedAtMs` the first decision's clock,
         `decisionNote` only when the row has one, `rememberApplied: false` only when THIS request asked `allow_session`.
@@ -21176,14 +21643,57 @@ components:
         decidedAtMs: { type: integer }
         decisionNote: { type: string }
         rememberApplied: { type: boolean, enum: [false] }
+        noteRecorded: { type: boolean, description: 'server >= 7.133.0 (two doors, one shape): present ONLY when THIS request carried a `note`; `true` <=> the row''s text is verbatim what this request submitted, `false` = not confirmed (another reason is on the row / no store / read-back failed). A late answer''s note never overwrites the first decision''s reason — that is `decisionNote`.' }
+        rulePersisted: { type: boolean, enum: [false], description: 'server >= 7.133.0: present (as `false`) only when this late answer carried `persistRule`: the rule is redeemed on the FIRST decision only, a late answer never saves one.' }
+        ruleRefusal:
+          type: string
+          enum: [rule_lane_unavailable]
+          description: 'with `rulePersisted: false`; on this arm always `rule_lane_unavailable` (the only word the published late-answer path mints).'
+    ToolApprovalRespondParkedRedeemed:
+      type: object
+      description: >
+        The PARKED-REDEEMED arm of the 200 ack of POST /v1/tool-approvals/{id}/respond (server >= 7.133.0; server tool-approval.ts `redeemParkedAsk` /
+        `replayRedeemReceipt`): the card's window had run out and the ask moved to background waiting (PARKED); this late answer — on another replica or after a restart —
+        goes through the EXISTING durable redemption leg (the same CAS as POST /v1/approvals/{sessionId}/decide) instead of the old 404 `tool_approval.not_pending`
+        (`cause: unknown_or_other_replica`). Body = the redemption leg's receipt (ApprovalDecisionResult's keys — `status` / `taskId` / `sessionId` / ... as they come) plus the three keys
+        this door adds: `approvalId` / `askId` (the same 64-hex value) and the discriminant `accepted`. `decision` is the two-word direction on the REPLAY form only (`allow` / `deny`,
+        `allow_session` folded to `allow`); `rememberApplied: false` appears only when this request asked `allow_session` (a parked redemption cannot remember a session grant);
+        `rulePersisted` / `ruleRefusal` / `persistedRule*` are the `persistRule` outcome on the redemption leg (a rule that fails to store NEVER flips the verdict).
+        `idempotent: true` appears only on the REPLAY (the same already-redeemed card answered again returns the first redemption's receipt).
+        CLOSED like its two sibling arms (the census keeps this op's 200 body closed): the key set is ApprovalDecisionResult's own keys (one source per shape, by `$ref`) plus the added ones.
+      required: [approvalId, askId, accepted]
+      additionalProperties: false
+      properties:
+        approvalId: { type: string }
+        askId: { type: string }
+        accepted: { type: string, enum: [parked_redeemed] }
+        status: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/status' }
+        taskId: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/taskId' }
+        sessionId: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/sessionId' }
+        bindingEnforced: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/bindingEnforced' }
+        decision: { type: string, description: 'REPLAY form: `allow` / `deny` (`allow_session` folded to `allow`). FIRST redemption: whatever the redemption leg''s own receipt says (`approve` / `deny` today) — read it open.' }
+        errorCode: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/errorCode' }
+        errorMessage: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/errorMessage' }
+        retriable: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/retriable' }
+        idempotent: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/idempotent' }
+        executionOutcome: { $ref: '#/components/schemas/ApprovalDecisionResult/properties/executionOutcome' }
+        rememberApplied: { type: boolean, enum: [false] }
+        rulePersisted: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/rulePersisted' }
+        ruleRefusal: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/ruleRefusal' }
+        persistedRule: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/persistedRule' }
+        persistedRules: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/persistedRules' }
+        persistedRuleAnchors: { $ref: '#/components/schemas/ToolApprovalRespondApplied/properties/persistedRuleAnchors' }
     ToolApprovalRespondAck:
       description: >
-        The 200 ack of POST /v1/tool-approvals/{approvalId}/respond — a discriminated union: the decision was APPLIED to a live
+        The 200 ack of POST /v1/tool-approvals/{id}/respond — a discriminated union: the decision was APPLIED to a live
         gate (ToolApprovalRespondApplied, `delivery: "applied"`) or the ask was already decided and the first decision is
-        REPLAYED (ToolApprovalRespondReplayed, `idempotent: true`). The discriminant is `idempotent`.
+        REPLAYED (ToolApprovalRespondReplayed, `idempotent: true`), or (server >= 7.133.0, sdk 25.0.0) the answer REDEEMED a PARKED card through the durable redemption
+        leg (ToolApprovalRespondParkedRedeemed, `accepted: "parked_redeemed"`). The discriminants are `delivery` / `idempotent` / `accepted` (a replayed redemption carries
+        BOTH `accepted: "parked_redeemed"` and `idempotent: true` — read `accepted` first).
       oneOf:
         - $ref: '#/components/schemas/ToolApprovalRespondApplied'
         - $ref: '#/components/schemas/ToolApprovalRespondReplayed'
+        - $ref: '#/components/schemas/ToolApprovalRespondParkedRedeemed'
     UsageMetric:
       type: string
       enum: [tasks, tokensIn, tokensOut, costUsd]
@@ -21346,74 +21856,6 @@ components:
         delivery: { type: string, const: applied, description: 'Literal "applied" on today''s server.' }
         marker: { type: string, description: 'Engine-minted delivery marker.' }
 
-    WorkspaceSnapshotPage:
-      # 4.3.0(CAPS-OPS-8):把 GET …/workspace 的 200 信封提成具名 schema。SDK 侧此前是 `list()` 返回位上的
-      # **内联闭合字面量**,两道 spec 门(field-drift 只扫 types.ts / resource-schema 只扫 resources 的 exported
-      # type)对方法返回位的内联形都是盲的 —— 于是它漏了这里一直标为 required 的 `sessionId`,CI 全绿。
-      type: object
-      description: >
-        GET /v1/sessions/{sessionId}/workspace 的 200 信封(server src/http/routes/sessions.ts)。
-        ⚠️ `total` = **本页行数**(`snapshots.length`),不是快照总数,且这条腿没有任何分页游标 —— 与同族
-        `WorkspaceTreePage.total`(真·全量)**同名反义**。`latest` 与展示行同源(防 ghost key)。
-      additionalProperties: false
-      required: [sessionId, snapshots, total]
-      properties:
-        sessionId: { type: string }
-        snapshots:
-          type: array
-          items: { $ref: '#/components/schemas/WorkspaceSnapshotRow' }
-        latest: { type: string, description: 'Newest snapshot key; absent when the session has none.' }
-        total: { type: integer, description: 'ROWS ON THIS PAGE — not the snapshot count.' }
-
-    WorkspaceTreePage:
-      # 4.3.0(CAPS-OPS-8):同上,tree 腿的 200 信封。
-      type: object
-      description: >
-        GET /v1/sessions/{sessionId}/workspace/{key}/tree 的 200 信封(server src/http/routes/sessions.ts)。
-        `total` 在这条腿上是**全量**(`all.length`)—— 与 `WorkspaceSnapshotPage.total` 语义相反。
-        `key` 回的是解析后的真实键(请求可传 `latest` 别名)。
-      additionalProperties: false
-      required: [sessionId, key, entries, total]
-      properties:
-        sessionId: { type: string }
-        key: { type: string, description: 'The RESOLVED snapshot key (a `latest` alias in the request comes back resolved).' }
-        entries:
-          type: array
-          items: { $ref: '#/components/schemas/WorkspaceTreeEntry' }
-        total: { type: integer, description: 'FULL entry count (not the page size).' }
-        nextOffset: { type: integer, description: 'Present ⇒ more pages; send it back as ?offset=.' }
-
-    WorkspaceSnapshotRow:
-      type: object
-      description: >
-        One snapshot row of GET /v1/sessions/{sessionId}/workspace (envelope `{sessionId, snapshots,
-        latest?, total}`; server src/http/routes/sessions.ts — newest first, uuidv7 keys). E19 snapshot store's
-        read-only projection: each row is the freeze at a turn boundary, NOT a live workspace.
-      required: [key, files]
-      additionalProperties: true
-      properties:
-        key: { type: string, description: 'Snapshot key (uuidv7 entry id; "latest" is an accepted alias on the sub-routes).' }
-        files: { type: integer, description: 'Manifest row count.' }
-        bytes: { type: integer, description: 'Total snapshot bytes — present only when the store has a sizes face (SQL backends); the local store honestly omits it ([1894]② additive).' }
-
-    WorkspaceTreeEntry:
-      type: object
-      description: >
-        One file entry of GET /v1/sessions/{sessionId}/workspace/{key}/tree (envelope `{sessionId, key,
-        entries, total, nextOffset?}`; server src/http/routes/sessions.ts — stable path order, offset paging).
-      required: [path, hash]
-      additionalProperties: true
-      properties:
-        path: { type: string, description: 'The relPath — pass VERBATIM as ?path= on the file sub-route.' }
-        hash: { type: string, description: 'Content address (sha256) — enables cross-snapshot change highlighting ([1894]②).' }
-        size: { type: integer, description: 'Present only when the store has a sizes face (SQL backends).' }
-
-    # ═══════════════════════════════════════════════════════════════════════════════════════════════
-    # #154 车二(design/179 §7)—— 持久权限规则的 CC settings 导入面。形按 server 真码 + core 原形亲读
-    # (`src/http/routes/rules.ts` / `src/rules-consent.ts`;preview/result 两形是 core `ImportPreview` /
-    # `ImportResult` 的原样透传)。
-    # ═══════════════════════════════════════════════════════════════════════════════════════════════
-
     CcImportSettingsLayer:
       type: string
       enum: [userSettings, projectSettings, localSettings]
@@ -22141,7 +22583,7 @@ components:
 
     AdoptionNotMigratedFace:
       type: string
-      enum: [usage-window, cost-quota, rate-limit, approval-exemption-grantor, approval-ask-decision-actor, image-bake-requested-by]
+      enum: [usage-window, cost-quota, rate-limit, approval-exemption-grantor, approval-ask-decision-actor, image-bake-requested-by, permission-rule-approval-history, permission-rule-import-ticket, org-delivery-quota]
       description: >
         FROZEN machine-readable vocabulary of the faces the server deliberately does not migrate. Renaming or
         removing a member is a wire break; adding one is a new behaviour face. Consumers assert POSITIVELY on