@sema-agent/sdk 25.0.0 → 26.0.0

package/openapi.yaml

@@ -172,7 +172,7 @@ tags:
       themself said yes"), never operator. GATED AND OFF BY DEFAULT: the whole lane hangs on
       PERMISSION_RULES_ENABLED (default false) plus a wired rule store — so on a stock deployment BOTH doors
       answer 501 `capability.rule_store_required`, and so does the single-card half (the ask frame simply
-      carries no `ruleSuggestions`). Read the observed frame / an actual response, never a version number.
+      carries no `ruleOffers`). Read the observed frame / an actual response, never a version number.
       The SINGLE-CARD half of the same lane is `persistRule` on POST /v1/tool-approvals/{id}/respond.
   - name: adoption
     description: >
@@ -2280,38 +2280,16 @@ paths:
     get:
       tags: [workspace]
       operationId: workspaceList
-      x-status: retired          # S-15/design/381 (server 7.52.0): whole-tree snapshot epoch retired — every ≥7.52 deployment answers 501 capability.workspace_retired.
-      summary: 'RETIRED (server 7.52.0, S-15) — snapshot listing; ≥7.52 answers 501 capability.workspace_retired. Live on 1.299–7.51 only.'
-      description: >
-        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this
-        face projected was replaced by per-edited-file rewind HISTORY, which holds only files the agent edited
-        — structurally there is no "whole workspace" manifest to browse anymore. The route SHAPE is kept
-        server-side as a tombstone: every ≥7.52 deployment answers 501 `capability.workspace_retired` (a named
-        refusal, not a 404 that reads like a typo), and `capabilities.workspace` is always false (same
-        predicate). There is NO 1:1 replacement path — a future "rewind coverage" browse would be a NEW face
-        with tracked-set semantics, not this name wired back. Related live faces: rewind restore rides
-        `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file history blobs ride
-        `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`.
-        Historical shape (servers 1.299–7.51): read-only projection over the E19 snapshot store. Rows carry
-        `{key, files, bytes?}`; `latest` = the newest snapshot key. Owner-scoped (non-owner → 404, no
-        oracle); 501 without the snapshot-store read faces (probe `capabilities.workspace`).
-      parameters:
-        - in: query
-          name: limit
-          required: false
-          schema: { type: integer, minimum: 1, maximum: 100 }
+      x-status: retired          # server 7.52.0: whole-tree snapshot epoch retired; sdk 26.0.0 deleted the verb (support floor 7.52.0).
+      summary: 'RETIRED (server 7.52.0, S-15) — snapshot listing; every supported server (>= 7.52.0) answers 501 capability.workspace_retired.'
+      description: >
+        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this face projected was replaced by per-edited-file
+        rewind HISTORY (only files the agent edited — there is no "whole workspace" manifest to browse). The route SHAPE is kept server-side as a tombstone:
+        every supported server answers 501 `capability.workspace_retired` (a named refusal, not a 404 that reads like a typo), and `capabilities.workspace` is
+        always `false` (same predicate). No 1:1 replacement: rewind restore rides `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file
+        history blobs ride `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`. sdk 26.0.0 deleted `client.workspace` (its 200 shapes only existed on 1.299–7.51).
       responses:
-        '200':
-          description: The snapshot listing.
-          content:
-            application/json:
-              # 封闭两层(census 批2 第三段,2026-07-30):铸造点 `routes/sessions.ts`(信封与行两处)。条件键=信封 `latest`(零快照即省略)、行 `bytes`(blobSizes 面缺席=诚实省略)。
-              # 4.3.0:形提成具名 `WorkspaceSnapshotPage`(SDK 同批把返回位的内联字面量也提成了 exported type,
-              # 让 spec-resource-schema-gate 罩得住 —— CAPS-OPS-8)。
-              schema: { $ref: '#/components/schemas/WorkspaceSnapshotPage' }
-        '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
   /v1/sessions/{sessionId}/workspace/{key}/tree:
@@ -2325,38 +2303,19 @@ paths:
         name: key
         required: true
         schema: { type: string }
-        description: 'Snapshot key (entryId), or the alias `latest` = the newest snapshot.'
     get:
       tags: [workspace]
       operationId: workspaceTree
-      x-status: retired          # S-15 (server 7.52.0): retired with the family — see workspaceList's retirement note.
-      summary: 'RETIRED (server 7.52.0, S-15) — snapshot file tree; ≥7.52 answers 501 capability.workspace_retired.'
-      description: >
-        🔴 RETIRED as of server 7.52.0 — same retirement (and same replacement pointers) as `workspaceList`
-        above: every ≥7.52 deployment answers 501 `capability.workspace_retired`; `capabilities.workspace` is
-        always false. Historical shape (1.299–7.51): entries carry `{path, hash, size?}` — `hash` is the
-        sha256 content-address (cross-snapshot change highlighting, [1894]②); `size` only when the SQL size
-        index is available. `limit` 1..2000 default 500, `offset` cursor; `nextOffset` present = more pages.
-      parameters:
-        - in: query
-          name: limit
-          required: false
-          schema: { type: integer, minimum: 1, maximum: 2000 }
-        - in: query
-          name: offset
-          required: false
-          schema: { type: integer, minimum: 0 }
+      x-status: retired          # server 7.52.0: whole-tree snapshot epoch retired; sdk 26.0.0 deleted the verb (support floor 7.52.0).
+      summary: 'RETIRED (server 7.52.0, S-15) — snapshot file tree; every supported server (>= 7.52.0) answers 501 capability.workspace_retired.'
+      description: >
+        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this face projected was replaced by per-edited-file
+        rewind HISTORY (only files the agent edited — there is no "whole workspace" manifest to browse). The route SHAPE is kept server-side as a tombstone:
+        every supported server answers 501 `capability.workspace_retired` (a named refusal, not a 404 that reads like a typo), and `capabilities.workspace` is
+        always `false` (same predicate). No 1:1 replacement: rewind restore rides `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file
+        history blobs ride `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`. sdk 26.0.0 deleted `client.workspace` (its 200 shapes only existed on 1.299–7.51).
       responses:
-        '200':
-          description: One page of the tree.
-          content:
-            application/json:
-              # 封闭两层(census 批2 第三段,2026-07-30):铸造点 `routes/sessions.ts`(信封与行两处)。条件键=信封 `nextOffset`(尾页省略)、行 `size`(blobSizes 面缺席省略)。
-              # 4.3.0:形提成具名 `WorkspaceTreePage`(理由同 list 腿 —— CAPS-OPS-8)。
-              schema: { $ref: '#/components/schemas/WorkspaceTreePage' }
-        '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
   /v1/sessions/{sessionId}/workspace/{key}/file:
@@ -2373,46 +2332,16 @@ paths:
     get:
       tags: [workspace]
       operationId: workspaceFile
-      x-status: retired          # S-15 (server 7.52.0): retired with the family — ≥7.52 the tombstone rejects BEFORE any size check, so the 413 envelope below is unreachable there.
-      summary: 'RETIRED (server 7.52.0, S-15) — single-file read; ≥7.52 answers 501 capability.workspace_retired.'
-      description: >
-        🔴 RETIRED as of server 7.52.0 — same retirement (and replacement pointers) as `workspaceList` above.
-        On ≥7.52 the tombstone 501 fires BEFORE any size check, so the 413 `workspace_file_too_large`
-        envelope below is UNREACHABLE there (the SDK keeps its typed WorkspaceFileTooLargeError for
-        1.299–7.51 servers still inside the support range). Historical shape (1.299–7.51): raw bytes with a
-        CONSERVATIVE content-type table (html/svg etc. deliberately serve as octet-stream — agent output is
-        untrusted; `x-content-type-options: nosniff` always set) + the `x-sema-content-binary` discriminator
-        header (first-8KiB NUL sniff, [1894]③). Capped at `capabilities.workspace.maxFileBytes` (default
-        8MiB, WORKSPACE_FILE_MAX_BYTES) — over-cap ⇒ 413 STRUCTURED envelope
-        `{errorCode: "workspace_file_too_large", sizeBytes, limit}` ([1894]①; archive was the escape hatch).
-        With the SQL size index the 413 fired BEFORE fetching the bytes.
-      parameters:
-        - in: query
-          name: path
-          required: true
-          schema: { type: string }
-          description: The tree's relPath, verbatim.
+      x-status: retired          # server 7.52.0: whole-tree snapshot epoch retired; sdk 26.0.0 deleted the verb (support floor 7.52.0).
+      summary: 'RETIRED (server 7.52.0, S-15) — snapshot single file; every supported server (>= 7.52.0) answers 501 capability.workspace_retired.'
+      description: >
+        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this face projected was replaced by per-edited-file
+        rewind HISTORY (only files the agent edited — there is no "whole workspace" manifest to browse). The route SHAPE is kept server-side as a tombstone:
+        every supported server answers 501 `capability.workspace_retired` (a named refusal, not a 404 that reads like a typo), and `capabilities.workspace` is
+        always `false` (same predicate). No 1:1 replacement: rewind restore rides `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file
+        history blobs ride `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`. sdk 26.0.0 deleted `client.workspace` (its 200 shapes only existed on 1.299–7.51).
       responses:
-        '200':
-          description: The file bytes.
-          content:
-            application/octet-stream:
-              schema: { type: string, format: binary }
-        '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
-        '413':
-          description: 'Structured over-cap envelope: {error, errorCode: "workspace_file_too_large", sizeBytes, limit}.'
-          content:
-            application/json:
-              schema:
-                type: object
-                required: [error, errorCode, sizeBytes, limit]
-                properties:
-                  error: { type: string }
-                  errorCode: { type: string, enum: [workspace_file_too_large] }
-                  sizeBytes: { type: integer }
-                  limit: { type: integer }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
   /v1/sessions/{sessionId}/workspace/{key}/archive:
@@ -2429,28 +2358,17 @@ paths:
     get:
       tags: [workspace]
       operationId: workspaceArchive
-      x-status: retired          # S-15 (server 7.52.0): retired with the family — see workspaceList's retirement note.
-      summary: 'RETIRED (server 7.52.0, S-15) — whole-snapshot tar; ≥7.52 answers 501 capability.workspace_retired.'
-      description: >
-        🔴 RETIRED as of server 7.52.0 — same retirement (and replacement pointers) as `workspaceList` above:
-        every ≥7.52 deployment answers 501 `capability.workspace_retired`. Historical shape (1.299–7.51):
-        streamed ustar (`content-disposition: attachment`), entries in stable path order, blob-by-blob with
-        backpressure — server memory stays O(1 file). Pre-flight checks BEFORE the headers went out: paths
-        not representable in ustar ⇒ 422 naming the first offenders; missing blobs (raced a reap / partial
-        import) ⇒ 502 (retryable). A blob vanishing MID-stream destroyed the connection (honest truncation)
-        rather than faking a complete archive.
+      x-status: retired          # server 7.52.0: whole-tree snapshot epoch retired; sdk 26.0.0 deleted the verb (support floor 7.52.0).
+      summary: 'RETIRED (server 7.52.0, S-15) — snapshot tar archive; every supported server (>= 7.52.0) answers 501 capability.workspace_retired.'
+      description: >
+        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this face projected was replaced by per-edited-file
+        rewind HISTORY (only files the agent edited — there is no "whole workspace" manifest to browse). The route SHAPE is kept server-side as a tombstone:
+        every supported server answers 501 `capability.workspace_retired` (a named refusal, not a 404 that reads like a typo), and `capabilities.workspace` is
+        always `false` (same predicate). No 1:1 replacement: rewind restore rides `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file
+        history blobs ride `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`. sdk 26.0.0 deleted `client.workspace` (its 200 shapes only existed on 1.299–7.51).
       responses:
-        '200':
-          description: The tar stream.
-          content:
-            application/x-tar:
-              schema: { type: string, format: binary }
-        '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
-        '422': { description: 'Snapshot contains paths not representable in ustar (names the first 5).' }
         '501': { $ref: '#/components/responses/NotImplemented' }
-        '502': { description: 'Snapshot is missing blobs (raced a reap or a partial import) — retry or pick another snapshot.' }
 
   /v1/sessions/{sessionId}/policy:
     parameters:
@@ -3040,50 +2958,6 @@ paths:
         '404': { $ref: '#/components/responses/NotFound' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
-  /v1/sessions/{sessionId}/sync/snapshots/{key}/blobs/{hash}:
-    parameters:
-      - $ref: '#/components/parameters/PrincipalHeader'
-      - in: path
-        name: sessionId
-        required: true
-        schema: { type: string }
-      - in: path
-        name: key
-        required: true
-        schema: { type: string }
-        description: The snapshot key (= a `SessionTreeEntry.id`).
-      - in: path
-        name: hash
-        required: true
-        schema: { type: string, pattern: '^[0-9a-f]{64}$' }
-        description: The content-address (SHA-256, 64 lowercase-hex).
-    get:
-      tags: [sessions]
-      operationId: sessionSyncGetBlob
-      x-status: retired          # S-15 (server 7.52.0): the E19-era snapshot-scoped PULL arm was REPLACED by GET …/sync/history/blobs/{hash} — ≥7.52 this path 404s (not_found.route).
-      summary: 'RETIRED (server 7.52.0, S-15) — snapshot-scoped blob PULL; use GET …/sync/history/blobs/{hash}. Live on ≤7.51 only.'
-      description: >
-        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): a blob is scoped by the session's
-        HISTORY GRAPH now, not by a per-snapshot manifest key, so this arm was replaced by
-        `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}` (sessionSyncGetHistoryBlob — same
-        octet-stream body, same no-oracle 404 posture, scope check = "referenced by this session's
-        exportHistory envelope"). On ≥7.52 this path no longer matches the sync route family and answers 404
-        `not_found.route`. SDK: `sessions.sync.getHistoryBlob` (the legacy `getBlob` verb stays, deprecated,
-        for ≤7.51 servers inside the support range).
-        Historical shape (≤7.51): one content-addressed blob's RAW bytes; the cloud served a hash ONLY if
-        THIS session's `:key` manifest referenced it (foreign/unreferenced → 404 `blob not found`). 400 on a
-        non-64-hex hash or an undecodable key/hash. Owner-scoped (404).
-      responses:
-        '200':
-          description: The blob bytes.
-          content:
-            application/octet-stream:
-              schema: { type: string, format: binary }
-        '400': { $ref: '#/components/responses/BadRequest' }
-        '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
-        '501': { $ref: '#/components/responses/NotImplemented' }
-
   /v1/sessions/{sessionId}/sync/history/blobs/{hash}:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -3109,7 +2983,7 @@ paths:
         → 404 `not_found.blob`, never a blind read; a server whose file-history store has no blob faces
         (e.g. the local file backend) answers the SAME 404 shape (no oracle — "nothing servable" and "not
         referenced" are deliberately indistinguishable). 400 `request.id_invalid` on a non-64-hex hash.
-        Owner-scoped (404). Replaces the retired `GET …/sync/snapshots/{key}/blobs/{hash}`.
+        Owner-scoped (404). Replaces the retired snapshot-scoped PULL arm of servers <= 7.51 (below the support floor; sdk 26.0.0 deleted `getBlob` and its path).
       responses:
         '200':
           description: The blob bytes.
@@ -3142,12 +3016,10 @@ paths:
         body). The cloud verifies `sha256(body) === :hash` (the content-address integrity guard) BEFORE storing — a
         mismatch → 400 `blob hash mismatch`. own-or-FRESH gate. Per-blob cap 64 MiB → 413 mid-stream beyond it. A
         backend write failure (e.g. a MinIO non-2xx) → 502 `blob store write failed`. 204 on success (no body). The
-        PUSH path is the BARE `blobs/:hash` (the PULL is `history/blobs/:hash` since server 7.52,
-        `snapshots/:key/blobs/:hash` before). 🔴 server ≥7.52 (S-15 换店): the blob faces ride the
+        PUSH path is the BARE `blobs/:hash` (the PULL is `history/blobs/:hash`). The blob faces ride the
         file-HISTORY store — a deployment whose store has no blob faces (the local file backend) answers 501
         `capability.snapshot_store_required` ("blob upload requires a durable file-history store") while the
-        rest of the sync surface keeps working; on ≤7.51 the same code meant a missing snapshot store. Same
-        code, same operator disposition (wire a backend with blob faces).
+        rest of the sync surface keeps working (operator disposition: wire a backend with blob faces).
       requestBody:
         required: true
         content:
@@ -3217,14 +3089,12 @@ paths:
       x-status: live
       summary: PUSH Phase A — classify + stage (mint a stagingId).
       description: >
-        2c session-sync PUSH Phase A — a SMALL metadata body (`entryIds, snapshots, policy, anchors, resolution?`); the
+        2c session-sync PUSH Phase A — a SMALL metadata body (`entryIds, fileHistory?, policy, anchors, resolution?, logDigest?, title?, pinned?`); the
         entries stream in Phase B. The cloud classifies (§7), pre-checks blob presence (a missing referenced hash →
         422 `missing_blob` — PUT it first), guards the import lease + any active run (409), then mints a stagingId.
-        ⚠️ S-15 EPOCH: server ≥7.52's Phase A consumes `{entryIds, fileHistory?, policy, anchors, resolution?,
-        logDigest?}` (routes/session-sync.ts) — the `snapshots` key is SILENTLY IGNORED there (an unknown body key); the
-        file history rides `fileHistory` (a `FileHistoryExport` envelope, `null` / absent = none) and every blob it references must have been
-        `PUT …/sync/blobs/{hash}` first. ≤7.51 servers consume `snapshots` and do not know `fileHistory`. SDK 16.2.0 carries
-        `fileHistory` in `pushSessionBundle` / `importSessionBundle` (and fills `snapshots: []` on the pull side when the manifest omits it); a hand-rolled
+        The file history rides `fileHistory` (a `FileHistoryExport` envelope, `null` / absent = none) and every blob it references must have been
+        `PUT …/sync/blobs/{hash}` first (the `snapshots` key of servers <= 7.51 is outside the support range; a supported server ignores it and sdk 26.0.0
+        no longer declares it). The SDK carries `fileHistory` in `pushSessionBundle` / `importSessionBundle`; a hand-rolled
         push must send `fileHistory` itself, and only to a peer whose `capabilities.sessionSyncFileHistory` is not false (server >= 7.116.0 — else the
         commit 422s `missing_blob`).
         `identical` → `{ relation:"identical", basis, payloadVerified }` with NO stagingId (skip Phase B);
@@ -3239,15 +3109,14 @@ paths:
           application/json:
             schema:
               type: object
-              required: [entryIds, snapshots, policy, anchors]
+              required: [entryIds, policy, anchors]
               properties:
                 entryIds: { type: array, items: { type: string } }
-                snapshots: { type: array, items: { $ref: '#/components/schemas/SyncSnapshot' } }
                 fileHistory:
                   oneOf:
                     - { $ref: '#/components/schemas/FileHistoryExport' }
                     - { type: 'null' }
-                  description: 'server >= 7.52: the file-history envelope (replaces `snapshots`); `null` / absent = none. Every blob it references must already be PUT.'
+                  description: 'the file-history envelope; `null` / absent = none. Every blob it references must already be PUT.'
                 policy: { type: array, items: { $ref: '#/components/schemas/SessionRulesRecord' } }
                 anchors: { type: array, items: { $ref: '#/components/schemas/SyncAnchor' } }
                 title:
@@ -3324,7 +3193,7 @@ paths:
       description: >
         2c session-sync PUSH Phase B — stream the entry log as an NDJSON REQUEST body into the staged shadow id; the
         cloud validates per-line (the streaming invariant gate) then `finish()` (exactly-one-root + leaf-resolvable) →
-        commits (the atomic swap) → replays snapshots/policy/anchors. Returns `{ relation }` (the AUTHORITATIVE in-txn
+        commits (the atomic swap) → replays fileHistory/policy/anchors. Returns `{ relation }` (the AUTHORITATIVE in-txn
         re-classify). Re-POSTing the same stagingId is idempotent. Typed errors: a per-entry / structural violation →
         422 `invalid_entries`; a line too large → 413; a commit-time TOCTOU flip to fork/stale → 409 `conflict`
         (SyncConflictError); a refused policy loosen → 403 `loosen_forbidden`; a wrong/foreign stagingId → 404.
@@ -3385,6 +3254,15 @@ paths:
             application/json:
               schema: { $ref: '#/components/schemas/PendingList' }
         '401': { $ref: '#/components/responses/Unauthorized' }
+        '500':
+          description: >-
+            server >= 7.134.0: a queue row whose stored body cannot be read (the store's refusal contract — a retry fails the same way; an operator has to repair
+            or delete that row) answers `500` + `errorCode: "approvals.read_corrupt"` (body `{ error, errorCode }`; the bad row's coordinates stay off the wire) —
+            the same judge and the same code as `GET /v1/approvals/stream`. Do NOT retry it as-is (the SDK's GET retry arm exempts the code). Every other read
+            failure (connection / timeout / store hiccup) is still `500 internal.error`. Older servers answered the corrupt row with `internal.error`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/approvals/stream:
     parameters:
@@ -4458,7 +4336,7 @@ paths:
                     verbatim 400 texts, the two capability bits to probe first and the `deny` posture are on
                     the PersistRuleSelection schema. Allow-family only (on `deny` the whole field is ignored).
 
-                    ⚠️ If the frame carried neither `ruleOffers` nor `ruleSuggestions`, do not send this key —
+                    ⚠️ If the frame carried no `ruleOffers`, do not send this key —
                     there is nothing redeemable for THIS card and the answer is necessarily
                     `rulePersisted:false` + `rule_lane_unavailable` (the missing material short-circuits BEFORE
                     any candidate comparison, so it is never `rule_not_offered`). Absence has several causes —
@@ -5327,39 +5205,6 @@ paths:
                   error: { type: string }
                   missing: { type: array, items: { type: string } }
 
-  /v1/approvals/{approvalId}:
-    parameters:
-      - $ref: '#/components/parameters/PrincipalHeader'
-      - in: path
-        name: approvalId
-        required: true
-        schema: { type: string }
-    get:
-      tags: [approvals]
-      operationId: approvalsGet
-      x-status: retired          # 5.0.0: legacy approval-store leg deleted — NO deployment serves this route.
-      summary: 'RETIRED (server 5.0.0) — by-id approval read; every deployment answers 404. Use GET /v1/approvals.'
-      description: >
-        🔴 RETIRED as of `@sema-agent/server` 5.0.0 ([2354]/[2356] A-5): the legacy approval-store polling leg
-        that served this route was deleted whole, and the durable checkpoint lane never had a by-id read
-        (it can list by scope or look up by capability token — there is no simple-id query). A worker WITH a
-        checkpoint store answers 404 `not_found.route`; a worker WITHOUT one never matches the `/v1/approvals*`
-        prefix at all. Either way: 404 on every deployment, and that 404 is indistinguishable from "no such
-        approval", which is exactly why the SDK stopped calling it (4.0.1 — `approvals.get` now reads
-        `GET /v1/approvals` and filters by `sessionId`, one round trip instead of a guaranteed-404 probe plus
-        the same list call).
-        Kept in the spec as a tombstone rather than deleted: consumers generated against an older spec need to
-        see WHY the path went away. Decide via `POST /v1/approvals/{sessionId}/decide`; list via `GET /v1/approvals`.
-        Historical shape (below) is left intact for the same reason; it describes no live behavior.
-      responses:
-        '200':
-          description: The approval row (full args projection).
-          content:
-            application/json:
-              schema: { $ref: '#/components/schemas/ApprovalRow' }
-        '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
-
   /v1/memory/export:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -7801,7 +7646,7 @@ components:
             `permissions.defaultMode`'s specific fold is documented on `TaskRequest.permissionMode`.
             🔴 ON THIS SUBMIT FACE THE KEY SET IS CLOSED (server >= 7.57.0 for the sub-tree): accepted top-level keys
             are `env` / `hooks` / `model` / `outputStyle` / `permissions` / `skillListingBudgetFraction` /
-            `skillListingMaxDescChars` / `ultracode` / `webSearch` (server >= 7.133.0 adds the three TIGHTEN-ONLY seats `complianceAdditionalDenies` / `readDenyPatterns` / `writeProtectedExtra`), and accepted `permissions.*` keys are
+            `skillListingMaxDescChars` / `ultracode` / `webSearch` (server >= 7.133.0 adds the three TIGHTEN-ONLY seats `complianceAdditionalDenies` / `readDenyPatterns` / `writeProtectedExtra`; server >= 7.134.0 adds `approvalFrameFamilies`), and accepted `permissions.*` keys are
             `allow` / `ask` / `defaultMode` / `deny` / `disableAutoMode` (server >= 7.133.0 adds `neverAuto`); anything else is 400 `request.body_shape`
             with the names in the refusal's `unknownKeys` / `unsupportedKeys` arrays (REFUSED, not dropped — a dropped
             key reads as "in effect" to the caller). The object stays OPEN here because the same `SemaSettings`
@@ -7812,6 +7657,15 @@ components:
             (the request face has no loosening arm); an empty array is the same as not sent. Bad value => 400 `request.field_invalid` with `field` + `reason` (`over_cap` + `count` + `cap` / `bad_entry` + the first bad `index`).
             Caps: 1000 entries per seat, EXCEPT `readDenyPatterns`: at most 32 entries, at most 2 `*` per path segment and 16 `*` in the whole table (every star counts, nothing is folded). A `neverAuto` name that can never match any tool => 422.
             A resume replay of a stored body whose seat went bad => 409 `resume_blocked_by_policy`. A compliance deny is a REFUSAL, not a narrowing: a request denying `web_fetch` is refused whole where the default tool surface still mounts `WebFetch` (the single-user default does).
+            🔴 `settings.approvalFrameFamilies` (server >= 7.134.0; send it on sight of `capabilities.taskSettings.approvalFrameFamilies === true` — NOT of the top-level
+            `capabilities.approvalFrameFamilies`, which <= 7.133.x already has while answering 400 `request.body_shape` for this key): the approval opening-frame FAMILIES this
+            run's client RENDERS — an array of `tool_approval` / `approval_request`, each once (`[]` reads as absent). Bad value (not an array / a word outside the set / a
+            repeat) => 400 `request.field_invalid` with `field: "settings.approvalFrameFamilies"`, `reason: "bad_entry"` and `index` (absent for a non-array). BEHAVIOR (BREAKING, wire):
+            a run whose declaration does not contain the family this worker presents (`capabilities.approvalFrameFamilies`) has NO live approval channel — no card of either
+            family (no fallback, no double send), no replay in the stream preamble of the sync stream or of `GET /v1/runs/{taskId}/events`; every ask goes to the unattended
+            policy at once: with a durable store (`capabilities.approvals`) it parks per the operator policy (default; answer through `POST /v1/approvals/{sessionId}/decide`)
+            or is refused naming the missing family; with NO durable store the gated tool is refused on the spot and the run finishes (no card, no decide). The declaration
+            rides the persisted body onto resume legs.
             🔴 `settings.hooks[]` (server >= 7.133.0; probe `capabilities.taskSettings.pluginHooks` / `managedHookGroups` — an absent or false bit = the keys are STRIPPED SILENTLY): group key `source` (closed: `managedPolicy` / `user` / `project` / `local` / `flag` /
             `managedPlugin:<name>` / `plugin:<name>`; absent = unmanaged; managed groups run in an independent lane after the unmanaged rewrites), command-entry keys `plugin { name, root, dataDir?, options? }` and exec-form `args`; a malformed one =>
             400 `request.field_invalid` with `detail: { reason: "wire_key_invalid", key, path }`; the plugin context has one 8192-character budget.
@@ -9659,6 +9513,14 @@ components:
             redispatched: { type: array, items: { type: string } }
             collapsed: { type: string }
 
+    ApprovalFrameFamily:
+      type: string
+      enum: [tool_approval, approval_request]
+      description: >-
+        The approval opening-frame FAMILY words (closed; the server's `APPROVAL_FRAME_FAMILIES` verbatim and in order): `tool_approval` = the legacy family
+        (live card `tool_approval` / close `tool_approval_complete`); `approval_request` = the card family (`approval_request` / `approval_complete` /
+        batch revoke `approval_revoke`). ONE vocabulary for two faces: the capability `approvalFrameFamilies` (which family this worker presents) and, server >= 7.134.0,
+        the request key `settings.approvalFrameFamilies` (which families this run's client renders).
     ApprovalDecision:
       type: object
       description: HITL decision (`POST /v1/approvals/:sessionId/decide`).
@@ -9726,30 +9588,17 @@ components:
             refused by the ENGINE before the CAS (409 `resume_outcome_invalid` + `field: "hostDecision"`, the card stays
             pending); outside the closed set ⇒ 400 `request.field_invalid`; any value on a direct-door worker ⇒ 400
             `decided_by_not_in_proof`. An older server (no `approvalDecidedBy` bit) refuses the key (400 `request.body_shape`).
-
-    ApprovalRow:
-      type: object
-      description: >
-        The legacy D-lane approval row of GET /v1/approvals/{approvalId} (server `ApprovalRow`,
-        plugins/approval-store-sql.ts — the row is `sendJson`'d verbatim, approvals-assistant.ts).
-        Present only on deployments running the legacy `approvalStore` leg (no `checkpointStore` wired);
-        the durable F4 lane has no by-id GET (only list + decide).
-      # 🔴 census 批2 五段:CLOSED — byte-identical to the server row type, no extra keys.
-      required: [id, taskId, sessionId, owner, scope, toolName, args, status, reason, decidedBy, createdAt, decidedAt]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-        taskId: { type: [string, 'null'] }
-        sessionId: { type: [string, 'null'] }
-        owner: { type: [string, 'null'] }
-        scope: { type: [string, 'null'], description: 'Single-DB fleet scope guard (tenant identity, owner-sourced).' }
-        toolName: { type: string }
-        args: { description: 'The reviewed tool-call args — full fidelity, not redacted (this IS the review surface).' }
-        status: { type: string, enum: [pending, approved, denied, expired] }
-        reason: { type: [string, 'null'] }
-        decidedBy: { type: [string, 'null'] }
-        createdAt: { type: string }
-        decidedAt: { type: [string, 'null'] }
+        feedback:
+          type: string
+          description: >-
+            server >= 7.134.0 (core 7.54.0) — what the approving PERSON writes in the card's "and tell the agent what to do next" input: on the resumed
+            leg it reaches the model as the user's own words (unfenced, unbounded — like the reference's accepted-prompt feedback). ONLY on a person's approve
+            (`decision: "approve"`, `decidedBy` absent or `person`): on a deny or a `decidedBy: "policy"` decision ⇒ 400 `request.field_conflict` with
+            `detail.kind: "approval_feedback"` and `detail.fields` `["feedback", "decision"]` / `["feedback", "decidedBy"]` (a denial's words go in `reason`);
+            a non-string ⇒ 400 `request.field_invalid`; any value on a direct-door worker ⇒ 400 `feedback_not_in_proof` (not inside the signed proof); words
+            carrying `<system-reminder>` ⇒ 409 `approval_binding_mismatch` (the engine's sentence; the card stays pending — ask the person to change the words,
+            do not auto-refetch and re-decide on the code). The same door serves parked background-agent cards and workflow child cards; the live
+            `POST /v1/tool-approvals/{id}/respond` does NOT take it. Servers <= 7.133.x refuse the key (400 `request.body_shape`, `unknownKeys: ["feedback"]`).
 
     Capabilities:
       type: object
@@ -10029,25 +9878,12 @@ components:
                 leaseClient: { type: boolean, description: 'server >= 7.121.0, a version bit (always true, rides with the `fleet` object): this binary carries the serving-lease CLIENT — when the engine is a fleet member (`FLEET_GENERATION`) and the center declares in its heartbeat reply that it answers renewals (`servingLease`), the engine renews and is governed by the lease. Deliberately NOT named `servingLease` (that is the center''s bit): this says the client exists, not that a lease is in force — read `/health.leaseState` for that. Absent = an older worker.' }
                 generationEcho: { type: boolean, description: 'server >= 7.121.0, a version bit (always true, rides with the `fleet` object): this binary echoes env `FLEET_GENERATION` as `generation` on the heartbeat and on `/health` (with `leaseState` / `leaseUntil`), and the drain endpoint `POST /v1/admin/drain` compares the four-part identity including `expectedGeneration`. Absent = an older worker.' }
         workspace:
+          type: boolean
+          enum: [false]
           description: >
-            #3 (server 1.299–7.51): workspace-browse capability family — an OBJECT when the E19 snapshot-store
-            read faces + a durable session store are wired ({browse, archive, maxFileBytes}); `false`/absent
-            otherwise (same predicate as the routes' 501). `maxFileBytes` = the single-file read cap (over-cap
-            ⇒ 413 workspace_file_too_large envelope; the archive endpoint is the escape hatch).
-            🔴 RETIRED (server ≥7.52, S-15/design/381): the whole-tree snapshot epoch this face projected was
-            replaced by per-edited-file rewind history, so this key is now ALWAYS false and the four
-            /v1/sessions/{sessionId}/workspace* routes answer 501 `capability.workspace_retired` (route shape
-            kept as a tombstone — a named refusal, not a 404 that reads like a typo). Consumption posture
-            unchanged: probe this bit, false ⇒ don't render the panel.
-          oneOf:
-            - type: boolean
-              enum: [false]
-            - type: object
-              additionalProperties: true
-              properties:
-                browse: { type: boolean }
-                archive: { type: boolean }
-                maxFileBytes: { type: integer }
+            The workspace-browse bit — ALWAYS `false` on every supported server (>= 7.52.0: the whole-tree snapshot epoch was replaced by
+            per-edited-file rewind history; the four /v1/sessions/{sessionId}/workspace* routes answer 501 `capability.workspace_retired`, route shape kept as a
+            tombstone). sdk 26.0.0 deleted the object arm `{ browse, archive, maxFileBytes }` (servers 1.299–7.51, below the support floor).
         sessionEvents:
           type: boolean
           description: >
@@ -10140,7 +9976,7 @@ components:
         approvalFrameFamilies:
           type: array
           maxItems: 1
-          items: { type: string, enum: [tool_approval, approval_request] }
+          items: { $ref: '#/components/schemas/ApprovalFrameFamily' }
           description: >-
             server >= 7.133.0, ALWAYS present (the projection of the same judgement as `streamApproval`) — which FRAME FAMILY this worker's approval opening frames belong to:
             a closed-word array with AT MOST ONE member. `["approval_request"]` = the card protocol is on: one ask travels only `approval_request` -> `approval_complete` / `approval_revoke`
@@ -10148,6 +9984,9 @@ components:
             remedy on the worker: `STREAM_APPROVAL_ENABLED=false`). `["tool_approval"]` = the card protocol is not on (`STREAM_APPROVAL_ENABLED=false`, no store backend, or no checkpoint store) but the live card leg is.
             `[]` = per-call approvals are off altogether (`TOOL_APPROVAL_ENABLED=false`): no card is presented. Dispatch frame families off THIS array, never off `streamApproval`.
             KEY ABSENT (not `[]`) = server <= 7.132.x — there a `streamApproval: true` leg sends BOTH families for one ask.
+            🔴 server >= 7.134.0: this bit says which family THIS WORKER presents, no longer that you will receive cards — a run has a live approval channel only when
+            its submit body declared that family in `settings.approvalFrameFamilies` (send it on sight of `taskSettings.approvalFrameFamilies`, not of this bit — <= 7.133.x
+            already had this bit yet answers 400 `request.body_shape` for the key). The value does not change with a declaration. The words are the request key's words.
         streamApproval:
           type: boolean
           description: >
@@ -10324,6 +10163,7 @@ components:
             pluginHooks: { type: boolean, description: 'server >= 7.133.0 — the request `settings.hooks[]` PLUGIN-CONTEXT keys (command entry `plugin { name, root, dataDir?, options? }` / exec-form `args`) are accepted; same predicate as `hooks` (single-user true, multi-tenant false). ABSENT or false = the keys are stripped silently — send only on sight of the bit.' }
             managedHookGroups: { type: boolean, description: 'server >= 7.133.0 — the request `settings.hooks[]` GROUP `source` key (managed lanes `managedPolicy` / `managedPlugin:<name>`) is accepted; same predicate as `hooks`. ABSENT or false = stripped silently (the managed-lane semantics do not apply, it is not a refusal).' }
             tightenOnlySeats: { type: boolean, description: 'server >= 7.133.0, constant true — the four tighten-only request seats `settings.readDenyPatterns` / `settings.writeProtectedExtra` / `settings.complianceAdditionalDenies` / `settings.permissions.neverAuto` are accepted (each seat = deployment table UNION request list, only ever growing; an empty array is the same as not sent). ABSENT = server <= 7.132.x, which answers 400 `request.body_shape` for those keys — send only on sight of the bit.' }
+            approvalFrameFamilies: { type: boolean, description: 'server >= 7.134.0, constant true — the request key `settings.approvalFrameFamilies` (which approval opening-frame families this run''s client renders) is accepted. THIS is the trigger bit for that key, NOT the top-level `approvalFrameFamilies`: servers <= 7.133.x already carry the top-level bit yet answer 400 `request.body_shape` (`unknownKeys: ["settings.approvalFrameFamilies"]`) for the key. ABSENT = do not send it.' }
         settings:
           type: object
           description: >
@@ -11931,7 +11771,8 @@ components:
       # 没声明 ⇒ 键缺席 ⇒ 不再是必有键(此前由 `input` 恒算成布尔,对没声明的条目报 false)。
       # 🔴 server 7.131.0 起 `reasoning` 同样三态:env 车道 `MODEL_REASONING` / `MODEL_VISION` 缺省 true 退役、中心名册条目不写即不声明
       # ⇒ 两键都「未声明 = 键缺席」,`required` 只剩 name / id / provider(sdk 23.1.0;TS 型 `ModelInfo.reasoning?` 早已可选)。
-      required: [name, id, provider]
+      # sdk 26.0.0(支持底线 7.52.0):`routePairing` 进 required(≥7.45 恒铸,此前因地板 3.0.0 不进)。
+      required: [name, id, provider, routePairing]
       additionalProperties: false
       properties:
         name: { type: string, description: 'the @mention handle (user-pickable model name).' }
@@ -11955,8 +11796,8 @@ components:
             adjudicated" must stay distinguishable on the wire). Declared here 2026-09-10 alongside `compat`:
             this schema is CLOSED, and the key has been minted unconditionally since 7.45 — so every real
             /v1/models response has been structurally rejected by a strict validator for the whole time (same
-            class as `hasBidiControls` on InboxRow). Optional here because the SDK's supported server floor is
-            3.0.0; the discriminant is the PEER'S VERSION, not this key's presence.
+            class as `hasBidiControls` on InboxRow). REQUIRED since sdk 26.0.0 (the support floor 7.52.0 is above 7.45; it
+            was optional only while the floor was 3.0.0).
         compat:
           $ref: '#/components/schemas/ModelCompat'
           description: >-
@@ -12766,19 +12607,6 @@ components:
         startedAt: { type: integer }
         elapsedMs: { type: integer }
         tokens: { type: integer }
-        # tokenDir REMOVED (engine ruling 2026-06-28): dead field, 0 producer / 0 consumer — spec caught up 2026-07-26.
-        queuedCount:
-          type: integer
-          description: >-
-            🔴 PHANTOM KEY — NO server version ever emits it (verified against the published 7.87.0 bytes:
-            the row type declares it and the fleet route's per-key table forwards it, but NO producer writes it
-            — not `publishTask`'s call sites, not core's bg-sink tick, not the durable reconcile leg — and the
-            wire contract does not mention it either). The server deleted it as a DEAD KEY (S-459, zero
-            behavioural impact since `!== undefined` was always false). It stays declared here only because
-            removing an exported field is BREAKING = major-only; it is registered with its deletion condition
-            in `test/_keyset-divergence.ts` (`FLEET_TASK_ROW_PHANTOM_KEYS`) and goes with the next major.
-            DO NOT read it as "queue depth is already reported" — a permanently absent optional key is a FALSE
-            LEAD. Real queue depth needs a NEW key WITH a producer, not this one resurrected.
         awaitingPlanApproval: { type: boolean }
         currentAction: { type: string, description: "The child's most recent tool intent as one human-readable line (UNTRUSTED argument head, redacted server-side)." }
         currentTool:
@@ -12892,6 +12720,13 @@ components:
         failedCount: { type: integer }
         elapsedMs: { type: integer }
         tokens: { type: integer }
+        errorCode:
+          type: string
+          description: >-
+            server >= 7.134.0 — the workflow run's MACHINE code (open set; the same words as the same-named slot on `GET /v1/workflows/{id}`): carried verbatim when the
+            run row has one, the key ABSENT otherwise (never an empty string). A parked workflow run reads `status: "failed"` + `errorCode: "workflow.agent_parked"`
+            (parked, not failed; the `status` vocabulary gains no word). Snapshot rows, `workflow` upsert frames and rows merged from the terminal window share one mint
+            point; a `?session=` subscriber's demoted rows carry it too. ABSENT = an older server, or no code on this row — fall back to `status`.
     FleetFrame:
       description: >
         One decoded frame off GET /v1/fleet/stream (service streamFleet emit set, src/http/routes/fleet.ts). On the
@@ -13105,7 +12940,8 @@ components:
         DISTINCT vocabulary from AgentEvent (the durable log is BLOCK-grained, each frame is a delta to append).
         Resumable (each `id:` = the durable task_event.seq; on 416 the server returns `{retainedFrom}` and the SDK
         resumes from there after a turns full-sync). Known events: meta / block-thinking-delta / block-content-delta
-        / tool-call / tool-result / turn / done / error (+ heartbeat keep-alives the SDK swallows). Open set.
+        / tool-call / tool-result / prompt-assembled / cross-boundary-taint (server >= 7.134.0: the device lane's taint row + `seq`, see
+        `Event_cross_boundary_taint`) / turn / done / error (+ heartbeat keep-alives the SDK swallows). Open set.
         NOTE: SSE framing on the wire (event name + JSON data + optional id), not a JSON body.
       required: [event, data]
       additionalProperties: true
@@ -13122,10 +12958,11 @@ components:
               description: >
                 契约调和车1 G(2026-08-02;server [2373]C-12, `src/trace/project.ts` + the meta frame at
                 `routes/trace-usage.ts`): the frame's own event name, DOUBLE-EMITTED inside `data`. Always
-                present on server >= 5.0.0; OPTIONAL here because the SDK's supported floor is server 3.0.0
-                (where only the `error` frame carried it). Equal to the SSE `event:` line verbatim — its reason
-                to exist is the proxy/relay case that strips the `event:` line and forwards only the data JSON,
-                where this is the only key left to dispatch on. Heartbeats (`data: {}`) carry none.
+                present on every named frame of a supported server (>= 7.52.0; minted since server 5.0.0) — the SDK's
+                typed arms declare it REQUIRED since 26.0.0; it is not in this schema's `required` only because the one
+                schema also covers heartbeats (`data: {}`, which carry none and which the SDK swallows). Equal to the SSE
+                `event:` line verbatim — its reason to exist is the proxy/relay case that strips the `event:` line and
+                forwards only the data JSON, where this is the only key left to dispatch on.
             output:
               allOf: [{ $ref: '#/components/schemas/ToolOutput' }]
               description: >
@@ -13528,26 +13365,13 @@ components:
                 is RETIRED: the SQL backend rewrote its parked rows once at the 7.117.0 boot to `[{ member: "persisted", entries: [<old value>] }]`, but the
                 file backend's pre-upgrade parked rows and run results already on disk (`checkpointGate.riskDescriptor`) keep the old key verbatim
                 (text still redacted, no structured disclosure) — a consumer reading those must still tolerate the old string.
-        # server 7.16.0 [3684]② — durable 队列行归因两键(与活卡 tool_approval 帧的同名键语义同族、判据不同源;
-        # 两条腿对同一只 ask 的在场性可以不一致,两侧都只认在场、都禁把缺席读成否定)。
-        ruleSuggestions:
-          type: array
-          minItems: 1
-          items: { $ref: '#/components/schemas/RuleSuggestion' }
-          description: >
-            server 7.16.0 ([3684]②), ADDITIVE: the rule candidates minted for this ask, replayed off the durable
-            row (checkpoint.rule_suggestions). DISPLAY-ONLY on this leg — the durable queue has no persistRule
-            redemption; the only redemption path is the LIVE card leg (respond + persistRule). Array order =
-            display order; an EXACT entry, when present, is always first. core contract caps candidates at 2;
-            the server enforces a tolerance cap of 4 on read-back — lay out for 4. Absent = pre-column row
-            (parked before the column existed) OR no candidates; render both as "no candidates", never an error.
         ruleOffers:
           type: array
           minItems: 1
           items: { $ref: '#/components/schemas/RuleOffer' }
           description: >
             server >= 7.46.0 (core 5.58.0, design/375) — the discriminated-union successor of the retired
-            `ruleSuggestions` above on the DURABLE queue row (core `PendingAction.ruleOffers`, the same
+            `ruleSuggestions` (servers <= 7.45; sdk 26.0.0 deleted it) on the DURABLE queue row (core `PendingAction.ruleOffers`, the same
             contract as the sync leg's `AskRequest.ruleOffers`). A >= 7.46.0 row carries only the new key;
             pre-5.58 rows fail the new narrow read entry by entry and land as "no supply" (no compatibility
             read — a stale schema means re-ask).
@@ -13772,25 +13596,20 @@ components:
             one-off question. The value comes WHOLE from core (`summarizeCheckpoint` echoes it only when the
             cause is a member of the engine's set), so the server neither recomputes nor re-screens it. See
             ClassifierUnavailable for the open-`cause` rule and the three shapes absence covers.
-            RETIRED: server >= 7.72.0 (core 7.14.0 #688) never mints this key on any of the three faces; its
+            RETIRED: server >= 7.72.0 (core 7.14.0) never mints this key on any of the three faces; its
             successor is `disposition.cause` on the gate record (`unavailable` / `parse_error` — a different
-            question, so an old switch does not port). Kept for servers in [7.69.0, 7.72.0) only (sdk 9.2.0).
+            question, so an old switch does not port). Kept for servers in [7.69.0, 7.72.0) only (sdk 9.2.0); the row key retires
+            together with the frame key (floor ≥ 7.106.0, next major); why the frame still declares it: `ToolApprovalFrame.classifierUnavailable`.
         ruleStoreUnreadable:
           type: string
           enum: [store, call]
           description: >-
-            server >= 7.72.0 (core 7.14.0 #688 C3), ADDITIVE — WHICH HALF of the rule lane could not be read.
-            Present iff `origin === "rule_store_unavailable"`: `store` = the wired rule store could not be read
-            (look at the store / network); `call` = the store was read but THIS command could not be read against
-            the person's deny/ask rows (look at the command spelling). One `origin` word covers both facts, and
-            their recovery verbs live in different places (ops vs prompt). Carried on the live `tool_approval`
-            frame and the inbox row; the `card_json` card deliberately does NOT carry it (it travels with `origin`,
-            which is not on the card). Absence = `origin` is not that word — NOT an assertion that the rule store
-            is healthy.
-            RETIRED: server >= 7.106.0 (core 7.34.0 C-R172, BREAKING — wire) never mints this key on either face — an
-            unreadable rule store no longer raises a card: that read's rows are SKIPPED by partition and the session
-            stream gets the user-facing `engine_notice` `permission.rule_store_unavailable` (`detail.at` = `prepare` /
-            `call`). Kept for servers in [7.72.0, 7.106.0) only (sdk K-32); `origin: rule_store_unavailable` itself stays.
+            server >= 7.72.0 (core 7.14.0 #688 C3), ADDITIVE — WHICH HALF of the rule lane could not be read (`store` / `call`).
+            The same key, with the same two words and the same reading, as on the live frame; the authoritative statement of the shape, the presence
+            rule, what the two words mean and the retirement wording is on `ToolApprovalFrame.ruleStoreUnreadable`, and this description points to it.
+            RETIRED: server >= 7.106.0 never mints this key on either face (the frame's description names the successor). Kept for
+            servers in [7.72.0, 7.106.0) only (sdk K-32); the row key retires together with the frame key (floor ≥ 7.106.0, next major);
+            `origin: rule_store_unavailable` itself stays.
 
     InboxList:
       type: object
@@ -14685,26 +14504,6 @@ components:
         parentId: { type: [string, 'null'] }
         type: { type: string, description: Entry discriminator (message / leaf / compaction / …) — opaque to the SDK. }
 
-    SyncSnapshot:
-      type: object
-      description: >
-        One E19 file snapshot keyed by a `SessionTreeEntry.id`. `manifest` = `[relPath, blobHash]` tuples; the blob
-        BYTES are NOT inlined (they ride the content-addressed blob routes).
-      # 封闭(census 批2 第三段,2026-07-30):server 侧类型+铸造点(`session-sync.ts` PULL 出 /
-      # `routes/session-sync.ts` PUSH 校验形)都恰是这两键。
-      additionalProperties: false
-      required: [key, manifest]
-      properties:
-        key: { type: string }
-        manifest:
-          type: array
-          items:
-            type: array
-            minItems: 2
-            maxItems: 2
-            items: { type: string }
-            description: A `[relPath, blobHash]` tuple.
-
     SyncAnchor:
       type: object
       description: One E18 resume-at anchor. `owner` is RE-KEYED to the importing principal on a PUSH (§9).
@@ -14732,31 +14531,28 @@ components:
       description: >
         2c session-sync `GET …/sync/manifest` payload (wrapped server-side as `{ manifest }`). The THIN cross-backend
         snapshot: entry IDS (oldest-first, NOT payloads) + the file-history envelope + policy + anchors + leaf.
-        🔴 server >= 7.52 (S-15, design/381; re-read byte for byte against 7.116.0): the key `snapshots` (per-snapshot
-        relPath→blobHash, the retired E19 whole-tree snapshot epoch) is NO LONGER SENT — the server's `exportSessionManifest` mints
-        `{ sessionId, entryIds, entryCount, leafId, fileHistory, policy, anchors }` (server >= 7.125.0 adds the session row's two writable bits `title` / `pinned`,
-        present-iff the session is a row of the list face — see the two properties) and `fileHistory` (core's versioned
-        `FileHistoryExport` envelope; `null` = no history / the source store cannot export) replaces it. <= 7.51 servers still send
-        `snapshots` and no `fileHistory`. The blob BYTES never ride the manifest: content-addressed, via the history blob faces
-        (`GET …/sync/history/blobs/{hash}` / `PUT …/sync/blobs/{hash}`; probe `capabilities.sessionSyncFileHistory` on BOTH ends).
-        The SDK's `manifest()` fills `snapshots: []` when the wire omits it.
+        The server's `exportSessionManifest` mints `{ sessionId, entryIds, entryCount, leafId, fileHistory, policy, anchors }` (server >= 7.125.0 adds the
+        session row's two writable bits `title` / `pinned`, present-iff the session is a row of the list face — see the two properties). `fileHistory`
+        (core's versioned `FileHistoryExport` envelope; `null` = no history / the source store cannot export) is ALWAYS present on a supported server
+        (>= 7.52.0); the retired E19 whole-tree snapshot key `snapshots` of servers <= 7.51 is below the support floor (sdk 26.0.0 deleted it). The blob BYTES
+        never ride the manifest: content-addressed, via the history blob faces (`GET …/sync/history/blobs/{hash}` / `PUT …/sync/blobs/{hash}`; probe
+        `capabilities.sessionSyncFileHistory` on BOTH ends). The SDK returns the wire verbatim.
       # 封闭(census 批2 第三段,2026-07-30;16.2.0 按 7.116.0 发布字节重核):铸造点 `session-sync.ts`(exportSessionManifest 尾部
       # 字面量)恰是 `{ sessionId, entryIds, entryCount, leafId, fileHistory, policy, anchors }` 7 键(≥7.52),无 `snapshots`;
       # server ≥7.125.0 另有 `title` / `pinned` 两键(会话行可写位,present-iff 会话是列表面上的行;条件展开,不进 required);
-      # ≤7.51 老 server 发 `snapshots`、无 `fileHistory` ⇒ 两键都不进 required(支持底线 3.0.0)。
+      # sdk 26.0.0(支持底线 7.52.0):`fileHistory` 进 required(支持面内恒铸),`snapshots` 删(≤7.51 才发)。
       additionalProperties: false
-      required: [sessionId, entryIds, entryCount, leafId, policy, anchors]
+      required: [sessionId, entryIds, entryCount, leafId, fileHistory, policy, anchors]
       properties:
         sessionId: { type: string }
         entryIds: { type: array, items: { type: string }, description: Oldest-first, verbatim cross-backend. }
         entryCount: { type: integer, description: '= entryIds.length (the `/sync/entries` trailer count).' }
         leafId: { type: [string, 'null'] }
-        snapshots: { type: array, items: { $ref: '#/components/schemas/SyncSnapshot' }, description: 'server <= 7.51 ONLY (the retired E19 snapshot epoch); server >= 7.52 does not send it — see `fileHistory`.' }
         fileHistory:
           oneOf:
             - { $ref: '#/components/schemas/FileHistoryExport' }
             - { type: 'null' }
-          description: 'server >= 7.52: the per-edited-file rewind history envelope; `null` = no history / the source store cannot export; key ABSENT = a <= 7.51 server (that generation sends `snapshots`).'
+          description: 'the per-edited-file rewind history envelope; `null` = no history / the source store cannot export. Always present on a supported server.'
         policy: { type: array, items: { $ref: '#/components/schemas/SessionRulesRecord' } }
         anchors: { type: array, items: { $ref: '#/components/schemas/SyncAnchor' } }
         title:
@@ -14819,20 +14615,18 @@ components:
     SessionBundle:
       type: object
       description: >
-        The portable state of ONE session, ready to replay into another backend. Blobs are NOT inlined (each
-        snapshot carries only its `manifest`; the bytes stream through the content-addressed blob routes). The SDK
-        assembles this from a manifest + the streamed entries for a PUSH. server >= 7.52: the file history rides `fileHistory`
-        (the `FileHistoryExport` envelope) instead of `snapshots`.
-      required: [sessionId, entries, snapshots, policy, anchors]
+        The portable state of ONE session, ready to replay into another backend. Blobs are NOT inlined (the file-history
+        envelope carries only blob hashes; the bytes stream through the content-addressed blob routes). The SDK
+        assembles this from a manifest + the streamed entries for a PUSH.
+      required: [sessionId, entries, fileHistory, policy, anchors]
       properties:
         sessionId: { type: string }
         entries: { type: array, items: { $ref: '#/components/schemas/SyncEntry' } }
-        snapshots: { type: array, items: { $ref: '#/components/schemas/SyncSnapshot' } }
         fileHistory:
           oneOf:
             - { $ref: '#/components/schemas/FileHistoryExport' }
             - { type: 'null' }
-          description: 'server >= 7.52 file-history envelope (same as `SessionManifest.fileHistory`); key absent = the source is a <= 7.51 server.'
+          description: 'the file-history envelope (same as `SessionManifest.fileHistory`; `null` = none, or the pull did not carry it because the source has no blob faces).'
         policy: { type: array, items: { $ref: '#/components/schemas/SessionRulesRecord' } }
         anchors: { type: array, items: { $ref: '#/components/schemas/SyncAnchor' } }
 
@@ -15020,8 +14814,9 @@ components:
             <= 7.105.0 answered the synchronous leg 200 + a failed body), `corrupt` (500 — the session rule store
             cannot read its own bytes), `internal.memory_control_plane_corrupt` (500 — the memory control plane refuses
             fail-closed) and `state.scenario_assignment_unknown` (503, server >= 7.119.0 — the center's scenario assignment for the
-            principal is dangling; only re-pointing the assignment, or adding the scenario back to the deployment, helps). Every other 5xx
-            code keeps the status-based retry.
+            principal is dangling; only re-pointing the assignment, or adding the scenario back to the deployment, helps) and
+            `approvals.read_corrupt` (500, server >= 7.134.0 on `GET /v1/approvals` — a queue row's stored body cannot be read; an operator has to repair or
+            delete the row). Every other 5xx code keeps the status-based retry.
             🔴 `request.host_posture_refused` (422) has TWO triggers (same code, same status — "you wrote it right, this
             deployment will not grant that host posture"): (1) the write-containment face (`permissionMode: bypassPermissions` ⇒
             `writeFace: open`; read `capabilities.taskWriteFaceOpen` first); (2) server >= 7.106.0 / S-895: `inheritEnv: "all"` on a
@@ -15095,7 +14890,7 @@ components:
             S-904): `over_cap` (more than `cap` entries; beside `count` + `cap`) / `bad_entry` (a non-string or empty item; beside
             `index`); server >= 7.132.0 widens that group to every tool-name list on the body, the agent definitions and the two host-path lists, and adds
             `too_long` (a text over its character cap; beside `count` + `cap`) — closed words `over_cap` / `too_long` / `bad_entry` (SDK `RequestFieldRefusalExtra`); server >= 7.133.0 adds `too_large` (a payload over its BYTE cap, only on 413 `request.payload_too_large`: `{ field: "body", reason: "too_large", cap }` — `count` ABSENT when the read stopped at the cap and cannot measure; a request body over 8 MiB is now always that 413) and the `request.invalid_json` reasons `not_json` | `not_object` (400, every JSON-body door; formerly `request.rejected`/`request.body_shape` by door).
-            On 409 refusals of a resume (server >= 7.132.0): the engine's `CheckpointErrorReason` arm (`detail.reason` passed through; see `blockedBy`). On 400 `rules.inert_entry` (server >= 7.129.0): the engine's `ALLOW_ENTRY_INERT_REASONS` (`tool_name` / `wildcard_all` / `namespace_wildcard` / `content_unsupported` / `grammar` / `near_miss` / `earlier_grammar`). Out-of-vocabulary word ⇒ treat as unknown. (Other codes carry their own `reason` words.)
+            On 409 refusals of a resume (server >= 7.132.0) and on 422 `parked_resume.startup_failed` (server >= 7.134.0 — the parked background agent's pre-claim failure; absent when the engine gave none): the engine's `CheckpointErrorReason` arm (`detail.reason` passed through; see `blockedBy`). On 409 `conflict.checkpoint_ctx_unsealable` (server >= 7.134.0): why the request's credentials cannot be sealed into, or unsealed from, the stored resume context — a closed five-word set (SDK `CHECKPOINT_CTX_UNSEALABLE_REASONS`); which doors can answer which word is written once, in the SDK documentation of `CHECKPOINT_CTX_UNSEALABLE_REASONS`, not here: `no_key_store` (this server has no sealed-key store) / `key_not_held` (sealed with a key this server does not hold — another replica's, or a replaced sealed-key directory) / `unopenable` (the sealed value is damaged or belongs to another session) / `plaintext` (an older server stored it unsealed) / `unrecognized_seal` (a seal format this version does not know) — the way out depends on the door and the `reason`: `key_not_held` (a resume door) — have the operator restore the sealed-key directory that sealed it and restart that replica (it reads its keys only at startup), then resend the same request; `no_key_store` on the submit door — give the service a writable sealed-key directory (`<data root>/sealed-key/`, read at startup), or resubmit WITHOUT those credentials — resending the same submit body is refused again; `no_key_store` on a resume door — the same way out as `key_not_held`: restore the directory that sealed it and restart, then resend (a fresh empty directory does not help: it holds no such key, so the next read says `key_not_held`); `unopenable` / `plaintext` / `unrecognized_seal` — submit the work as a new task (cancel the still-suspended one first); never auto-retry, never match the sentence. A resume door's refusal decides nothing and starts no resume (the card stays pending; the known exception is a terminal run's steer race arm, which first opens a wake card and, when the second read fails for any of the five reasons, withdraws it and then answers 409 — if the withdrawal fails the server only logs it); a submit door's refusal lands before the task runs (nothing runs; a run row already opened for it is closed as `failed` and its idempotency key released, both best-effort — a failed step is only logged by the server and the answer is still the 409). On 400 `rules.inert_entry` (server >= 7.129.0): the engine's `ALLOW_ENTRY_INERT_REASONS` (`tool_name` / `wildcard_all` / `namespace_wildcard` / `content_unsupported` / `grammar` / `near_miss` / `earlier_grammar`). Out-of-vocabulary word ⇒ treat as unknown. (Other codes carry their own `reason` words.)
         retryAfterSec:
           type: number
           description: >-
@@ -15122,6 +14917,10 @@ components:
             `null` and `""` count), the refusal landed before any decision, and `field` is the literal `settledBy`; the three doors now answer
             the SAME sentence. Every such 400 carries it, even when another defect in the same body was hit first (the sentence then names that
             defect). Branch on the code plus `field`, never on the sentence; a bad body WITHOUT that key carries no `field`. SDK: `err.extra.field`.
+            server >= 7.134.0: on 409 `conflict.checkpoint_ctx_unsealable` `field` is the SUBMIT-BODY PATH of the credential slot that cannot be sealed or unsealed (arrays
+            `[i]`, record members `.key`: `mcpServers[0].transport.headers.Authorization`, `settings.hooks.PreToolUse[0].hooks[0].headers.Authorization`; the key
+            name is not a secret, the value never enters the refusal); on 400 `request.field_invalid` for the request key `settings.approvalFrameFamilies` it is
+            that literal (with `reason: "bad_entry"` and the bad `index`; no `index` for a non-array).
         detail:
           description: >
             🔴 SHAPES differ by code — branch on `field` (or the `errorCode`), never guess from the type of `detail`. On 503
@@ -15256,8 +15055,9 @@ components:
                 callerTrust: { type: string }
             - type: object
               description: >-
-                server >= 7.133.0 — 400 `request.field_conflict`: the request body contradicts itself. `kind` = which constraint (a CLOSED fourteen-word set, read open: cascade_verify | image_profile | resume_anchor |
-                system_prompt_fold | file_history_restore | skills_disabled | existing_session | scratchpad_root | ask_answer | policy_person_ask | plan_edit | plan_mode_after | bound_call_door | remember_decision);
+                server >= 7.133.0 — 400 `request.field_conflict`: the request body contradicts itself. `kind` = which constraint (a CLOSED set — fourteen words, fifteen from server >= 7.134.0 — read open: cascade_verify | image_profile | resume_anchor |
+                system_prompt_fold | file_history_restore | skills_disabled | existing_session | scratchpad_root | ask_answer | policy_person_ask | plan_edit | plan_mode_after | bound_call_door | remember_decision |
+                approval_feedback (server >= 7.134.0: `feedback` on a deny — fields `["feedback", "decision"]` — or on a policy decision — `["feedback", "decidedBy"]`));
                 `fields` = the named body coordinates, subject first (at least one; a dynamic index reads `agents[1].skills`); `count` / `cap` only on the fold-cap kind (the folded total and its cap).
               required: [kind, fields]
               additionalProperties: false
@@ -15303,6 +15103,8 @@ components:
             the engine's `detail.code` passes through as `blockedBy` (today only `checkpoint.config_refused` carries it — the closed set is core's
             `CHECKPOINT_CONFIG_REFUSAL_CODES`, 40 words since core 7.53.0; read it as "the errorCode a fresh run would report for the same bad configuration"),
             next to `field` and `reason`, absent keys not minted (SDK `ResumeRefusalExtra`).
+            server >= 7.134.0 / core 7.54.0: the SAME three keys on 422 `parked_resume.startup_failed` (a parked background agent's leg refused before the claim — the
+            engine now hands the failure's code / field / reason to the redemption receipt; absent when the engine gave none; <= 7.133.x carried only `cause` there).
 
     ResumeLegConflictError:
       description: >
@@ -15386,6 +15188,9 @@ components:
         # 🔴 census 轴一(2026-07-30)补的 4 臂:server 今天就真发,spec/SDK 两侧此前同缺(详见各 schema 处的注)。
         - $ref: '#/components/schemas/Event_context_usage'
         - $ref: '#/components/schemas/Event_config_assembled'
+        # server >= 7.134.0 (core 7.54.0): the device lane's cross-boundary taint row — DURABLE only (the `GET /v1/runs/{taskId}/events` ledger replay), never
+        #   on the live stream and never on the `GET /v1/runs/{taskId}` poll object; the trace SSE twin is the `cross-boundary-taint` frame.
+        - $ref: '#/components/schemas/Event_cross_boundary_taint'
         - $ref: '#/components/schemas/Event_needs_review'
         - $ref: '#/components/schemas/Event_message_committed'
         # [2373]A-2(2026-08-03,server 5.0.0):compaction_outcome 三腿同源批的 spec 半场(SDK 臂 20867e1 同批)。
@@ -15464,6 +15269,7 @@ components:
           failed: '#/components/schemas/Event_failed'
           context_usage: '#/components/schemas/Event_context_usage'
           config_assembled: '#/components/schemas/Event_config_assembled'
+          cross_boundary_taint: '#/components/schemas/Event_cross_boundary_taint'
           needs_review: '#/components/schemas/Event_needs_review'
           message_committed: '#/components/schemas/Event_message_committed'
           compaction_outcome: '#/components/schemas/Event_compaction_outcome'
@@ -15690,10 +15496,10 @@ components:
     # 每只闭集 = 引擎今天的词 ∪ 引擎退役词表里那一集。这五张 enum 与引擎 `RETIRED_MEMBERS` 逐集逐词同(由 `server-7129-wire` 对拍);卡面 / 队列行 / 请求面的同名闭集只取今天的词。
     GateRecordAskClass:
       type: string
-      enum: [content_question, hook, ancestor, dangerous_delete, unverifiable_delete, unverifiable_shell_text, transcript_write, org_rule, rule_unreadable, ask_rule, denial_limit_fallback, classifier_no_ruling, requires_user_interaction, operator_forced, shell_floor, target_unresolved, probe, write_protection, tool_marks_mcp, tool_marks_a2a, policy_rra, artifact_shared_read, mode, unstated, ordinary, write_protection_unresolved, governance_unavailable]
+      enum: [content_question, hook, ancestor, dangerous_delete, unverifiable_delete, unverifiable_shell_text, transcript_write, org_rule, rule_unreadable, ask_rule, denial_limit_fallback, classifier_no_ruling, requires_user_interaction, cross_boundary, operator_forced, shell_floor, target_unresolved, probe, write_protection, tool_marks_mcp, tool_marks_a2a, policy_rra, artifact_shared_read, mode, unstated, ordinary, write_protection_unresolved, governance_unavailable]
       description: >-
         The class word on a GATE RECORD (`tool_end.gate.disposition.askClass` / `.classes` on the mode-refusal arm, `ModeRelease.askClass` / `.classes`) — server >= 7.129.0 reads the record as an ARCHIVE:
-        today's `AskClass` set (twenty-five words) PLUS the words the engine retired (`write_protection_unresolved`, retired in core 7.49.0 — renamed `target_unresolved`; `governance_unavailable`,
+        today's `AskClass` set (twenty-six words; `cross_boundary` from server >= 7.134.0) PLUS the words the engine retired (`write_protection_unresolved`, retired in core 7.49.0 — renamed `target_unresolved`; `governance_unavailable`,
         retired in core 7.51.0 — merged into `rule_unreadable`). A record the previous engine generation legally wrote is replayed byte for byte (a 7.50.x mode refusal can carry `governance_unavailable`);
         a word NO engine generation ever minted (a case variant, the empty string, a future word) withholds the whole `gate` and counts `server.trace.gate-outcome-defective`.
         Render a known archive word normally and an unknown one generically; never drop the record because the word is not in today's set.
@@ -15711,9 +15517,9 @@ components:
         OMITTED `reason` for the two retired words (`released` was still sent); from 7.129.0 they arrive verbatim on the replay faces. Same reading as `GateRecordAskClass`.
     GateRecordPersistedRuleMandate:
       type: string
-      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved, write_protection_unresolved]
+      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved, cross_boundary_taint, write_protection_unresolved]
       description: >-
-        `released.mandate` on a GATE RECORD (archive read, server >= 7.129.0): today's six `PersistedRuleMandate` words PLUS the retired `write_protection_unresolved` (core 7.49.0 rename). Same reading as `GateRecordAskClass`.
+        `released.mandate` on a GATE RECORD (archive read, server >= 7.129.0): today's seven `PersistedRuleMandate` words (`cross_boundary_taint` from server >= 7.134.0) PLUS the retired `write_protection_unresolved` (core 7.49.0 rename). Same reading as `GateRecordAskClass`.
     GateRecordAskOrigin:
       type: string
       enum: [content_question, plan_review, ancestor_marked, org_unavailable, org_rule, rule_store_unavailable, hook, ask_rule, denial_limit_fallback, shell_gate_tighten, safety_tighten, policy, unresolvable]
@@ -15944,9 +15750,10 @@ components:
         `UNATTENDED_PERMISSION_MODE=dontAsk`).
     AskClass:
       type: string
-      enum: [content_question, hook, ancestor, dangerous_delete, unverifiable_delete, unverifiable_shell_text, transcript_write, org_rule, rule_unreadable, ask_rule, denial_limit_fallback, classifier_no_ruling, requires_user_interaction, operator_forced, shell_floor, target_unresolved, probe, write_protection, tool_marks_mcp, tool_marks_a2a, policy_rra, artifact_shared_read, mode, unstated, ordinary]
+      enum: [content_question, hook, ancestor, dangerous_delete, unverifiable_delete, unverifiable_shell_text, transcript_write, org_rule, rule_unreadable, ask_rule, denial_limit_fallback, classifier_no_ruling, requires_user_interaction, cross_boundary, operator_forced, shell_floor, target_unresolved, probe, write_protection, tool_marks_mcp, tool_marks_a2a, policy_rra, artifact_shared_read, mode, unstated, ordinary]
       description: >
-        core `ASK_CLASSES` (TWENTY-FIVE words as of core 7.51.0 / server >= 7.129.0: `governance_unavailable` was merged into `rule_unreadable`, no alias — sdk 23.0.0; a stored card / parked row written by server <= 7.128.x is rewritten once by the server at boot. The gate record reads the ARCHIVE form, see `GateRecordAskClass`. History: twenty-two words as of core 7.40.0, twenty-three as of core 7.41.0, twenty-four as of core 7.43.0, twenty-five as of core 7.45.0, twenty-six as of core 7.49.0 — 7.34.0 minted twenty; `unverifiable_shell_text` joined in 7.49.0 #1505 and rides server >= 7.126.0, where the
+        core `ASK_CLASSES` (TWENTY-SIX words as of core 7.54.0 / server >= 7.134.0: `cross_boundary` joined after `requires_user_interaction` — the device lane's
+        cross-boundary confirmation, see below; TWENTY-FIVE as of core 7.51.0 / server >= 7.129.0: `governance_unavailable` was merged into `rule_unreadable`, no alias — sdk 23.0.0; a stored card / parked row written by server <= 7.128.x is rewritten once by the server at boot. The gate record reads the ARCHIVE form, see `GateRecordAskClass`. History: twenty-two words as of core 7.40.0, twenty-three as of core 7.41.0, twenty-four as of core 7.43.0, twenty-five as of core 7.45.0, twenty-six as of core 7.49.0 — 7.34.0 minted twenty; `unverifiable_shell_text` joined in 7.49.0 #1505 and rides server >= 7.126.0, where the
         unresolved-write-target class was also RENAMED to `target_unresolved` (#955; zero alias — the previous spelling is in the SDK README's 22.0.0 migration table); `shell_floor` joined in 7.39.0 #1260 and rides
         server >= 7.113.0; `unstated` joined in 7.40.0 and rides server >= 7.115.0; `requires_user_interaction` joined in 7.41.0 and rides
         server >= 7.116.0; `classifier_no_ruling` joined in 7.43.0 #1353 and rides server >= 7.118.0; `dangerous_delete` joined in 7.45.0 and rides
@@ -17164,6 +16971,16 @@ components:
         pathTarget: { $ref: '#/components/schemas/McpToolPathTarget' }
         ruleFace: { $ref: '#/components/schemas/McpToolRuleFace' }
         renderHints: { $ref: '#/components/schemas/McpToolRenderHints' }
+        boundaryLegs:
+          description: >-
+            core 7.54.0 / server >= 7.134.0 (a REQUIRED engine member: every row of `wiring_manifest.tools.entries[]` and of a `tool_roster_delta` frame's
+            `delta.roster.entries[]` carries it) — the LEGS a call of this tool travels (core `BOUNDARY_LEGS`, in that order: `env` = inside the execution
+            environment / on the device, `outside_read` = a read beyond it, `outside_write` = a write beyond it), or `per_call` when its dispatch gives the legs
+            per call (the engine's own definitions and the protocol tools state them; every other row follows its `effect`). The device lane's launch gate reads
+            it. ABSENT = an older server (<= 7.133.x).
+          oneOf:
+            - { type: string, const: per_call }
+            - { type: array, items: { type: string, enum: [env, outside_read, outside_write] } }
     McpToolPathTarget:
       type: object
       required: [param, access]
@@ -17865,44 +17682,6 @@ components:
             governance shell gate sits at the "classify" tier, a shell ask may come from the classifier or from
             another gate; the server leaves the key absent rather than guessing). Never render absence as
             "this gate can be bypassed by a posture".
-        ruleSuggestions:
-          type: array
-          minItems: 1   # 空数组不可能出现:server 的合取项②要求 `req.ruleSuggestions` **非空**,否则整键省略(缺席 = 本卡无此选项)
-          # 刻意**不**声明 maxItems:server 的 `.max(4)` 是**卡** schema(`ApprovalCardSchema`)上的约束,这条
-          # live 帧腿没有它。在这里抄一个上界 = 声明一条 server 并不执行的约束(照 spec 生成的严格客户端会
-          # 拒收一条合法帧)。数量上界的真源是引擎:core 5.22.0 的 `suggestRulesForCommand` **至多铸一条,且恒
-          # `match: "exact"`**(不写死上界是给将来的 miner 留位,不是暗示今天会有更多)。
-          items: { $ref: '#/components/schemas/RuleSuggestion' }
-          description: >
-            server #154 车二 (core 5.18.0, design/179), ADDITIVE, "tool_approval" only: the rule candidates
-            the ENGINE minted for this ask. Render them as the "don't ask again" options and echo the chosen
-            one back as `persistRule.rule` on POST /v1/tool-approvals/{id}/respond.
-
-            🔴 PRESENCE IS THE PROMISE: the key is present ONLY on a deployment that actually has a
-            permission-rule store wired (the same object behind the engine's `permissionRules.storeWired`
-            manifest bit). A deployment without one OMITS it rather than offering an option with nowhere to
-            redeem — an unredeemable "don't ask again" is a wire lie, worse than absence.
-
-            🔴 THE CONVERSE DOES NOT HOLD: absence means "THIS CARD has no redeemable candidate", and three
-            causes produce it — no rule store wired, the engine minted no candidate for this command (compound /
-            redirect / substitution), or the command bytes were unreadable. One frame cannot tell them apart, so
-            never diagnose the deployment's rule lane from a single absence, and never synthesize a candidate.
-
-            📏 HOW MANY, TODAY: core 5.22.0's miner (`suggestRulesForCommand`) emits AT MOST ONE candidate and
-            always `match: "exact"` — no shipped producer mints the broader prefix option. `prefix` stays in the
-            closed vocabulary because the wire validator accepts it and a later miner may emit it; render what
-            arrives, but do NOT build a UI that assumes a narrow/broad PAIR is on offer.
-
-            🔴 The values are the engine's VERBATIM (closed `match` vocabulary + engine-minted text); the
-            server neither re-mints nor re-orders them. A hand-built rule string is refused at redemption
-            (`ruleRefusal: "rule_not_offered"`) — by construction, so a click on a harmless command cannot be
-            turned into a rule for something else.
-
-            ⚠️ REDEMPTION SCOPE: the key also rides the durable card replay, but its only redemption channel is
-            the LIVE respond leg keyed by this frame's `approvalId` — an in-process map on ONE replica. Same
-            replica ⇒ redeemable; after a restart / on another replica that `approvalId` 404s and the person
-            must use the durable decide leg, which carries NO rule field in v1 (its body is strict — an extra
-            `persistRule` is a loud 400, not a silent drop).
         ruleOffers:
           type: array
           minItems: 1
@@ -17910,8 +17689,8 @@ components:
           description: >
             server >= 7.46.0 (core 5.58.0, design/375), "tool_approval" only — the ENGINE-minted "don't ask
             again" OPTIONS for this ask, as a DISCRIMINATED UNION (`single` | `batch`). It is the BREAKING
-            REPLACEMENT of `ruleSuggestions` above: a >= 7.46.0 engine mints the old key nowhere, there is no
-            alias, and the two keys are declared side by side only so one type surface covers both generations.
+            REPLACEMENT of the triple-shaped `ruleSuggestions` of servers <= 7.45: a >= 7.46.0 engine mints the old key nowhere and there is no
+            alias (sdk 26.0.0 deleted the old key with the support floor 7.52.0).
 
             🔴 READ `kind` TO TELL THE ARMS APART, never a positional assumption. ORDER IS CONTRACT: a
             whole-string exact `single` is index 0 when present and a `batch` is always last; core's own
@@ -17926,23 +17705,15 @@ components:
             suppress its persistence actions entirely (core's normative clause) — a compacted index means the
             k-th option the person clicked is not the k-th rule the server redeems.
 
-            🔴 PRESENCE IS THE PROMISE (same as `ruleSuggestions`): present only where a permission-rule store
+            🔴 PRESENCE IS THE PROMISE: present only where a permission-rule store
             is really wired. The converse does not hold — a wired deployment still omits it for mandated /
             requiresRealApproval / allow_outranked / ask_rule_matched / hook-produced / inherited-unresolved / ancestor-resolved /
             anonymous asks. Absence reads as "THIS CARD has no such option", never as "this deployment has no
             rule lane" (that is `capabilities.permissionRules`) and never as "your rule broke" (that is
-            `allowRuleShadowed`; `persistedRuleShadowed` on a server <= 7.116.x).
+            `allowRuleShadowed`).
 
             ⚠️ REDEMPTION SCOPE is the live respond leg keyed by this frame's `approvalId` only; a replayed
             offer on another replica is not a promise that it is still redeemable.
-        persistedRuleShadowed:
-          type: string
-          description: >-
-            server >= 7.13.0 (core 5.25.0 #144), ADDITIVE, "tool_approval" only — this ask MATCHED one of the caller's persisted allow
-            rules and that rule COULD NOT silence it; the value is the rule's VERBATIM text (secret-redacted + length-bounded; UNTRUSTED
-            for display, like `message`). Absent != "you have no rule"; deliberately separate from `governanceForced`.
-            RETIRED: server >= 7.117.0 (core 7.42.0, BREAKING rename, no alias) never mints this key on any face; its successor is
-            `allowRuleShadowed` (all five allow-layer members, not just the rule store). Kept for servers in [7.13.0, 7.117.0) only (sdk 16.3.0).
         allowRuleShadowed:
           type: array
           items: { $ref: '#/components/schemas/AllowRuleShadow' }
@@ -18220,17 +17991,18 @@ components:
         classifierUnavailable:
           $ref: '#/components/schemas/ClassifierUnavailable'
           description: >-
-            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE, present only when the classifier was consulted and
+            server >= 7.69.0 (core 7.10.0), ADDITIVE, present only when the classifier was consulted and
             could not run — WHY this ask reached a human. See ClassifierUnavailable for the open-`cause` rule and
             the three shapes absence covers.
-            RETIRED: server >= 7.72.0 (core 7.14.0 #688) never mints this key on any of the three faces; its
+            RETIRED: server >= 7.72.0 (core 7.14.0) never mints this key on any of the three faces; its
             successor is `disposition.cause` on the gate record (`unavailable` / `parse_error` — a different
-            question, so an old switch does not port). Kept for servers in [7.69.0, 7.72.0) only (sdk 9.2.0).
+            question, so an old switch does not port). Kept on the frame because servers 7.69–7.71 are inside the supported range and still
+            send it, and the closed inbox row declares the same key (frame and row read the same); it goes with the next major once the support floor is >= 7.106.0.
         ruleStoreUnreadable:
           type: string
           enum: [store, call]
           description: >-
-            server >= 7.72.0 (core 7.14.0 #688 C3), ADDITIVE — WHICH HALF of the rule lane could not be read.
+            server >= 7.72.0 (core 7.14.0), ADDITIVE — WHICH HALF of the rule lane could not be read.
             Present iff `origin === "rule_store_unavailable"`: `store` = the wired rule store could not be read
             (look at the store / network); `call` = the store was read but THIS command could not be read against
             the person's deny/ask rows (look at the command spelling). One `origin` word covers both facts, and
@@ -18238,10 +18010,11 @@ components:
             frame and the inbox row; the `card_json` card deliberately does NOT carry it (it travels with `origin`,
             which is not on the card). Absence = `origin` is not that word — NOT an assertion that the rule store
             is healthy.
-            RETIRED: server >= 7.106.0 (core 7.34.0 C-R172, BREAKING — wire) never mints this key on either face — an
-            unreadable rule store no longer raises a card: that read's rows are SKIPPED by partition and the session
-            stream gets the user-facing `engine_notice` `permission.rule_store_unavailable` (`detail.at` = `prepare` /
-            `call`). Kept for servers in [7.72.0, 7.106.0) only (sdk K-32); `origin: rule_store_unavailable` itself stays.
+            RETIRED: server >= 7.106.0 (core 7.34.0, BREAKING — wire) never mints this key on either face — an
+            unreadable rule store no longer raises a card; the signal moved to the session stream's user-facing
+            `engine_notice` `permission.rule_store_unavailable` (`detail.at` = `prepare` / `call`; what the run does while the rules cannot be read is
+            that notice's own text). Kept on the frame because servers 7.72–7.105 are inside the supported range and still send it, and the closed inbox row
+            declares the same key; it goes with the next major once the support floor is >= 7.106.0 (`origin: rule_store_unavailable` itself stays).
         readRootCandidate:
           type: object
           required: [dir, clearsThisAsk]
@@ -18395,33 +18168,15 @@ components:
             posture. Semantics, the ABSENT != false clause and the discrimination boundary are stated verbatim on
             ToolApprovalFrame.governanceForced. It sits at the card's top level rather than inside `risk` because
             `risk` describes the ENGINE's judgement of the call, while this key says WHO imposed the gate.
-        ruleSuggestions:
-          type: array
-          minItems: 1   # 同帧腿:空数组不可能出现(素材同源),缺席才是「本卡无此选项」
-          maxItems: 4   # 卡形上**真有**这条上界(server `ApprovalCardSchema` 的 `.max(4)`);live 帧腿没有,故只写在这里
-          items: { $ref: '#/components/schemas/RuleSuggestion' }
-          description: >
-            ADDITIVE (#154 车二 / core 5.18.0 design/179): the rule candidates the ENGINE minted for this ask —
-            the card's "don't ask again" options; echo the chosen one back as `persistRule.rule`. Semantics,
-            the PRESENCE-IS-THE-PROMISE clause (present only where a rule store is wired) and the redemption
-            scope are stated verbatim on ToolApprovalFrame.ruleSuggestions — the live frame, the stored
-            `card_json` and the replayed frame carry the SAME material.
         ruleOffers:
           type: array
           minItems: 1
           items: { $ref: '#/components/schemas/RuleOffer' }
           description: >
-            server >= 7.46.0 (core 5.58.0, design/375) — the discriminated-union replacement of
-            `ruleSuggestions` above. Same material as the live frame and the stored `card_json` (the server
+            server >= 7.46.0 (core 5.58.0, design/375) — the discriminated-union replacement of the retired
+            `ruleSuggestions` (servers <= 7.45; sdk 26.0.0 deleted it). Same material as the live frame and the stored `card_json` (the server
             projects all three through one `copyRuleOffer`), so semantics, order-is-contract, presence-is-the-
             promise and the per-leg index rules are stated verbatim on ToolApprovalFrame.ruleOffers.
-        persistedRuleShadowed:
-          type: string
-          description: >-
-            server >= 7.13.0 (core 5.25.0 #144), ADDITIVE — the persisted rule this ask matched but which could not silence it; frame and
-            card carry the SAME material (see ToolApprovalFrame.persistedRuleShadowed).
-            RETIRED: server >= 7.117.0 (core 7.42.0) never mints this key on any face (its strict card schema even refuses a stored card
-            carrying it); its successor is `allowRuleShadowed`. Kept for servers in [7.13.0, 7.117.0) only (sdk 16.3.0).
         allowRuleShadowed:
           type: array
           items: { $ref: '#/components/schemas/AllowRuleShadow' }
@@ -18456,35 +18211,13 @@ components:
         classifierUnavailable:
           $ref: '#/components/schemas/ClassifierUnavailable'
           description: >-
-            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE — WHY this ask reached a human. Frame and card carry
-            the SAME value (one narrow-read function server-side). See ClassifierUnavailable for the open-`cause`
-            rule and the three shapes absence covers.
-            RETIRED: server >= 7.72.0 (core 7.14.0 #688) never mints this key on any of the three faces; its
+            (minted by servers [7.69.0, 7.72.0), core 7.10.0 #616) WHY this ask reached a human. See ClassifierUnavailable for the open-`cause` rule and the three
+            shapes absence covers.
+            RETIRED: server >= 7.72.0 (core 7.14.0) never mints this key on any of the three faces; its
             successor is `disposition.cause` on the gate record (`unavailable` / `parse_error` — a different
-            question, so an old switch does not port). Kept for servers in [7.69.0, 7.72.0) only (sdk 9.2.0).
-
-    RuleSuggestion:
-      type: object
-      description: >
-        One ENGINE-minted rule candidate (#154 车二 / core 5.18.0 `RuleSuggestion`) — what a single click on
-        "don't ask again" would persist.
-
-        🔴 THE TEXT COMES FROM THE ENGINE, NOT THE SHELL: the server derives it from the adjudicated command's
-        own bytes; a client may only echo one of these back verbatim (`persistRule.rule`). Reporting text that
-        is not among the candidates is refused (`ruleRefusal: "rule_not_offered"`) rather than guessed at, so
-        "click on a harmless command, get a rule for something else" is not spellable on this path.
-      # 封闭:core `RuleSuggestion` 恰三键(rule/match/command),server 逐字透传不重铸。
-      additionalProperties: false
-      required: [rule, match, command]
-      properties:
-        rule: { type: string, maxLength: 512, description: 'The canonical rule text to echo back on redemption (server MAX_RULE_TEXT_CHARS = 512).' }
-        match:
-          type: string
-          enum: [exact, prefix]
-          description: '`exact` = this one command only (`Bash(git status)`); `prefix` = word-boundary prefix (`Bash(git status:*)`). Closed vocabulary — an unknown value is not a candidate this contract describes; do not render it as redeemable.'
-        command: { type: string, maxLength: 512, description: 'The command pattern inside the rule, for a shell that would rather not re-parse `rule`.' }
+            question, so an old switch does not port). It stays declared on the CARD because the pinned server's card schema (`ApprovalCardSchema`, server 7.134.0) still accepts it: a still-pending `card_json` row a
+            7.69–7.71 server wrote replays verbatim onto `approval_request.card` / the replay frame. (The FRAME's same-named key stays declared too; why, and until when: `ToolApprovalFrame.classifierUnavailable`.)
 
-    # ─── S-139(sdk 8.3.0):对 server 7.60.0 整体重对账带进来的四张型面 ───────────────────────
     ClassifierUnavailable:
       # 8.9.0:三面(tool_approval 帧 / ApprovalCard / InboxRow)同形同值 ⇒ 具名单源,内联三份会各自漂。
       type: object
@@ -18599,7 +18332,7 @@ components:
         `ApprovalCard.ruleOffersAbsence`; server >= 7.55.0 / core #490 fix ②, S-15). The engine names which
         door is shut: `mandated` = this ask must be confirmed every time (🔴 this arm must NOT point the user
         at writing a rule — a rule would not silence it, and saying so sends them into a loop); `allow_outranked` = an
-        allow-layer member matched this call but the ask sits at a higher tier, so another allow rule cannot clear it (the machine-readable twin of `allowRuleShadowed`; `persistedRuleShadowed` on a server <= 7.116.x);
+        allow-layer member matched this call but the ask sits at a higher tier, so another allow rule cannot clear it (the machine-readable twin of `allowRuleShadowed`);
         `ask_rule_matched` = an explicit `ask` rule matched this call (same frame `origin: ask_rule`): it keeps asking, an allow rule would not silence it either; a card from the deployment name-list gate
         `APPROVAL_REQUIRE` / the supervisor route that reports an explicit ask-rule hit lands here too; `lane_cannot_speak` = a rule COULD clear this ask but the lane cannot speak this time (the engine could mint no coverable form for this command).
         🔴 sdk 23.0.0 BREAKING (server >= 7.129.0 / engine 7.51.0, `RULE_OFFERS_ABSENCES`): the former `shadowed` meant two things and is split into the middle two words, no alias; a card / parked row that a server <= 7.128.x
@@ -18634,10 +18367,12 @@ components:
         `READ_ROOT_COVERS` and its `isApprovalRequestFrameV1` judges `covers` by membership in it; a source-level anchor reads the word off the server's minting site and the engine's type.
     PersistedRuleMandate:
       type: string
-      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved]
+      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved, cross_boundary_taint]
       description: >
         WHICH WORD a mandated ask stands on (server >= 7.102.0 / S-721 / core 7.32.0 #1092) — core's
-        `PERSISTED_RULE_MANDATES` six words, transcribed verbatim and in order (core 7.32.1
+        `PERSISTED_RULE_MANDATES` (seven words since core 7.54.0 / server >= 7.134.0: `cross_boundary_taint` — the run executes on a device outside the deployment's
+        trust boundary and the deployment is multi-tenant, so an org-side write, or after an off-target read a call bound for the device, is confirmed by the deployment's
+        approver per call; no standing allow rule and no automatic lane answers it; core puts it at the HEAD of the mandate ladder, the array keeps core's constant order), transcribed verbatim and in order (core 7.32.1
         `dist/core/ask-origin.d.ts:349`; the vocabulary's owner is core; the sixth word is `target_unresolved` from core 7.49.0 #955 / server >= 7.126.0 —
         server 7.122.0–7.125.x sent the previous spelling, which reads as out of set here, see the SDK README's 22.0.0 migration table). Rides FOUR faces with one value: the
         `tool_approval` frame, the `livePending` row top level, the operator queue row (`GET /v1/approvals`
@@ -18691,9 +18426,9 @@ components:
     RuleOfferMatch:
       type: string
       description: >
-        The MATCH FORM of a persisted rule — the server's `PERSISTED_RULE_MATCHES`, verbatim and in order (the vocabulary
-        is OWNED BY CORE; the server only transcribes it and pins set equality, so core adding a member turns
-        the server red at compile time). ONE vocabulary for two faces: a card's rule offer (`RuleOffer.match`, the
+        The MATCH FORM of a persisted rule — core's `PERSISTED_RULE_MATCHES`, verbatim and in order (the vocabulary is OWNED BY CORE: a package-root
+        value since core 7.54.0, which server >= 7.134.0 reads directly instead of keeping its own transcription; earlier servers transcribed it and pinned set
+        equality). ONE vocabulary for two faces: a card's rule offer (`RuleOffer.match`, the
         server's card schema validates it with this very enum) and a persisted rule row (`GET /v1/rules`).
 
         `exact` = this one command only (`Bash(git status)`). `prefix` = the historical colon-star
@@ -18896,8 +18631,7 @@ components:
               maxLength: 512
               description: >
                 With `edited` absent or false this is the CANDIDATE ARM: echo back, VERBATIM, the `rule` of the
-                chosen `kind: "single"` entry of the frame's `ruleOffers` (or, against a <= 7.45 server, of
-                `ruleSuggestions`). Do not hand-build it, re-case it or append `:*` — the server locates it by
+                chosen `kind: "single"` entry of the frame's `ruleOffers`. Do not hand-build it, re-case it or append `:*` — the server locates it by
                 text and refuses otherwise (`rule_not_offered`). With `edited: true` this is the FREE-TEXT ARM
                 and the string is whatever the person typed.
             edited:
@@ -19835,6 +19569,38 @@ components:
         fields: {}
         overrideReasons: {}
         ts: {}
+    CrossBoundaryTaintRow:
+      type: object
+      description: >
+        server >= 7.134.0 / core 7.54.0 — the device lane's CROSS-BOUNDARY TAINT row: the engine's `permission.cross_boundary_taint` frame minus its envelope
+        (`kind` / `version` / `taskId` / `ts`). Metadata only. Emitted ONLY on a tree that executes on a target device (one row when an armed tree prepares a
+        leg — `prepare`, one on a durable resume leg — `resume`, one when this leg first lets an off-target read into the tree — `observed`, with that call);
+        the host lane never emits it. Two exits, one row: the ledger event `cross_boundary_taint` on `GET /v1/runs/{taskId}/events` (`Event_cross_boundary_taint`)
+        and the trace SSE `cross-boundary-taint` frame on `GET /v1/tasks/{taskId}/stream` (the row + `seq`). The `GET /v1/runs/{taskId}` poll object carries NO
+        such key.
+      # 不封闭(`additionalProperties: true`):本 schema 是 `Event_cross_boundary_taint` 的 allOf 目标(帧上多一个 `type`),封闭会把合法帧判成违约(同 PromptManifestRow)。
+      additionalProperties: true
+      required: [runId, phase, taint, governed]
+      properties:
+        runId: { type: string, description: 'the leg''s run id.' }
+        phase: { type: string, enum: [prepare, resume, observed], description: 'core `permission.cross_boundary_taint` `phase` (engine closed set).' }
+        taint:
+          type: array
+          description: 'The tree''s taint bits after the event — core `CROSS_BOUNDARY_TAINT_BITS` (`targetExecutionArmed` = the tree is armed to execute on the target; `offTargetReadObserved` = off-target read content was let into the tree).'
+          items: { type: string, enum: [targetExecutionArmed, offTargetReadObserved] }
+        governed: { type: boolean, description: 'the tree has run under the `multi_tenant` posture since it armed (derived from `REQUIRE_PRINCIPAL`).' }
+        toolName: { type: string, description: '`observed` only: the call that let the off-target read in.' }
+        toolCallId: { type: string, description: '`observed` only: that call''s id.' }
+    Event_cross_boundary_taint:
+      description: >
+        DURABLE only (server >= 7.134.0 / core 7.54.0) — the ledger event of a `CrossBoundaryTaintRow` on `GET /v1/runs/{taskId}/events` (SSE `id:` = the row's
+        seq). Never on the live stream, never on the `GET /v1/runs/{taskId}` poll object; an older server drops the frame on the spot.
+      allOf:
+        - $ref: '#/components/schemas/CrossBoundaryTaintRow'
+        - type: object
+          required: [type]
+          properties:
+            type: { const: cross_boundary_taint }
     Event_needs_review:
       type: object
       description: >
@@ -21690,6 +21456,13 @@ components:
         (the `livePending[]` row + `state`; answer door open); `decided` = the row is DECIDED (`decision` / `decidedAtMs` / `decisionNote?`, the same three keys as the late-replay body); `parked` = PARKING / PARKED
         (a late answer redeems the parked card; `decidePath?` points at the durable decision path); `void` = DENIED / VOID (nobody decided it, the answer has nowhere to land; `cause?` is the same cause word as the
         late-answer 404's, see ToolApprovalNotPendingCause).
+        🔴 server >= 7.134.0: a PARKED row passes the gate judge (the same one the answer door's 409 `approval_stale` reads) — the gate still open ⇒ `parked`
+        (+ `decidePath`; ONLY this state renders "go decide"); the gate settled by a person / policy ⇒ `decided` (no `decidePath`); the gate expired (a cancel expires it
+        first) / superseded / settled by the host SLA sweep, the window or nobody-to-answer ⇒ `void` WITHOUT `cause`; the checkpoint row gone, or settled without a
+        readable direction / time ⇒ 404 `tool_approval.not_pending` WITHOUT `cause`; the gate unreadable (store failure) ⇒ falls back to `parked`. Known boundary (re-read
+        to settle it): a parked row's `decided` can return to `parked` when the resume leg fails before the approved action starts (the engine reopens the same gate), and
+        a cancelled resume reads `void` once the server collects the reopened gate (`parked` in between, or `void` for an instant during the reopen).
+        Older servers answered all of these with `parked` + `decidePath`.
       oneOf:
         - $ref: '#/components/schemas/ToolApprovalReadPending'
         - $ref: '#/components/schemas/ToolApprovalReadDecided'
@@ -22083,74 +21856,6 @@ components:
         delivery: { type: string, const: applied, description: 'Literal "applied" on today''s server.' }
         marker: { type: string, description: 'Engine-minted delivery marker.' }
 
-    WorkspaceSnapshotPage:
-      # 4.3.0(CAPS-OPS-8):把 GET …/workspace 的 200 信封提成具名 schema。SDK 侧此前是 `list()` 返回位上的
-      # **内联闭合字面量**,两道 spec 门(field-drift 只扫 types.ts / resource-schema 只扫 resources 的 exported
-      # type)对方法返回位的内联形都是盲的 —— 于是它漏了这里一直标为 required 的 `sessionId`,CI 全绿。
-      type: object
-      description: >
-        GET /v1/sessions/{sessionId}/workspace 的 200 信封(server src/http/routes/sessions.ts)。
-        ⚠️ `total` = **本页行数**(`snapshots.length`),不是快照总数,且这条腿没有任何分页游标 —— 与同族
-        `WorkspaceTreePage.total`(真·全量)**同名反义**。`latest` 与展示行同源(防 ghost key)。
-      additionalProperties: false
-      required: [sessionId, snapshots, total]
-      properties:
-        sessionId: { type: string }
-        snapshots:
-          type: array
-          items: { $ref: '#/components/schemas/WorkspaceSnapshotRow' }
-        latest: { type: string, description: 'Newest snapshot key; absent when the session has none.' }
-        total: { type: integer, description: 'ROWS ON THIS PAGE — not the snapshot count.' }
-
-    WorkspaceTreePage:
-      # 4.3.0(CAPS-OPS-8):同上,tree 腿的 200 信封。
-      type: object
-      description: >
-        GET /v1/sessions/{sessionId}/workspace/{key}/tree 的 200 信封(server src/http/routes/sessions.ts)。
-        `total` 在这条腿上是**全量**(`all.length`)—— 与 `WorkspaceSnapshotPage.total` 语义相反。
-        `key` 回的是解析后的真实键(请求可传 `latest` 别名)。
-      additionalProperties: false
-      required: [sessionId, key, entries, total]
-      properties:
-        sessionId: { type: string }
-        key: { type: string, description: 'The RESOLVED snapshot key (a `latest` alias in the request comes back resolved).' }
-        entries:
-          type: array
-          items: { $ref: '#/components/schemas/WorkspaceTreeEntry' }
-        total: { type: integer, description: 'FULL entry count (not the page size).' }
-        nextOffset: { type: integer, description: 'Present ⇒ more pages; send it back as ?offset=.' }
-
-    WorkspaceSnapshotRow:
-      type: object
-      description: >
-        One snapshot row of GET /v1/sessions/{sessionId}/workspace (envelope `{sessionId, snapshots,
-        latest?, total}`; server src/http/routes/sessions.ts — newest first, uuidv7 keys). E19 snapshot store's
-        read-only projection: each row is the freeze at a turn boundary, NOT a live workspace.
-      required: [key, files]
-      additionalProperties: true
-      properties:
-        key: { type: string, description: 'Snapshot key (uuidv7 entry id; "latest" is an accepted alias on the sub-routes).' }
-        files: { type: integer, description: 'Manifest row count.' }
-        bytes: { type: integer, description: 'Total snapshot bytes — present only when the store has a sizes face (SQL backends); the local store honestly omits it ([1894]② additive).' }
-
-    WorkspaceTreeEntry:
-      type: object
-      description: >
-        One file entry of GET /v1/sessions/{sessionId}/workspace/{key}/tree (envelope `{sessionId, key,
-        entries, total, nextOffset?}`; server src/http/routes/sessions.ts — stable path order, offset paging).
-      required: [path, hash]
-      additionalProperties: true
-      properties:
-        path: { type: string, description: 'The relPath — pass VERBATIM as ?path= on the file sub-route.' }
-        hash: { type: string, description: 'Content address (sha256) — enables cross-snapshot change highlighting ([1894]②).' }
-        size: { type: integer, description: 'Present only when the store has a sizes face (SQL backends).' }
-
-    # ═══════════════════════════════════════════════════════════════════════════════════════════════
-    # #154 车二(design/179 §7)—— 持久权限规则的 CC settings 导入面。形按 server 真码 + core 原形亲读
-    # (`src/http/routes/rules.ts` / `src/rules-consent.ts`;preview/result 两形是 core `ImportPreview` /
-    # `ImportResult` 的原样透传)。
-    # ═══════════════════════════════════════════════════════════════════════════════════════════════
-
     CcImportSettingsLayer:
       type: string
       enum: [userSettings, projectSettings, localSettings]