@sema-agent/sdk 25.0.0 → 26.1.0

package/openapi.yaml

@@ -172,7 +172,7 @@ tags:
       themself said yes"), never operator. GATED AND OFF BY DEFAULT: the whole lane hangs on
       PERMISSION_RULES_ENABLED (default false) plus a wired rule store — so on a stock deployment BOTH doors
       answer 501 `capability.rule_store_required`, and so does the single-card half (the ask frame simply
-      carries no `ruleSuggestions`). Read the observed frame / an actual response, never a version number.
+      carries no `ruleOffers`). Read the observed frame / an actual response, never a version number.
       The SINGLE-CARD half of the same lane is `persistRule` on POST /v1/tool-approvals/{id}/respond.
   - name: adoption
     description: >
@@ -2280,38 +2280,16 @@ paths:
     get:
       tags: [workspace]
       operationId: workspaceList
-      x-status: retired          # S-15/design/381 (server 7.52.0): whole-tree snapshot epoch retired — every ≥7.52 deployment answers 501 capability.workspace_retired.
-      summary: 'RETIRED (server 7.52.0, S-15) — snapshot listing; ≥7.52 answers 501 capability.workspace_retired. Live on 1.299–7.51 only.'
-      description: >
-        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this
-        face projected was replaced by per-edited-file rewind HISTORY, which holds only files the agent edited
-        — structurally there is no "whole workspace" manifest to browse anymore. The route SHAPE is kept
-        server-side as a tombstone: every ≥7.52 deployment answers 501 `capability.workspace_retired` (a named
-        refusal, not a 404 that reads like a typo), and `capabilities.workspace` is always false (same
-        predicate). There is NO 1:1 replacement path — a future "rewind coverage" browse would be a NEW face
-        with tracked-set semantics, not this name wired back. Related live faces: rewind restore rides
-        `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file history blobs ride
-        `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`.
-        Historical shape (servers 1.299–7.51): read-only projection over the E19 snapshot store. Rows carry
-        `{key, files, bytes?}`; `latest` = the newest snapshot key. Owner-scoped (non-owner → 404, no
-        oracle); 501 without the snapshot-store read faces (probe `capabilities.workspace`).
-      parameters:
-        - in: query
-          name: limit
-          required: false
-          schema: { type: integer, minimum: 1, maximum: 100 }
+      x-status: retired          # server 7.52.0: whole-tree snapshot epoch retired; sdk 26.0.0 deleted the verb (support floor 7.52.0).
+      summary: 'RETIRED (server 7.52.0, S-15) — snapshot listing; every supported server (>= 7.52.0) answers 501 capability.workspace_retired.'
+      description: >
+        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this face projected was replaced by per-edited-file
+        rewind HISTORY (only files the agent edited — there is no "whole workspace" manifest to browse). The route SHAPE is kept server-side as a tombstone:
+        every supported server answers 501 `capability.workspace_retired` (a named refusal, not a 404 that reads like a typo), and `capabilities.workspace` is
+        always `false` (same predicate). No 1:1 replacement: rewind restore rides `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file
+        history blobs ride `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`. sdk 26.0.0 deleted `client.workspace` (its 200 shapes only existed on 1.299–7.51).
       responses:
-        '200':
-          description: The snapshot listing.
-          content:
-            application/json:
-              # 封闭两层(census 批2 第三段,2026-07-30):铸造点 `routes/sessions.ts`(信封与行两处)。条件键=信封 `latest`(零快照即省略)、行 `bytes`(blobSizes 面缺席=诚实省略)。
-              # 4.3.0:形提成具名 `WorkspaceSnapshotPage`(SDK 同批把返回位的内联字面量也提成了 exported type,
-              # 让 spec-resource-schema-gate 罩得住 —— CAPS-OPS-8)。
-              schema: { $ref: '#/components/schemas/WorkspaceSnapshotPage' }
-        '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
   /v1/sessions/{sessionId}/workspace/{key}/tree:
@@ -2325,38 +2303,19 @@ paths:
         name: key
         required: true
         schema: { type: string }
-        description: 'Snapshot key (entryId), or the alias `latest` = the newest snapshot.'
     get:
       tags: [workspace]
       operationId: workspaceTree
-      x-status: retired          # S-15 (server 7.52.0): retired with the family — see workspaceList's retirement note.
-      summary: 'RETIRED (server 7.52.0, S-15) — snapshot file tree; ≥7.52 answers 501 capability.workspace_retired.'
-      description: >
-        🔴 RETIRED as of server 7.52.0 — same retirement (and same replacement pointers) as `workspaceList`
-        above: every ≥7.52 deployment answers 501 `capability.workspace_retired`; `capabilities.workspace` is
-        always false. Historical shape (1.299–7.51): entries carry `{path, hash, size?}` — `hash` is the
-        sha256 content-address (cross-snapshot change highlighting, [1894]②); `size` only when the SQL size
-        index is available. `limit` 1..2000 default 500, `offset` cursor; `nextOffset` present = more pages.
-      parameters:
-        - in: query
-          name: limit
-          required: false
-          schema: { type: integer, minimum: 1, maximum: 2000 }
-        - in: query
-          name: offset
-          required: false
-          schema: { type: integer, minimum: 0 }
+      x-status: retired          # server 7.52.0: whole-tree snapshot epoch retired; sdk 26.0.0 deleted the verb (support floor 7.52.0).
+      summary: 'RETIRED (server 7.52.0, S-15) — snapshot file tree; every supported server (>= 7.52.0) answers 501 capability.workspace_retired.'
+      description: >
+        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this face projected was replaced by per-edited-file
+        rewind HISTORY (only files the agent edited — there is no "whole workspace" manifest to browse). The route SHAPE is kept server-side as a tombstone:
+        every supported server answers 501 `capability.workspace_retired` (a named refusal, not a 404 that reads like a typo), and `capabilities.workspace` is
+        always `false` (same predicate). No 1:1 replacement: rewind restore rides `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file
+        history blobs ride `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`. sdk 26.0.0 deleted `client.workspace` (its 200 shapes only existed on 1.299–7.51).
       responses:
-        '200':
-          description: One page of the tree.
-          content:
-            application/json:
-              # 封闭两层(census 批2 第三段,2026-07-30):铸造点 `routes/sessions.ts`(信封与行两处)。条件键=信封 `nextOffset`(尾页省略)、行 `size`(blobSizes 面缺席省略)。
-              # 4.3.0:形提成具名 `WorkspaceTreePage`(理由同 list 腿 —— CAPS-OPS-8)。
-              schema: { $ref: '#/components/schemas/WorkspaceTreePage' }
-        '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
   /v1/sessions/{sessionId}/workspace/{key}/file:
@@ -2373,46 +2332,16 @@ paths:
     get:
       tags: [workspace]
       operationId: workspaceFile
-      x-status: retired          # S-15 (server 7.52.0): retired with the family — ≥7.52 the tombstone rejects BEFORE any size check, so the 413 envelope below is unreachable there.
-      summary: 'RETIRED (server 7.52.0, S-15) — single-file read; ≥7.52 answers 501 capability.workspace_retired.'
-      description: >
-        🔴 RETIRED as of server 7.52.0 — same retirement (and replacement pointers) as `workspaceList` above.
-        On ≥7.52 the tombstone 501 fires BEFORE any size check, so the 413 `workspace_file_too_large`
-        envelope below is UNREACHABLE there (the SDK keeps its typed WorkspaceFileTooLargeError for
-        1.299–7.51 servers still inside the support range). Historical shape (1.299–7.51): raw bytes with a
-        CONSERVATIVE content-type table (html/svg etc. deliberately serve as octet-stream — agent output is
-        untrusted; `x-content-type-options: nosniff` always set) + the `x-sema-content-binary` discriminator
-        header (first-8KiB NUL sniff, [1894]③). Capped at `capabilities.workspace.maxFileBytes` (default
-        8MiB, WORKSPACE_FILE_MAX_BYTES) — over-cap ⇒ 413 STRUCTURED envelope
-        `{errorCode: "workspace_file_too_large", sizeBytes, limit}` ([1894]①; archive was the escape hatch).
-        With the SQL size index the 413 fired BEFORE fetching the bytes.
-      parameters:
-        - in: query
-          name: path
-          required: true
-          schema: { type: string }
-          description: The tree's relPath, verbatim.
+      x-status: retired          # server 7.52.0: whole-tree snapshot epoch retired; sdk 26.0.0 deleted the verb (support floor 7.52.0).
+      summary: 'RETIRED (server 7.52.0, S-15) — snapshot single file; every supported server (>= 7.52.0) answers 501 capability.workspace_retired.'
+      description: >
+        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this face projected was replaced by per-edited-file
+        rewind HISTORY (only files the agent edited — there is no "whole workspace" manifest to browse). The route SHAPE is kept server-side as a tombstone:
+        every supported server answers 501 `capability.workspace_retired` (a named refusal, not a 404 that reads like a typo), and `capabilities.workspace` is
+        always `false` (same predicate). No 1:1 replacement: rewind restore rides `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file
+        history blobs ride `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`. sdk 26.0.0 deleted `client.workspace` (its 200 shapes only existed on 1.299–7.51).
       responses:
-        '200':
-          description: The file bytes.
-          content:
-            application/octet-stream:
-              schema: { type: string, format: binary }
-        '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
-        '413':
-          description: 'Structured over-cap envelope: {error, errorCode: "workspace_file_too_large", sizeBytes, limit}.'
-          content:
-            application/json:
-              schema:
-                type: object
-                required: [error, errorCode, sizeBytes, limit]
-                properties:
-                  error: { type: string }
-                  errorCode: { type: string, enum: [workspace_file_too_large] }
-                  sizeBytes: { type: integer }
-                  limit: { type: integer }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
   /v1/sessions/{sessionId}/workspace/{key}/archive:
@@ -2429,28 +2358,17 @@ paths:
     get:
       tags: [workspace]
       operationId: workspaceArchive
-      x-status: retired          # S-15 (server 7.52.0): retired with the family — see workspaceList's retirement note.
-      summary: 'RETIRED (server 7.52.0, S-15) — whole-snapshot tar; ≥7.52 answers 501 capability.workspace_retired.'
-      description: >
-        🔴 RETIRED as of server 7.52.0 — same retirement (and replacement pointers) as `workspaceList` above:
-        every ≥7.52 deployment answers 501 `capability.workspace_retired`. Historical shape (1.299–7.51):
-        streamed ustar (`content-disposition: attachment`), entries in stable path order, blob-by-blob with
-        backpressure — server memory stays O(1 file). Pre-flight checks BEFORE the headers went out: paths
-        not representable in ustar ⇒ 422 naming the first offenders; missing blobs (raced a reap / partial
-        import) ⇒ 502 (retryable). A blob vanishing MID-stream destroyed the connection (honest truncation)
-        rather than faking a complete archive.
+      x-status: retired          # server 7.52.0: whole-tree snapshot epoch retired; sdk 26.0.0 deleted the verb (support floor 7.52.0).
+      summary: 'RETIRED (server 7.52.0, S-15) — snapshot tar archive; every supported server (>= 7.52.0) answers 501 capability.workspace_retired.'
+      description: >
+        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): the E19 whole-tree snapshot store this face projected was replaced by per-edited-file
+        rewind HISTORY (only files the agent edited — there is no "whole workspace" manifest to browse). The route SHAPE is kept server-side as a tombstone:
+        every supported server answers 501 `capability.workspace_retired` (a named refusal, not a 404 that reads like a typo), and `capabilities.workspace` is
+        always `false` (same predicate). No 1:1 replacement: rewind restore rides `TaskRequest.restoreFiles` (probe `capabilities.restoreFiles`); per-file
+        history blobs ride `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`. sdk 26.0.0 deleted `client.workspace` (its 200 shapes only existed on 1.299–7.51).
       responses:
-        '200':
-          description: The tar stream.
-          content:
-            application/x-tar:
-              schema: { type: string, format: binary }
-        '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
-        '422': { description: 'Snapshot contains paths not representable in ustar (names the first 5).' }
         '501': { $ref: '#/components/responses/NotImplemented' }
-        '502': { description: 'Snapshot is missing blobs (raced a reap or a partial import) — retry or pick another snapshot.' }
 
   /v1/sessions/{sessionId}/policy:
     parameters:
@@ -2510,7 +2428,7 @@ paths:
       summary: Write the per-session tool-permission rules (tighten-only).
       description: >
         E6 — write the per-session rules. 🔴 TIGHTEN-ONLY for a normal principal: a loosen (remove a deny / widen
-        an allowlist or allowDirs) → 403 `loosen_forbidden` (operator-only). `expectedRev` = optimistic-concurrency
+        an allowlist or allowDirs) → 403 `loosen_forbidden` (operator-only). 🔴 server >= 7.135.0 (engine 7.55.0): the tighten gate is a gate on the row's OPERATOR PART (`operatorRules`), not on the whole row — a non-operator (the session's owner) can take back what NON-operator writes added, but not what an operator wrote (moving anything inside the operator part, even an entry both sides wrote, answers 403 `loosen_forbidden`; the row stays). <= 7.134.x: a non-operator write was subtract-only against the whole row. Read the CODE (the sentence changed: `a non-operator session-rule write may not loosen what an operator wrote; refused: …` vs `… may only tighten …`) — never the sentence. `expectedRev` = optimistic-concurrency
         CAS; a stale rev → 409 `conflict`. Each rule field must be `string[]` and the body carries only the three buckets (`toolAllow` / `toolDeny` / `allowDirs`; any other
         key, including the retired `commandAllow` / `commandDeny`, → 400 `rules.invalid_shape` on server >= 7.129.0) → malformed body 400. ownerless
         session → 409; non-owner → 404. 501 without a session-policy store.
@@ -2538,6 +2456,9 @@ paths:
                     # write judge stamps the current grammar). `grammar` newer than the engine's ⇒ `400 rules.invalid_shape`.
                     rev: { type: integer, minimum: 0 }
                     grammar: { type: integer, minimum: 0 }
+                    # server >= 7.135.0 (engine 7.55.0): a stored body echoed back (GET → edit → PUT) may also carry its `operatorRules`; on THIS door the echoed part is ALWAYS ignored — the route reads the value through the write reader
+                    # (its product carries no `rev`) and the store judges it again: over an existing row the STORED row's operator part is kept, over no row an empty stamped part is minted. Do not rely on an echo to move the operator line — send the new value without `operatorRules`.
+                    operatorRules: { $ref: '#/components/schemas/SessionRulesOperatorPart' }
                 expectedRev: { type: integer, minimum: 0, description: CAS — reject if the stored rev differs. }
       responses:
         '200':
@@ -2574,7 +2495,8 @@ paths:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
         '401': { $ref: '#/components/responses/Unauthorized' }
         '403':
-          description: 403 `loosen_forbidden` — a non-operator write tried to relax the rules (tighten-only).
+          description: >-
+            403 `loosen_forbidden` — a non-operator write tried to relax what an OPERATOR wrote (server >= 7.135.0; <= 7.134.x: relax the rules at all, tighten-only). Branch on the code, never the sentence (it changed with 7.135.0).
           content:
             application/json:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
@@ -2663,7 +2585,7 @@ paths:
         narrow it, switch with a default arm; `httpStatus` 401 is a re-authorize door); `reason` is HUMAN TEXT
         (server-redacted, length-bounded) and must NOT be parsed.
         Gates, the same family as steer / capture-optout: 501 `capability.run_store_required` (no durable run
-        ledger) · 501 `capability.session_ownership_required` (no `sessionStorage.ownerOf`) · 400
+        ledger) · 501 `capability.session_ownership_required` (no `sessionStorage.headOf`; <= 7.134.x: `ownerOf`) · 400
         `request.path_malformed` (bad percent-encoding in the id) · 404 `not_found.session` — unknown session
         AND someone else's session answer the SAME code and SAME message (deliberate: no existence oracle); an
         EXPLICIT operator may re-dial any tenant's session · 422 `steering.invalid_content` · 409
@@ -2729,7 +2651,7 @@ paths:
         the model's description, falling back to the launch command text (content family: redacted, cut at 500
         chars). At most 500 rows (core `list()`'s own cap). 🔴 IN-PROCESS: only rows on THIS replica.
         Zero model work: not billable, not refused by drain. Gates (same family as `mcp/reconnect`): 501
-        `capability.session_ownership_required` (no `sessionStorage.ownerOf`) · 404 `not_found.session` — unknown
+        `capability.session_ownership_required` (no `sessionStorage.headOf`; <= 7.134.x: `ownerOf`) · 404 `not_found.session` — unknown
         session AND someone else's session answer the SAME code and SAME message (no existence oracle); an EXPLICIT
         operator may read any session · 400 `request.path_malformed`. Probe with `capabilities.background.listFace`;
         ABSENT key = an older server, where this path is 404 `not_found.route` (same status, different code).
@@ -3002,6 +2924,14 @@ paths:
         '401': { $ref: '#/components/responses/Unauthorized' }
         '404': { $ref: '#/components/responses/NotFound' }
         '501': { $ref: '#/components/responses/NotImplemented' }
+        '503':
+          description: >-
+            server >= 7.135.0: `503 state.file_history_unreadable` — this session's file history cannot be read WHOLE (a boundary torn / unreadable, the tracked set unreadable); nothing is exported this time. 🔴 It is NOT "no history":
+            with nothing to export the manifest still answers `200` with `fileHistory: null`. May carry `permanence` (`transient` / `terminal`; absent = the store did not judge — see `ErrorResponse.permanence`). Older servers read an
+            unreadable history as "none" (manifest 200 / blob 404).
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/sessions/{sessionId}/sync/entries:
     parameters:
@@ -3040,50 +2970,6 @@ paths:
         '404': { $ref: '#/components/responses/NotFound' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
-  /v1/sessions/{sessionId}/sync/snapshots/{key}/blobs/{hash}:
-    parameters:
-      - $ref: '#/components/parameters/PrincipalHeader'
-      - in: path
-        name: sessionId
-        required: true
-        schema: { type: string }
-      - in: path
-        name: key
-        required: true
-        schema: { type: string }
-        description: The snapshot key (= a `SessionTreeEntry.id`).
-      - in: path
-        name: hash
-        required: true
-        schema: { type: string, pattern: '^[0-9a-f]{64}$' }
-        description: The content-address (SHA-256, 64 lowercase-hex).
-    get:
-      tags: [sessions]
-      operationId: sessionSyncGetBlob
-      x-status: retired          # S-15 (server 7.52.0): the E19-era snapshot-scoped PULL arm was REPLACED by GET …/sync/history/blobs/{hash} — ≥7.52 this path 404s (not_found.route).
-      summary: 'RETIRED (server 7.52.0, S-15) — snapshot-scoped blob PULL; use GET …/sync/history/blobs/{hash}. Live on ≤7.51 only.'
-      description: >
-        🔴 RETIRED as of `@sema-agent/server` 7.52.0 (S-15/design/381): a blob is scoped by the session's
-        HISTORY GRAPH now, not by a per-snapshot manifest key, so this arm was replaced by
-        `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}` (sessionSyncGetHistoryBlob — same
-        octet-stream body, same no-oracle 404 posture, scope check = "referenced by this session's
-        exportHistory envelope"). On ≥7.52 this path no longer matches the sync route family and answers 404
-        `not_found.route`. SDK: `sessions.sync.getHistoryBlob` (the legacy `getBlob` verb stays, deprecated,
-        for ≤7.51 servers inside the support range).
-        Historical shape (≤7.51): one content-addressed blob's RAW bytes; the cloud served a hash ONLY if
-        THIS session's `:key` manifest referenced it (foreign/unreferenced → 404 `blob not found`). 400 on a
-        non-64-hex hash or an undecodable key/hash. Owner-scoped (404).
-      responses:
-        '200':
-          description: The blob bytes.
-          content:
-            application/octet-stream:
-              schema: { type: string, format: binary }
-        '400': { $ref: '#/components/responses/BadRequest' }
-        '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
-        '501': { $ref: '#/components/responses/NotImplemented' }
-
   /v1/sessions/{sessionId}/sync/history/blobs/{hash}:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -3109,7 +2995,7 @@ paths:
         → 404 `not_found.blob`, never a blind read; a server whose file-history store has no blob faces
         (e.g. the local file backend) answers the SAME 404 shape (no oracle — "nothing servable" and "not
         referenced" are deliberately indistinguishable). 400 `request.id_invalid` on a non-64-hex hash.
-        Owner-scoped (404). Replaces the retired `GET …/sync/snapshots/{key}/blobs/{hash}`.
+        Owner-scoped (404). Replaces the retired snapshot-scoped PULL arm of servers <= 7.51 (below the support floor; sdk 26.0.0 deleted `getBlob` and its path).
       responses:
         '200':
           description: The blob bytes.
@@ -3120,6 +3006,14 @@ paths:
         '401': { $ref: '#/components/responses/Unauthorized' }
         '404': { $ref: '#/components/responses/NotFound' }
         '501': { $ref: '#/components/responses/NotImplemented' }
+        '503':
+          description: >-
+            server >= 7.135.0: `503 state.file_history_unreadable` — the history cannot be read WHOLE, so the server cannot tell whether this hash is one the session references — it does NOT answer "no such blob" (that is `404 not_found.blob`) and gives no bytes. 🔴 It is NOT "no history":
+            with nothing to export the manifest still answers `200` with `fileHistory: null`. May carry `permanence` (`transient` / `terminal`; absent = the store did not judge — see `ErrorResponse.permanence`). Older servers read an
+            unreadable history as "none" (manifest 200 / blob 404).
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/sessions/{sessionId}/sync/blobs/{hash}:
     parameters:
@@ -3142,12 +3036,10 @@ paths:
         body). The cloud verifies `sha256(body) === :hash` (the content-address integrity guard) BEFORE storing — a
         mismatch → 400 `blob hash mismatch`. own-or-FRESH gate. Per-blob cap 64 MiB → 413 mid-stream beyond it. A
         backend write failure (e.g. a MinIO non-2xx) → 502 `blob store write failed`. 204 on success (no body). The
-        PUSH path is the BARE `blobs/:hash` (the PULL is `history/blobs/:hash` since server 7.52,
-        `snapshots/:key/blobs/:hash` before). 🔴 server ≥7.52 (S-15 换店): the blob faces ride the
+        PUSH path is the BARE `blobs/:hash` (the PULL is `history/blobs/:hash`). The blob faces ride the
         file-HISTORY store — a deployment whose store has no blob faces (the local file backend) answers 501
         `capability.snapshot_store_required` ("blob upload requires a durable file-history store") while the
-        rest of the sync surface keeps working; on ≤7.51 the same code meant a missing snapshot store. Same
-        code, same operator disposition (wire a backend with blob faces).
+        rest of the sync surface keeps working (operator disposition: wire a backend with blob faces).
       requestBody:
         required: true
         content:
@@ -3217,16 +3109,17 @@ paths:
       x-status: live
       summary: PUSH Phase A — classify + stage (mint a stagingId).
       description: >
-        2c session-sync PUSH Phase A — a SMALL metadata body (`entryIds, snapshots, policy, anchors, resolution?`); the
+        2c session-sync PUSH Phase A — a SMALL metadata body (`entryIds, fileHistory?, policy, anchors, resolution?, logDigest?, title?, pinned?`); the
         entries stream in Phase B. The cloud classifies (§7), pre-checks blob presence (a missing referenced hash →
-        422 `missing_blob` — PUT it first), guards the import lease + any active run (409), then mints a stagingId.
-        ⚠️ S-15 EPOCH: server ≥7.52's Phase A consumes `{entryIds, fileHistory?, policy, anchors, resolution?,
-        logDigest?}` (routes/session-sync.ts) — the `snapshots` key is SILENTLY IGNORED there (an unknown body key); the
-        file history rides `fileHistory` (a `FileHistoryExport` envelope, `null` / absent = none) and every blob it references must have been
-        `PUT …/sync/blobs/{hash}` first. ≤7.51 servers consume `snapshots` and do not know `fileHistory`. SDK 16.2.0 carries
-        `fileHistory` in `pushSessionBundle` / `importSessionBundle` (and fills `snapshots: []` on the pull side when the manifest omits it); a hand-rolled
-        push must send `fileHistory` itself, and only to a peer whose `capabilities.sessionSyncFileHistory` is not false (server >= 7.116.0 — else the
-        commit 422s `missing_blob`).
+        422 `missing_blob` — PUT it first; server >= 7.135.0 answers it in this FIRST phase — zero staging, zero commit, ahead of the `identical` replay arm — and
+        a deployment whose `capabilities.sessionSyncFileHistory` is false, e.g. `DB_BACKEND=local`, takes a `fileHistory` that references blobs as a first-phase 422 too: the conversation does not land either; <= 7.134.x answered it after the conversation
+        had committed), guards the import lease + any active run (409), then mints a stagingId. 🔴 server >= 7.135.0: a file-history replay fault (the replay arms of `identical` re-push and of the commit) answers `422 adopt_failed`
+        (+ optional `permanence`, see `ErrorResponse.permanence`; <= 7.134.x: `unsupported_format`) — distinct from `missing_blob`.
+        The file history rides `fileHistory` (a `FileHistoryExport` envelope, `null` / absent = none) and every blob it references must have been
+        `PUT …/sync/blobs/{hash}` first (the `snapshots` key of servers <= 7.51 is outside the support range; a supported server ignores it and sdk 26.0.0
+        no longer declares it). The SDK carries `fileHistory` in `pushSessionBundle` / `importSessionBundle`; a hand-rolled
+        push must send `fileHistory` itself, and only to a peer whose `capabilities.sessionSyncFileHistory` is not false (server >= 7.116.0 — else
+        `422 missing_blob` in the first phase from server >= 7.135.0; after the commit on <= 7.134.x).
         `identical` → `{ relation:"identical", basis, payloadVerified }` with NO stagingId (skip Phase B);
         `basis` is `"entry-ids+digest"` when the caller supplied a comparable digest and it matched, else
         `"entry-ids"` (id-set equality only) — see the `ImportStaged` schema, which has carried these two
@@ -3239,15 +3132,14 @@ paths:
           application/json:
             schema:
               type: object
-              required: [entryIds, snapshots, policy, anchors]
+              required: [entryIds, policy, anchors]
               properties:
                 entryIds: { type: array, items: { type: string } }
-                snapshots: { type: array, items: { $ref: '#/components/schemas/SyncSnapshot' } }
                 fileHistory:
                   oneOf:
                     - { $ref: '#/components/schemas/FileHistoryExport' }
                     - { type: 'null' }
-                  description: 'server >= 7.52: the file-history envelope (replaces `snapshots`); `null` / absent = none. Every blob it references must already be PUT.'
+                  description: 'the file-history envelope; `null` / absent = none. Every blob it references must already be PUT.'
                 policy: { type: array, items: { $ref: '#/components/schemas/SessionRulesRecord' } }
                 anchors: { type: array, items: { $ref: '#/components/schemas/SyncAnchor' } }
                 title:
@@ -3300,7 +3192,12 @@ paths:
           content:
             application/json:
               schema: { $ref: '#/components/schemas/SyncConflict' }
-        '422': { $ref: '#/components/responses/UnprocessableEntity' }
+        '422':
+          description: >-
+            422 — `missing_blob` (first phase from server >= 7.135.0), `restore_failed`, and (server >= 7.135.0) `adopt_failed` (+ optional `permanence`) for the file-history replay; `invalid_entries` etc. as before. Branch on `errorCode`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
         '501': { $ref: '#/components/responses/NotImplemented' }
         '503': { $ref: '#/components/responses/Unauthorized' } # (declared 2026-08-01) E6 兄弟守卫:无 service token + 未开 ALLOW_UNAUTHED_WRITES 时,这条 import 提交腿与 `PUT …/policy` 写的是同一个 policy store ⇒ 同门同码 `auth.service_token_required`(server 3.15.0 起)
 
@@ -3324,7 +3221,7 @@ paths:
       description: >
         2c session-sync PUSH Phase B — stream the entry log as an NDJSON REQUEST body into the staged shadow id; the
         cloud validates per-line (the streaming invariant gate) then `finish()` (exactly-one-root + leaf-resolvable) →
-        commits (the atomic swap) → replays snapshots/policy/anchors. Returns `{ relation }` (the AUTHORITATIVE in-txn
+        commits (the atomic swap) → replays fileHistory/policy/anchors. Returns `{ relation }` (the AUTHORITATIVE in-txn
         re-classify). Re-POSTing the same stagingId is idempotent. Typed errors: a per-entry / structural violation →
         422 `invalid_entries`; a line too large → 413; a commit-time TOCTOU flip to fork/stale → 409 `conflict`
         (SyncConflictError); a refused policy loosen → 403 `loosen_forbidden`; a wrong/foreign stagingId → 404.
@@ -3342,7 +3239,8 @@ paths:
         '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
         '403':
-          description: 403 `loosen_forbidden` — a post-commit policy replay tried to relax the rules (tighten-only).
+          description: >-
+            403 `loosen_forbidden` — a post-commit policy replay tried to relax what an operator wrote (server >= 7.135.0; <= 7.134.x: tighten-only against the whole row). A non-operator replay keeps each record's own operator part; an operator replay makes the imported row the operator's.
           content:
             application/json:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
@@ -3385,6 +3283,22 @@ paths:
             application/json:
               schema: { $ref: '#/components/schemas/PendingList' }
         '401': { $ref: '#/components/responses/Unauthorized' }
+        '500':
+          description: >-
+            server >= 7.134.0: a queue row whose stored body cannot be read (the store's refusal contract — a retry fails the same way; an operator has to repair
+            or delete that row) answers `500` + `errorCode: "approvals.read_corrupt"` (body `{ error, errorCode }`; the bad row's coordinates stay off the wire) —
+            the same judge and the same code as `GET /v1/approvals/stream`. Do NOT retry it as-is (the SDK's GET retry arm exempts the code). Every other read
+            failure (connection / timeout / store hiccup) is `503 approvals.read_unavailable` from server >= 7.135.0 (below); servers <= 7.134.x answered it `500 internal.error`. Older servers answered the corrupt row with `internal.error`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '503':
+          description: >-
+            server >= 7.135.0: `503 approvals.read_unavailable` — the approvals queue could not be read RIGHT NOW (the store hiccuped; transient — the SDK retries it by status). Until a read succeeds, an answer here does NOT mean nothing is pending.
+            Body `{ error, errorCode }`. Older servers answered a read that could not complete with the global fallback `500 internal.error`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/approvals/stream:
     parameters:
@@ -3829,6 +3743,20 @@ paths:
             application/json:
               schema: { $ref: '#/components/schemas/InboxList' }
         '401': { $ref: '#/components/responses/Unauthorized' }
+        '500':
+          description: >-
+            server >= 7.135.0: `500 approvals.read_corrupt` — a queue row's stored body cannot be read (the store's refusal contract: a retry fails the same way; an operator has to repair or delete that row) — the SAME judge and the same code as `GET /v1/approvals`
+            and `GET /v1/approvals/stream`. Do NOT retry it as-is (the SDK's retry arm exempts the code). Every other read failure is `503 approvals.read_unavailable` (below). Older servers: `500 internal.error`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '503':
+          description: >-
+            server >= 7.135.0: `503 approvals.read_unavailable` — the approvals queue could not be read RIGHT NOW (the store hiccuped; transient — the SDK retries it by status). Until a read succeeds, an answer here does NOT mean nothing is pending.
+            Body `{ error, errorCode }`. Older servers answered a read that could not complete with the global fallback `500 internal.error`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/assistant/tasks:
     parameters:
@@ -3850,6 +3778,20 @@ paths:
             application/json:
               schema: { $ref: '#/components/schemas/AssistantTaskList' }
         '401': { $ref: '#/components/responses/Unauthorized' }
+        '500':
+          description: >-
+            server >= 7.135.0: `500 approvals.read_corrupt` — a queue row's stored body cannot be read (the store's refusal contract: a retry fails the same way; an operator has to repair or delete that row) — the SAME judge and the same code as `GET /v1/approvals`
+            and `GET /v1/approvals/stream`. Do NOT retry it as-is (the SDK's retry arm exempts the code). Every other read failure is `503 approvals.read_unavailable` (below). Older servers: `500 internal.error`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '503':
+          description: >-
+            server >= 7.135.0: `503 approvals.read_unavailable` — the approvals queue could not be read RIGHT NOW (the store hiccuped; transient — the SDK retries it by status). Until a read succeeds, an answer here does NOT mean nothing is pending.
+            Body `{ error, errorCode }`. Older servers answered a read that could not complete with the global fallback `500 internal.error`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/assistant/tasks/{taskId}/resume:
     parameters:
@@ -4458,7 +4400,7 @@ paths:
                     verbatim 400 texts, the two capability bits to probe first and the `deny` posture are on
                     the PersistRuleSelection schema. Allow-family only (on `deny` the whole field is ignored).
 
-                    ⚠️ If the frame carried neither `ruleOffers` nor `ruleSuggestions`, do not send this key —
+                    ⚠️ If the frame carried no `ruleOffers`, do not send this key —
                     there is nothing redeemable for THIS card and the answer is necessarily
                     `rulePersisted:false` + `rule_lane_unavailable` (the missing material short-circuits BEFORE
                     any candidate comparison, so it is never `rule_not_offered`). Absence has several causes —
@@ -5327,39 +5269,6 @@ paths:
                   error: { type: string }
                   missing: { type: array, items: { type: string } }
 
-  /v1/approvals/{approvalId}:
-    parameters:
-      - $ref: '#/components/parameters/PrincipalHeader'
-      - in: path
-        name: approvalId
-        required: true
-        schema: { type: string }
-    get:
-      tags: [approvals]
-      operationId: approvalsGet
-      x-status: retired          # 5.0.0: legacy approval-store leg deleted — NO deployment serves this route.
-      summary: 'RETIRED (server 5.0.0) — by-id approval read; every deployment answers 404. Use GET /v1/approvals.'
-      description: >
-        🔴 RETIRED as of `@sema-agent/server` 5.0.0 ([2354]/[2356] A-5): the legacy approval-store polling leg
-        that served this route was deleted whole, and the durable checkpoint lane never had a by-id read
-        (it can list by scope or look up by capability token — there is no simple-id query). A worker WITH a
-        checkpoint store answers 404 `not_found.route`; a worker WITHOUT one never matches the `/v1/approvals*`
-        prefix at all. Either way: 404 on every deployment, and that 404 is indistinguishable from "no such
-        approval", which is exactly why the SDK stopped calling it (4.0.1 — `approvals.get` now reads
-        `GET /v1/approvals` and filters by `sessionId`, one round trip instead of a guaranteed-404 probe plus
-        the same list call).
-        Kept in the spec as a tombstone rather than deleted: consumers generated against an older spec need to
-        see WHY the path went away. Decide via `POST /v1/approvals/{sessionId}/decide`; list via `GET /v1/approvals`.
-        Historical shape (below) is left intact for the same reason; it describes no live behavior.
-      responses:
-        '200':
-          description: The approval row (full args projection).
-          content:
-            application/json:
-              schema: { $ref: '#/components/schemas/ApprovalRow' }
-        '401': { $ref: '#/components/responses/Unauthorized' }
-        '404': { $ref: '#/components/responses/NotFound' }
-
   /v1/memory/export:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -6076,6 +5985,14 @@ paths:
               schema: { $ref: '#/components/schemas/WorkflowJournalPage' }
         '401': { $ref: '#/components/responses/Unauthorized' }
         '404': { $ref: '#/components/responses/NotFound' }
+        '500':
+          description: >-
+            server >= 7.135.0 (core 7.55.0): `500 workflow.journal_incompatible` — a journal row the engine's judge rejects (a parked row with no checkpoint token, a parked row whose terminal is not paused, a row that does not read as an object — hand-edited / another writer /
+            a newer format). The judgment covers the WHOLE journal, on every backend, on every page (a bad row on another page, or one over 64 KiB, answers the same); the body carries `ordinal` (the first bad row, ascending; `-1` = the refusal names no entry). The run's resume is refused by the engine
+            with the same code. Repair that row from the retained copy — NEVER by deleting it (a missing entry re-runs that step live). A retry changes nothing (the SDK's retry arm exempts the code). <= 7.134.x read such rows back as `200`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
   /v1/workflows/{workflowRunId}/agents/{label}/steer:
@@ -7161,8 +7078,32 @@ components:
         enabled: { type: boolean }
         available: { type: boolean, description: 'whether this deployment can actually RUN the scenario right now — same predicate as the 501 rejection arm on submit; false ⟺ submitting is guaranteed to 501. Independent axis from `enabled` (declared vs runnable).' }
         attachmentSupplies: { type: array, items: { type: string, enum: [path, content_text, content_image] }, description: 'server >= 7.133.0, always present there: the attachment SUPPLY words this scenario actually carries — a subset of `capabilities.userAttachments.supplies` (`path` only on hands scenarios, where a workspace lives somewhere; a no-hands scenario drops `path`, and a `path` entry is refused by the engine with `config.user_attachment_invalid`). ABSENT = server <= 7.132.x: fall back to `userAttachments.supplies` plus the existing 400 handling.' }
+        skills:
+          type: array
+          items: { $ref: '#/components/schemas/ScenarioSkill' }
+          description: >-
+            server >= 7.135.0, always present there (`[]` when none): the deployment SKILLS this scenario's run mounts (the deployment skills directory UNION what the config source hands over, filtered by scenario; a request's own `skills` are not
+            included) — the same single filter that feeds `TaskSpec`, same group, same order. A client's `/skill-name` completion reads it; naming one goes through `userInvokedSkills`. Entries carry no body and none of a skill's tool lists. On the card
+            but not in the run: `disableSkills: true` (nothing mounted) and a skill whose body exceeds the engine's load cap (naming it answers `config.user_invoked_skill_unknown`). ABSENT = an older server: the list cannot be read —
+            NOT "no skills" (that is `[]`). Bit: `capabilities.scenarioSkills`.
         unavailableReason: { type: string, description: 'machine-readable reason, present ONLY when available:false (absent = no reason). Closed set, currently the single member `git_client_unconfigured`; branch on the key, never match the English prose. Additive-open: treat an unknown word as "unavailable, reason unknown".' }
 
+    ScenarioSkill:
+      type: object
+      description: One row of `ScenarioDetail.skills` (server >= 7.135.0). No body, no tool lists.
+      additionalProperties: false
+      required: [name, description, source]
+      properties:
+        name: { type: string }
+        description: { type: string }
+        source: { $ref: '#/components/schemas/ScenarioSkillSource' }
+    ScenarioSkillSource:
+      type: string
+      description: >
+        Where a scenario skill came from (server >= 7.135.0; the server's self-minted word table `scenarioSkillSource`, closed two words): `factory` = the deployment's skills directory (`SKILLS_DIR`);
+        `center` = the config source (the center / the local `config.d` skills list, or a config-declared plugin) — a skill that overrides a same-named factory one by name is also `center`.
+      enum: [factory, center]
+
     RunStatus:
       type: string
       enum: [running, completed, failed, suspended, needs_review, blocked]
@@ -7445,7 +7386,7 @@ components:
             CC Rewind parity (E18). Fork the conversation FROM this user-message SessionTreeEntry.id (non-destructive
             branch via setLeafId). With `restoreFiles: true` ⇒ "both" (also restore the working tree — the retired spelling
             `rewindFiles` still rides the wire but its restore sense is core's typed migration rejection naming `restoreFiles`). Alone ⇒
-            "conversation". HONORED only where the deployment wired a resume-anchor store + getLeafId (capabilities.resumeAt);
+            "conversation". HONORED only where the deployment wired a resume-anchor store + the session head read `headOf` (<= 7.134.x: `getLeafId`) (capabilities.resumeAt);
             unknown anchor ⇒ 4xx, capability-off ⇒ 501. Cannot combine with a durable resume.
         resumeAtMode:
           type: string
@@ -7479,7 +7420,7 @@ components:
             kind of handle as `resumeAt`, resolved through the SAME anchor store — typically the `taskId` from that turn's
             202 receipt (the server keys the user-message anchor by the run's taskId). Server `src/boot/resolve-spec.ts:686-697`:
             `resumeAnchorStore.resolve(sessionId, handle, principal)` → entry id; unknown handle ⇒ 404
-            `rewind_files_to.unknown_event`; no session ⇒ 422 `rewind_files_to.no_session`; no anchor store / no getLeafId ⇒
+            `rewind_files_to.unknown_event`; no session ⇒ 422 `rewind_files_to.no_session`; no anchor store / no session head read (`headOf`; <= 7.134.x: `getLeafId`) ⇒
             501. ⚠️ The 501 is NOT the capability's whole predicate: `capabilities.rewindFilesTo` also requires the
             file-history store; without it the server does not 501 — core refuses at prepare with
             `rewind.store_unconfigured` (server >= 7.104.0 / S-724: a 409 error body on the synchronous `POST /v1/tasks` when
@@ -7801,7 +7742,7 @@ components:
             `permissions.defaultMode`'s specific fold is documented on `TaskRequest.permissionMode`.
             🔴 ON THIS SUBMIT FACE THE KEY SET IS CLOSED (server >= 7.57.0 for the sub-tree): accepted top-level keys
             are `env` / `hooks` / `model` / `outputStyle` / `permissions` / `skillListingBudgetFraction` /
-            `skillListingMaxDescChars` / `ultracode` / `webSearch` (server >= 7.133.0 adds the three TIGHTEN-ONLY seats `complianceAdditionalDenies` / `readDenyPatterns` / `writeProtectedExtra`), and accepted `permissions.*` keys are
+            `skillListingMaxDescChars` / `ultracode` / `webSearch` (server >= 7.133.0 adds the three TIGHTEN-ONLY seats `complianceAdditionalDenies` / `readDenyPatterns` / `writeProtectedExtra`; server >= 7.134.0 adds `approvalFrameFamilies`), and accepted `permissions.*` keys are
             `allow` / `ask` / `defaultMode` / `deny` / `disableAutoMode` (server >= 7.133.0 adds `neverAuto`); anything else is 400 `request.body_shape`
             with the names in the refusal's `unknownKeys` / `unsupportedKeys` arrays (REFUSED, not dropped — a dropped
             key reads as "in effect" to the caller). The object stays OPEN here because the same `SemaSettings`
@@ -7812,6 +7753,15 @@ components:
             (the request face has no loosening arm); an empty array is the same as not sent. Bad value => 400 `request.field_invalid` with `field` + `reason` (`over_cap` + `count` + `cap` / `bad_entry` + the first bad `index`).
             Caps: 1000 entries per seat, EXCEPT `readDenyPatterns`: at most 32 entries, at most 2 `*` per path segment and 16 `*` in the whole table (every star counts, nothing is folded). A `neverAuto` name that can never match any tool => 422.
             A resume replay of a stored body whose seat went bad => 409 `resume_blocked_by_policy`. A compliance deny is a REFUSAL, not a narrowing: a request denying `web_fetch` is refused whole where the default tool surface still mounts `WebFetch` (the single-user default does).
+            🔴 `settings.approvalFrameFamilies` (server >= 7.134.0; send it on sight of `capabilities.taskSettings.approvalFrameFamilies === true` — NOT of the top-level
+            `capabilities.approvalFrameFamilies`, which <= 7.133.x already has while answering 400 `request.body_shape` for this key): the approval opening-frame FAMILIES this
+            run's client RENDERS — an array of `tool_approval` / `approval_request`, each once (`[]` reads as absent). Bad value (not an array / a word outside the set / a
+            repeat) => 400 `request.field_invalid` with `field: "settings.approvalFrameFamilies"`, `reason: "bad_entry"` and `index` (absent for a non-array). BEHAVIOR (BREAKING, wire):
+            a run whose declaration does not contain the family this worker presents (`capabilities.approvalFrameFamilies`) has NO live approval channel — no card of either
+            family (no fallback, no double send), no replay in the stream preamble of the sync stream or of `GET /v1/runs/{taskId}/events`; every ask goes to the unattended
+            policy at once: with a durable store (`capabilities.approvals`) it parks per the operator policy (default; answer through `POST /v1/approvals/{sessionId}/decide`)
+            or is refused naming the missing family; with NO durable store the gated tool is refused on the spot and the run finishes (no card, no decide). The declaration
+            rides the persisted body onto resume legs.
             🔴 `settings.hooks[]` (server >= 7.133.0; probe `capabilities.taskSettings.pluginHooks` / `managedHookGroups` — an absent or false bit = the keys are STRIPPED SILENTLY): group key `source` (closed: `managedPolicy` / `user` / `project` / `local` / `flag` /
             `managedPlugin:<name>` / `plugin:<name>`; absent = unmanaged; managed groups run in an independent lane after the unmanaged rewrites), command-entry keys `plugin { name, root, dataDir?, options? }` and exec-form `args`; a malformed one =>
             400 `request.field_invalid` with `detail: { reason: "wire_key_invalid", key, path }`; the plugin context has one 8192-character budget.
@@ -8066,6 +8016,15 @@ components:
             combination); `taskWriteFaceOpen` is NOT its reading. Residual (server S-908): the binding is keyed by SESSION and written
             after the run is claimed (a refused request writes nothing); on deployments without a run store two concurrently accepted
             runs on one session are last-writer-wins. Delegated children's shells keep the default scrub.
+        projectMemory:
+          type: string
+          enum: [disabled]
+          description: >
+            server >= 7.135.0 (engine 7.55.0 `TaskSpec.projectMemory`, passed through verbatim): this ONE run does not read the deployment's project context — the engine does not call the deployment's project-context seat, so the project layer,
+            the declared instruction files and the few things they feed are all absent (the engine's own git-status lane, the memory engine, skills / hooks / MCP are unaffected; delegated / background / fork / workflow children inherit it from
+            the parent). The only word is `disabled`; the key ABSENT = call the seat. The leg's `wiring_manifest.projectMemory` reads `disabled` and the server-minted `instructions` section is absent. A deployment without the seat still accepts it
+            (the manifest answers `absent`). Anything else (`off`, a boolean, `null`) ⇒ a fresh submit answers 400 `request.field_invalid`; a resume replay judges the same and folds into 409 `resume_blocked_by_policy`
+            (`blockedBy: request.field_invalid`). Read `capabilities.projectMemory` beforehand: older servers answer 400 `request.body_shape` (`unknownKeys: ["projectMemory"]`).
         attachments:
           type: object
           description: >
@@ -9659,6 +9618,14 @@ components:
             redispatched: { type: array, items: { type: string } }
             collapsed: { type: string }
 
+    ApprovalFrameFamily:
+      type: string
+      enum: [tool_approval, approval_request]
+      description: >-
+        The approval opening-frame FAMILY words (closed; the server's `APPROVAL_FRAME_FAMILIES` verbatim and in order): `tool_approval` = the legacy family
+        (live card `tool_approval` / close `tool_approval_complete`); `approval_request` = the card family (`approval_request` / `approval_complete` /
+        batch revoke `approval_revoke`). ONE vocabulary for two faces: the capability `approvalFrameFamilies` (which family this worker presents) and, server >= 7.134.0,
+        the request key `settings.approvalFrameFamilies` (which families this run's client renders).
     ApprovalDecision:
       type: object
       description: HITL decision (`POST /v1/approvals/:sessionId/decide`).
@@ -9726,30 +9693,17 @@ components:
             refused by the ENGINE before the CAS (409 `resume_outcome_invalid` + `field: "hostDecision"`, the card stays
             pending); outside the closed set ⇒ 400 `request.field_invalid`; any value on a direct-door worker ⇒ 400
             `decided_by_not_in_proof`. An older server (no `approvalDecidedBy` bit) refuses the key (400 `request.body_shape`).
-
-    ApprovalRow:
-      type: object
-      description: >
-        The legacy D-lane approval row of GET /v1/approvals/{approvalId} (server `ApprovalRow`,
-        plugins/approval-store-sql.ts — the row is `sendJson`'d verbatim, approvals-assistant.ts).
-        Present only on deployments running the legacy `approvalStore` leg (no `checkpointStore` wired);
-        the durable F4 lane has no by-id GET (only list + decide).
-      # 🔴 census 批2 五段:CLOSED — byte-identical to the server row type, no extra keys.
-      required: [id, taskId, sessionId, owner, scope, toolName, args, status, reason, decidedBy, createdAt, decidedAt]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-        taskId: { type: [string, 'null'] }
-        sessionId: { type: [string, 'null'] }
-        owner: { type: [string, 'null'] }
-        scope: { type: [string, 'null'], description: 'Single-DB fleet scope guard (tenant identity, owner-sourced).' }
-        toolName: { type: string }
-        args: { description: 'The reviewed tool-call args — full fidelity, not redacted (this IS the review surface).' }
-        status: { type: string, enum: [pending, approved, denied, expired] }
-        reason: { type: [string, 'null'] }
-        decidedBy: { type: [string, 'null'] }
-        createdAt: { type: string }
-        decidedAt: { type: [string, 'null'] }
+        feedback:
+          type: string
+          description: >-
+            server >= 7.134.0 (core 7.54.0) — what the approving PERSON writes in the card's "and tell the agent what to do next" input: on the resumed
+            leg it reaches the model as the user's own words (unfenced, unbounded — like the reference's accepted-prompt feedback). ONLY on a person's approve
+            (`decision: "approve"`, `decidedBy` absent or `person`): on a deny or a `decidedBy: "policy"` decision ⇒ 400 `request.field_conflict` with
+            `detail.kind: "approval_feedback"` and `detail.fields` `["feedback", "decision"]` / `["feedback", "decidedBy"]` (a denial's words go in `reason`);
+            a non-string ⇒ 400 `request.field_invalid`; any value on a direct-door worker ⇒ 400 `feedback_not_in_proof` (not inside the signed proof); words
+            carrying `<system-reminder>` ⇒ server >= 7.135.0 (engine 7.55.0): 409 `resume_outcome_invalid` + `field: "feedback"` + `retriable: true` (the engine's sentence naming `feedback`; refused before the CAS, the card stays pending — ask the person to change
+            or drop the words, do not auto-refetch and re-decide on the code); server 7.134.x: 409 `approval_binding_mismatch` (no `field`). The same door serves parked background-agent cards and workflow child cards; the live
+            `POST /v1/tool-approvals/{id}/respond` does NOT take it. Servers <= 7.133.x refuse the key (400 `request.body_shape`, `unknownKeys: ["feedback"]`).
 
     Capabilities:
       type: object
@@ -9958,7 +9912,7 @@ components:
           type: boolean
           description: >-
             Code-only rewind (`TaskRequest.rewindFilesTo`) is wired — mint `routes/capabilities.ts:839` =
-            `Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && deps.sessionStorage?.getLeafId)`: it needs the
+            `Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && headReadOf(deps.sessionStorage))` (<= 7.134.x last conjunct: `deps.sessionStorage?.getLeafId`): it needs the
             file-history store (to restore) AND the anchor map (to resolve the target HANDLE). Corrected in sdk 11.4.0
             (board [8437] U3): the store is the FILE-HISTORY store (not the pre-S-15 whole-tree snapshot store).
             🔴 K-24: on server 7.97.0–7.103.x that seat was the CAPTURE face (backend AND the `FILE_HISTORY_CAPTURE` knob), so a
@@ -10029,32 +9983,20 @@ components:
                 leaseClient: { type: boolean, description: 'server >= 7.121.0, a version bit (always true, rides with the `fleet` object): this binary carries the serving-lease CLIENT — when the engine is a fleet member (`FLEET_GENERATION`) and the center declares in its heartbeat reply that it answers renewals (`servingLease`), the engine renews and is governed by the lease. Deliberately NOT named `servingLease` (that is the center''s bit): this says the client exists, not that a lease is in force — read `/health.leaseState` for that. Absent = an older worker.' }
                 generationEcho: { type: boolean, description: 'server >= 7.121.0, a version bit (always true, rides with the `fleet` object): this binary echoes env `FLEET_GENERATION` as `generation` on the heartbeat and on `/health` (with `leaseState` / `leaseUntil`), and the drain endpoint `POST /v1/admin/drain` compares the four-part identity including `expectedGeneration`. Absent = an older worker.' }
         workspace:
+          type: boolean
+          enum: [false]
           description: >
-            #3 (server 1.299–7.51): workspace-browse capability family — an OBJECT when the E19 snapshot-store
-            read faces + a durable session store are wired ({browse, archive, maxFileBytes}); `false`/absent
-            otherwise (same predicate as the routes' 501). `maxFileBytes` = the single-file read cap (over-cap
-            ⇒ 413 workspace_file_too_large envelope; the archive endpoint is the escape hatch).
-            🔴 RETIRED (server ≥7.52, S-15/design/381): the whole-tree snapshot epoch this face projected was
-            replaced by per-edited-file rewind history, so this key is now ALWAYS false and the four
-            /v1/sessions/{sessionId}/workspace* routes answer 501 `capability.workspace_retired` (route shape
-            kept as a tombstone — a named refusal, not a 404 that reads like a typo). Consumption posture
-            unchanged: probe this bit, false ⇒ don't render the panel.
-          oneOf:
-            - type: boolean
-              enum: [false]
-            - type: object
-              additionalProperties: true
-              properties:
-                browse: { type: boolean }
-                archive: { type: boolean }
-                maxFileBytes: { type: integer }
+            The workspace-browse bit — ALWAYS `false` on every supported server (>= 7.52.0: the whole-tree snapshot epoch was replaced by
+            per-edited-file rewind history; the four /v1/sessions/{sessionId}/workspace* routes answer 501 `capability.workspace_retired`, route shape kept as a
+            tombstone). sdk 26.0.0 deleted the object arm `{ browse, archive, maxFileBytes }` (servers 1.299–7.51, below the support floor).
         sessionEvents:
           type: boolean
           description: >
             🔴 契约调和车1 H② (2026-08-02): server HAS been emitting this key (the `sessionEvents` bit in `src/http/routes/capabilities.ts`)
             while both this spec and the SDK type were missing it. Gates `GET /v1/sessions/{sessionId}/events`
-            (the session-level SSE head subscription). Predicate is a THREE-way AND: a durable session-watch seam
-            plus a session store exposing BOTH `getLeafId` and `ownerOf` — the route's 501 uses the same
+            (the session-level SSE head subscription). Predicate (server >= 7.135.0) is a TWO-way AND: a durable session-watch seam
+            plus a session store exposing the session head read `headOf` (<= 7.134.x it was a THREE-way AND with BOTH `getLeafId` and `ownerOf`; those two
+            methods left the store contract in 7.135.0, so `DB_BACKEND=memory` now answers `true`, was `false`) — the route's 501 uses the same
             predicate, so "says yes <=> route works" holds here. False/absent => fall back to polling
             `GET /v1/sessions/{sessionId}/head`. NOTE (server [2373]A-5): no consumer is wired to it yet — it is
             a prepared slot, correct to gate on, wrong to read as "widely consumed".
@@ -10140,7 +10082,7 @@ components:
         approvalFrameFamilies:
           type: array
           maxItems: 1
-          items: { type: string, enum: [tool_approval, approval_request] }
+          items: { $ref: '#/components/schemas/ApprovalFrameFamily' }
           description: >-
             server >= 7.133.0, ALWAYS present (the projection of the same judgement as `streamApproval`) — which FRAME FAMILY this worker's approval opening frames belong to:
             a closed-word array with AT MOST ONE member. `["approval_request"]` = the card protocol is on: one ask travels only `approval_request` -> `approval_complete` / `approval_revoke`
@@ -10148,6 +10090,9 @@ components:
             remedy on the worker: `STREAM_APPROVAL_ENABLED=false`). `["tool_approval"]` = the card protocol is not on (`STREAM_APPROVAL_ENABLED=false`, no store backend, or no checkpoint store) but the live card leg is.
             `[]` = per-call approvals are off altogether (`TOOL_APPROVAL_ENABLED=false`): no card is presented. Dispatch frame families off THIS array, never off `streamApproval`.
             KEY ABSENT (not `[]`) = server <= 7.132.x — there a `streamApproval: true` leg sends BOTH families for one ask.
+            🔴 server >= 7.134.0: this bit says which family THIS WORKER presents, no longer that you will receive cards — a run has a live approval channel only when
+            its submit body declared that family in `settings.approvalFrameFamilies` (send it on sight of `taskSettings.approvalFrameFamilies`, not of this bit — <= 7.133.x
+            already had this bit yet answers 400 `request.body_shape` for the key). The value does not change with a declaration. The words are the request key's words.
         streamApproval:
           type: boolean
           description: >
@@ -10324,6 +10269,7 @@ components:
             pluginHooks: { type: boolean, description: 'server >= 7.133.0 — the request `settings.hooks[]` PLUGIN-CONTEXT keys (command entry `plugin { name, root, dataDir?, options? }` / exec-form `args`) are accepted; same predicate as `hooks` (single-user true, multi-tenant false). ABSENT or false = the keys are stripped silently — send only on sight of the bit.' }
             managedHookGroups: { type: boolean, description: 'server >= 7.133.0 — the request `settings.hooks[]` GROUP `source` key (managed lanes `managedPolicy` / `managedPlugin:<name>`) is accepted; same predicate as `hooks`. ABSENT or false = stripped silently (the managed-lane semantics do not apply, it is not a refusal).' }
             tightenOnlySeats: { type: boolean, description: 'server >= 7.133.0, constant true — the four tighten-only request seats `settings.readDenyPatterns` / `settings.writeProtectedExtra` / `settings.complianceAdditionalDenies` / `settings.permissions.neverAuto` are accepted (each seat = deployment table UNION request list, only ever growing; an empty array is the same as not sent). ABSENT = server <= 7.132.x, which answers 400 `request.body_shape` for those keys — send only on sight of the bit.' }
+            approvalFrameFamilies: { type: boolean, description: 'server >= 7.134.0, constant true — the request key `settings.approvalFrameFamilies` (which approval opening-frame families this run''s client renders) is accepted. THIS is the trigger bit for that key, NOT the top-level `approvalFrameFamilies`: servers <= 7.133.x already carry the top-level bit yet answer 400 `request.body_shape` (`unknownKeys: ["settings.approvalFrameFamilies"]`) for the key. ABSENT = do not send it.' }
         settings:
           type: object
           description: >
@@ -10382,11 +10328,29 @@ components:
             — SQL backends only; `DB_BACKEND=local` is always false). Advertises exactly the two file-history blob faces
             `PUT /v1/sessions/{sessionId}/sync/blobs/{hash}` and `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`.
             READ IT ON BOTH ENDS of a sync: if either is false, sync the conversation only — do not push `fileHistory`, do
-            not PUT blobs (a `fileHistory` pushed to a peer without the blob faces 422s `missing_blob` after commit). When
+            not PUT blobs (a `fileHistory` pushed to a peer without the blob faces 422s `missing_blob` in the FIRST phase — zero staging, zero commit, the conversation does not land either — from server >= 7.135.0; <= 7.134.x answered it in the second phase, after the conversation committed). When
             false the two routes answer 501 `capability.snapshot_store_required` (any session id, ahead of the owner check).
             A blob that the session history graph does not reference / whose bytes are gone stays a 404 `not_found.blob`.
             ABSENT = an older server (<= 7.115.x): the bit cannot be read there (a `DB_BACKEND=local` deployment with
             `sessionSync: true` answered PUT blob 501 on every call), so try as before.
+        sessionRulesNamespaceForms:
+          type: boolean
+          description: >
+            server >= 7.135.0 (predicate class "always true", read per request from the engine's protocol table): the session-rule write faces (`PUT /v1/sessions/{id}/policy`, the `policy` face of `POST /v1/sessions/{id}/sync/import`)
+            accept — in `toolAllow` / `toolDeny` — the three COVERING FORMS of every protocol namespace the engine knows (today `mcp__` and `a2a__`): the whole peer (`mcp__srv`), a tool-segment wildcard (`mcp__srv__*`)
+            and a tool-segment glob (`mcp__srv__get_*`); the engine's matcher reads each as ONE GROUP of tools. A client may stop refusing those three forms losslessly on this bit alone (never on a version guess).
+            The bit says NOTHING about other wildcards: `*`, partial peer-segment wildcards (`mcp__git*`) and a trailing-separator `mcp__srv__` are still refused by the write face (`400 rules.inert_entry`); the whole-protocol
+            name `mcp__*` is accepted only in `toolDeny`. Orthogonal to `sessionPolicy` (does the deployment have a session-rules write face at all): read `sessionPolicy` AND this bit. ABSENT (older server) and `false` ⇒ read as "do not widen".
+        projectMemory:
+          type: boolean
+          description: >
+            server >= 7.135.0 (always true): the top-level request key `projectMemory: "disabled"` is accepted. The read face hangs on no facility — a deployment without a project-context seat still accepts it
+            (the manifest answers `"absent"`). ABSENT = an older server, whose key-closure gate answers `400 request.body_shape` (`unknownKeys` names it): send the key on sight of the bit only.
+        scenarioSkills:
+          type: boolean
+          description: >
+            server >= 7.135.0 (always true): `GET /v1/capabilities/scenarios/{name}` carries `skills[]` (`ScenarioDetail.skills`). ABSENT = an older server: the card has no list — do NOT read that as "this scenario has no skills"
+            (that is `skills: []`).
 
         # ─── S-139(sdk 8.3.0):对 server 7.60.0 的整体重对账补齐的 19 位 ───────────────────────
         # 行号 = server 7.60.0 树的 `src/http/routes/capabilities.ts`。语义与谓词的全文在
@@ -10673,7 +10637,7 @@ components:
           type: boolean
           description: >
             server >= 7.85.0 (S-381 / core 7.22.0 #857; mint `routes/capabilities.ts:264` =
-            `Boolean(deps.runStore) && Boolean(deps.sessionStorage?.ownerOf)`) — presence of
+            `Boolean(deps.runStore) && Boolean(deps.sessionStorage?.ownerOf)`; server >= 7.135.0 the last conjunct is `headReadOf(deps.sessionStorage) !== undefined`) — presence of
             `POST /v1/sessions/{sessionId}/mcp/reconnect`. FACILITY DEPENDENCY, two conjuncts: a durable run
             ledger (the verb reaches the live stream through the run row) AND the session-ownership face (the
             inbound owner gate is fail-closed; without it the whole door is 501). Both 501s derive from the SAME
@@ -10794,7 +10758,7 @@ components:
             sessionBackgroundFacesAvailable(deps), exitFaces: sessionBackgroundFacesAvailable(deps) }`) — presence of the
             session background-task doors: `listFace` = `GET /v1/sessions/{sessionId}/background`, `exitFaces` =
             `POST /v1/sessions/{sessionId}/background/stop` (contract §16). Both bits use the SAME predicate as the two
-            doors' 501 (the session-ownership face `sessionStorage.ownerOf`), so "says yes but 501s" is structurally
+            doors' 501 (the session-ownership face: `sessionStorage.headOf` on server >= 7.135.0, `ownerOf` on <= 7.134.x), so "says yes but 501s" is structurally
             impossible; without it both bits are explicitly `false` and both doors answer 501
             `capability.session_ownership_required`. ENDPOINT-GATE FORM: `false` ⇒ do not call. True only promises the
             endpoint — not that this replica holds any background row of that session (the registry is in-process).
@@ -11845,7 +11809,7 @@ components:
         modelPlane:
           allOf: [{ $ref: '#/components/schemas/ModelPlane' }]
           description: >-
-            server >= 7.133.0, ALWAYS present there (appended last): which model table this engine SERVES, whether the catalog was adopted, and what the start-up route judge says — read this instead of predicting
+            server >= 7.133.0, ALWAYS present there (appended last on 7.133.0–7.134.x; from server >= 7.135.0 the last key is `aliases` and this one precedes it — key order is not a contract, read by name): which model table this engine SERVES, whether the catalog was adopted, and what the start-up route judge says — read this instead of predicting
             (the judge's inputs are the serving process's facts; mirroring two of its judgements drifts). ABSENT = an earlier server (<= 7.132.x). Field reading: ModelPlane.
         candidateRejected:
           allOf: [{ $ref: '#/components/schemas/CandidateRejected' }]
@@ -11857,6 +11821,25 @@ components:
             configuration is clean" (it is also an earlier server): render the real cause only when the key is present; keep the old behaviour when absent.
             Same read as `models`: key present => this `models` is the fallback generation (none of the candidate's models are in it). No capability bit
             (the endpoint is always there; the presence of the key is the presence rule).
+        aliases:
+          type: array
+          items: { $ref: '#/components/schemas/ModelAlias' }
+          description: >
+            server >= 7.135.0, ALWAYS present there (appended LAST; `[]` when none): the model WORDS besides `models[].name` that the server's acceptance gate takes (tier words / `default` / a catalog entry's id spelling, ...).
+            ACCEPTANCE RULE (one rule; a model-word judge reads this key, never infers from a row's id): a model word is submittable IFF its name is in `models[].name` UNION `aliases[].name` AND its row's `atMentionable !== false`
+            (`atMentionable` absent = no allowlist verdict, not "not mentionable"). `aliases` deliberately does not say which row a word lands on. ABSENT = an earlier server (<= 7.134.x): tier words / `default` stay "cannot tell" —
+            do not read the absence as "no aliases". Known boundary (not introduced by this version): a catalog entry literally named `default` does not appear in `models[]`.
+
+    ModelAlias:
+      type: object
+      additionalProperties: false
+      required: [name]
+      description: >
+        One row of `ModelsResponse.aliases` (server >= 7.135.0): a submittable model word that is not a `models[]` row. `name` = the word (never equal to a `models[].name`); `atMentionable` = the SAME projection as on a `models[]`
+        row, present ONLY when the deployment configured an at-mention allowlist (the allowlist verdict for the catalog entry the word resolves to); absent = no allowlist verdict, NOT "not mentionable".
+      properties:
+        name: { type: string }
+        atMentionable: { type: boolean }
 
     CandidateRejected:
       type: object
@@ -11931,7 +11914,8 @@ components:
       # 没声明 ⇒ 键缺席 ⇒ 不再是必有键(此前由 `input` 恒算成布尔,对没声明的条目报 false)。
       # 🔴 server 7.131.0 起 `reasoning` 同样三态:env 车道 `MODEL_REASONING` / `MODEL_VISION` 缺省 true 退役、中心名册条目不写即不声明
       # ⇒ 两键都「未声明 = 键缺席」,`required` 只剩 name / id / provider(sdk 23.1.0;TS 型 `ModelInfo.reasoning?` 早已可选)。
-      required: [name, id, provider]
+      # sdk 26.0.0(支持底线 7.52.0):`routePairing` 进 required(≥7.45 恒铸,此前因地板 3.0.0 不进)。
+      required: [name, id, provider, routePairing]
       additionalProperties: false
       properties:
         name: { type: string, description: 'the @mention handle (user-pickable model name).' }
@@ -11955,8 +11939,8 @@ components:
             adjudicated" must stay distinguishable on the wire). Declared here 2026-09-10 alongside `compat`:
             this schema is CLOSED, and the key has been minted unconditionally since 7.45 — so every real
             /v1/models response has been structurally rejected by a strict validator for the whole time (same
-            class as `hasBidiControls` on InboxRow). Optional here because the SDK's supported server floor is
-            3.0.0; the discriminant is the PEER'S VERSION, not this key's presence.
+            class as `hasBidiControls` on InboxRow). REQUIRED since sdk 26.0.0 (the support floor 7.52.0 is above 7.45; it
+            was optional only while the floor was 3.0.0).
         compat:
           $ref: '#/components/schemas/ModelCompat'
           description: >-
@@ -12236,6 +12220,8 @@ components:
         name: { type: string, description: "The workflow script's declared `meta.name`." }
         description: { type: string, description: "The workflow script's declared `meta.description` (one-liner)." }
         agentFailures: { type: integer, description: 'Count of agent-runs that ended failed — present only when > 0 (a "completed, with failures" flag without an N+1 get).' }
+        parked: { type: boolean, enum: [true], description: 'server >= 7.135.0 (core 7.55.0 `runParkedOf`) — present, always the literal `true`, ONLY while the run is `running` AND at least one of its agents is parked at an approval gate; otherwise the key is ABSENT (never `false`). Read it as "the run is waiting on a person", not "failed". Older servers never send it.' }
+        errorCode: { type: string, description: 'The run row''s machine code (open set; e.g. `workflow.agent_parked` for a drained parked terminal) — present only when the row has one. (Declared here in 26.1.0: the engine summary has emitted it since before 7.134.0.)' }
         currentPhase: { type: string, description: 'Title of the phase currently executing (absent once terminal).' }
         status: { $ref: '#/components/schemas/WorkflowRunStatus' }
         phaseCount: { type: integer, description: 'Phases recorded.' }
@@ -12414,6 +12400,8 @@ components:
         description: { type: string, description: "The workflow script's declared `meta.description` (redacted, one-liner)." }
         status: { $ref: '#/components/schemas/WorkflowRunStatus' }
         agentFailures: { type: integer, description: 'run-level count of agents whose status ended failed — stamped at run end, only when > 0.' }
+        parked: { type: boolean, enum: [true], description: 'server >= 7.135.0 (core 7.55.0 `runParkedOf`) — present, always the literal `true`, ONLY while the run is `running` AND at least one of its agents is parked at an approval gate; otherwise the key is ABSENT (never `false`). Read it as "the run is waiting on a person", not "failed". Older servers never send it.' }
+        errorCode: { type: string, description: 'The run row''s machine code (open set; the same words as the same-named slot on the fleet row, e.g. `workflow.agent_parked` for a drained parked terminal) — present only when the row has one. (Declared here in 26.1.0: the detail projection has forwarded it since before 7.134.0.)' }
         stats: { $ref: '#/components/schemas/WorkflowRunStats' }
         startedAt: { type: integer }
         endedAt: { type: integer }
@@ -12766,19 +12754,6 @@ components:
         startedAt: { type: integer }
         elapsedMs: { type: integer }
         tokens: { type: integer }
-        # tokenDir REMOVED (engine ruling 2026-06-28): dead field, 0 producer / 0 consumer — spec caught up 2026-07-26.
-        queuedCount:
-          type: integer
-          description: >-
-            🔴 PHANTOM KEY — NO server version ever emits it (verified against the published 7.87.0 bytes:
-            the row type declares it and the fleet route's per-key table forwards it, but NO producer writes it
-            — not `publishTask`'s call sites, not core's bg-sink tick, not the durable reconcile leg — and the
-            wire contract does not mention it either). The server deleted it as a DEAD KEY (S-459, zero
-            behavioural impact since `!== undefined` was always false). It stays declared here only because
-            removing an exported field is BREAKING = major-only; it is registered with its deletion condition
-            in `test/_keyset-divergence.ts` (`FLEET_TASK_ROW_PHANTOM_KEYS`) and goes with the next major.
-            DO NOT read it as "queue depth is already reported" — a permanently absent optional key is a FALSE
-            LEAD. Real queue depth needs a NEW key WITH a producer, not this one resurrected.
         awaitingPlanApproval: { type: boolean }
         currentAction: { type: string, description: "The child's most recent tool intent as one human-readable line (UNTRUSTED argument head, redacted server-side)." }
         currentTool:
@@ -12892,6 +12867,18 @@ components:
         failedCount: { type: integer }
         elapsedMs: { type: integer }
         tokens: { type: integer }
+        errorCode:
+          type: string
+          description: >-
+            server >= 7.134.0 — the workflow run's MACHINE code (open set; the same words as the same-named slot on `GET /v1/workflows/{id}`): carried verbatim when the
+            run row has one, the key ABSENT otherwise (never an empty string). A parked workflow run reads `status: "failed"` + `errorCode: "workflow.agent_parked"`
+            (parked, not failed; the `status` vocabulary gains no word). Snapshot rows, `workflow` upsert frames and rows merged from the terminal window share one mint
+            point; a `?session=` subscriber's demoted rows carry it too. ABSENT = an older server, or no code on this row — fall back to `status`.
+        parked:
+          type: boolean
+          enum: [true]
+          description: >-
+            server >= 7.135.0 (core 7.55.0 `runParkedOf`) — present, always the literal `true`, ONLY while the run is `running` AND at least one of its agents is parked at an approval gate; otherwise the key is ABSENT (never `false`). Read it as "the run is waiting on a person", not "failed". Older servers never send it. On a fleet row the workflow-bus row is now replaced WHOLE on every `workflow` upsert (server >= 7.135.0; no longer merged by `id` into the old row), so a key that left is gone from the row.
     FleetFrame:
       description: >
         One decoded frame off GET /v1/fleet/stream (service streamFleet emit set, src/http/routes/fleet.ts). On the
@@ -13105,7 +13092,8 @@ components:
         DISTINCT vocabulary from AgentEvent (the durable log is BLOCK-grained, each frame is a delta to append).
         Resumable (each `id:` = the durable task_event.seq; on 416 the server returns `{retainedFrom}` and the SDK
         resumes from there after a turns full-sync). Known events: meta / block-thinking-delta / block-content-delta
-        / tool-call / tool-result / turn / done / error (+ heartbeat keep-alives the SDK swallows). Open set.
+        / tool-call / tool-result / prompt-assembled / cross-boundary-taint (server >= 7.134.0: the device lane's taint row + `seq`, see
+        `Event_cross_boundary_taint`) / turn / done / error (+ heartbeat keep-alives the SDK swallows). Open set.
         NOTE: SSE framing on the wire (event name + JSON data + optional id), not a JSON body.
       required: [event, data]
       additionalProperties: true
@@ -13122,10 +13110,11 @@ components:
               description: >
                 契约调和车1 G(2026-08-02;server [2373]C-12, `src/trace/project.ts` + the meta frame at
                 `routes/trace-usage.ts`): the frame's own event name, DOUBLE-EMITTED inside `data`. Always
-                present on server >= 5.0.0; OPTIONAL here because the SDK's supported floor is server 3.0.0
-                (where only the `error` frame carried it). Equal to the SSE `event:` line verbatim — its reason
-                to exist is the proxy/relay case that strips the `event:` line and forwards only the data JSON,
-                where this is the only key left to dispatch on. Heartbeats (`data: {}`) carry none.
+                present on every named frame of a supported server (>= 7.52.0; minted since server 5.0.0) — the SDK's
+                typed arms declare it REQUIRED since 26.0.0; it is not in this schema's `required` only because the one
+                schema also covers heartbeats (`data: {}`, which carry none and which the SDK swallows). Equal to the SSE
+                `event:` line verbatim — its reason to exist is the proxy/relay case that strips the `event:` line and
+                forwards only the data JSON, where this is the only key left to dispatch on.
             output:
               allOf: [{ $ref: '#/components/schemas/ToolOutput' }]
               description: >
@@ -13528,26 +13517,13 @@ components:
                 is RETIRED: the SQL backend rewrote its parked rows once at the 7.117.0 boot to `[{ member: "persisted", entries: [<old value>] }]`, but the
                 file backend's pre-upgrade parked rows and run results already on disk (`checkpointGate.riskDescriptor`) keep the old key verbatim
                 (text still redacted, no structured disclosure) — a consumer reading those must still tolerate the old string.
-        # server 7.16.0 [3684]② — durable 队列行归因两键(与活卡 tool_approval 帧的同名键语义同族、判据不同源;
-        # 两条腿对同一只 ask 的在场性可以不一致,两侧都只认在场、都禁把缺席读成否定)。
-        ruleSuggestions:
-          type: array
-          minItems: 1
-          items: { $ref: '#/components/schemas/RuleSuggestion' }
-          description: >
-            server 7.16.0 ([3684]②), ADDITIVE: the rule candidates minted for this ask, replayed off the durable
-            row (checkpoint.rule_suggestions). DISPLAY-ONLY on this leg — the durable queue has no persistRule
-            redemption; the only redemption path is the LIVE card leg (respond + persistRule). Array order =
-            display order; an EXACT entry, when present, is always first. core contract caps candidates at 2;
-            the server enforces a tolerance cap of 4 on read-back — lay out for 4. Absent = pre-column row
-            (parked before the column existed) OR no candidates; render both as "no candidates", never an error.
         ruleOffers:
           type: array
           minItems: 1
           items: { $ref: '#/components/schemas/RuleOffer' }
           description: >
             server >= 7.46.0 (core 5.58.0, design/375) — the discriminated-union successor of the retired
-            `ruleSuggestions` above on the DURABLE queue row (core `PendingAction.ruleOffers`, the same
+            `ruleSuggestions` (servers <= 7.45; sdk 26.0.0 deleted it) on the DURABLE queue row (core `PendingAction.ruleOffers`, the same
             contract as the sync leg's `AskRequest.ruleOffers`). A >= 7.46.0 row carries only the new key;
             pre-5.58 rows fail the new narrow read entry by entry and land as "no supply" (no compatibility
             read — a stale schema means re-ask).
@@ -13772,25 +13748,20 @@ components:
             one-off question. The value comes WHOLE from core (`summarizeCheckpoint` echoes it only when the
             cause is a member of the engine's set), so the server neither recomputes nor re-screens it. See
             ClassifierUnavailable for the open-`cause` rule and the three shapes absence covers.
-            RETIRED: server >= 7.72.0 (core 7.14.0 #688) never mints this key on any of the three faces; its
+            RETIRED: server >= 7.72.0 (core 7.14.0) never mints this key on any of the three faces; its
             successor is `disposition.cause` on the gate record (`unavailable` / `parse_error` — a different
-            question, so an old switch does not port). Kept for servers in [7.69.0, 7.72.0) only (sdk 9.2.0).
+            question, so an old switch does not port). Kept for servers in [7.69.0, 7.72.0) only (sdk 9.2.0); the row key retires
+            together with the frame key (floor ≥ 7.106.0, next major); why the frame still declares it: `ToolApprovalFrame.classifierUnavailable`.
         ruleStoreUnreadable:
           type: string
           enum: [store, call]
           description: >-
-            server >= 7.72.0 (core 7.14.0 #688 C3), ADDITIVE — WHICH HALF of the rule lane could not be read.
-            Present iff `origin === "rule_store_unavailable"`: `store` = the wired rule store could not be read
-            (look at the store / network); `call` = the store was read but THIS command could not be read against
-            the person's deny/ask rows (look at the command spelling). One `origin` word covers both facts, and
-            their recovery verbs live in different places (ops vs prompt). Carried on the live `tool_approval`
-            frame and the inbox row; the `card_json` card deliberately does NOT carry it (it travels with `origin`,
-            which is not on the card). Absence = `origin` is not that word — NOT an assertion that the rule store
-            is healthy.
-            RETIRED: server >= 7.106.0 (core 7.34.0 C-R172, BREAKING — wire) never mints this key on either face — an
-            unreadable rule store no longer raises a card: that read's rows are SKIPPED by partition and the session
-            stream gets the user-facing `engine_notice` `permission.rule_store_unavailable` (`detail.at` = `prepare` /
-            `call`). Kept for servers in [7.72.0, 7.106.0) only (sdk K-32); `origin: rule_store_unavailable` itself stays.
+            server >= 7.72.0 (core 7.14.0 #688 C3), ADDITIVE — WHICH HALF of the rule lane could not be read (`store` / `call`).
+            The same key, with the same two words and the same reading, as on the live frame; the authoritative statement of the shape, the presence
+            rule, what the two words mean and the retirement wording is on `ToolApprovalFrame.ruleStoreUnreadable`, and this description points to it.
+            RETIRED: server >= 7.106.0 never mints this key on either face (the frame's description names the successor). Kept for
+            servers in [7.72.0, 7.106.0) only (sdk K-32); the row key retires together with the frame key (floor ≥ 7.106.0, next major);
+            `origin: rule_store_unavailable` itself stays.
 
     InboxList:
       type: object
@@ -14329,12 +14300,20 @@ components:
                 server >= 7.92.0 (engine 7.25.0): the session's rule LINEAGE generation. An erase
                 (`deleteBySession`) ends the lineage — the next write carries gen+1 — so a reader treats a
                 different gen as a new lineage, never a continuation, regardless of rev. Absent on older servers.
+            operatorRules:
+              allOf: [{ $ref: '#/components/schemas/SessionRulesOperatorPart' }]
+              description: >
+                server >= 7.135.0 (engine 7.55.0): the row's OPERATOR PART — the buckets (and their own `grammar` stamp) the last OPERATOR write set; the line a non-operator write may not loosen (`403 loosen_forbidden` on a move inside it).
+                ABSENT = the whole row is the operator's (an operator write; every row stored before 7.135.0, read as before the upgrade: the owner can take nothing back). Minted by the engine's write judge alone, stored whole and read back verbatim; also on the 2c export `policy[].rules`.
+                A non-operator write over an EMPTY row stamps an empty part (stamp only) — the owner can then take back what the owner added. A part ECHOED back is read per door: on `PUT /v1/sessions/{sessionId}/policy` it is ALWAYS ignored (the stored row's part is kept over an existing row; an empty stamped part is minted over none).
+                On the sync-import replay (`POST …/sync/import`, `policy[]` records, which carry `rev`): over an existing row the judge keeps the STORED row's part and ignores the echo; over NO row, a non-operator record that looks like a stored row (carries `rev` >= 1)
+                has its own part adopted (from then on that part IS the row's operator line: taking it back answers 403 `loosen_forbidden`), otherwise an empty stamped part is minted; an operator write never carries a part.
             grammar:
               type: integer
               minimum: 0
               description: >
                 server >= 7.129.0 (engine 7.51.2): the rule GRAMMAR the row's entries are read in, stamped by the
-                engine's write judge on every row written through it (every row this server writes carries `1`).
+                engine's write judge on every row written through it (server >= 7.135.0 writes `4` — the engine's `SESSION_RULES_GRAMMAR`; 7.129.0 wrote `1`).
                 Absent = a row stored before the stamp (grammar 0: an allow entry spelled as a rule, `Bash(rm:*)`,
                 named no tool and admitted nothing — the engine keeps reading such a row that way and announces it
                 once; the one-time migration rewrites stored rows and stamps them). Echoing a stored body back into
@@ -14355,6 +14334,18 @@ components:
         rev: { type: integer }
         gen: { type: integer }
         grammar: { type: integer }
+        operatorRules: { $ref: '#/components/schemas/SessionRulesOperatorPart' }
+
+    SessionRulesOperatorPart:
+      type: object
+      description: '`StoredSessionRules.operatorRules` (server >= 7.135.0): the three buckets plus their own grammar stamp. The `grammar` is always present (the write judge stamps it).'
+      additionalProperties: false
+      required: [grammar]
+      properties:
+        toolAllow: { type: array, items: { type: string } }
+        toolDeny: { type: array, items: { type: string } }
+        allowDirs: { type: array, items: { type: string } }
+        grammar: { type: integer, minimum: 0 }
 
     McpServerStatus:
       type: object
@@ -14685,26 +14676,6 @@ components:
         parentId: { type: [string, 'null'] }
         type: { type: string, description: Entry discriminator (message / leaf / compaction / …) — opaque to the SDK. }
 
-    SyncSnapshot:
-      type: object
-      description: >
-        One E19 file snapshot keyed by a `SessionTreeEntry.id`. `manifest` = `[relPath, blobHash]` tuples; the blob
-        BYTES are NOT inlined (they ride the content-addressed blob routes).
-      # 封闭(census 批2 第三段,2026-07-30):server 侧类型+铸造点(`session-sync.ts` PULL 出 /
-      # `routes/session-sync.ts` PUSH 校验形)都恰是这两键。
-      additionalProperties: false
-      required: [key, manifest]
-      properties:
-        key: { type: string }
-        manifest:
-          type: array
-          items:
-            type: array
-            minItems: 2
-            maxItems: 2
-            items: { type: string }
-            description: A `[relPath, blobHash]` tuple.
-
     SyncAnchor:
       type: object
       description: One E18 resume-at anchor. `owner` is RE-KEYED to the importing principal on a PUSH (§9).
@@ -14732,31 +14703,28 @@ components:
       description: >
         2c session-sync `GET …/sync/manifest` payload (wrapped server-side as `{ manifest }`). The THIN cross-backend
         snapshot: entry IDS (oldest-first, NOT payloads) + the file-history envelope + policy + anchors + leaf.
-        🔴 server >= 7.52 (S-15, design/381; re-read byte for byte against 7.116.0): the key `snapshots` (per-snapshot
-        relPath→blobHash, the retired E19 whole-tree snapshot epoch) is NO LONGER SENT — the server's `exportSessionManifest` mints
-        `{ sessionId, entryIds, entryCount, leafId, fileHistory, policy, anchors }` (server >= 7.125.0 adds the session row's two writable bits `title` / `pinned`,
-        present-iff the session is a row of the list face — see the two properties) and `fileHistory` (core's versioned
-        `FileHistoryExport` envelope; `null` = no history / the source store cannot export) replaces it. <= 7.51 servers still send
-        `snapshots` and no `fileHistory`. The blob BYTES never ride the manifest: content-addressed, via the history blob faces
-        (`GET …/sync/history/blobs/{hash}` / `PUT …/sync/blobs/{hash}`; probe `capabilities.sessionSyncFileHistory` on BOTH ends).
-        The SDK's `manifest()` fills `snapshots: []` when the wire omits it.
+        The server's `exportSessionManifest` mints `{ sessionId, entryIds, entryCount, leafId, fileHistory, policy, anchors }` (server >= 7.125.0 adds the
+        session row's two writable bits `title` / `pinned`, present-iff the session is a row of the list face — see the two properties). `fileHistory`
+        (core's versioned `FileHistoryExport` envelope; `null` = no history / the source store cannot export) is ALWAYS present on a supported server
+        (>= 7.52.0); the retired E19 whole-tree snapshot key `snapshots` of servers <= 7.51 is below the support floor (sdk 26.0.0 deleted it). The blob BYTES
+        never ride the manifest: content-addressed, via the history blob faces (`GET …/sync/history/blobs/{hash}` / `PUT …/sync/blobs/{hash}`; probe
+        `capabilities.sessionSyncFileHistory` on BOTH ends). The SDK returns the wire verbatim.
       # 封闭(census 批2 第三段,2026-07-30;16.2.0 按 7.116.0 发布字节重核):铸造点 `session-sync.ts`(exportSessionManifest 尾部
       # 字面量)恰是 `{ sessionId, entryIds, entryCount, leafId, fileHistory, policy, anchors }` 7 键(≥7.52),无 `snapshots`;
       # server ≥7.125.0 另有 `title` / `pinned` 两键(会话行可写位,present-iff 会话是列表面上的行;条件展开,不进 required);
-      # ≤7.51 老 server 发 `snapshots`、无 `fileHistory` ⇒ 两键都不进 required(支持底线 3.0.0)。
+      # sdk 26.0.0(支持底线 7.52.0):`fileHistory` 进 required(支持面内恒铸),`snapshots` 删(≤7.51 才发)。
       additionalProperties: false
-      required: [sessionId, entryIds, entryCount, leafId, policy, anchors]
+      required: [sessionId, entryIds, entryCount, leafId, fileHistory, policy, anchors]
       properties:
         sessionId: { type: string }
         entryIds: { type: array, items: { type: string }, description: Oldest-first, verbatim cross-backend. }
         entryCount: { type: integer, description: '= entryIds.length (the `/sync/entries` trailer count).' }
         leafId: { type: [string, 'null'] }
-        snapshots: { type: array, items: { $ref: '#/components/schemas/SyncSnapshot' }, description: 'server <= 7.51 ONLY (the retired E19 snapshot epoch); server >= 7.52 does not send it — see `fileHistory`.' }
         fileHistory:
           oneOf:
             - { $ref: '#/components/schemas/FileHistoryExport' }
             - { type: 'null' }
-          description: 'server >= 7.52: the per-edited-file rewind history envelope; `null` = no history / the source store cannot export; key ABSENT = a <= 7.51 server (that generation sends `snapshots`).'
+          description: 'the per-edited-file rewind history envelope; `null` = no history / the source store cannot export. Always present on a supported server.'
         policy: { type: array, items: { $ref: '#/components/schemas/SessionRulesRecord' } }
         anchors: { type: array, items: { $ref: '#/components/schemas/SyncAnchor' } }
         title:
@@ -14819,20 +14787,18 @@ components:
     SessionBundle:
       type: object
       description: >
-        The portable state of ONE session, ready to replay into another backend. Blobs are NOT inlined (each
-        snapshot carries only its `manifest`; the bytes stream through the content-addressed blob routes). The SDK
-        assembles this from a manifest + the streamed entries for a PUSH. server >= 7.52: the file history rides `fileHistory`
-        (the `FileHistoryExport` envelope) instead of `snapshots`.
-      required: [sessionId, entries, snapshots, policy, anchors]
+        The portable state of ONE session, ready to replay into another backend. Blobs are NOT inlined (the file-history
+        envelope carries only blob hashes; the bytes stream through the content-addressed blob routes). The SDK
+        assembles this from a manifest + the streamed entries for a PUSH.
+      required: [sessionId, entries, fileHistory, policy, anchors]
       properties:
         sessionId: { type: string }
         entries: { type: array, items: { $ref: '#/components/schemas/SyncEntry' } }
-        snapshots: { type: array, items: { $ref: '#/components/schemas/SyncSnapshot' } }
         fileHistory:
           oneOf:
             - { $ref: '#/components/schemas/FileHistoryExport' }
             - { type: 'null' }
-          description: 'server >= 7.52 file-history envelope (same as `SessionManifest.fileHistory`); key absent = the source is a <= 7.51 server.'
+          description: 'the file-history envelope (same as `SessionManifest.fileHistory`; `null` = none, or the pull did not carry it because the source has no blob faces).'
         policy: { type: array, items: { $ref: '#/components/schemas/SessionRulesRecord' } }
         anchors: { type: array, items: { $ref: '#/components/schemas/SyncAnchor' } }
 
@@ -15020,8 +14986,20 @@ components:
             <= 7.105.0 answered the synchronous leg 200 + a failed body), `corrupt` (500 — the session rule store
             cannot read its own bytes), `internal.memory_control_plane_corrupt` (500 — the memory control plane refuses
             fail-closed) and `state.scenario_assignment_unknown` (503, server >= 7.119.0 — the center's scenario assignment for the
-            principal is dangling; only re-pointing the assignment, or adding the scenario back to the deployment, helps). Every other 5xx
-            code keeps the status-based retry.
+            principal is dangling; only re-pointing the assignment, or adding the scenario back to the deployment, helps) and
+            `approvals.read_corrupt` (500, server >= 7.134.0 on `GET /v1/approvals` — a queue row's stored body cannot be read; an operator has to repair or
+            delete the row; server >= 7.135.0 the same judge answers `GET /v1/assistant/inbox` and `GET /v1/assistant/tasks` too) and `workflow.journal_incompatible`
+            (500, server >= 7.135.0 on `GET /v1/workflows/{id}/journal` — a journal row the engine's judge rejects; the body carries `ordinal`; repair the row from the retained copy, never by deleting it).
+            Every other 5xx code keeps the status-based retry.
+            🔴 server >= 7.135.0 read-failure and store-fault codes (all additive; branch on the code, never the sentence): `503 approvals.read_unavailable` on `GET /v1/approvals`, `/v1/assistant/inbox` and
+            `/v1/assistant/tasks` (the queue cannot be read RIGHT NOW — transient, retried by status; until a read succeeds an answer does NOT mean nothing is pending; it moved from the SSE-only table into the status-bearing catalog, status `-` → 503) and, on
+            the same three faces, `500 approvals.read_corrupt` (above); `503 state.file_history_unreadable` on the session-sync pull faces (`GET /v1/sessions/{id}/sync/manifest`, `GET /v1/sessions/{id}/sync/history/blobs/{hash}` — the file history
+            cannot be read WHOLE; it is NOT "no history", which stays `200` with `fileHistory: null`); `422 adopt_failed` on `POST /v1/sessions/{id}/sync/import` (the file-history replay hit a store fault; 7.134.x answered `unsupported_format`;
+            NOT a missing blob — that is `422 missing_blob`, now answered in the FIRST phase). The two store-fault codes may carry `permanence` (`transient` = nothing changed, retry the same shape later / `terminal` = repair the store first; absent = the store did not judge).
+            `422 request.unprocessable` now also answers a deny / ask rule whose PARAMETER does not belong to the tool (the sentence carries the engine code `unsupported.param_unknown`, the same word in `detail.problems[].reason`; a stored body that
+            resumes ⇒ `409 resume_blocked_by_policy` with `blockedBy: request.unprocessable`; 7.134.x accepted such a rule, and it never matched). `400 request.body_shape` also names an unread key inside a `settings.hooks` group / entry in
+            `unknownKeys` as a FULL coordinate (`settings.hooks.PreToolUse.0.hooks.0.onFailure`) on a fresh submit.
+            `409 resume_outcome_invalid` + `field: "feedback"` (`retriable: true`) now answers a release `feedback` that carries an engine `<system-reminder>` tag (refused before the CAS, the card stays pending; fix or drop the words and decide again — it was `409 approval_binding_mismatch` without `field` on 7.134.x). A `feedback` on a deny / policy decision stays `400 request.field_conflict` (`detail.kind: approval_feedback`).
             🔴 `request.host_posture_refused` (422) has TWO triggers (same code, same status — "you wrote it right, this
             deployment will not grant that host posture"): (1) the write-containment face (`permissionMode: bypassPermissions` ⇒
             `writeFace: open`; read `capabilities.taskWriteFaceOpen` first); (2) server >= 7.106.0 / S-895: `inheritEnv: "all"` on a
@@ -15085,17 +15063,30 @@ components:
             the ids of the background children rooted at this session that are still alive (count = length) — the SAME
             strings as the `handle` on `GET /v1/agents/roster` rows. Nothing was deleted; wait for them to finish (or stop
             them where they run) and retry the delete verbatim. SDK: `err.extra.remaining` on the ConflictError.
+        permanence:
+          type: string
+          enum: [transient, terminal]
+          description: >-
+            server >= 7.135.0, on `503 state.file_history_unreadable` and `422 adopt_failed` only: the file-history store's own judgment of the fault (the engine's `GovernanceRetryClass`) —
+            `transient` = nothing was changed, retrying the same shape later may succeed; `terminal` = repair the store first. ABSENT = the store did not judge (retry later once; still red ⇒ look at the store). SDK: `err.extra.permanence`.
+        ordinal:
+          type: integer
+          description: >-
+            server >= 7.135.0, on `500 workflow.journal_incompatible`: the journal ordinal of the FIRST bad row (ascending); `-1` = the refusal names no entry. SDK: `err.extra.ordinal`.
         reason:
           type: string
           description: >-
-            A per-code closed word — read it by `errorCode`, never across codes. On 503 `fleet.lease_unavailable` (server >=
+            A per-code closed word — read it by `errorCode`, never across codes. On 400 `request.field_invalid` for a URL that carries a credential (server >= 7.135.0): `url_userinfo` (`user:pass@host`) / `url_credential_param` (a credential-named
+            query / fragment parameter — the names the service's log redactor treats as credentials), beside `field` = the body coordinate (`mcpServers[i].transport.url`, `a2aPeers[i].url`, `a2aPeers[i].cardUrl`,
+            `settings.hooks.<event>[g].hooks[h].url` — the FULL coordinate, not `field: "settings.hooks"` + `detail` — and `settings.webSearch.endpoint`; a `settings.webSearch.endpoint` with userinfo keeps its sentence and gains `field` / `reason`);
+            `a2aPeers` over 32 entries answers `over_cap` + `count` + `cap` on `field: "a2aPeers"`. On 503 `fleet.lease_unavailable` (server >=
             7.106.0 / S-866 ③): `auth-rejected` (the center refused this engine's credential, or the credential file is
             unreadable) / `unreachable` (unreachable / 5xx / timeout / bad body / any status other than 200 / 409 / 400 / 401 / 403 —
             center 404 / 429 / 3xx included). On 400 `request.field_invalid` for a `settings.permissions` bucket (server >= 7.106.0 /
             S-904): `over_cap` (more than `cap` entries; beside `count` + `cap`) / `bad_entry` (a non-string or empty item; beside
             `index`); server >= 7.132.0 widens that group to every tool-name list on the body, the agent definitions and the two host-path lists, and adds
             `too_long` (a text over its character cap; beside `count` + `cap`) — closed words `over_cap` / `too_long` / `bad_entry` (SDK `RequestFieldRefusalExtra`); server >= 7.133.0 adds `too_large` (a payload over its BYTE cap, only on 413 `request.payload_too_large`: `{ field: "body", reason: "too_large", cap }` — `count` ABSENT when the read stopped at the cap and cannot measure; a request body over 8 MiB is now always that 413) and the `request.invalid_json` reasons `not_json` | `not_object` (400, every JSON-body door; formerly `request.rejected`/`request.body_shape` by door).
-            On 409 refusals of a resume (server >= 7.132.0): the engine's `CheckpointErrorReason` arm (`detail.reason` passed through; see `blockedBy`). On 400 `rules.inert_entry` (server >= 7.129.0): the engine's `ALLOW_ENTRY_INERT_REASONS` (`tool_name` / `wildcard_all` / `namespace_wildcard` / `content_unsupported` / `grammar` / `near_miss` / `earlier_grammar`). Out-of-vocabulary word ⇒ treat as unknown. (Other codes carry their own `reason` words.)
+            On 409 refusals of a resume (server >= 7.132.0) and on 422 `parked_resume.startup_failed` (server >= 7.134.0 — the parked background agent's pre-claim failure; absent when the engine gave none): the engine's `CheckpointErrorReason` arm (`detail.reason` passed through; see `blockedBy`). On 409 `conflict.checkpoint_ctx_unsealable` (server >= 7.134.0): why the request's credentials cannot be sealed into, or unsealed from, the stored resume context — a closed five-word set (SDK `CHECKPOINT_CTX_UNSEALABLE_REASONS`); which doors can answer which word is written once, in the SDK documentation of `CHECKPOINT_CTX_UNSEALABLE_REASONS`, not here: `no_key_store` (this server has no sealed-key store) / `key_not_held` (sealed with a key this server does not hold — another replica's, or a replaced sealed-key directory) / `unopenable` (the sealed value is damaged or belongs to another session) / `plaintext` (an older server stored it unsealed) / `unrecognized_seal` (a seal format this version does not know) — the way out depends on the door and the `reason`: `key_not_held` (a resume door) — have the operator restore the sealed-key directory that sealed it and restart that replica (it reads its keys only at startup), then resend the same request; `no_key_store` on the submit door — give the service a writable sealed-key directory (`<data root>/sealed-key/`, read at startup), or resubmit WITHOUT those credentials — resending the same submit body is refused again; `no_key_store` on a resume door — the same way out as `key_not_held`: restore the directory that sealed it and restart, then resend (a fresh empty directory does not help: it holds no such key, so the next read says `key_not_held`); `unopenable` / `plaintext` / `unrecognized_seal` — submit the work as a new task (cancel the still-suspended one first); never auto-retry, never match the sentence. A resume door's refusal decides nothing and starts no resume (the card stays pending; the known exception is a terminal run's steer race arm, which first opens a wake card and, when the second read fails for any of the five reasons, withdraws it and then answers 409 — if the withdrawal fails the server only logs it); a submit door's refusal lands before the task runs (nothing runs; a run row already opened for it is closed as `failed` and its idempotency key released, both best-effort — a failed step is only logged by the server and the answer is still the 409). On 400 `rules.inert_entry` (server >= 7.129.0): the engine's `ALLOW_ENTRY_INERT_REASONS` (`tool_name` / `wildcard_all` / `namespace_wildcard` / `content_unsupported` / `grammar` / `near_miss` / `earlier_grammar`). Out-of-vocabulary word ⇒ treat as unknown. (Other codes carry their own `reason` words.)
         retryAfterSec:
           type: number
           description: >-
@@ -15122,6 +15113,10 @@ components:
             `null` and `""` count), the refusal landed before any decision, and `field` is the literal `settledBy`; the three doors now answer
             the SAME sentence. Every such 400 carries it, even when another defect in the same body was hit first (the sentence then names that
             defect). Branch on the code plus `field`, never on the sentence; a bad body WITHOUT that key carries no `field`. SDK: `err.extra.field`.
+            server >= 7.134.0: on 409 `conflict.checkpoint_ctx_unsealable` `field` is the SUBMIT-BODY PATH of the credential slot that cannot be sealed or unsealed (arrays
+            `[i]`, record members `.key`: `mcpServers[0].transport.headers.Authorization`, `settings.hooks.PreToolUse[0].hooks[0].headers.Authorization`; the key
+            name is not a secret, the value never enters the refusal); on 400 `request.field_invalid` for the request key `settings.approvalFrameFamilies` it is
+            that literal (with `reason: "bad_entry"` and the bad `index`; no `index` for a non-array).
         detail:
           description: >
             🔴 SHAPES differ by code — branch on `field` (or the `errorCode`), never guess from the type of `detail`. On 503
@@ -15256,8 +15251,9 @@ components:
                 callerTrust: { type: string }
             - type: object
               description: >-
-                server >= 7.133.0 — 400 `request.field_conflict`: the request body contradicts itself. `kind` = which constraint (a CLOSED fourteen-word set, read open: cascade_verify | image_profile | resume_anchor |
-                system_prompt_fold | file_history_restore | skills_disabled | existing_session | scratchpad_root | ask_answer | policy_person_ask | plan_edit | plan_mode_after | bound_call_door | remember_decision);
+                server >= 7.133.0 — 400 `request.field_conflict`: the request body contradicts itself. `kind` = which constraint (a CLOSED set — fourteen words, fifteen from server >= 7.134.0 — read open: cascade_verify | image_profile | resume_anchor |
+                system_prompt_fold | file_history_restore | skills_disabled | existing_session | scratchpad_root | ask_answer | policy_person_ask | plan_edit | plan_mode_after | bound_call_door | remember_decision |
+                approval_feedback (server >= 7.134.0: `feedback` on a deny — fields `["feedback", "decision"]` — or on a policy decision — `["feedback", "decidedBy"]`));
                 `fields` = the named body coordinates, subject first (at least one; a dynamic index reads `agents[1].skills`); `count` / `cap` only on the fold-cap kind (the folded total and its cap).
               required: [kind, fields]
               additionalProperties: false
@@ -15303,6 +15299,8 @@ components:
             the engine's `detail.code` passes through as `blockedBy` (today only `checkpoint.config_refused` carries it — the closed set is core's
             `CHECKPOINT_CONFIG_REFUSAL_CODES`, 40 words since core 7.53.0; read it as "the errorCode a fresh run would report for the same bad configuration"),
             next to `field` and `reason`, absent keys not minted (SDK `ResumeRefusalExtra`).
+            server >= 7.134.0 / core 7.54.0: the SAME three keys on 422 `parked_resume.startup_failed` (a parked background agent's leg refused before the claim — the
+            engine now hands the failure's code / field / reason to the redemption receipt; absent when the engine gave none; <= 7.133.x carried only `cause` there).
 
     ResumeLegConflictError:
       description: >
@@ -15386,6 +15384,9 @@ components:
         # 🔴 census 轴一(2026-07-30)补的 4 臂:server 今天就真发,spec/SDK 两侧此前同缺(详见各 schema 处的注)。
         - $ref: '#/components/schemas/Event_context_usage'
         - $ref: '#/components/schemas/Event_config_assembled'
+        # server >= 7.134.0 (core 7.54.0): the device lane's cross-boundary taint row — DURABLE only (the `GET /v1/runs/{taskId}/events` ledger replay), never
+        #   on the live stream and never on the `GET /v1/runs/{taskId}` poll object; the trace SSE twin is the `cross-boundary-taint` frame.
+        - $ref: '#/components/schemas/Event_cross_boundary_taint'
         - $ref: '#/components/schemas/Event_needs_review'
         - $ref: '#/components/schemas/Event_message_committed'
         # [2373]A-2(2026-08-03,server 5.0.0):compaction_outcome 三腿同源批的 spec 半场(SDK 臂 20867e1 同批)。
@@ -15464,6 +15465,7 @@ components:
           failed: '#/components/schemas/Event_failed'
           context_usage: '#/components/schemas/Event_context_usage'
           config_assembled: '#/components/schemas/Event_config_assembled'
+          cross_boundary_taint: '#/components/schemas/Event_cross_boundary_taint'
           needs_review: '#/components/schemas/Event_needs_review'
           message_committed: '#/components/schemas/Event_message_committed'
           compaction_outcome: '#/components/schemas/Event_compaction_outcome'
@@ -15690,10 +15692,10 @@ components:
     # 每只闭集 = 引擎今天的词 ∪ 引擎退役词表里那一集。这五张 enum 与引擎 `RETIRED_MEMBERS` 逐集逐词同(由 `server-7129-wire` 对拍);卡面 / 队列行 / 请求面的同名闭集只取今天的词。
     GateRecordAskClass:
       type: string
-      enum: [content_question, hook, ancestor, dangerous_delete, unverifiable_delete, unverifiable_shell_text, transcript_write, org_rule, rule_unreadable, ask_rule, denial_limit_fallback, classifier_no_ruling, requires_user_interaction, operator_forced, shell_floor, target_unresolved, probe, write_protection, tool_marks_mcp, tool_marks_a2a, policy_rra, artifact_shared_read, mode, unstated, ordinary, write_protection_unresolved, governance_unavailable]
+      enum: [content_question, hook, ancestor, dangerous_delete, unverifiable_delete, unverifiable_shell_text, transcript_write, org_rule, rule_unreadable, ask_rule, denial_limit_fallback, classifier_no_ruling, requires_user_interaction, cross_boundary, operator_forced, shell_floor, target_unresolved, probe, write_protection, tool_marks_mcp, tool_marks_a2a, policy_rra, artifact_shared_read, mode, unstated, ordinary, write_protection_unresolved, governance_unavailable]
       description: >-
         The class word on a GATE RECORD (`tool_end.gate.disposition.askClass` / `.classes` on the mode-refusal arm, `ModeRelease.askClass` / `.classes`) — server >= 7.129.0 reads the record as an ARCHIVE:
-        today's `AskClass` set (twenty-five words) PLUS the words the engine retired (`write_protection_unresolved`, retired in core 7.49.0 — renamed `target_unresolved`; `governance_unavailable`,
+        today's `AskClass` set (twenty-six words; `cross_boundary` from server >= 7.134.0) PLUS the words the engine retired (`write_protection_unresolved`, retired in core 7.49.0 — renamed `target_unresolved`; `governance_unavailable`,
         retired in core 7.51.0 — merged into `rule_unreadable`). A record the previous engine generation legally wrote is replayed byte for byte (a 7.50.x mode refusal can carry `governance_unavailable`);
         a word NO engine generation ever minted (a case variant, the empty string, a future word) withholds the whole `gate` and counts `server.trace.gate-outcome-defective`.
         Render a known archive word normally and an unknown one generically; never drop the record because the word is not in today's set.
@@ -15711,9 +15713,9 @@ components:
         OMITTED `reason` for the two retired words (`released` was still sent); from 7.129.0 they arrive verbatim on the replay faces. Same reading as `GateRecordAskClass`.
     GateRecordPersistedRuleMandate:
       type: string
-      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved, write_protection_unresolved]
+      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved, cross_boundary_taint, write_protection_unresolved]
       description: >-
-        `released.mandate` on a GATE RECORD (archive read, server >= 7.129.0): today's six `PersistedRuleMandate` words PLUS the retired `write_protection_unresolved` (core 7.49.0 rename). Same reading as `GateRecordAskClass`.
+        `released.mandate` on a GATE RECORD (archive read, server >= 7.129.0): today's seven `PersistedRuleMandate` words (`cross_boundary_taint` from server >= 7.134.0) PLUS the retired `write_protection_unresolved` (core 7.49.0 rename). Same reading as `GateRecordAskClass`.
     GateRecordAskOrigin:
       type: string
       enum: [content_question, plan_review, ancestor_marked, org_unavailable, org_rule, rule_store_unavailable, hook, ask_rule, denial_limit_fallback, shell_gate_tighten, safety_tighten, policy, unresolvable]
@@ -15893,6 +15895,12 @@ components:
                 K-32 (server >= 7.106.0 / core 7.34.0 design/1111) — `bypassPermissions` RELEASED an ask nobody answered (see
                 `ModeRelease`). Absent = this allow was not a mode release (a plain allow / a person's yes / a rule), or an older
                 server (<= 7.105.0 stripped it).
+            clearedBy:
+              allOf: [{ $ref: '#/components/schemas/AllowRuleClearance' }]
+              description: >
+                server >= 7.135.0 (core 7.55.0) — the allow layer's account of a call it let run WITHOUT asking: which member's allow rule cleared a standing ask that nobody answered
+                (`AllowRuleClearance`). Present exactly when an allow member cleared the ask; absent on a call nothing asked about, a mode's release or acceptance, the read-only arm's,
+                the classifier's or the sandbox's allow, and a person's yes. Never present together with `released`. Older servers stripped it.
         - type: object
           additionalProperties: false
           required: [kind, deniedBy]
@@ -15944,9 +15952,10 @@ components:
         `UNATTENDED_PERMISSION_MODE=dontAsk`).
     AskClass:
       type: string
-      enum: [content_question, hook, ancestor, dangerous_delete, unverifiable_delete, unverifiable_shell_text, transcript_write, org_rule, rule_unreadable, ask_rule, denial_limit_fallback, classifier_no_ruling, requires_user_interaction, operator_forced, shell_floor, target_unresolved, probe, write_protection, tool_marks_mcp, tool_marks_a2a, policy_rra, artifact_shared_read, mode, unstated, ordinary]
+      enum: [content_question, hook, ancestor, dangerous_delete, unverifiable_delete, unverifiable_shell_text, transcript_write, org_rule, rule_unreadable, ask_rule, denial_limit_fallback, classifier_no_ruling, requires_user_interaction, cross_boundary, operator_forced, shell_floor, target_unresolved, probe, write_protection, tool_marks_mcp, tool_marks_a2a, policy_rra, artifact_shared_read, mode, unstated, ordinary]
       description: >
-        core `ASK_CLASSES` (TWENTY-FIVE words as of core 7.51.0 / server >= 7.129.0: `governance_unavailable` was merged into `rule_unreadable`, no alias — sdk 23.0.0; a stored card / parked row written by server <= 7.128.x is rewritten once by the server at boot. The gate record reads the ARCHIVE form, see `GateRecordAskClass`. History: twenty-two words as of core 7.40.0, twenty-three as of core 7.41.0, twenty-four as of core 7.43.0, twenty-five as of core 7.45.0, twenty-six as of core 7.49.0 — 7.34.0 minted twenty; `unverifiable_shell_text` joined in 7.49.0 #1505 and rides server >= 7.126.0, where the
+        core `ASK_CLASSES` (TWENTY-SIX words as of core 7.54.0 / server >= 7.134.0: `cross_boundary` joined after `requires_user_interaction` — the device lane's
+        cross-boundary confirmation, see below; TWENTY-FIVE as of core 7.51.0 / server >= 7.129.0: `governance_unavailable` was merged into `rule_unreadable`, no alias — sdk 23.0.0; a stored card / parked row written by server <= 7.128.x is rewritten once by the server at boot. The gate record reads the ARCHIVE form, see `GateRecordAskClass`. History: twenty-two words as of core 7.40.0, twenty-three as of core 7.41.0, twenty-four as of core 7.43.0, twenty-five as of core 7.45.0, twenty-six as of core 7.49.0 — 7.34.0 minted twenty; `unverifiable_shell_text` joined in 7.49.0 #1505 and rides server >= 7.126.0, where the
         unresolved-write-target class was also RENAMED to `target_unresolved` (#955; zero alias — the previous spelling is in the SDK README's 22.0.0 migration table); `shell_floor` joined in 7.39.0 #1260 and rides
         server >= 7.113.0; `unstated` joined in 7.40.0 and rides server >= 7.115.0; `requires_user_interaction` joined in 7.41.0 and rides
         server >= 7.116.0; `classifier_no_ruling` joined in 7.43.0 #1353 and rides server >= 7.118.0; `dangerous_delete` joined in 7.45.0 and rides
@@ -16349,6 +16358,10 @@ components:
             `MCP_FAILURE_CODES` spellings — including `network` and the `http_<status>` encoding — are gone,
             and an HTTP status now rides the structured `httpStatus` seat on `wiring_manifest.mcp[]` instead of
             being baked into the code. The set as a WHOLE stays open (a tool owns its own codes).
+            🔴 core 7.55.0 / server >= 7.135.0 — two MCP words minted BEFORE the call is sent (`delivered: "no"`; the server has no mint point, they pass through verbatim): after the engine redials a Streamable HTTP
+            server that LOST its session, `mcp.tool_declaration_changed` (the server now declares the tool differently — safety axis / read-only reading / the "a person must answer" mark / task support — or no longer lists it) and
+            `mcp.tool_listing_unreached` (the post-redial listing walk stopped before reaching the tool, so its new declaration cannot be proved). Every later call to that tool is refused the same way until a listing of the connection
+            reaches it — the way out is `POST /v1/sessions/{id}/mcp/reconnect` (or the engine's refresh); do not resend as-is. The lost-session failure itself stays `http_status` + `httpStatus: 404` + `delivered: "unknown"`.
             Consumers MUST branch with a `default` arm and MUST NOT exhaustively switch on known values.
             The service enforces only a length bound (>128 chars = malformed, the whole key is DROPPED rather
             than truncated — truncating would mint a code core never sent). NOTE: this is a DIFFERENT
@@ -16698,6 +16711,21 @@ components:
           type: object
           additionalProperties: false
           properties: { kind: { type: string, description: 'root | child | resume. Open on read.' } }
+        sessionRules:
+          type: object
+          additionalProperties: false
+          required: [childrenReadLive]
+          description: >
+            server >= 7.135.0 (engine 7.55.0; effective half only, both faces): whether the session-rules layer is handed to the delegated legs. `childrenReadLive: true` = this leg wired the session-rules layer (the deployment has a session-rules
+            store and the task carries a session id) and handed the session's key to every leg it delegates (sync / background / fork / workflow / resume / observer side-car, any depth) — a rule written into the session NOW governs an
+            already-running child's NEXT call; `false` = no rules layer, nothing handed out. The section ABSENT = an older engine (say nothing; do not read it as `false`). An unreadable section (not `{ childrenReadLive: <boolean> }`) is dropped.
+          properties:
+            childrenReadLive: { type: boolean }
+        projectMemory:
+          type: string
+          description: >
+            server >= 7.135.0 (engine 7.55.0; effective half only, both faces): did this leg call the deployment's project-context seat — `on` = it did; `disabled` = the seat is wired but the request's `projectMemory: "disabled"` turned it off;
+            `absent` = the deployment wired no seat (whatever the request said). On `disabled` / `absent` legs the server-minted `instructions` section is ABSENT. Open on read (a new engine word passes through); ABSENT = an older engine.
         ask:
           type: object
           additionalProperties: false
@@ -17164,6 +17192,16 @@ components:
         pathTarget: { $ref: '#/components/schemas/McpToolPathTarget' }
         ruleFace: { $ref: '#/components/schemas/McpToolRuleFace' }
         renderHints: { $ref: '#/components/schemas/McpToolRenderHints' }
+        boundaryLegs:
+          description: >-
+            core 7.54.0 / server >= 7.134.0 (a REQUIRED engine member: every row of `wiring_manifest.tools.entries[]` and of a `tool_roster_delta` frame's
+            `delta.roster.entries[]` carries it) — the LEGS a call of this tool travels (core `BOUNDARY_LEGS`, in that order: `env` = inside the execution
+            environment / on the device, `outside_read` = a read beyond it, `outside_write` = a write beyond it), or `per_call` when its dispatch gives the legs
+            per call (the engine's own definitions and the protocol tools state them; every other row follows its `effect`). The device lane's launch gate reads
+            it. ABSENT = an older server (<= 7.133.x).
+          oneOf:
+            - { type: string, const: per_call }
+            - { type: array, items: { type: string, enum: [env, outside_read, outside_write] } }
     McpToolPathTarget:
       type: object
       required: [param, access]
@@ -17279,6 +17317,10 @@ components:
         own failure carries the same code. `{ modelId, boundOrigin, requestOrigin, sessionId, runId }` — both origins in display spelling (scheme + host +
         port, no userinfo / path), never a credential or a digest of one. Once per run per (modelId, boundOrigin, requestOrigin). It replaces the retired
         operator code `route.base_url_changed_key_unchanged` (never on this whitelist). `config.credential_not_withheld` is operator-audience — ops log only.
+        `advisor.not_attached` (server >= 7.135.0 / core 7.55.0; D.3 is now 42 codes) — the request's advisor model did NOT attach (the engine's pairing judge refuses the (advisor, main) pair).
+        `{ advisorModel, mainModel, reason, sessionId, runId? }` — the two model names are the catalog id / the reference the request wrote (display spelling); `reason` is an engine word (`unknown_model` / `advisor_unranked` /
+        `weakest_tier` / `main_unranked` / `pairing` / `hold_unknown`; the server echoes it — read OPEN). Unreachable on this server today: it does not accept `advisorModel` (the request body does not take it, and the
+        `advisor` section is not projected on either `wiring_manifest` face).
         Value change: `permission.rule_row_dropped`'s `detail.rows[].rule` is, since core 7.53.0, the rule's original text (the same reading as
         `allowed_tool_not_granted`'s `entries[].entry`: at most 1 024 code points, longer cut to 1 024 + a truncation mark, CONTROL CHARACTERS RIDE AS DATA —
         neutralize at render); before it was the engine-neutralized single-line form (at most 201 code points). Same keys.
@@ -17865,44 +17907,6 @@ components:
             governance shell gate sits at the "classify" tier, a shell ask may come from the classifier or from
             another gate; the server leaves the key absent rather than guessing). Never render absence as
             "this gate can be bypassed by a posture".
-        ruleSuggestions:
-          type: array
-          minItems: 1   # 空数组不可能出现:server 的合取项②要求 `req.ruleSuggestions` **非空**,否则整键省略(缺席 = 本卡无此选项)
-          # 刻意**不**声明 maxItems:server 的 `.max(4)` 是**卡** schema(`ApprovalCardSchema`)上的约束,这条
-          # live 帧腿没有它。在这里抄一个上界 = 声明一条 server 并不执行的约束(照 spec 生成的严格客户端会
-          # 拒收一条合法帧)。数量上界的真源是引擎:core 5.22.0 的 `suggestRulesForCommand` **至多铸一条,且恒
-          # `match: "exact"`**(不写死上界是给将来的 miner 留位,不是暗示今天会有更多)。
-          items: { $ref: '#/components/schemas/RuleSuggestion' }
-          description: >
-            server #154 车二 (core 5.18.0, design/179), ADDITIVE, "tool_approval" only: the rule candidates
-            the ENGINE minted for this ask. Render them as the "don't ask again" options and echo the chosen
-            one back as `persistRule.rule` on POST /v1/tool-approvals/{id}/respond.
-
-            🔴 PRESENCE IS THE PROMISE: the key is present ONLY on a deployment that actually has a
-            permission-rule store wired (the same object behind the engine's `permissionRules.storeWired`
-            manifest bit). A deployment without one OMITS it rather than offering an option with nowhere to
-            redeem — an unredeemable "don't ask again" is a wire lie, worse than absence.
-
-            🔴 THE CONVERSE DOES NOT HOLD: absence means "THIS CARD has no redeemable candidate", and three
-            causes produce it — no rule store wired, the engine minted no candidate for this command (compound /
-            redirect / substitution), or the command bytes were unreadable. One frame cannot tell them apart, so
-            never diagnose the deployment's rule lane from a single absence, and never synthesize a candidate.
-
-            📏 HOW MANY, TODAY: core 5.22.0's miner (`suggestRulesForCommand`) emits AT MOST ONE candidate and
-            always `match: "exact"` — no shipped producer mints the broader prefix option. `prefix` stays in the
-            closed vocabulary because the wire validator accepts it and a later miner may emit it; render what
-            arrives, but do NOT build a UI that assumes a narrow/broad PAIR is on offer.
-
-            🔴 The values are the engine's VERBATIM (closed `match` vocabulary + engine-minted text); the
-            server neither re-mints nor re-orders them. A hand-built rule string is refused at redemption
-            (`ruleRefusal: "rule_not_offered"`) — by construction, so a click on a harmless command cannot be
-            turned into a rule for something else.
-
-            ⚠️ REDEMPTION SCOPE: the key also rides the durable card replay, but its only redemption channel is
-            the LIVE respond leg keyed by this frame's `approvalId` — an in-process map on ONE replica. Same
-            replica ⇒ redeemable; after a restart / on another replica that `approvalId` 404s and the person
-            must use the durable decide leg, which carries NO rule field in v1 (its body is strict — an extra
-            `persistRule` is a loud 400, not a silent drop).
         ruleOffers:
           type: array
           minItems: 1
@@ -17910,8 +17914,8 @@ components:
           description: >
             server >= 7.46.0 (core 5.58.0, design/375), "tool_approval" only — the ENGINE-minted "don't ask
             again" OPTIONS for this ask, as a DISCRIMINATED UNION (`single` | `batch`). It is the BREAKING
-            REPLACEMENT of `ruleSuggestions` above: a >= 7.46.0 engine mints the old key nowhere, there is no
-            alias, and the two keys are declared side by side only so one type surface covers both generations.
+            REPLACEMENT of the triple-shaped `ruleSuggestions` of servers <= 7.45: a >= 7.46.0 engine mints the old key nowhere and there is no
+            alias (sdk 26.0.0 deleted the old key with the support floor 7.52.0).
 
             🔴 READ `kind` TO TELL THE ARMS APART, never a positional assumption. ORDER IS CONTRACT: a
             whole-string exact `single` is index 0 when present and a `batch` is always last; core's own
@@ -17926,23 +17930,15 @@ components:
             suppress its persistence actions entirely (core's normative clause) — a compacted index means the
             k-th option the person clicked is not the k-th rule the server redeems.
 
-            🔴 PRESENCE IS THE PROMISE (same as `ruleSuggestions`): present only where a permission-rule store
+            🔴 PRESENCE IS THE PROMISE: present only where a permission-rule store
             is really wired. The converse does not hold — a wired deployment still omits it for mandated /
             requiresRealApproval / allow_outranked / ask_rule_matched / hook-produced / inherited-unresolved / ancestor-resolved /
             anonymous asks. Absence reads as "THIS CARD has no such option", never as "this deployment has no
             rule lane" (that is `capabilities.permissionRules`) and never as "your rule broke" (that is
-            `allowRuleShadowed`; `persistedRuleShadowed` on a server <= 7.116.x).
+            `allowRuleShadowed`).
 
             ⚠️ REDEMPTION SCOPE is the live respond leg keyed by this frame's `approvalId` only; a replayed
             offer on another replica is not a promise that it is still redeemable.
-        persistedRuleShadowed:
-          type: string
-          description: >-
-            server >= 7.13.0 (core 5.25.0 #144), ADDITIVE, "tool_approval" only — this ask MATCHED one of the caller's persisted allow
-            rules and that rule COULD NOT silence it; the value is the rule's VERBATIM text (secret-redacted + length-bounded; UNTRUSTED
-            for display, like `message`). Absent != "you have no rule"; deliberately separate from `governanceForced`.
-            RETIRED: server >= 7.117.0 (core 7.42.0, BREAKING rename, no alias) never mints this key on any face; its successor is
-            `allowRuleShadowed` (all five allow-layer members, not just the rule store). Kept for servers in [7.13.0, 7.117.0) only (sdk 16.3.0).
         allowRuleShadowed:
           type: array
           items: { $ref: '#/components/schemas/AllowRuleShadow' }
@@ -18220,17 +18216,18 @@ components:
         classifierUnavailable:
           $ref: '#/components/schemas/ClassifierUnavailable'
           description: >-
-            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE, present only when the classifier was consulted and
+            server >= 7.69.0 (core 7.10.0), ADDITIVE, present only when the classifier was consulted and
             could not run — WHY this ask reached a human. See ClassifierUnavailable for the open-`cause` rule and
             the three shapes absence covers.
-            RETIRED: server >= 7.72.0 (core 7.14.0 #688) never mints this key on any of the three faces; its
+            RETIRED: server >= 7.72.0 (core 7.14.0) never mints this key on any of the three faces; its
             successor is `disposition.cause` on the gate record (`unavailable` / `parse_error` — a different
-            question, so an old switch does not port). Kept for servers in [7.69.0, 7.72.0) only (sdk 9.2.0).
+            question, so an old switch does not port). Kept on the frame because servers 7.69–7.71 are inside the supported range and still
+            send it, and the closed inbox row declares the same key (frame and row read the same); it goes with the next major once the support floor is >= 7.106.0.
         ruleStoreUnreadable:
           type: string
           enum: [store, call]
           description: >-
-            server >= 7.72.0 (core 7.14.0 #688 C3), ADDITIVE — WHICH HALF of the rule lane could not be read.
+            server >= 7.72.0 (core 7.14.0), ADDITIVE — WHICH HALF of the rule lane could not be read.
             Present iff `origin === "rule_store_unavailable"`: `store` = the wired rule store could not be read
             (look at the store / network); `call` = the store was read but THIS command could not be read against
             the person's deny/ask rows (look at the command spelling). One `origin` word covers both facts, and
@@ -18238,10 +18235,11 @@ components:
             frame and the inbox row; the `card_json` card deliberately does NOT carry it (it travels with `origin`,
             which is not on the card). Absence = `origin` is not that word — NOT an assertion that the rule store
             is healthy.
-            RETIRED: server >= 7.106.0 (core 7.34.0 C-R172, BREAKING — wire) never mints this key on either face — an
-            unreadable rule store no longer raises a card: that read's rows are SKIPPED by partition and the session
-            stream gets the user-facing `engine_notice` `permission.rule_store_unavailable` (`detail.at` = `prepare` /
-            `call`). Kept for servers in [7.72.0, 7.106.0) only (sdk K-32); `origin: rule_store_unavailable` itself stays.
+            RETIRED: server >= 7.106.0 (core 7.34.0, BREAKING — wire) never mints this key on either face — an
+            unreadable rule store no longer raises a card; the signal moved to the session stream's user-facing
+            `engine_notice` `permission.rule_store_unavailable` (`detail.at` = `prepare` / `call`; what the run does while the rules cannot be read is
+            that notice's own text). Kept on the frame because servers 7.72–7.105 are inside the supported range and still send it, and the closed inbox row
+            declares the same key; it goes with the next major once the support floor is >= 7.106.0 (`origin: rule_store_unavailable` itself stays).
         readRootCandidate:
           type: object
           required: [dir, clearsThisAsk]
@@ -18395,33 +18393,15 @@ components:
             posture. Semantics, the ABSENT != false clause and the discrimination boundary are stated verbatim on
             ToolApprovalFrame.governanceForced. It sits at the card's top level rather than inside `risk` because
             `risk` describes the ENGINE's judgement of the call, while this key says WHO imposed the gate.
-        ruleSuggestions:
-          type: array
-          minItems: 1   # 同帧腿:空数组不可能出现(素材同源),缺席才是「本卡无此选项」
-          maxItems: 4   # 卡形上**真有**这条上界(server `ApprovalCardSchema` 的 `.max(4)`);live 帧腿没有,故只写在这里
-          items: { $ref: '#/components/schemas/RuleSuggestion' }
-          description: >
-            ADDITIVE (#154 车二 / core 5.18.0 design/179): the rule candidates the ENGINE minted for this ask —
-            the card's "don't ask again" options; echo the chosen one back as `persistRule.rule`. Semantics,
-            the PRESENCE-IS-THE-PROMISE clause (present only where a rule store is wired) and the redemption
-            scope are stated verbatim on ToolApprovalFrame.ruleSuggestions — the live frame, the stored
-            `card_json` and the replayed frame carry the SAME material.
         ruleOffers:
           type: array
           minItems: 1
           items: { $ref: '#/components/schemas/RuleOffer' }
           description: >
-            server >= 7.46.0 (core 5.58.0, design/375) — the discriminated-union replacement of
-            `ruleSuggestions` above. Same material as the live frame and the stored `card_json` (the server
+            server >= 7.46.0 (core 5.58.0, design/375) — the discriminated-union replacement of the retired
+            `ruleSuggestions` (servers <= 7.45; sdk 26.0.0 deleted it). Same material as the live frame and the stored `card_json` (the server
             projects all three through one `copyRuleOffer`), so semantics, order-is-contract, presence-is-the-
             promise and the per-leg index rules are stated verbatim on ToolApprovalFrame.ruleOffers.
-        persistedRuleShadowed:
-          type: string
-          description: >-
-            server >= 7.13.0 (core 5.25.0 #144), ADDITIVE — the persisted rule this ask matched but which could not silence it; frame and
-            card carry the SAME material (see ToolApprovalFrame.persistedRuleShadowed).
-            RETIRED: server >= 7.117.0 (core 7.42.0) never mints this key on any face (its strict card schema even refuses a stored card
-            carrying it); its successor is `allowRuleShadowed`. Kept for servers in [7.13.0, 7.117.0) only (sdk 16.3.0).
         allowRuleShadowed:
           type: array
           items: { $ref: '#/components/schemas/AllowRuleShadow' }
@@ -18456,35 +18436,13 @@ components:
         classifierUnavailable:
           $ref: '#/components/schemas/ClassifierUnavailable'
           description: >-
-            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE — WHY this ask reached a human. Frame and card carry
-            the SAME value (one narrow-read function server-side). See ClassifierUnavailable for the open-`cause`
-            rule and the three shapes absence covers.
-            RETIRED: server >= 7.72.0 (core 7.14.0 #688) never mints this key on any of the three faces; its
+            (minted by servers [7.69.0, 7.72.0), core 7.10.0 #616) WHY this ask reached a human. See ClassifierUnavailable for the open-`cause` rule and the three
+            shapes absence covers.
+            RETIRED: server >= 7.72.0 (core 7.14.0) never mints this key on any of the three faces; its
             successor is `disposition.cause` on the gate record (`unavailable` / `parse_error` — a different
-            question, so an old switch does not port). Kept for servers in [7.69.0, 7.72.0) only (sdk 9.2.0).
-
-    RuleSuggestion:
-      type: object
-      description: >
-        One ENGINE-minted rule candidate (#154 车二 / core 5.18.0 `RuleSuggestion`) — what a single click on
-        "don't ask again" would persist.
-
-        🔴 THE TEXT COMES FROM THE ENGINE, NOT THE SHELL: the server derives it from the adjudicated command's
-        own bytes; a client may only echo one of these back verbatim (`persistRule.rule`). Reporting text that
-        is not among the candidates is refused (`ruleRefusal: "rule_not_offered"`) rather than guessed at, so
-        "click on a harmless command, get a rule for something else" is not spellable on this path.
-      # 封闭:core `RuleSuggestion` 恰三键(rule/match/command),server 逐字透传不重铸。
-      additionalProperties: false
-      required: [rule, match, command]
-      properties:
-        rule: { type: string, maxLength: 512, description: 'The canonical rule text to echo back on redemption (server MAX_RULE_TEXT_CHARS = 512).' }
-        match:
-          type: string
-          enum: [exact, prefix]
-          description: '`exact` = this one command only (`Bash(git status)`); `prefix` = word-boundary prefix (`Bash(git status:*)`). Closed vocabulary — an unknown value is not a candidate this contract describes; do not render it as redeemable.'
-        command: { type: string, maxLength: 512, description: 'The command pattern inside the rule, for a shell that would rather not re-parse `rule`.' }
+            question, so an old switch does not port). It stays declared on the CARD because the pinned server's card schema (`ApprovalCardSchema`, server 7.134.0) still accepts it: a still-pending `card_json` row a
+            7.69–7.71 server wrote replays verbatim onto `approval_request.card` / the replay frame. (The FRAME's same-named key stays declared too; why, and until when: `ToolApprovalFrame.classifierUnavailable`.)
 
-    # ─── S-139(sdk 8.3.0):对 server 7.60.0 整体重对账带进来的四张型面 ───────────────────────
     ClassifierUnavailable:
       # 8.9.0:三面(tool_approval 帧 / ApprovalCard / InboxRow)同形同值 ⇒ 具名单源,内联三份会各自漂。
       type: object
@@ -18567,6 +18525,27 @@ components:
         The closed five-word vocabulary of `AllowRuleShadow.member` (server >= 7.117.0 / core 7.42.0 `ALLOW_RULE_MEMBERS`, verbatim and in the order the engine reads the members). The SDK exports
         it at runtime as `ALLOW_RULE_MEMBERS`. Owner = core; read it as an open string with a default arm (core may add a member and the server follows).
 
+    AllowRuleClearance:
+      type: object
+      additionalProperties: false
+      required: [member, entries]
+      description: >
+        `tool_end.gate.disposition.clearedBy` (server >= 7.135.0 / core 7.55.0 `AllowRuleClearance`): the allow-layer member whose rule CLEARED a standing ask (the pair of `AllowRuleShadow`, which is
+        "matched and could NOT clear"). Same `member` / `entries` / `omitted` shape (minted and capped by the same seat), plus `positions` for a LIST member (`request`, `deployment`): the index of every element of the
+        list the run received that is one of those entries (a string listed twice has both indices), so a host reads which line of its own declaration spoke even where the shown text is capped.
+      properties:
+        member: { $ref: '#/components/schemas/AllowRuleMember' }
+        entries:
+          type: array
+          maxItems: 32
+          items: { type: string, maxLength: 512 }
+          description: 'The entries that member stood on (UNTRUSTED for display, secret-redacted, <= 512 chars each, <= 32 listed).'
+        omitted: { type: integer, minimum: 1, description: 'How many entries were not listed (beyond the cap). Absent = none omitted.' }
+        positions:
+          type: array
+          items: { type: integer, minimum: 0 }
+          description: 'LIST members only: the indices, in the list this run received, of the elements that are those entries. Absent for a non-list member.'
+
     AllowRuleShadow:
       type: object
       additionalProperties: false
@@ -18599,7 +18578,7 @@ components:
         `ApprovalCard.ruleOffersAbsence`; server >= 7.55.0 / core #490 fix ②, S-15). The engine names which
         door is shut: `mandated` = this ask must be confirmed every time (🔴 this arm must NOT point the user
         at writing a rule — a rule would not silence it, and saying so sends them into a loop); `allow_outranked` = an
-        allow-layer member matched this call but the ask sits at a higher tier, so another allow rule cannot clear it (the machine-readable twin of `allowRuleShadowed`; `persistedRuleShadowed` on a server <= 7.116.x);
+        allow-layer member matched this call but the ask sits at a higher tier, so another allow rule cannot clear it (the machine-readable twin of `allowRuleShadowed`);
         `ask_rule_matched` = an explicit `ask` rule matched this call (same frame `origin: ask_rule`): it keeps asking, an allow rule would not silence it either; a card from the deployment name-list gate
         `APPROVAL_REQUIRE` / the supervisor route that reports an explicit ask-rule hit lands here too; `lane_cannot_speak` = a rule COULD clear this ask but the lane cannot speak this time (the engine could mint no coverable form for this command).
         🔴 sdk 23.0.0 BREAKING (server >= 7.129.0 / engine 7.51.0, `RULE_OFFERS_ABSENCES`): the former `shadowed` meant two things and is split into the middle two words, no alias; a card / parked row that a server <= 7.128.x
@@ -18634,10 +18613,12 @@ components:
         `READ_ROOT_COVERS` and its `isApprovalRequestFrameV1` judges `covers` by membership in it; a source-level anchor reads the word off the server's minting site and the engine's type.
     PersistedRuleMandate:
       type: string
-      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved]
+      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved, cross_boundary_taint]
       description: >
         WHICH WORD a mandated ask stands on (server >= 7.102.0 / S-721 / core 7.32.0 #1092) — core's
-        `PERSISTED_RULE_MANDATES` six words, transcribed verbatim and in order (core 7.32.1
+        `PERSISTED_RULE_MANDATES` (seven words since core 7.54.0 / server >= 7.134.0: `cross_boundary_taint` — the run executes on a device outside the deployment's
+        trust boundary and the deployment is multi-tenant, so an org-side write, or after an off-target read a call bound for the device, is confirmed by the deployment's
+        approver per call; no standing allow rule and no automatic lane answers it; core puts it at the HEAD of the mandate ladder, the array keeps core's constant order), transcribed verbatim and in order (core 7.32.1
         `dist/core/ask-origin.d.ts:349`; the vocabulary's owner is core; the sixth word is `target_unresolved` from core 7.49.0 #955 / server >= 7.126.0 —
         server 7.122.0–7.125.x sent the previous spelling, which reads as out of set here, see the SDK README's 22.0.0 migration table). Rides FOUR faces with one value: the
         `tool_approval` frame, the `livePending` row top level, the operator queue row (`GET /v1/approvals`
@@ -18691,12 +18672,12 @@ components:
     RuleOfferMatch:
       type: string
       description: >
-        The MATCH FORM of a persisted rule — the server's `PERSISTED_RULE_MATCHES`, verbatim and in order (the vocabulary
-        is OWNED BY CORE; the server only transcribes it and pins set equality, so core adding a member turns
-        the server red at compile time). ONE vocabulary for two faces: a card's rule offer (`RuleOffer.match`, the
+        The MATCH FORM of a persisted rule — core's `PERSISTED_RULE_MATCHES`, verbatim and in order (the vocabulary is OWNED BY CORE: a package-root
+        value since core 7.54.0, which server >= 7.134.0 reads directly instead of keeping its own transcription; earlier servers transcribed it and pinned set
+        equality). ONE vocabulary for two faces: a card's rule offer (`RuleOffer.match`, the
         server's card schema validates it with this very enum) and a persisted rule row (`GET /v1/rules`).
 
-        `exact` = this one command only (`Bash(git status)`). `prefix` = the historical colon-star
+        `exact` = this one command only (`Bash(git status)`). `pattern` (server >= 7.135.0 / core 7.55.0) = the MID-STAR command form (`Bash(git * main)`) — the fourth Bash command form a card edit may persist; the persisted `command` is the written pattern itself. `prefix` = the historical colon-star
         word-boundary prefix (`Bash(git status:*)`) and the ONLY spelling for a compound prefix form; it stays
         a permanent compatibility read. `wildcard` = the trailing space-star form (`Bash(npm run *)`), the
         same predicate as `prefix` on a single command body. `subpath` = the `Read(//abs-dir/**)` directory form,
@@ -18710,11 +18691,11 @@ components:
         always refuses these two words (no network grant is minted through a card). A replica rolled back to 7.125.x reads such a
         row as a damaged row.
 
-        🔴 NINE MEMBERS, closed: the server validates the member on both faces. A consumer type narrower than the
+        🔴 TEN MEMBERS, closed (server >= 7.135.0 / core 7.55.0 added `pattern`, between `wildcard` and `subpath` — the engine's order): the server validates the member on both faces. A consumer type narrower than the
         mint point is a lie — it lets a `switch` claim exhaustiveness the wire does not honour (SDK <= 16 declared
         four here, so a `path` offer and every 7.118.0 skill-card offer were dropped as malformed; SDK <= 21 declared
         seven, so every domain grant row on `GET /v1/rules` was dropped the same way).
-      enum: [exact, prefix, wildcard, subpath, path, name, name_prefix, host, subdomain]
+      enum: [exact, prefix, wildcard, pattern, subpath, path, name, name_prefix, host, subdomain]
 
     RuleOfferUncoveredReason:
       type: string
@@ -18896,8 +18877,7 @@ components:
               maxLength: 512
               description: >
                 With `edited` absent or false this is the CANDIDATE ARM: echo back, VERBATIM, the `rule` of the
-                chosen `kind: "single"` entry of the frame's `ruleOffers` (or, against a <= 7.45 server, of
-                `ruleSuggestions`). Do not hand-build it, re-case it or append `:*` — the server locates it by
+                chosen `kind: "single"` entry of the frame's `ruleOffers`. Do not hand-build it, re-case it or append `:*` — the server locates it by
                 text and refuses otherwise (`rule_not_offered`). With `edited: true` this is the FREE-TEXT ARM
                 and the string is whatever the person typed.
             edited:
@@ -19835,6 +19815,38 @@ components:
         fields: {}
         overrideReasons: {}
         ts: {}
+    CrossBoundaryTaintRow:
+      type: object
+      description: >
+        server >= 7.134.0 / core 7.54.0 — the device lane's CROSS-BOUNDARY TAINT row: the engine's `permission.cross_boundary_taint` frame minus its envelope
+        (`kind` / `version` / `taskId` / `ts`). Metadata only. Emitted ONLY on a tree that executes on a target device (one row when an armed tree prepares a
+        leg — `prepare`, one on a durable resume leg — `resume`, one when this leg first lets an off-target read into the tree — `observed`, with that call);
+        the host lane never emits it. Two exits, one row: the ledger event `cross_boundary_taint` on `GET /v1/runs/{taskId}/events` (`Event_cross_boundary_taint`)
+        and the trace SSE `cross-boundary-taint` frame on `GET /v1/tasks/{taskId}/stream` (the row + `seq`). The `GET /v1/runs/{taskId}` poll object carries NO
+        such key.
+      # 不封闭(`additionalProperties: true`):本 schema 是 `Event_cross_boundary_taint` 的 allOf 目标(帧上多一个 `type`),封闭会把合法帧判成违约(同 PromptManifestRow)。
+      additionalProperties: true
+      required: [runId, phase, taint, governed]
+      properties:
+        runId: { type: string, description: 'the leg''s run id.' }
+        phase: { type: string, enum: [prepare, resume, observed], description: 'core `permission.cross_boundary_taint` `phase` (engine closed set).' }
+        taint:
+          type: array
+          description: 'The tree''s taint bits after the event — core `CROSS_BOUNDARY_TAINT_BITS` (`targetExecutionArmed` = the tree is armed to execute on the target; `offTargetReadObserved` = off-target read content was let into the tree).'
+          items: { type: string, enum: [targetExecutionArmed, offTargetReadObserved] }
+        governed: { type: boolean, description: 'the tree has run under the `multi_tenant` posture since it armed (derived from `REQUIRE_PRINCIPAL`).' }
+        toolName: { type: string, description: '`observed` only: the call that let the off-target read in.' }
+        toolCallId: { type: string, description: '`observed` only: that call''s id.' }
+    Event_cross_boundary_taint:
+      description: >
+        DURABLE only (server >= 7.134.0 / core 7.54.0) — the ledger event of a `CrossBoundaryTaintRow` on `GET /v1/runs/{taskId}/events` (SSE `id:` = the row's
+        seq). Never on the live stream, never on the `GET /v1/runs/{taskId}` poll object; an older server drops the frame on the spot.
+      allOf:
+        - $ref: '#/components/schemas/CrossBoundaryTaintRow'
+        - type: object
+          required: [type]
+          properties:
+            type: { const: cross_boundary_taint }
     Event_needs_review:
       type: object
       description: >
@@ -20019,6 +20031,12 @@ components:
         runId: { type: string }
         status: { type: string }
         summary: { type: string }
+        completionId:
+          type: string
+          description: >
+            server >= 7.135.0 — the idempotency anchor of this workflow completion: the SAME id rides every notification path of one completion (this frame / `task_notification` / fleet `bg_notification` / inbox replay) and
+            is the dedup key ACROSS paths (the same value domain as `task_notification.completionId`). ABSENT when the engine gave none (an orphan the service terminated itself) — dedup on `runId` as before. The read faces
+            (`GET /v1/workflows/{id}` etc.) deliberately never carry it. Older servers' re-delivered frames have no such key.
 
     # ── 🔴 #185a (2026-08-08): the DURABLE leg's three APPROVAL arms ────────────────────────────────
     #   Shape rule for all three: `allOf: [<frame schema>, {the narrowed discriminant}]`. The keys are NOT
@@ -20718,7 +20736,7 @@ components:
         🔴 ONE RULE FOR EVERY "EFFECTIVE HALF ONLY" KEY (sdk 9.7.0, after a codex adversarial-review [high]):
         this schema's only consumer today is `GET /v1/diagnostics/wiring`'s `static` half, and every key marked
         "effective half only" (`leg`, `ask.effective`, `configFingerprint`, `tools`, `mods`, `lsp`,
-        `modelGate`, `autoMode`, `writeProtection`, `readDeny`, `autoConsolidation`, `fileHistory`, `instructions`) is ALWAYS ABSENT on that
+        `modelGate`, `autoMode`, `writeProtection`, `readDeny`, `autoConsolidation`, `fileHistory`, `instructions`, `sessionRules`, `projectMemory`) is ALWAYS ABSENT on that
         wire ⇒ THEIR ABSENCE HERE CARRIES NO INFORMATION. The per-key absence readings ("absent = not armed",
         "absent = a third state", …) hold for the LIVE FRAME (`Event_wiring_manifest`) and must not be carried
         over to this response. For the facts behind those keys: a tenant reads
@@ -20731,7 +20749,7 @@ components:
         are EFFECTIVE-half only (the live `wiring_manifest` event) — as are the four per-leg sections
         `modelGate`, `autoMode`, `mcp` and `tools`, which describe what THIS leg did and have no static
         counterpart — and the STATIC half
-        (GET /v1/diagnostics/wiring) NEVER mints them; every other section, plus `governance`, is always
+        (GET /v1/diagnostics/wiring) NEVER mints them; every other section NOT in the effective-half-only list above, plus `governance`, is always
         present on the static half. Fields stay optional because core may add or drop sections and that
         must not hard-break a client — read by half, and never wait on a key the half never sends.
         🔴 EVERY section is declared HERE, each saying which half mints it (sdk 8.9.0). Before that, `tools`
@@ -20752,6 +20770,18 @@ components:
           description: 'Which leg emitted it (effective half only; the static half has no leg identity).'
           properties:
             kind: { type: string, enum: [root, child, resume] }
+        sessionRules:
+          type: object
+          required: [childrenReadLive]
+          description: >
+            server >= 7.135.0 (engine 7.55.0; effective half only — the static half never mints it): whether the session-rules layer is handed to the delegated legs. Same reading as on the live frame (`Event_wiring_manifest.sessionRules`):
+            `childrenReadLive: true` = a rule written into the session NOW governs an already-running child's NEXT call; `false` = no rules layer; the section ABSENT = an older engine, or this half.
+          properties:
+            childrenReadLive: { type: boolean }
+        projectMemory:
+          type: string
+          description: >
+            server >= 7.135.0 (engine 7.55.0; effective half only): did the leg call the deployment's project-context seat — `on` / `disabled` (the request's `projectMemory: "disabled"`) / `absent` (no seat wired). Open on read; ABSENT = an older engine, or this half.
         ask:
           type: object
           description: 'Approval seam: wired form, which seat it came from, and (effective half) what it adjudicates to.'
@@ -21519,6 +21549,19 @@ components:
         usageMissing: { type: boolean, enum: [true] }
         stopReason: { type: string }
         errorMessage: { type: string, description: 'A post-stream error (contract: not thrown as HTTP).' }
+        errorCode:
+          type: string
+          description: >-
+            server >= 7.135.0 (core 7.55.0, passed through verbatim; failure only): the engine's brain error code of the failed reply (open on read; today `auth` / `invalid_request` / `rate_limit` / `server` / `network` /
+            `http` / `stream_torn` / `refusal` / `length_empty`). ABSENT on success and on older servers.
+        errorKind:
+          type: string
+          enum: [input_too_long, degenerate, length_empty]
+          description: 'server >= 7.135.0 (failure only): the STRUCTURAL failure kind the reply carried, forwarded as is — `input_too_long` (the provider refused the request as over its window), `degenerate`, `length_empty`. Absent when the reply carried none.'
+        inputTooLongRuledOut:
+          type: boolean
+          enum: [true]
+          description: 'server >= 7.135.0 (failure only): present (always `true`) when the failure was a provider refusal whose minter RULED OUT input-too-long as the explanation (core `AssistantMessage.inputTooLongRuledOut`, passed through). It speaks ONLY to that negative: it does not say the status is 400 / 422 and does not say a verbatim resend repeats the failure (the engine also rules input length out for statuses such as 401 / 429 / 500) — triage on `errorCode`. Absent = no such judgment.'
 
     ToolApprovalDecision:
       type: string
@@ -21690,6 +21733,15 @@ components:
         (the `livePending[]` row + `state`; answer door open); `decided` = the row is DECIDED (`decision` / `decidedAtMs` / `decisionNote?`, the same three keys as the late-replay body); `parked` = PARKING / PARKED
         (a late answer redeems the parked card; `decidePath?` points at the durable decision path); `void` = DENIED / VOID (nobody decided it, the answer has nowhere to land; `cause?` is the same cause word as the
         late-answer 404's, see ToolApprovalNotPendingCause).
+        🔴 server >= 7.134.0: a PARKED row passes the gate judge (the same one the answer door's 409 `approval_stale` reads) — the gate still open ⇒ `parked`
+        (+ `decidePath`; ONLY this state renders "go decide"); the gate settled by a person / policy ⇒ `decided` (no `decidePath`); the gate expired (a cancel expires it
+        first) / superseded / settled by the host SLA sweep, the window or nobody-to-answer ⇒ `void` WITHOUT `cause`; the checkpoint row gone, or settled without a
+        readable direction / time ⇒ 404 `tool_approval.not_pending` WITHOUT `cause`; the gate unreadable (store failure) ⇒ falls back to `parked`. Known boundary (re-read
+        to settle it): a parked row's `decided` can return to `parked` when the resume leg fails before the approved action starts (the engine reopens the same gate), and
+        a cancelled resume reads `void` once the server collects the reopened gate (`parked` in between, or `void` for an instant during the reopen).
+        Older servers answered all of these with `parked` + `decidePath`.
+        🔴 server >= 7.135.0: a gate that was DECIDED and then REOPENED by the engine reads `parked` WITH `reopened` (`ToolApprovalReopened`: the engine's reopen reason + the earlier decision's
+        `decision` / `decidedAtMs` / `decisionNote?`). `reopened` ABSENT = the read cannot say it was reopened (not "confirmed never reopened"). Older servers: always absent.
       oneOf:
         - $ref: '#/components/schemas/ToolApprovalReadPending'
         - $ref: '#/components/schemas/ToolApprovalReadDecided'
@@ -21727,6 +21779,29 @@ components:
           properties:
             state: { type: string, enum: [parked] }
             decidePath: { type: string, description: 'The durable decision path for this ask when it can be built.' }
+            reopened:
+              allOf: [{ $ref: '#/components/schemas/ToolApprovalReopened' }]
+              description: 'server >= 7.135.0: present when the gate was decided and then reopened by the engine (the resume leg failed before the approved action started). Absent = the read cannot say it was reopened.'
+    ToolApprovalReopenReason:
+      type: string
+      description: >
+        `ToolApprovalReopened.reason` (server >= 7.135.0) — the engine's `REOPEN_REASONS`, verbatim and in order (engine-owned; the server echoes a word only when it is in this
+        set, otherwise `reopened` is omitted entirely): `env_failed` (the environment / session side failed) · `tool_unavailable` (the approved tool is not there now — decide again) ·
+        `constraint_rejected` (the decision input was rejected — decide again) · `config_refused` (the configuration was refused). Read open on the consumer side: an unknown word is "reopened, reason unknown".
+      enum: [env_failed, tool_unavailable, constraint_rejected, config_refused]
+    ToolApprovalReopened:
+      type: object
+      description: >
+        `ToolApprovalReadParked.reopened` (server >= 7.135.0): evidence that a DECIDED gate was reopened by the engine. `reason` = the engine's reopen reason; `decision` / `decidedAtMs` / `decisionNote?` = the
+        decision made BEFORE the reopen (the same three keys as a `decided` body). An unreadable earlier decision ⇒ the three keys are absent TOGETHER (only `reason` stays; `decisionNote` may always be absent).
+        Single-instant read: if the row is decided and reopened between the two reads the server re-judges (three rounds in a row ⇒ falls back to plain `parked`).
+      additionalProperties: false
+      required: [reason]
+      properties:
+        reason: { $ref: '#/components/schemas/ToolApprovalReopenReason' }
+        decision: { type: string, enum: [allow, deny] }
+        decidedAtMs: { type: integer }
+        decisionNote: { type: string }
     ToolApprovalReadVoid:
       allOf:
         - $ref: '#/components/schemas/ToolApprovalReadProjection'
@@ -22083,74 +22158,6 @@ components:
         delivery: { type: string, const: applied, description: 'Literal "applied" on today''s server.' }
         marker: { type: string, description: 'Engine-minted delivery marker.' }
 
-    WorkspaceSnapshotPage:
-      # 4.3.0(CAPS-OPS-8):把 GET …/workspace 的 200 信封提成具名 schema。SDK 侧此前是 `list()` 返回位上的
-      # **内联闭合字面量**,两道 spec 门(field-drift 只扫 types.ts / resource-schema 只扫 resources 的 exported
-      # type)对方法返回位的内联形都是盲的 —— 于是它漏了这里一直标为 required 的 `sessionId`,CI 全绿。
-      type: object
-      description: >
-        GET /v1/sessions/{sessionId}/workspace 的 200 信封(server src/http/routes/sessions.ts)。
-        ⚠️ `total` = **本页行数**(`snapshots.length`),不是快照总数,且这条腿没有任何分页游标 —— 与同族
-        `WorkspaceTreePage.total`(真·全量)**同名反义**。`latest` 与展示行同源(防 ghost key)。
-      additionalProperties: false
-      required: [sessionId, snapshots, total]
-      properties:
-        sessionId: { type: string }
-        snapshots:
-          type: array
-          items: { $ref: '#/components/schemas/WorkspaceSnapshotRow' }
-        latest: { type: string, description: 'Newest snapshot key; absent when the session has none.' }
-        total: { type: integer, description: 'ROWS ON THIS PAGE — not the snapshot count.' }
-
-    WorkspaceTreePage:
-      # 4.3.0(CAPS-OPS-8):同上,tree 腿的 200 信封。
-      type: object
-      description: >
-        GET /v1/sessions/{sessionId}/workspace/{key}/tree 的 200 信封(server src/http/routes/sessions.ts)。
-        `total` 在这条腿上是**全量**(`all.length`)—— 与 `WorkspaceSnapshotPage.total` 语义相反。
-        `key` 回的是解析后的真实键(请求可传 `latest` 别名)。
-      additionalProperties: false
-      required: [sessionId, key, entries, total]
-      properties:
-        sessionId: { type: string }
-        key: { type: string, description: 'The RESOLVED snapshot key (a `latest` alias in the request comes back resolved).' }
-        entries:
-          type: array
-          items: { $ref: '#/components/schemas/WorkspaceTreeEntry' }
-        total: { type: integer, description: 'FULL entry count (not the page size).' }
-        nextOffset: { type: integer, description: 'Present ⇒ more pages; send it back as ?offset=.' }
-
-    WorkspaceSnapshotRow:
-      type: object
-      description: >
-        One snapshot row of GET /v1/sessions/{sessionId}/workspace (envelope `{sessionId, snapshots,
-        latest?, total}`; server src/http/routes/sessions.ts — newest first, uuidv7 keys). E19 snapshot store's
-        read-only projection: each row is the freeze at a turn boundary, NOT a live workspace.
-      required: [key, files]
-      additionalProperties: true
-      properties:
-        key: { type: string, description: 'Snapshot key (uuidv7 entry id; "latest" is an accepted alias on the sub-routes).' }
-        files: { type: integer, description: 'Manifest row count.' }
-        bytes: { type: integer, description: 'Total snapshot bytes — present only when the store has a sizes face (SQL backends); the local store honestly omits it ([1894]② additive).' }
-
-    WorkspaceTreeEntry:
-      type: object
-      description: >
-        One file entry of GET /v1/sessions/{sessionId}/workspace/{key}/tree (envelope `{sessionId, key,
-        entries, total, nextOffset?}`; server src/http/routes/sessions.ts — stable path order, offset paging).
-      required: [path, hash]
-      additionalProperties: true
-      properties:
-        path: { type: string, description: 'The relPath — pass VERBATIM as ?path= on the file sub-route.' }
-        hash: { type: string, description: 'Content address (sha256) — enables cross-snapshot change highlighting ([1894]②).' }
-        size: { type: integer, description: 'Present only when the store has a sizes face (SQL backends).' }
-
-    # ═══════════════════════════════════════════════════════════════════════════════════════════════
-    # #154 车二(design/179 §7)—— 持久权限规则的 CC settings 导入面。形按 server 真码 + core 原形亲读
-    # (`src/http/routes/rules.ts` / `src/rules-consent.ts`;preview/result 两形是 core `ImportPreview` /
-    # `ImportResult` 的原样透传)。
-    # ═══════════════════════════════════════════════════════════════════════════════════════════════
-
     CcImportSettingsLayer:
       type: string
       enum: [userSettings, projectSettings, localSettings]
@@ -22512,8 +22519,8 @@ components:
         match:
           allOf: [{ $ref: '#/components/schemas/RuleOfferMatch' }]
           description: >
-            The match form — the same seven-member vocabulary as a card's rule offer (`RuleOfferMatch`, the server's
-            `PERSISTED_RULE_MATCHES`): `exact` / `prefix` / `wildcard` / `subpath` / `path`, and from server >= 7.118.0
+            The match form — the same ten-member vocabulary as a card's rule offer (`RuleOfferMatch`, the server's
+            `PERSISTED_RULE_MATCHES`): `exact` / `prefix` / `wildcard` / `pattern` (server >= 7.135.0: the mid-star command form) / `subpath` / `path`, and from server >= 7.118.0
             `name` / `name_prefix` (a `Skill(<name>)` / `Skill(<prefix>:*)` rule).
         command: { type: string, description: 'What the matcher actually compares against, parsed out of `rule` at mint time and stored so no consumer re-parses. Trust this + `match`, not your own parse of `rule`.' }
         adds: