@sema-agent/sdk 26.0.0 → 27.0.0

package/openapi.yaml

@@ -2428,7 +2428,7 @@ paths:
       summary: Write the per-session tool-permission rules (tighten-only).
       description: >
         E6 — write the per-session rules. 🔴 TIGHTEN-ONLY for a normal principal: a loosen (remove a deny / widen
-        an allowlist or allowDirs) → 403 `loosen_forbidden` (operator-only). `expectedRev` = optimistic-concurrency
+        an allowlist or allowDirs) → 403 `loosen_forbidden` (operator-only). 🔴 server >= 7.135.0 (engine 7.55.0): the tighten gate is a gate on the row's OPERATOR PART (`operatorRules`), not on the whole row — a non-operator (the session's owner) can take back what NON-operator writes added, but not what an operator wrote (moving anything inside the operator part, even an entry both sides wrote, answers 403 `loosen_forbidden`; the row stays). <= 7.134.x: a non-operator write was subtract-only against the whole row. Read the CODE (the sentence changed: `a non-operator session-rule write may not loosen what an operator wrote; refused: …` vs `… may only tighten …`) — never the sentence. `expectedRev` = optimistic-concurrency
         CAS; a stale rev → 409 `conflict`. Each rule field must be `string[]` and the body carries only the three buckets (`toolAllow` / `toolDeny` / `allowDirs`; any other
         key, including the retired `commandAllow` / `commandDeny`, → 400 `rules.invalid_shape` on server >= 7.129.0) → malformed body 400. ownerless
         session → 409; non-owner → 404. 501 without a session-policy store.
@@ -2456,6 +2456,9 @@ paths:
                     # write judge stamps the current grammar). `grammar` newer than the engine's ⇒ `400 rules.invalid_shape`.
                     rev: { type: integer, minimum: 0 }
                     grammar: { type: integer, minimum: 0 }
+                    # server >= 7.135.0 (engine 7.55.0): a stored body echoed back (GET → edit → PUT) may also carry its `operatorRules`; on THIS door the echoed part is ALWAYS ignored — the route reads the value through the write reader
+                    # (its product carries no `rev`) and the store judges it again: over an existing row the STORED row's operator part is kept, over no row an empty stamped part is minted. Do not rely on an echo to move the operator line — send the new value without `operatorRules`.
+                    operatorRules: { $ref: '#/components/schemas/SessionRulesOperatorPart' }
                 expectedRev: { type: integer, minimum: 0, description: CAS — reject if the stored rev differs. }
       responses:
         '200':
@@ -2492,7 +2495,8 @@ paths:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
         '401': { $ref: '#/components/responses/Unauthorized' }
         '403':
-          description: 403 `loosen_forbidden` — a non-operator write tried to relax the rules (tighten-only).
+          description: >-
+            403 `loosen_forbidden` — a non-operator write tried to relax what an OPERATOR wrote (server >= 7.135.0; <= 7.134.x: relax the rules at all, tighten-only). Branch on the code, never the sentence (it changed with 7.135.0).
           content:
             application/json:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
@@ -2581,7 +2585,7 @@ paths:
         narrow it, switch with a default arm; `httpStatus` 401 is a re-authorize door); `reason` is HUMAN TEXT
         (server-redacted, length-bounded) and must NOT be parsed.
         Gates, the same family as steer / capture-optout: 501 `capability.run_store_required` (no durable run
-        ledger) · 501 `capability.session_ownership_required` (no `sessionStorage.ownerOf`) · 400
+        ledger) · 501 `capability.session_ownership_required` (no `sessionStorage.headOf`; <= 7.134.x: `ownerOf`) · 400
         `request.path_malformed` (bad percent-encoding in the id) · 404 `not_found.session` — unknown session
         AND someone else's session answer the SAME code and SAME message (deliberate: no existence oracle); an
         EXPLICIT operator may re-dial any tenant's session · 422 `steering.invalid_content` · 409
@@ -2647,7 +2651,7 @@ paths:
         the model's description, falling back to the launch command text (content family: redacted, cut at 500
         chars). At most 500 rows (core `list()`'s own cap). 🔴 IN-PROCESS: only rows on THIS replica.
         Zero model work: not billable, not refused by drain. Gates (same family as `mcp/reconnect`): 501
-        `capability.session_ownership_required` (no `sessionStorage.ownerOf`) · 404 `not_found.session` — unknown
+        `capability.session_ownership_required` (no `sessionStorage.headOf`; <= 7.134.x: `ownerOf`) · 404 `not_found.session` — unknown
         session AND someone else's session answer the SAME code and SAME message (no existence oracle); an EXPLICIT
         operator may read any session · 400 `request.path_malformed`. Probe with `capabilities.background.listFace`;
         ABSENT key = an older server, where this path is 404 `not_found.route` (same status, different code).
@@ -2920,6 +2924,15 @@ paths:
         '401': { $ref: '#/components/responses/Unauthorized' }
         '404': { $ref: '#/components/responses/NotFound' }
         '501': { $ref: '#/components/responses/NotImplemented' }
+        '503':
+          description: >-
+            server >= 7.135.0: `503 state.file_history_unreadable` — this session's file history cannot be read WHOLE (a boundary torn / unreadable, the tracked set unreadable); nothing is exported this time. 🔴 It is NOT "no history":
+            with nothing to export the manifest still answers `200` with `fileHistory: null`. May carry `permanence` (`transient` / `terminal`; absent = the store did not judge — see `ErrorResponse.permanence`). Older servers read an
+            unreadable history as "none" (manifest 200 / blob 404).
+            Server >= 7.136.0: the SAME code with `permanence: "transient"` also answers a database / store connection failure on this leg (the entry-id set, policy, anchors, session row, the history read — the code's `file_history` is its origin; the action reads `permanence`); before 7.136.0 that fell to a generic `500 internal.error`. The SDK retries this 503 up to `maxRetries` times BEFORE the first byte (the same retrier on all three pull legs), except `permanence: "terminal"` (the store judged retrying useless until it is repaired).
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/sessions/{sessionId}/sync/entries:
     parameters:
@@ -2957,6 +2970,13 @@ paths:
         '401': { $ref: '#/components/responses/Unauthorized' }
         '404': { $ref: '#/components/responses/NotFound' }
         '501': { $ref: '#/components/responses/NotImplemented' }
+        '503':
+          description: >-
+            server >= 7.136.0: `503 state.file_history_unreadable` + `permanence: "transient"` — a database / store connection failure BEFORE the response head is sent (nothing is streamed; before 7.136.0 a generic `500 internal.error`). The code's `file_history` is its origin; the action reads `permanence` (see `ErrorResponse.permanence`).
+            A disconnect AFTER the 200 head can only truncate the stream — no `{"__sync":"end"}` trailer — and is never a 5xx. The SDK retries the 503 up to `maxRetries` times BEFORE the first byte (the same retrier on all three pull legs), except `permanence: "terminal"` (the store judged retrying useless until it is repaired); a truncated body is not retried (resume with `afterSeq`).
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/sessions/{sessionId}/sync/history/blobs/{hash}:
     parameters:
@@ -2994,6 +3014,15 @@ paths:
         '401': { $ref: '#/components/responses/Unauthorized' }
         '404': { $ref: '#/components/responses/NotFound' }
         '501': { $ref: '#/components/responses/NotImplemented' }
+        '503':
+          description: >-
+            server >= 7.135.0: `503 state.file_history_unreadable` — the history cannot be read WHOLE, so the server cannot tell whether this hash is one the session references — it does NOT answer "no such blob" (that is `404 not_found.blob`) and gives no bytes. 🔴 It is NOT "no history":
+            with nothing to export the manifest still answers `200` with `fileHistory: null`. May carry `permanence` (`transient` / `terminal`; absent = the store did not judge — see `ErrorResponse.permanence`). Older servers read an
+            unreadable history as "none" (manifest 200 / blob 404).
+            Server >= 7.136.0: the SAME code with `permanence: "transient"` also answers a database / store connection failure on this leg (the history read or the blob bytes read — the code's `file_history` is its origin; the action reads `permanence`); before 7.136.0 that fell to a generic `500 internal.error`. The SDK retries this 503 up to `maxRetries` times BEFORE the first byte (the same retrier on all three pull legs), except `permanence: "terminal"` (the store judged retrying useless until it is repaired).
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/sessions/{sessionId}/sync/blobs/{hash}:
     parameters:
@@ -3091,12 +3120,15 @@ paths:
       description: >
         2c session-sync PUSH Phase A — a SMALL metadata body (`entryIds, fileHistory?, policy, anchors, resolution?, logDigest?, title?, pinned?`); the
         entries stream in Phase B. The cloud classifies (§7), pre-checks blob presence (a missing referenced hash →
-        422 `missing_blob` — PUT it first), guards the import lease + any active run (409), then mints a stagingId.
+        422 `missing_blob` — PUT it first; server >= 7.135.0 answers it in this FIRST phase — zero staging, zero commit, ahead of the `identical` replay arm — and
+        a deployment whose `capabilities.sessionSyncFileHistory` is false, e.g. `DB_BACKEND=local`, takes a `fileHistory` that references blobs as a first-phase 422 too: the conversation does not land either; <= 7.134.x answered it after the conversation
+        had committed), guards the import lease + any active run (409), then mints a stagingId. 🔴 server >= 7.135.0: a file-history replay fault (the replay arms of `identical` re-push and of the commit) answers `422 adopt_failed`
+        (+ optional `permanence`, see `ErrorResponse.permanence`; <= 7.134.x: `unsupported_format`) — distinct from `missing_blob`.
         The file history rides `fileHistory` (a `FileHistoryExport` envelope, `null` / absent = none) and every blob it references must have been
         `PUT …/sync/blobs/{hash}` first (the `snapshots` key of servers <= 7.51 is outside the support range; a supported server ignores it and sdk 26.0.0
         no longer declares it). The SDK carries `fileHistory` in `pushSessionBundle` / `importSessionBundle`; a hand-rolled
-        push must send `fileHistory` itself, and only to a peer whose `capabilities.sessionSyncFileHistory` is not false (server >= 7.116.0 — else the
-        commit 422s `missing_blob`).
+        push must send `fileHistory` itself, and only to a peer whose `capabilities.sessionSyncFileHistory` is not false (server >= 7.116.0 — else
+        `422 missing_blob` in the first phase from server >= 7.135.0; after the commit on <= 7.134.x).
         `identical` → `{ relation:"identical", basis, payloadVerified }` with NO stagingId (skip Phase B);
         `basis` is `"entry-ids+digest"` when the caller supplied a comparable digest and it matched, else
         `"entry-ids"` (id-set equality only) — see the `ImportStaged` schema, which has carried these two
@@ -3169,7 +3201,12 @@ paths:
           content:
             application/json:
               schema: { $ref: '#/components/schemas/SyncConflict' }
-        '422': { $ref: '#/components/responses/UnprocessableEntity' }
+        '422':
+          description: >-
+            422 — `missing_blob` (first phase from server >= 7.135.0), `restore_failed`, and (server >= 7.135.0) `adopt_failed` (+ optional `permanence`) for the file-history replay; `invalid_entries` etc. as before. Branch on `errorCode`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
         '501': { $ref: '#/components/responses/NotImplemented' }
         '503': { $ref: '#/components/responses/Unauthorized' } # (declared 2026-08-01) E6 兄弟守卫:无 service token + 未开 ALLOW_UNAUTHED_WRITES 时,这条 import 提交腿与 `PUT …/policy` 写的是同一个 policy store ⇒ 同门同码 `auth.service_token_required`(server 3.15.0 起)
 
@@ -3211,7 +3248,8 @@ paths:
         '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
         '403':
-          description: 403 `loosen_forbidden` — a post-commit policy replay tried to relax the rules (tighten-only).
+          description: >-
+            403 `loosen_forbidden` — a post-commit policy replay tried to relax what an operator wrote (server >= 7.135.0; <= 7.134.x: tighten-only against the whole row). A non-operator replay keeps each record's own operator part; an operator replay makes the imported row the operator's.
           content:
             application/json:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
@@ -3259,7 +3297,14 @@ paths:
             server >= 7.134.0: a queue row whose stored body cannot be read (the store's refusal contract — a retry fails the same way; an operator has to repair
             or delete that row) answers `500` + `errorCode: "approvals.read_corrupt"` (body `{ error, errorCode }`; the bad row's coordinates stay off the wire) —
             the same judge and the same code as `GET /v1/approvals/stream`. Do NOT retry it as-is (the SDK's GET retry arm exempts the code). Every other read
-            failure (connection / timeout / store hiccup) is still `500 internal.error`. Older servers answered the corrupt row with `internal.error`.
+            failure (connection / timeout / store hiccup) is `503 approvals.read_unavailable` from server >= 7.135.0 (below); servers <= 7.134.x answered it `500 internal.error`. Older servers answered the corrupt row with `internal.error`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '503':
+          description: >-
+            server >= 7.135.0: `503 approvals.read_unavailable` — the approvals queue could not be read RIGHT NOW (the store hiccuped; transient — the SDK retries it by status). Until a read succeeds, an answer here does NOT mean nothing is pending.
+            Body `{ error, errorCode }`. Older servers answered a read that could not complete with the global fallback `500 internal.error`.
           content:
             application/json:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
@@ -3339,7 +3384,10 @@ paths:
             schema: { $ref: '#/components/schemas/ApprovalDecision' }
       responses:
         '200':
-          description: Decision accepted; the run resumes.
+          description: >-
+            Decision accepted. Usually the run (or the parked background agent) resumes; on the two parked-agent forms that can never revive,
+            a DENY (server >= 7.136.0) is answered `{ taskId, status: "failed", decision: "deny" }` instead — the card is voided and nothing resumes
+            (see `ParkedDecideAccepted`, `ApprovalDecisionResult`).
           content:
             application/json:
               schema: { $ref: '#/components/schemas/ApprovalDecisionResult' }
@@ -3514,6 +3562,10 @@ paths:
             the claim and rolls back when it is gone or different) — a 7.104.0 session delete retires such cards, so this form
             mostly meets cards left by a pre-7.104.0 delete; `decide.row_unrevivable` (DecideError) now also answers when the
             parked row carries no root-session anchor (refused before the claim, nothing consumed).
+            server >= 7.136.0 — those two never-revive forms (a parked child whose row carries no agent name; a row with no root-session anchor) keep answering APPROVE with this 409 (the sentence now ends
+            by pointing at deny), but DENY answers `200 { taskId, status: "failed", decision: "deny" }`: the card is voided under its own scope CAS and leaves the pending queue and the
+            `/v1/approvals/stream` snapshot, the child ends `failed`, the gated tool never runs, no `remember` is granted; a lost void CAS is the existing 409 `decide.gate_moved`. Branch on
+            `status` / `errorCode`, not on the sentence.
           content:
             application/json:
               schema: { $ref: '#/components/schemas/ResumeLegConflictError' }
@@ -3707,6 +3759,20 @@ paths:
             application/json:
               schema: { $ref: '#/components/schemas/InboxList' }
         '401': { $ref: '#/components/responses/Unauthorized' }
+        '500':
+          description: >-
+            server >= 7.135.0: `500 approvals.read_corrupt` — a queue row's stored body cannot be read (the store's refusal contract: a retry fails the same way; an operator has to repair or delete that row) — the SAME judge and the same code as `GET /v1/approvals`
+            and `GET /v1/approvals/stream`. Do NOT retry it as-is (the SDK's retry arm exempts the code). Every other read failure is `503 approvals.read_unavailable` (below). Older servers: `500 internal.error`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '503':
+          description: >-
+            server >= 7.135.0: `503 approvals.read_unavailable` — the approvals queue could not be read RIGHT NOW (the store hiccuped; transient — the SDK retries it by status). Until a read succeeds, an answer here does NOT mean nothing is pending.
+            Body `{ error, errorCode }`. Older servers answered a read that could not complete with the global fallback `500 internal.error`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/assistant/tasks:
     parameters:
@@ -3728,6 +3794,20 @@ paths:
             application/json:
               schema: { $ref: '#/components/schemas/AssistantTaskList' }
         '401': { $ref: '#/components/responses/Unauthorized' }
+        '500':
+          description: >-
+            server >= 7.135.0: `500 approvals.read_corrupt` — a queue row's stored body cannot be read (the store's refusal contract: a retry fails the same way; an operator has to repair or delete that row) — the SAME judge and the same code as `GET /v1/approvals`
+            and `GET /v1/approvals/stream`. Do NOT retry it as-is (the SDK's retry arm exempts the code). Every other read failure is `503 approvals.read_unavailable` (below). Older servers: `500 internal.error`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '503':
+          description: >-
+            server >= 7.135.0: `503 approvals.read_unavailable` — the approvals queue could not be read RIGHT NOW (the store hiccuped; transient — the SDK retries it by status). Until a read succeeds, an answer here does NOT mean nothing is pending.
+            Body `{ error, errorCode }`. Older servers answered a read that could not complete with the global fallback `500 internal.error`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/assistant/tasks/{taskId}/resume:
     parameters:
@@ -5921,6 +6001,14 @@ paths:
               schema: { $ref: '#/components/schemas/WorkflowJournalPage' }
         '401': { $ref: '#/components/responses/Unauthorized' }
         '404': { $ref: '#/components/responses/NotFound' }
+        '500':
+          description: >-
+            server >= 7.135.0 (core 7.55.0): `500 workflow.journal_incompatible` — a journal row the engine's judge rejects (a parked row with no checkpoint token, a parked row whose terminal is not paused, a row that does not read as an object — hand-edited / another writer /
+            a newer format). The judgment covers the WHOLE journal, on every backend, on every page (a bad row on another page, or one over 64 KiB, answers the same); the body carries `ordinal` (the first bad row, ascending; `-1` = the refusal names no entry). The run's resume is refused by the engine
+            with the same code. Repair that row from the retained copy — NEVER by deleting it (a missing entry re-runs that step live). A retry changes nothing (the SDK's retry arm exempts the code). <= 7.134.x read such rows back as `200`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
   /v1/workflows/{workflowRunId}/agents/{label}/steer:
@@ -7006,8 +7094,32 @@ components:
         enabled: { type: boolean }
         available: { type: boolean, description: 'whether this deployment can actually RUN the scenario right now — same predicate as the 501 rejection arm on submit; false ⟺ submitting is guaranteed to 501. Independent axis from `enabled` (declared vs runnable).' }
         attachmentSupplies: { type: array, items: { type: string, enum: [path, content_text, content_image] }, description: 'server >= 7.133.0, always present there: the attachment SUPPLY words this scenario actually carries — a subset of `capabilities.userAttachments.supplies` (`path` only on hands scenarios, where a workspace lives somewhere; a no-hands scenario drops `path`, and a `path` entry is refused by the engine with `config.user_attachment_invalid`). ABSENT = server <= 7.132.x: fall back to `userAttachments.supplies` plus the existing 400 handling.' }
+        skills:
+          type: array
+          items: { $ref: '#/components/schemas/ScenarioSkill' }
+          description: >-
+            server >= 7.135.0, always present there (`[]` when none): the deployment SKILLS this scenario's run mounts (the deployment skills directory UNION what the config source hands over, filtered by scenario; a request's own `skills` are not
+            included) — the same single filter that feeds `TaskSpec`, same group, same order. A client's `/skill-name` completion reads it; naming one goes through `userInvokedSkills`. Entries carry no body and none of a skill's tool lists. On the card
+            but not in the run: `disableSkills: true` (nothing mounted) and a skill whose body exceeds the engine's load cap (naming it answers `config.user_invoked_skill_unknown`). ABSENT = an older server: the list cannot be read —
+            NOT "no skills" (that is `[]`). Bit: `capabilities.scenarioSkills`.
         unavailableReason: { type: string, description: 'machine-readable reason, present ONLY when available:false (absent = no reason). Closed set, currently the single member `git_client_unconfigured`; branch on the key, never match the English prose. Additive-open: treat an unknown word as "unavailable, reason unknown".' }
 
+    ScenarioSkill:
+      type: object
+      description: One row of `ScenarioDetail.skills` (server >= 7.135.0). No body, no tool lists.
+      additionalProperties: false
+      required: [name, description, source]
+      properties:
+        name: { type: string }
+        description: { type: string }
+        source: { $ref: '#/components/schemas/ScenarioSkillSource' }
+    ScenarioSkillSource:
+      type: string
+      description: >
+        Where a scenario skill came from (server >= 7.135.0; the server's self-minted word table `scenarioSkillSource`, closed two words): `factory` = the deployment's skills directory (`SKILLS_DIR`);
+        `center` = the config source (the center / the local `config.d` skills list, or a config-declared plugin) — a skill that overrides a same-named factory one by name is also `center`.
+      enum: [factory, center]
+
     RunStatus:
       type: string
       enum: [running, completed, failed, suspended, needs_review, blocked]
@@ -7279,10 +7391,16 @@ components:
             `egress:true` + `effect:"write"` (core's ruling); `toolAxes` is the caller's explicit override face.
             🔴 A malformed entry drops the WHOLE peer (named in a warn), never "drop the bad key and keep the
             peer": `allowSkills` is a NARROWING field whose absence means "no restriction", so a half-applied
-            entry would turn a narrowing intent into a widening. The request itself is not rejected.
-            The center/config baseline wins on a name clash (the peer name IS the tool namespace segment). Over
-            the 32-entry cap the surplus entries are DROPPED and named too — same disposition as a malformed
-            entry, not a 400.
+            entry would turn a narrowing intent into a widening.
+            🔴 server >= 7.136.0 — on a FRESH submit (the three submit doors) a badly written declaration is REFUSED, not dropped, and no longer answers a 200
+            that reads as "in effect": a list that is not an array / an entry that is not an object / a key value the judge cannot read as usable
+            (`url` not an http(s) string, `headers` values that are not strings, `allowSkills` not a string array …) ⇒ `400 request.field_invalid` with the sentence only
+            (no `field` / `reason`); a key outside the peer vocabulary (a mis-spelled `allowSkill` …) ⇒ `400 request.body_shape` + `unknownKeys` (full coordinates, e.g.
+            `a2aPeers[0].allowSkill`); a `url` / `cardUrl` that carries a credential ⇒ `400 request.field_invalid` WITH `field` / `reason` (`url_userinfo` / `url_credential_param`);
+            more than 32 entries ⇒ `400 request.field_invalid` WITH `field: "a2aPeers"` / `reason: "over_cap"` / `count` / `cap`. Branch on `errorCode` / `unknownKeys` / `field`, never on the sentence.
+            The durable-resume REPLAY leg (a stored body re-read on resume) does NOT refuse: it keeps the reader's degradation — a bad entry is not mounted and is named in an operator warn, the request is not 400.
+            Servers <= 7.135.x: a malformed entry drops the whole peer (warn), the request is not rejected, and over the cap the surplus is dropped (7.135.0 already answers 400 `over_cap`).
+            The center/config baseline wins on a name clash (the peer name IS the tool namespace segment).
           items: { $ref: '#/components/schemas/A2aServerSpec' }
         resumeAt:
           type: string
@@ -7290,7 +7408,7 @@ components:
             CC Rewind parity (E18). Fork the conversation FROM this user-message SessionTreeEntry.id (non-destructive
             branch via setLeafId). With `restoreFiles: true` ⇒ "both" (also restore the working tree — the retired spelling
             `rewindFiles` still rides the wire but its restore sense is core's typed migration rejection naming `restoreFiles`). Alone ⇒
-            "conversation". HONORED only where the deployment wired a resume-anchor store + getLeafId (capabilities.resumeAt);
+            "conversation". HONORED only where the deployment wired a resume-anchor store + the session head read `headOf` (<= 7.134.x: `getLeafId`) (capabilities.resumeAt);
             unknown anchor ⇒ 4xx, capability-off ⇒ 501. Cannot combine with a durable resume.
         resumeAtMode:
           type: string
@@ -7324,7 +7442,7 @@ components:
             kind of handle as `resumeAt`, resolved through the SAME anchor store — typically the `taskId` from that turn's
             202 receipt (the server keys the user-message anchor by the run's taskId). Server `src/boot/resolve-spec.ts:686-697`:
             `resumeAnchorStore.resolve(sessionId, handle, principal)` → entry id; unknown handle ⇒ 404
-            `rewind_files_to.unknown_event`; no session ⇒ 422 `rewind_files_to.no_session`; no anchor store / no getLeafId ⇒
+            `rewind_files_to.unknown_event`; no session ⇒ 422 `rewind_files_to.no_session`; no anchor store / no session head read (`headOf`; <= 7.134.x: `getLeafId`) ⇒
             501. ⚠️ The 501 is NOT the capability's whole predicate: `capabilities.rewindFilesTo` also requires the
             file-history store; without it the server does not 501 — core refuses at prepare with
             `rewind.store_unconfigured` (server >= 7.104.0 / S-724: a 409 error body on the synchronous `POST /v1/tasks` when
@@ -7501,7 +7619,7 @@ components:
             not exceed 5 MiB — otherwise the engine refuses BEFORE the first model call (after the UserPromptSubmit hook; not one model token spent) with 400 `config.image_invalid`, whose
             `error` starts with `TaskSpec.images: `. Before 7.117.0 such an image was sent as-is to the model provider and the whole first request failed there (no code to branch on).
             A base64 string longer than 5 242 880 characters (the model API's 5 MB image cap; the server reads the engine's exported constant) is NOT this code: the submit gate refuses it first
-            with 413 `request.payload_too_large` (zero model calls, no submit hook, no run row). The `{ url }` arm is unchanged. The model must accept image input (`ModelInfo.vision`; absent = unknown, send anyway).
+            with 413 `request.payload_too_large` (zero model calls, no submit hook, no run row). The `{ url }` arm: from server >= 7.136.0 a URL that carries a credential (`user:pass@host`, or a credential-named query / fragment parameter) is refused on a FRESH submit with 400 `request.field_invalid` + `field: "images[i].url"` + `reason` `url_userinfo` / `url_credential_param` (the sixth seat of the URL-credential judge; send the bytes inline as `{ data, mimeType }` instead — an inline image never lands in a URL); the durable-resume replay of a stored body is not judged. Otherwise unchanged (the server has long recognised the type by signature). The model must accept image input (`ModelInfo.vision`; absent = unknown, send anyway).
           items:
             oneOf:
               - type: object
@@ -7920,6 +8038,15 @@ components:
             combination); `taskWriteFaceOpen` is NOT its reading. Residual (server S-908): the binding is keyed by SESSION and written
             after the run is claimed (a refused request writes nothing); on deployments without a run store two concurrently accepted
             runs on one session are last-writer-wins. Delegated children's shells keep the default scrub.
+        projectMemory:
+          type: string
+          enum: [disabled]
+          description: >
+            server >= 7.135.0 (engine 7.55.0 `TaskSpec.projectMemory`, passed through verbatim): this ONE run does not read the deployment's project context — the engine does not call the deployment's project-context seat, so the project layer,
+            the declared instruction files and the few things they feed are all absent (the engine's own git-status lane, the memory engine, skills / hooks / MCP are unaffected; delegated / background / fork / workflow children inherit it from
+            the parent). The only word is `disabled`; the key ABSENT = call the seat. The leg's `wiring_manifest.projectMemory` reads `disabled` and the server-minted `instructions` section is absent. A deployment without the seat still accepts it
+            (the manifest answers `absent`). Anything else (`off`, a boolean, `null`) ⇒ a fresh submit answers 400 `request.field_invalid`; a resume replay judges the same and folds into 409 `resume_blocked_by_policy`
+            (`blockedBy: request.field_invalid`). Read `capabilities.projectMemory` beforehand: older servers answer 400 `request.body_shape` (`unknownKeys: ["projectMemory"]`).
         attachments:
           type: object
           description: >
@@ -9596,8 +9723,8 @@ components:
             (`decision: "approve"`, `decidedBy` absent or `person`): on a deny or a `decidedBy: "policy"` decision ⇒ 400 `request.field_conflict` with
             `detail.kind: "approval_feedback"` and `detail.fields` `["feedback", "decision"]` / `["feedback", "decidedBy"]` (a denial's words go in `reason`);
             a non-string ⇒ 400 `request.field_invalid`; any value on a direct-door worker ⇒ 400 `feedback_not_in_proof` (not inside the signed proof); words
-            carrying `<system-reminder>` ⇒ 409 `approval_binding_mismatch` (the engine's sentence; the card stays pending — ask the person to change the words,
-            do not auto-refetch and re-decide on the code). The same door serves parked background-agent cards and workflow child cards; the live
+            carrying `<system-reminder>` ⇒ server >= 7.135.0 (engine 7.55.0): 409 `resume_outcome_invalid` + `field: "feedback"` + `retriable: true` (the engine's sentence naming `feedback`; refused before the CAS, the card stays pending — ask the person to change
+            or drop the words, do not auto-refetch and re-decide on the code); server 7.134.x: 409 `approval_binding_mismatch` (no `field`). The same door serves parked background-agent cards and workflow child cards; the live
             `POST /v1/tool-approvals/{id}/respond` does NOT take it. Servers <= 7.133.x refuse the key (400 `request.body_shape`, `unknownKeys: ["feedback"]`).
 
     Capabilities:
@@ -9807,7 +9934,7 @@ components:
           type: boolean
           description: >-
             Code-only rewind (`TaskRequest.rewindFilesTo`) is wired — mint `routes/capabilities.ts:839` =
-            `Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && deps.sessionStorage?.getLeafId)`: it needs the
+            `Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && headReadOf(deps.sessionStorage))` (<= 7.134.x last conjunct: `deps.sessionStorage?.getLeafId`): it needs the
             file-history store (to restore) AND the anchor map (to resolve the target HANDLE). Corrected in sdk 11.4.0
             (board [8437] U3): the store is the FILE-HISTORY store (not the pre-S-15 whole-tree snapshot store).
             🔴 K-24: on server 7.97.0–7.103.x that seat was the CAPTURE face (backend AND the `FILE_HISTORY_CAPTURE` knob), so a
@@ -9889,8 +10016,9 @@ components:
           description: >
             🔴 契约调和车1 H② (2026-08-02): server HAS been emitting this key (the `sessionEvents` bit in `src/http/routes/capabilities.ts`)
             while both this spec and the SDK type were missing it. Gates `GET /v1/sessions/{sessionId}/events`
-            (the session-level SSE head subscription). Predicate is a THREE-way AND: a durable session-watch seam
-            plus a session store exposing BOTH `getLeafId` and `ownerOf` — the route's 501 uses the same
+            (the session-level SSE head subscription). Predicate (server >= 7.135.0) is a TWO-way AND: a durable session-watch seam
+            plus a session store exposing the session head read `headOf` (<= 7.134.x it was a THREE-way AND with BOTH `getLeafId` and `ownerOf`; those two
+            methods left the store contract in 7.135.0, so `DB_BACKEND=memory` now answers `true`, was `false`) — the route's 501 uses the same
             predicate, so "says yes <=> route works" holds here. False/absent => fall back to polling
             `GET /v1/sessions/{sessionId}/head`. NOTE (server [2373]A-5): no consumer is wired to it yet — it is
             a prepared slot, correct to gate on, wrong to read as "widely consumed".
@@ -10222,11 +10350,29 @@ components:
             — SQL backends only; `DB_BACKEND=local` is always false). Advertises exactly the two file-history blob faces
             `PUT /v1/sessions/{sessionId}/sync/blobs/{hash}` and `GET /v1/sessions/{sessionId}/sync/history/blobs/{hash}`.
             READ IT ON BOTH ENDS of a sync: if either is false, sync the conversation only — do not push `fileHistory`, do
-            not PUT blobs (a `fileHistory` pushed to a peer without the blob faces 422s `missing_blob` after commit). When
+            not PUT blobs (a `fileHistory` pushed to a peer without the blob faces 422s `missing_blob` in the FIRST phase — zero staging, zero commit, the conversation does not land either — from server >= 7.135.0; <= 7.134.x answered it in the second phase, after the conversation committed). When
             false the two routes answer 501 `capability.snapshot_store_required` (any session id, ahead of the owner check).
             A blob that the session history graph does not reference / whose bytes are gone stays a 404 `not_found.blob`.
             ABSENT = an older server (<= 7.115.x): the bit cannot be read there (a `DB_BACKEND=local` deployment with
             `sessionSync: true` answered PUT blob 501 on every call), so try as before.
+        sessionRulesNamespaceForms:
+          type: boolean
+          description: >
+            server >= 7.135.0 (predicate class "always true", read per request from the engine's protocol table): the session-rule write faces (`PUT /v1/sessions/{id}/policy`, the `policy` face of `POST /v1/sessions/{id}/sync/import`)
+            accept — in `toolAllow` / `toolDeny` — the three COVERING FORMS of every protocol namespace the engine knows (today `mcp__` and `a2a__`): the whole peer (`mcp__srv`), a tool-segment wildcard (`mcp__srv__*`)
+            and a tool-segment glob (`mcp__srv__get_*`); the engine's matcher reads each as ONE GROUP of tools. A client may stop refusing those three forms losslessly on this bit alone (never on a version guess).
+            The bit says NOTHING about other wildcards: `*`, partial peer-segment wildcards (`mcp__git*`) and a trailing-separator `mcp__srv__` are still refused by the write face (`400 rules.inert_entry`); the whole-protocol
+            name `mcp__*` is accepted only in `toolDeny`. Orthogonal to `sessionPolicy` (does the deployment have a session-rules write face at all): read `sessionPolicy` AND this bit. ABSENT (older server) and `false` ⇒ read as "do not widen".
+        projectMemory:
+          type: boolean
+          description: >
+            server >= 7.135.0 (always true): the top-level request key `projectMemory: "disabled"` is accepted. The read face hangs on no facility — a deployment without a project-context seat still accepts it
+            (the manifest answers `"absent"`). ABSENT = an older server, whose key-closure gate answers `400 request.body_shape` (`unknownKeys` names it): send the key on sight of the bit only.
+        scenarioSkills:
+          type: boolean
+          description: >
+            server >= 7.135.0 (always true): `GET /v1/capabilities/scenarios/{name}` carries `skills[]` (`ScenarioDetail.skills`). ABSENT = an older server: the card has no list — do NOT read that as "this scenario has no skills"
+            (that is `skills: []`).
 
         # ─── S-139(sdk 8.3.0):对 server 7.60.0 的整体重对账补齐的 19 位 ───────────────────────
         # 行号 = server 7.60.0 树的 `src/http/routes/capabilities.ts`。语义与谓词的全文在
@@ -10513,7 +10659,7 @@ components:
           type: boolean
           description: >
             server >= 7.85.0 (S-381 / core 7.22.0 #857; mint `routes/capabilities.ts:264` =
-            `Boolean(deps.runStore) && Boolean(deps.sessionStorage?.ownerOf)`) — presence of
+            `Boolean(deps.runStore) && Boolean(deps.sessionStorage?.ownerOf)`; server >= 7.135.0 the last conjunct is `headReadOf(deps.sessionStorage) !== undefined`) — presence of
             `POST /v1/sessions/{sessionId}/mcp/reconnect`. FACILITY DEPENDENCY, two conjuncts: a durable run
             ledger (the verb reaches the live stream through the run row) AND the session-ownership face (the
             inbound owner gate is fail-closed; without it the whole door is 501). Both 501s derive from the SAME
@@ -10634,7 +10780,7 @@ components:
             sessionBackgroundFacesAvailable(deps), exitFaces: sessionBackgroundFacesAvailable(deps) }`) — presence of the
             session background-task doors: `listFace` = `GET /v1/sessions/{sessionId}/background`, `exitFaces` =
             `POST /v1/sessions/{sessionId}/background/stop` (contract §16). Both bits use the SAME predicate as the two
-            doors' 501 (the session-ownership face `sessionStorage.ownerOf`), so "says yes but 501s" is structurally
+            doors' 501 (the session-ownership face: `sessionStorage.headOf` on server >= 7.135.0, `ownerOf` on <= 7.134.x), so "says yes but 501s" is structurally
             impossible; without it both bits are explicitly `false` and both doors answer 501
             `capability.session_ownership_required`. ENDPOINT-GATE FORM: `false` ⇒ do not call. True only promises the
             endpoint — not that this replica holds any background row of that session (the registry is in-process).
@@ -11685,7 +11831,7 @@ components:
         modelPlane:
           allOf: [{ $ref: '#/components/schemas/ModelPlane' }]
           description: >-
-            server >= 7.133.0, ALWAYS present there (appended last): which model table this engine SERVES, whether the catalog was adopted, and what the start-up route judge says — read this instead of predicting
+            server >= 7.133.0, ALWAYS present there (appended last on 7.133.0–7.134.x; from server >= 7.135.0 the last key is `aliases` and this one precedes it — key order is not a contract, read by name): which model table this engine SERVES, whether the catalog was adopted, and what the start-up route judge says — read this instead of predicting
             (the judge's inputs are the serving process's facts; mirroring two of its judgements drifts). ABSENT = an earlier server (<= 7.132.x). Field reading: ModelPlane.
         candidateRejected:
           allOf: [{ $ref: '#/components/schemas/CandidateRejected' }]
@@ -11697,6 +11843,25 @@ components:
             configuration is clean" (it is also an earlier server): render the real cause only when the key is present; keep the old behaviour when absent.
             Same read as `models`: key present => this `models` is the fallback generation (none of the candidate's models are in it). No capability bit
             (the endpoint is always there; the presence of the key is the presence rule).
+        aliases:
+          type: array
+          items: { $ref: '#/components/schemas/ModelAlias' }
+          description: >
+            server >= 7.135.0, ALWAYS present there (appended LAST; `[]` when none): the model WORDS besides `models[].name` that the server's acceptance gate takes (tier words / `default` / a catalog entry's id spelling, ...).
+            ACCEPTANCE RULE (one rule; a model-word judge reads this key, never infers from a row's id): a model word is submittable IFF its name is in `models[].name` UNION `aliases[].name` AND its row's `atMentionable !== false`
+            (`atMentionable` absent = no allowlist verdict, not "not mentionable"). `aliases` deliberately does not say which row a word lands on. ABSENT = an earlier server (<= 7.134.x): tier words / `default` stay "cannot tell" —
+            do not read the absence as "no aliases". Known boundary (not introduced by this version): a catalog entry literally named `default` does not appear in `models[]`.
+
+    ModelAlias:
+      type: object
+      additionalProperties: false
+      required: [name]
+      description: >
+        One row of `ModelsResponse.aliases` (server >= 7.135.0): a submittable model word that is not a `models[]` row. `name` = the word (never equal to a `models[].name`); `atMentionable` = the SAME projection as on a `models[]`
+        row, present ONLY when the deployment configured an at-mention allowlist (the allowlist verdict for the catalog entry the word resolves to); absent = no allowlist verdict, NOT "not mentionable".
+      properties:
+        name: { type: string }
+        atMentionable: { type: boolean }
 
     CandidateRejected:
       type: object
@@ -12077,6 +12242,8 @@ components:
         name: { type: string, description: "The workflow script's declared `meta.name`." }
         description: { type: string, description: "The workflow script's declared `meta.description` (one-liner)." }
         agentFailures: { type: integer, description: 'Count of agent-runs that ended failed — present only when > 0 (a "completed, with failures" flag without an N+1 get).' }
+        parked: { type: boolean, enum: [true], description: 'server >= 7.135.0 (core 7.55.0 `runParkedOf`) — present, always the literal `true`, ONLY while the run is `running` AND at least one of its agents is parked at an approval gate; otherwise the key is ABSENT (never `false`). Read it as "the run is waiting on a person", not "failed". Older servers never send it.' }
+        errorCode: { type: string, description: 'The run row''s machine code (open set; e.g. `workflow.agent_parked` for a drained parked terminal) — present only when the row has one. (Declared here in 26.1.0: the engine summary has emitted it since before 7.134.0.)' }
         currentPhase: { type: string, description: 'Title of the phase currently executing (absent once terminal).' }
         status: { $ref: '#/components/schemas/WorkflowRunStatus' }
         phaseCount: { type: integer, description: 'Phases recorded.' }
@@ -12255,6 +12422,8 @@ components:
         description: { type: string, description: "The workflow script's declared `meta.description` (redacted, one-liner)." }
         status: { $ref: '#/components/schemas/WorkflowRunStatus' }
         agentFailures: { type: integer, description: 'run-level count of agents whose status ended failed — stamped at run end, only when > 0.' }
+        parked: { type: boolean, enum: [true], description: 'server >= 7.135.0 (core 7.55.0 `runParkedOf`) — present, always the literal `true`, ONLY while the run is `running` AND at least one of its agents is parked at an approval gate; otherwise the key is ABSENT (never `false`). Read it as "the run is waiting on a person", not "failed". Older servers never send it.' }
+        errorCode: { type: string, description: 'The run row''s machine code (open set; the same words as the same-named slot on the fleet row, e.g. `workflow.agent_parked` for a drained parked terminal) — present only when the row has one. (Declared here in 26.1.0: the detail projection has forwarded it since before 7.134.0.)' }
         stats: { $ref: '#/components/schemas/WorkflowRunStats' }
         startedAt: { type: integer }
         endedAt: { type: integer }
@@ -12727,6 +12896,11 @@ components:
             run row has one, the key ABSENT otherwise (never an empty string). A parked workflow run reads `status: "failed"` + `errorCode: "workflow.agent_parked"`
             (parked, not failed; the `status` vocabulary gains no word). Snapshot rows, `workflow` upsert frames and rows merged from the terminal window share one mint
             point; a `?session=` subscriber's demoted rows carry it too. ABSENT = an older server, or no code on this row — fall back to `status`.
+        parked:
+          type: boolean
+          enum: [true]
+          description: >-
+            server >= 7.135.0 (core 7.55.0 `runParkedOf`) — present, always the literal `true`, ONLY while the run is `running` AND at least one of its agents is parked at an approval gate; otherwise the key is ABSENT (never `false`). Read it as "the run is waiting on a person", not "failed". Older servers never send it. On a fleet row the workflow-bus row is now replaced WHOLE on every `workflow` upsert (server >= 7.135.0; no longer merged by `id` into the old row), so a key that left is gone from the row.
     FleetFrame:
       description: >
         One decoded frame off GET /v1/fleet/stream (service streamFleet emit set, src/http/routes/fleet.ts). On the
@@ -13147,7 +13321,9 @@ components:
            errorCode?, errorMessage?, retriable?}`, plus `rememberApplied` when the request carried
            `remember:"session"` AND the worker has an exemption store;
          · the PARKED-BACKGROUND-AGENT shape (`parked-decide.ts`, server >=1.267) — `{taskId, status:"resuming",
-           decision}`, an ACCEPTED (not completed) receipt; the revive drives asynchronously.
+           decision}`, an ACCEPTED (not completed) receipt; the revive drives asynchronously. Since server >= 7.136.0 this
+           shape has a SECOND ARM, the VOIDED receipt `{taskId, status:"failed", decision:"deny"}` — a DENY on a parked row that can
+           never revive (no agent name / no root-session anchor) voids the card; nothing resumes (see `ParkedDecideAccepted`).
         A FOURTH shape, the #368 IDEMPOTENT REPLAY (server >= 7.4x; declared 2026-09-08 — it shipped without
         ever reaching this schema): `{sessionId, idempotent:true, decision, bindingEnforced:true,
         executionOutcome?}` — it carries NO `status` and NO `taskId` (nothing was accepted this time). So no key
@@ -13208,7 +13384,7 @@ components:
           description: >
             OPEN string — do NOT narrow. Task-level acceptance (server >= 7.37): the literal `resuming` (= accepted,
             resume in flight — follow the run stream). Terminal leg: the run's resulting status (`completed`/`failed`/
-            `suspended`/`needs_review`). Parked leg: the literal `resuming` (= accepted, revive in flight).
+            `suspended`/`needs_review`). Parked leg: the literal `resuming` (= accepted, revive in flight) — or, server >= 7.136.0, the literal `failed` on the VOIDED receipt (a deny that closed a card which could never revive; nothing resumes).
         decision:
           type: string
           enum: [approve, deny]
@@ -13429,7 +13605,14 @@ components:
           description: 'server >= 7.100.0 (S-700): WHY the park row offers no rule — the same narrow read and closed set (four words from server >= 7.129.0) as the live card frame and `card_json`.'
         boundGrantAbsence:
           allOf: [{ $ref: '#/components/schemas/BoundGrantAbsence' }]
-          description: 'server >= 7.129.0 (core 7.51.0 #1688; park-row fact eight): why this parked card has no grant-binding digest — the park-row twin seat `PendingAction.tool_approval.boundGrantAbsence`, the same narrow read and the same name / value as the live frame and the inbox row. ABSENT on this face = a skill card (it carries the digest; the digest itself is not on this face) / a row parked before engine 7.51.0 (says neither — the inbox face projects `unreadable` for the same row) / a word outside the set / an old server — NOT `not_bindable`.'
+          description: 'server >= 7.129.0 (core 7.51.0 #1688; park-row fact eight): why this parked card has no grant-binding digest — the park-row twin seat `PendingAction.tool_approval.boundGrantAbsence`, the same narrow read and the same name / value as the live frame and the inbox row. ABSENT on this face = a skill card (it carries the digest) / a row parked before engine 7.51.0 (says neither — the inbox face projects `unreadable` for the same row) / a word outside the set / an old server — NOT `not_bindable`.'
+        boundGrantDigest: { type: string, description: 'server >= 7.136.0 — a parked `Skill` card''s grant-binding digest; the same value as the inbox row''s and the live frame''s `boundGrantDigest` (one projection feeds this operator queue row, the `/v1/approvals/stream` `pending` frame and the inbox row — byte-equal for the same parked row). Present only on a skill card; absent on an ordinary card. `card_json` does not carry it. Server <= 7.135.x: not on this face.' }
+        boundGrants:
+          allOf: [{ $ref: '#/components/schemas/BoundSkillGrants' }]
+          description: 'server >= 7.136.0 — the value `boundGrantDigest` hashes, published ONLY when it hashes to it (digest only when they disagree; no digest, no list). DEPLOYMENT TEXT (skill names and list entries are written by the deployer; the server neither redacts nor escapes them): render with contextual escaping.'
+        classifierNoRuling:
+          allOf: [{ $ref: '#/components/schemas/AutoModeFallbackCause' }]
+          description: 'server >= 7.136.0 — only on a parked `classifier_no_ruling` card: why the auto-mode classifier did not rule (closed set, echoed only when a member). Same value as the inbox row''s and the live frame''s.'
         askClass:
           allOf: [{ $ref: '#/components/schemas/AskClass' }]
           description: 'server >= 7.109.0 (S-934 ② / core 7.37.0 #1214): the park-row twin seat `PendingAction.tool_approval.askClass`, read through `readAskClassPair` — the SAME narrow read as the live frame and the card. Present together with `classes` (`classes[0] === askClass`); the basis a durable approver answers by. Absent = an old row (parked before core 7.37.0; resume does not backfill) or an unreadable pair — NOT "no class". The inbox row (InboxRow) does not carry it.'
@@ -13583,7 +13766,7 @@ components:
         classifierNoRuling:
           allOf: [{ $ref: '#/components/schemas/AutoModeFallbackCause' }]
           description: 'server >= 7.118.0 — only on a parked `classifier_no_ruling` card: why the auto-mode classifier did not rule.'
-        objective: { type: ['string', 'null'], description: 'task objective, null if unavailable.' }
+        objective: { type: ['string', 'null'], description: 'task objective, null if unavailable. server >= 7.136.0: the run row''s `objectivePreview` (redacted when written, about 120 characters — the same column as `GET /v1/assistant/tasks`; looked up through the gate''s session: its active run, else its latest run; a delegated child''s gate — whose session has no run of its own — falls back to the run that spawned it, via the parked agent row''s `parentTaskId`, hop by hop, at most 8 hops) — null when no preview could be read (a deployment without a run ledger is one cause; a failed read of the row, a delegation chain that breaks or exceeds 8 hops, or a run row without a preview also answer null — the key does not say which). Before 7.136.0 this was the objective ORIGINAL stored in the parked context (not truncated, not redacted); a consumer that used it as the full objective should know that server 7.136.0 has no full-objective read face (`GET /v1/runs/:id` carries neither `objective` nor `objectivePreview`) — this key IS the preview; a full read face comes with a later server version and this package locksteps then (no substitute path is declared here).' }
         input:
           description: >
             REDACTED tool-args preview for display (null on gates without one, e.g. plan_review). Untyped by
@@ -14001,7 +14184,9 @@ components:
         non-object is `400 request.body_shape`. `title`: a string renames (1..120 CHARACTERS counted as Unicode characters = the storage column width, no leading /
         trailing whitespace, stored verbatim — not rewritten, not redacted); `null` CLEARS it back to the automatic title (the next submit lets the auto-titler fill
         it again). `""` is NOT a clear — it is `400 request.body_shape`. A string of the wrong form / a non-string-non-null `title` / a non-boolean `pinned` is
-        `400 request.field_invalid`.
+        `400 request.field_invalid`; from server >= 7.136.0 a title made only of invisible characters (zero-width, bidi controls, soft hyphen, C1 controls — empty after the cross-session peer directory's own
+        usable-name normalization) is `400 request.field_invalid` too (`title must contain at least one visible character`; the session-sync 2c import's `title` reads the same rule). Such titles written before
+        7.136.0 are not migrated.
       additionalProperties: false
       minProperties: 1
       properties:
@@ -14148,12 +14333,20 @@ components:
                 server >= 7.92.0 (engine 7.25.0): the session's rule LINEAGE generation. An erase
                 (`deleteBySession`) ends the lineage — the next write carries gen+1 — so a reader treats a
                 different gen as a new lineage, never a continuation, regardless of rev. Absent on older servers.
+            operatorRules:
+              allOf: [{ $ref: '#/components/schemas/SessionRulesOperatorPart' }]
+              description: >
+                server >= 7.135.0 (engine 7.55.0): the row's OPERATOR PART — the buckets (and their own `grammar` stamp) the last OPERATOR write set; the line a non-operator write may not loosen (`403 loosen_forbidden` on a move inside it).
+                ABSENT = the whole row is the operator's (an operator write; every row stored before 7.135.0, read as before the upgrade: the owner can take nothing back). Minted by the engine's write judge alone, stored whole and read back verbatim; also on the 2c export `policy[].rules`.
+                A non-operator write over an EMPTY row stamps an empty part (stamp only) — the owner can then take back what the owner added. A part ECHOED back is read per door: on `PUT /v1/sessions/{sessionId}/policy` it is ALWAYS ignored (the stored row's part is kept over an existing row; an empty stamped part is minted over none).
+                On the sync-import replay (`POST …/sync/import`, `policy[]` records, which carry `rev`): over an existing row the judge keeps the STORED row's part and ignores the echo; over NO row, a non-operator record that looks like a stored row (carries `rev` >= 1)
+                has its own part adopted (from then on that part IS the row's operator line: taking it back answers 403 `loosen_forbidden`), otherwise an empty stamped part is minted; an operator write never carries a part.
             grammar:
               type: integer
               minimum: 0
               description: >
                 server >= 7.129.0 (engine 7.51.2): the rule GRAMMAR the row's entries are read in, stamped by the
-                engine's write judge on every row written through it (every row this server writes carries `1`).
+                engine's write judge on every row written through it (server >= 7.135.0 writes `4` — the engine's `SESSION_RULES_GRAMMAR`; 7.129.0 wrote `1`).
                 Absent = a row stored before the stamp (grammar 0: an allow entry spelled as a rule, `Bash(rm:*)`,
                 named no tool and admitted nothing — the engine keeps reading such a row that way and announces it
                 once; the one-time migration rewrites stored rows and stamps them). Echoing a stored body back into
@@ -14174,6 +14367,18 @@ components:
         rev: { type: integer }
         gen: { type: integer }
         grammar: { type: integer }
+        operatorRules: { $ref: '#/components/schemas/SessionRulesOperatorPart' }
+
+    SessionRulesOperatorPart:
+      type: object
+      description: '`StoredSessionRules.operatorRules` (server >= 7.135.0): the three buckets plus their own grammar stamp. The `grammar` is always present (the write judge stamps it).'
+      additionalProperties: false
+      required: [grammar]
+      properties:
+        toolAllow: { type: array, items: { type: string } }
+        toolDeny: { type: array, items: { type: string } }
+        allowDirs: { type: array, items: { type: string } }
+        grammar: { type: integer, minimum: 0 }
 
     McpServerStatus:
       type: object
@@ -14816,7 +15021,18 @@ components:
             fail-closed) and `state.scenario_assignment_unknown` (503, server >= 7.119.0 — the center's scenario assignment for the
             principal is dangling; only re-pointing the assignment, or adding the scenario back to the deployment, helps) and
             `approvals.read_corrupt` (500, server >= 7.134.0 on `GET /v1/approvals` — a queue row's stored body cannot be read; an operator has to repair or
-            delete the row). Every other 5xx code keeps the status-based retry.
+            delete the row; server >= 7.135.0 the same judge answers `GET /v1/assistant/inbox` and `GET /v1/assistant/tasks` too) and `workflow.journal_incompatible`
+            (500, server >= 7.135.0 on `GET /v1/workflows/{id}/journal` — a journal row the engine's judge rejects; the body carries `ordinal`; repair the row from the retained copy, never by deleting it).
+            Every other 5xx code keeps the status-based retry.
+            🔴 server >= 7.135.0 read-failure and store-fault codes (all additive; branch on the code, never the sentence): `503 approvals.read_unavailable` on `GET /v1/approvals`, `/v1/assistant/inbox` and
+            `/v1/assistant/tasks` (the queue cannot be read RIGHT NOW — transient, retried by status; until a read succeeds an answer does NOT mean nothing is pending; it moved from the SSE-only table into the status-bearing catalog, status `-` → 503) and, on
+            the same three faces, `500 approvals.read_corrupt` (above); `503 state.file_history_unreadable` on the session-sync pull faces (`GET /v1/sessions/{id}/sync/manifest`, `GET /v1/sessions/{id}/sync/history/blobs/{hash}` — the file history
+            cannot be read WHOLE; it is NOT "no history", which stays `200` with `fileHistory: null`); `422 adopt_failed` on `POST /v1/sessions/{id}/sync/import` (the file-history replay hit a store fault; 7.134.x answered `unsupported_format`;
+            NOT a missing blob — that is `422 missing_blob`, now answered in the FIRST phase). The two store-fault codes may carry `permanence` (`transient` = nothing changed, retry the same shape later / `terminal` = repair the store first; absent = the store did not judge).
+            `422 request.unprocessable` now also answers a deny / ask rule whose PARAMETER does not belong to the tool (the sentence carries the engine code `unsupported.param_unknown`, the same word in `detail.problems[].reason`; a stored body that
+            resumes ⇒ `409 resume_blocked_by_policy` with `blockedBy: request.unprocessable`; 7.134.x accepted such a rule, and it never matched). `400 request.body_shape` also names an unread key inside a `settings.hooks` group / entry in
+            `unknownKeys` as a FULL coordinate (`settings.hooks.PreToolUse.0.hooks.0.onFailure`) on a fresh submit.
+            `409 resume_outcome_invalid` + `field: "feedback"` (`retriable: true`) now answers a release `feedback` that carries an engine `<system-reminder>` tag (refused before the CAS, the card stays pending; fix or drop the words and decide again — it was `409 approval_binding_mismatch` without `field` on 7.134.x). A `feedback` on a deny / policy decision stays `400 request.field_conflict` (`detail.kind: approval_feedback`).
             🔴 `request.host_posture_refused` (422) has TWO triggers (same code, same status — "you wrote it right, this
             deployment will not grant that host posture"): (1) the write-containment face (`permissionMode: bypassPermissions` ⇒
             `writeFace: open`; read `capabilities.taskWriteFaceOpen` first); (2) server >= 7.106.0 / S-895: `inheritEnv: "all"` on a
@@ -14880,10 +15096,23 @@ components:
             the ids of the background children rooted at this session that are still alive (count = length) — the SAME
             strings as the `handle` on `GET /v1/agents/roster` rows. Nothing was deleted; wait for them to finish (or stop
             them where they run) and retry the delete verbatim. SDK: `err.extra.remaining` on the ConflictError.
+        permanence:
+          type: string
+          enum: [transient, terminal]
+          description: >-
+            server >= 7.135.0, on `503 state.file_history_unreadable` and the file-history store's fault answers (`422 adopt_failed`; server >= 7.136.0 also `restore_failed` and the like, and the session-sync pull legs' database-disconnect `503`, where `transient` is judged for connection-class faults): the file-history store's own judgment of the fault (the engine's `GovernanceRetryClass`) —
+            `transient` = nothing was changed, retrying the same shape later may succeed; `terminal` = repair the store first. ABSENT = the store did not judge; not terminal — retried by status like any retryable 5xx (the SDK does so automatically on the pull legs, up to `maxRetries`); still red ⇒ look at the store. SDK: `err.extra.permanence`.
+        ordinal:
+          type: integer
+          description: >-
+            server >= 7.135.0, on `500 workflow.journal_incompatible`: the journal ordinal of the FIRST bad row (ascending); `-1` = the refusal names no entry. SDK: `err.extra.ordinal`.
         reason:
           type: string
           description: >-
-            A per-code closed word — read it by `errorCode`, never across codes. On 503 `fleet.lease_unavailable` (server >=
+            A per-code closed word — read it by `errorCode`, never across codes. On 400 `request.field_invalid` for a URL that carries a credential (server >= 7.135.0): `url_userinfo` (`user:pass@host`) / `url_credential_param` (a credential-named
+            query / fragment parameter — the names the service's log redactor treats as credentials), beside `field` = the body coordinate (`mcpServers[i].transport.url`, `a2aPeers[i].url`, `a2aPeers[i].cardUrl`,
+            `settings.hooks.<event>[g].hooks[h].url` — the FULL coordinate, not `field: "settings.hooks"` + `detail` — and `settings.webSearch.endpoint`; a `settings.webSearch.endpoint` with userinfo keeps its sentence and gains `field` / `reason`);
+            `a2aPeers` over 32 entries answers `over_cap` + `count` + `cap` on `field: "a2aPeers"`. Server >= 7.136.0: the same URL-credential words on a SIXTH seat, `images[i].url` (`field` = `images[i].url`, an `images` `{ url }` arm — fresh submits only); `mcpServers` over 32 entries answers `over_cap` + `count` + `cap` on `field: "mcpServers"` (the same body as `a2aPeers`; the probe door `POST /v1/capabilities/mcp/probe` answers the same sentence and keys — before 7.136.0 a sentence without machine keys); a malformed `a2aPeers` list / entry / key value carries NO `reason` (sentence only), a key outside the peer vocabulary is `request.body_shape` + `unknownKeys`. On 503 `fleet.lease_unavailable` (server >=
             7.106.0 / S-866 ③): `auth-rejected` (the center refused this engine's credential, or the credential file is
             unreadable) / `unreachable` (unreachable / 5xx / timeout / bad body / any status other than 200 / 409 / 400 / 401 / 403 —
             center 404 / 429 / 3xx included). On 400 `request.field_invalid` for a `settings.permissions` bucket (server >= 7.106.0 /
@@ -14921,6 +15150,10 @@ components:
             `[i]`, record members `.key`: `mcpServers[0].transport.headers.Authorization`, `settings.hooks.PreToolUse[0].hooks[0].headers.Authorization`; the key
             name is not a secret, the value never enters the refusal); on 400 `request.field_invalid` for the request key `settings.approvalFrameFamilies` it is
             that literal (with `reason: "bad_entry"` and the bad `index`; no `index` for a non-array).
+            server >= 7.135.0: on 409 `conflict.checkpoint_ctx_unsealable` with `reason: "unrecognized_seal"` the arm of the stored credential-slot GENERATION newer than this server's (or not a positive integer) reads `field: "credentialSlotGeneration"` — not an in-body coordinate.
+            server >= 7.136.0: the credential-slot set gains four seats (generation 3) — `mcpServers[i].transport.command` / `mcpServers[i].transport.args` (stdio transport) and `settings.hooks.<event>[g].hooks[h].command` / `.args` (command hook); `args` is sealed as ONE value (the whole array); on 409 `conflict.checkpoint_ctx_unsealable` `field` names that coordinate (which doors can answer which `reason`, and how the refusal arrives, is written once — in the SDK documentation of `CHECKPOINT_CTX_UNSEALABLE_REASONS` — not repeated here).
+            server >= 7.136.0: on 400 `request.field_invalid` for a URL that carries a credential, `field` also names `images[i].url` (the sixth seat); on `mcpServers` over 32 entries `field` is `mcpServers` (beside `reason: "over_cap"` / `count` / `cap`); a key outside the `a2aPeers` entry vocabulary is `400 request.body_shape` whose `unknownKeys` carry the full coordinates (`a2aPeers[0].allowSkill`).
+            server >= 7.135.0: on `a2aPeers` over 32 entries `field` is `a2aPeers` (beside `reason: "over_cap"` / `count` / `cap`).
         detail:
           description: >
             🔴 SHAPES differ by code — branch on `field` (or the `errorCode`), never guess from the type of `detail`. On 503
@@ -15699,6 +15932,12 @@ components:
                 K-32 (server >= 7.106.0 / core 7.34.0 design/1111) — `bypassPermissions` RELEASED an ask nobody answered (see
                 `ModeRelease`). Absent = this allow was not a mode release (a plain allow / a person's yes / a rule), or an older
                 server (<= 7.105.0 stripped it).
+            clearedBy:
+              allOf: [{ $ref: '#/components/schemas/AllowRuleClearance' }]
+              description: >
+                server >= 7.135.0 (core 7.55.0) — the allow layer's account of a call it let run WITHOUT asking: which member's allow rule cleared a standing ask that nobody answered
+                (`AllowRuleClearance`). Present exactly when an allow member cleared the ask; absent on a call nothing asked about, a mode's release or acceptance, the read-only arm's,
+                the classifier's or the sandbox's allow, and a person's yes. Never present together with `released`. Older servers stripped it.
         - type: object
           additionalProperties: false
           required: [kind, deniedBy]
@@ -16156,6 +16395,10 @@ components:
             `MCP_FAILURE_CODES` spellings — including `network` and the `http_<status>` encoding — are gone,
             and an HTTP status now rides the structured `httpStatus` seat on `wiring_manifest.mcp[]` instead of
             being baked into the code. The set as a WHOLE stays open (a tool owns its own codes).
+            🔴 core 7.55.0 / server >= 7.135.0 — two MCP words minted BEFORE the call is sent (`delivered: "no"`; the server has no mint point, they pass through verbatim): after the engine redials a Streamable HTTP
+            server that LOST its session, `mcp.tool_declaration_changed` (the server now declares the tool differently — safety axis / read-only reading / the "a person must answer" mark / task support — or no longer lists it) and
+            `mcp.tool_listing_unreached` (the post-redial listing walk stopped before reaching the tool, so its new declaration cannot be proved). Every later call to that tool is refused the same way until a listing of the connection
+            reaches it — the way out is `POST /v1/sessions/{id}/mcp/reconnect` (or the engine's refresh); do not resend as-is. The lost-session failure itself stays `http_status` + `httpStatus: 404` + `delivered: "unknown"`.
             Consumers MUST branch with a `default` arm and MUST NOT exhaustively switch on known values.
             The service enforces only a length bound (>128 chars = malformed, the whole key is DROPPED rather
             than truncated — truncating would mint a code core never sent). NOTE: this is a DIFFERENT
@@ -16505,6 +16748,21 @@ components:
           type: object
           additionalProperties: false
           properties: { kind: { type: string, description: 'root | child | resume. Open on read.' } }
+        sessionRules:
+          type: object
+          additionalProperties: false
+          required: [childrenReadLive]
+          description: >
+            server >= 7.135.0 (engine 7.55.0; effective half only, both faces): whether the session-rules layer is handed to the delegated legs. `childrenReadLive: true` = this leg wired the session-rules layer (the deployment has a session-rules
+            store and the task carries a session id) and handed the session's key to every leg it delegates (sync / background / fork / workflow / resume / observer side-car, any depth) — a rule written into the session NOW governs an
+            already-running child's NEXT call; `false` = no rules layer, nothing handed out. The section ABSENT = an older engine (say nothing; do not read it as `false`). An unreadable section (not `{ childrenReadLive: <boolean> }`) is dropped.
+          properties:
+            childrenReadLive: { type: boolean }
+        projectMemory:
+          type: string
+          description: >
+            server >= 7.135.0 (engine 7.55.0; effective half only, both faces): did this leg call the deployment's project-context seat — `on` = it did; `disabled` = the seat is wired but the request's `projectMemory: "disabled"` turned it off;
+            `absent` = the deployment wired no seat (whatever the request said). On `disabled` / `absent` legs the server-minted `instructions` section is ABSENT. Open on read (a new engine word passes through); ABSENT = an older engine.
         ask:
           type: object
           additionalProperties: false
@@ -17096,6 +17354,10 @@ components:
         own failure carries the same code. `{ modelId, boundOrigin, requestOrigin, sessionId, runId }` — both origins in display spelling (scheme + host +
         port, no userinfo / path), never a credential or a digest of one. Once per run per (modelId, boundOrigin, requestOrigin). It replaces the retired
         operator code `route.base_url_changed_key_unchanged` (never on this whitelist). `config.credential_not_withheld` is operator-audience — ops log only.
+        `advisor.not_attached` (server >= 7.135.0 / core 7.55.0; D.3 is now 42 codes) — the request's advisor model did NOT attach (the engine's pairing judge refuses the (advisor, main) pair).
+        `{ advisorModel, mainModel, reason, sessionId, runId? }` — the two model names are the catalog id / the reference the request wrote (display spelling); `reason` is an engine word (`unknown_model` / `advisor_unranked` /
+        `weakest_tier` / `main_unranked` / `pairing` / `hold_unknown`; the server echoes it — read OPEN). Unreachable on this server today: it does not accept `advisorModel` (the request body does not take it, and the
+        `advisor` section is not projected on either `wiring_manifest` face).
         Value change: `permission.rule_row_dropped`'s `detail.rows[].rule` is, since core 7.53.0, the rule's original text (the same reading as
         `allowed_tool_not_granted`'s `entries[].entry`: at most 1 024 code points, longer cut to 1 024 + a truncation mark, CONTROL CHARACTERS RIDE AS DATA —
         neutralize at render); before it was the engine-neutralized single-line form (at most 201 code points). Same keys.
@@ -17875,7 +18137,7 @@ components:
             second card word `contentKind` that server <= 7.125.x derived from the tool name (deleted at 7.126.0, no alias: a consumer reading `contentKind === "content_ask"` reads
             `approvalCard === "question"`). ABSENT = the engine minted none (a host-built ask / an older engine / a non-approval gate) — never `generic` by default. Display / triage only; it NEVER
             takes part in resume / gate / CAS. The same word rides the `livePending` row top level (= this frame's own value), the operator queue row and the `/v1/approvals/stream` `pending` /
-            `live_pending` frames; the `card_json` card face and the `approval_request` frame's `card` do NOT carry it (`ApprovalCard` is `.strict()`).
+            `live_pending` frames; from server >= 7.136.0 the `card_json` card face and the `approval_request` frame's `card` (live mint and reconnect replay alike) carry the same word too (`ApprovalCard.approvalCard`: one read, three faces — before 7.136.0 the card did not carry it, so a replayed frame had none and a reconnecting shell fell back to the generic card).
         inputHasBidi:
           type: boolean
           enum: [true]
@@ -18154,6 +18416,9 @@ components:
         argsOmitted: { type: boolean, enum: [true], description: 'Present (true) only when args exceeded the byte cap. Never false.' }
         toolCallId: { type: string, description: 'The engine''s tool-call id (the `call_…` on the assistant message''s tool_use block) — same domain as ToolApprovalFrame.toolCallId.' }
         risk: { $ref: '#/components/schemas/ApprovalRiskAxes' }
+        approvalCard:
+          allOf: [{ $ref: '#/components/schemas/ToolApprovalCardWord' }]
+          description: 'server >= 7.136.0, ADDITIVE: the engine-minted card word — the SAME word, read once, as the live frame''s top-level `ToolApprovalFrame.approvalCard`; it now rides the live-minted `approval_request` frame''s `card`, the stored `card_json` envelope and the reconnect-replay frame''s `card` (before 7.136.0 the card did not carry it, so a replayed frame had none). ABSENT = the engine minted none / an out-of-set word (the server narrows it again when it mints the card) / a card stored before 7.136.0 — never `generic` by default. Display / triage only; it NEVER takes part in resume / gate / CAS. The stored envelope is strict: a 7.135.x replica cannot read a row carrying this key (replay skips it, the idempotent re-entry goes to the durable park) — roll the fleet in one pass.'
         rememberRefused:
           type: boolean
           enum: [true]
@@ -18300,6 +18565,27 @@ components:
         The closed five-word vocabulary of `AllowRuleShadow.member` (server >= 7.117.0 / core 7.42.0 `ALLOW_RULE_MEMBERS`, verbatim and in the order the engine reads the members). The SDK exports
         it at runtime as `ALLOW_RULE_MEMBERS`. Owner = core; read it as an open string with a default arm (core may add a member and the server follows).
 
+    AllowRuleClearance:
+      type: object
+      additionalProperties: false
+      required: [member, entries]
+      description: >
+        `tool_end.gate.disposition.clearedBy` (server >= 7.135.0 / core 7.55.0 `AllowRuleClearance`): the allow-layer member whose rule CLEARED a standing ask (the pair of `AllowRuleShadow`, which is
+        "matched and could NOT clear"). Same `member` / `entries` / `omitted` shape (minted and capped by the same seat), plus `positions` for a LIST member (`request`, `deployment`): the index of every element of the
+        list the run received that is one of those entries (a string listed twice has both indices), so a host reads which line of its own declaration spoke even where the shown text is capped.
+      properties:
+        member: { $ref: '#/components/schemas/AllowRuleMember' }
+        entries:
+          type: array
+          maxItems: 32
+          items: { type: string, maxLength: 512 }
+          description: 'The entries that member stood on (UNTRUSTED for display, secret-redacted, <= 512 chars each, <= 32 listed).'
+        omitted: { type: integer, minimum: 1, description: 'How many entries were not listed (beyond the cap). Absent = none omitted.' }
+        positions:
+          type: array
+          items: { type: integer, minimum: 0 }
+          description: 'LIST members only: the indices, in the list this run received, of the elements that are those entries. Absent for a non-list member.'
+
     AllowRuleShadow:
       type: object
       additionalProperties: false
@@ -18431,7 +18717,7 @@ components:
         equality). ONE vocabulary for two faces: a card's rule offer (`RuleOffer.match`, the
         server's card schema validates it with this very enum) and a persisted rule row (`GET /v1/rules`).
 
-        `exact` = this one command only (`Bash(git status)`). `prefix` = the historical colon-star
+        `exact` = this one command only (`Bash(git status)`). `pattern` (server >= 7.135.0 / core 7.55.0) = the MID-STAR command form (`Bash(git * main)`) — the fourth Bash command form a card edit may persist; the persisted `command` is the written pattern itself. `prefix` = the historical colon-star
         word-boundary prefix (`Bash(git status:*)`) and the ONLY spelling for a compound prefix form; it stays
         a permanent compatibility read. `wildcard` = the trailing space-star form (`Bash(npm run *)`), the
         same predicate as `prefix` on a single command body. `subpath` = the `Read(//abs-dir/**)` directory form,
@@ -18445,11 +18731,11 @@ components:
         always refuses these two words (no network grant is minted through a card). A replica rolled back to 7.125.x reads such a
         row as a damaged row.
 
-        🔴 NINE MEMBERS, closed: the server validates the member on both faces. A consumer type narrower than the
+        🔴 TEN MEMBERS, closed (server >= 7.135.0 / core 7.55.0 added `pattern`, between `wildcard` and `subpath` — the engine's order): the server validates the member on both faces. A consumer type narrower than the
         mint point is a lie — it lets a `switch` claim exhaustiveness the wire does not honour (SDK <= 16 declared
         four here, so a `path` offer and every 7.118.0 skill-card offer were dropped as malformed; SDK <= 21 declared
         seven, so every domain grant row on `GET /v1/rules` was dropped the same way).
-      enum: [exact, prefix, wildcard, subpath, path, name, name_prefix, host, subdomain]
+      enum: [exact, prefix, wildcard, pattern, subpath, path, name, name_prefix, host, subdomain]
 
     RuleOfferUncoveredReason:
       type: string
@@ -19785,6 +20071,12 @@ components:
         runId: { type: string }
         status: { type: string }
         summary: { type: string }
+        completionId:
+          type: string
+          description: >
+            server >= 7.135.0 — the idempotency anchor of this workflow completion: the SAME id rides every notification path of one completion (this frame / `task_notification` / fleet `bg_notification` / inbox replay) and
+            is the dedup key ACROSS paths (the same value domain as `task_notification.completionId`). ABSENT when the engine gave none (an orphan the service terminated itself) — dedup on `runId` as before. The read faces
+            (`GET /v1/workflows/{id}` etc.) deliberately never carry it. Older servers' re-delivered frames have no such key.
 
     # ── 🔴 #185a (2026-08-08): the DURABLE leg's three APPROVAL arms ────────────────────────────────
     #   Shape rule for all three: `allOf: [<frame schema>, {the narrowed discriminant}]`. The keys are NOT
@@ -19960,6 +20252,13 @@ components:
         boundGrantAbsence:
           allOf: [{ $ref: '#/components/schemas/BoundGrantAbsence' }]
           description: '`pending` frames only (server >= 7.129.0 / core 7.51.0 #1688) — see PendingCheckpoint.boundGrantAbsence. A `live_pending` frame carries it only inside its `frame`.'
+        boundGrantDigest: { type: string, description: '`pending` frames only (server >= 7.136.0) — see PendingCheckpoint.boundGrantDigest. A `live_pending` frame carries it only inside its `frame`.' }
+        boundGrants:
+          allOf: [{ $ref: '#/components/schemas/BoundSkillGrants' }]
+          description: '`pending` frames only (server >= 7.136.0) — see PendingCheckpoint.boundGrants. DEPLOYMENT TEXT: render with contextual escaping.'
+        classifierNoRuling:
+          allOf: [{ $ref: '#/components/schemas/AutoModeFallbackCause' }]
+          description: '`pending` frames only (server >= 7.136.0) — see PendingCheckpoint.classifierNoRuling.'
         askClass:
           allOf: [{ $ref: '#/components/schemas/AskClass' }]
           description: '`pending` frames only (server >= 7.109.0 / S-934 ②) — see PendingCheckpoint.askClass. A `live_pending` frame carries the pair only inside its `frame`.'
@@ -19970,20 +20269,35 @@ components:
           description: '`pending` frames only (server >= 7.109.0) — see PendingCheckpoint.classes.'
 
     ParkedDecideAccepted:
-      type: object
       description: >
         The 200 body of POST /v1/approvals/{sessionId}/decide when the pending checkpoint belongs to a
         PARKED background agent (server 1.267, ASSISTANT-WIRE-CONTRACT §4a parked variant; server
-        parked-decide.ts — exact literal shape). ACCEPTANCE semantics: the revive drives
-        ASYNCHRONOUSLY — 200 means accepted, not completed; a failed drive honestly re-parks the row and
-        the pending re-appears on the list. Task-level suspends keep the legacy resumed shape —
-        discriminate by `status === "resuming"`.
-      required: [taskId, status, decision]
-      additionalProperties: true
-      properties:
-        taskId: { type: string, description: 'The background agent handle (a* domain).' }
-        status: { type: string, enum: [resuming] }
-        decision: { type: string, enum: [approve, deny] }
+        parked-decide.ts — exact literal shapes). TWO ARMS, read by `status` (the SDK type `ParkedDecideAccepted` is their union):
+        (1) `status: "resuming"` — the ACCEPTANCE receipt. The revive drives ASYNCHRONOUSLY — 200 means accepted,
+        not completed; a failed drive honestly re-parks the row and the pending re-appears on the list.
+        (2) `status: "failed"` (server >= 7.136.0; `decision` is always `deny`) — the VOIDED receipt: on the two forms that can
+        never revive (a parked child whose row carries no agent name — an unnamed `Agent` call — or no root-session anchor)
+        a DENY voids the card under its own scope CAS; the card leaves the pending queue and the `/v1/approvals/stream` snapshot,
+        the child ends `failed` (the engine's reconcile), the gated tool never runs, no `remember` is granted — and NOTHING is
+        resuming. Do not wait for a revive that never comes. APPROVE on those forms stays `409 decide.row_unrevivable`; a lost
+        void CAS is the existing `409 decide.gate_moved`.
+        Task-level suspends answer their own shapes (see `ApprovalDecisionResult`): discriminate a parked receipt by `decision`
+        present and `sessionId` absent, then read `status`.
+      oneOf:
+        - type: object
+          required: [taskId, status, decision]
+          additionalProperties: true
+          properties:
+            taskId: { type: string, description: 'The background agent handle (a* domain).' }
+            status: { type: string, enum: [resuming] }
+            decision: { type: string, enum: [approve, deny] }
+        - type: object
+          required: [taskId, status, decision]
+          additionalProperties: true
+          properties:
+            taskId: { type: string, description: 'The background agent handle (a* domain).' }
+            status: { type: string, enum: [failed] }
+            decision: { type: string, enum: [deny] }
 
     FleetMeta:
       type: object
@@ -20484,7 +20798,7 @@ components:
         🔴 ONE RULE FOR EVERY "EFFECTIVE HALF ONLY" KEY (sdk 9.7.0, after a codex adversarial-review [high]):
         this schema's only consumer today is `GET /v1/diagnostics/wiring`'s `static` half, and every key marked
         "effective half only" (`leg`, `ask.effective`, `configFingerprint`, `tools`, `mods`, `lsp`,
-        `modelGate`, `autoMode`, `writeProtection`, `readDeny`, `autoConsolidation`, `fileHistory`, `instructions`) is ALWAYS ABSENT on that
+        `modelGate`, `autoMode`, `writeProtection`, `readDeny`, `autoConsolidation`, `fileHistory`, `instructions`, `sessionRules`, `projectMemory`) is ALWAYS ABSENT on that
         wire ⇒ THEIR ABSENCE HERE CARRIES NO INFORMATION. The per-key absence readings ("absent = not armed",
         "absent = a third state", …) hold for the LIVE FRAME (`Event_wiring_manifest`) and must not be carried
         over to this response. For the facts behind those keys: a tenant reads
@@ -20497,7 +20811,7 @@ components:
         are EFFECTIVE-half only (the live `wiring_manifest` event) — as are the four per-leg sections
         `modelGate`, `autoMode`, `mcp` and `tools`, which describe what THIS leg did and have no static
         counterpart — and the STATIC half
-        (GET /v1/diagnostics/wiring) NEVER mints them; every other section, plus `governance`, is always
+        (GET /v1/diagnostics/wiring) NEVER mints them; every other section NOT in the effective-half-only list above, plus `governance`, is always
         present on the static half. Fields stay optional because core may add or drop sections and that
         must not hard-break a client — read by half, and never wait on a key the half never sends.
         🔴 EVERY section is declared HERE, each saying which half mints it (sdk 8.9.0). Before that, `tools`
@@ -20518,6 +20832,18 @@ components:
           description: 'Which leg emitted it (effective half only; the static half has no leg identity).'
           properties:
             kind: { type: string, enum: [root, child, resume] }
+        sessionRules:
+          type: object
+          required: [childrenReadLive]
+          description: >
+            server >= 7.135.0 (engine 7.55.0; effective half only — the static half never mints it): whether the session-rules layer is handed to the delegated legs. Same reading as on the live frame (`Event_wiring_manifest.sessionRules`):
+            `childrenReadLive: true` = a rule written into the session NOW governs an already-running child's NEXT call; `false` = no rules layer; the section ABSENT = an older engine, or this half.
+          properties:
+            childrenReadLive: { type: boolean }
+        projectMemory:
+          type: string
+          description: >
+            server >= 7.135.0 (engine 7.55.0; effective half only): did the leg call the deployment's project-context seat — `on` / `disabled` (the request's `projectMemory: "disabled"`) / `absent` (no seat wired). Open on read; ABSENT = an older engine, or this half.
         ask:
           type: object
           description: 'Approval seam: wired form, which seat it came from, and (effective half) what it adjudicates to.'
@@ -21285,6 +21611,19 @@ components:
         usageMissing: { type: boolean, enum: [true] }
         stopReason: { type: string }
         errorMessage: { type: string, description: 'A post-stream error (contract: not thrown as HTTP).' }
+        errorCode:
+          type: string
+          description: >-
+            server >= 7.135.0 (core 7.55.0, passed through verbatim; failure only): the engine's brain error code of the failed reply (open on read; today `auth` / `invalid_request` / `rate_limit` / `server` / `network` /
+            `http` / `stream_torn` / `refusal` / `length_empty`). ABSENT on success and on older servers.
+        errorKind:
+          type: string
+          enum: [input_too_long, degenerate, length_empty]
+          description: 'server >= 7.135.0 (failure only): the STRUCTURAL failure kind the reply carried, forwarded as is — `input_too_long` (the provider refused the request as over its window), `degenerate`, `length_empty`. Absent when the reply carried none.'
+        inputTooLongRuledOut:
+          type: boolean
+          enum: [true]
+          description: 'server >= 7.135.0 (failure only): present (always `true`) when the failure was a provider refusal whose minter RULED OUT input-too-long as the explanation (core `AssistantMessage.inputTooLongRuledOut`, passed through). It speaks ONLY to that negative: it does not say the status is 400 / 422 and does not say a verbatim resend repeats the failure (the engine also rules input length out for statuses such as 401 / 429 / 500) — triage on `errorCode`. Absent = no such judgment.'
 
     ToolApprovalDecision:
       type: string
@@ -21463,6 +21802,8 @@ components:
         to settle it): a parked row's `decided` can return to `parked` when the resume leg fails before the approved action starts (the engine reopens the same gate), and
         a cancelled resume reads `void` once the server collects the reopened gate (`parked` in between, or `void` for an instant during the reopen).
         Older servers answered all of these with `parked` + `decidePath`.
+        🔴 server >= 7.135.0: a gate that was DECIDED and then REOPENED by the engine reads `parked` WITH `reopened` (`ToolApprovalReopened`: the engine's reopen reason + the earlier decision's
+        `decision` / `decidedAtMs` / `decisionNote?`). `reopened` ABSENT = the read cannot say it was reopened (not "confirmed never reopened"). Older servers: always absent.
       oneOf:
         - $ref: '#/components/schemas/ToolApprovalReadPending'
         - $ref: '#/components/schemas/ToolApprovalReadDecided'
@@ -21500,6 +21841,29 @@ components:
           properties:
             state: { type: string, enum: [parked] }
             decidePath: { type: string, description: 'The durable decision path for this ask when it can be built.' }
+            reopened:
+              allOf: [{ $ref: '#/components/schemas/ToolApprovalReopened' }]
+              description: 'server >= 7.135.0: present when the gate was decided and then reopened by the engine (the resume leg failed before the approved action started). Absent = the read cannot say it was reopened.'
+    ToolApprovalReopenReason:
+      type: string
+      description: >
+        `ToolApprovalReopened.reason` (server >= 7.135.0) — the engine's `REOPEN_REASONS`, verbatim and in order (engine-owned; the server echoes a word only when it is in this
+        set, otherwise `reopened` is omitted entirely): `env_failed` (the environment / session side failed) · `tool_unavailable` (the approved tool is not there now — decide again) ·
+        `constraint_rejected` (the decision input was rejected — decide again) · `config_refused` (the configuration was refused). Read open on the consumer side: an unknown word is "reopened, reason unknown".
+      enum: [env_failed, tool_unavailable, constraint_rejected, config_refused]
+    ToolApprovalReopened:
+      type: object
+      description: >
+        `ToolApprovalReadParked.reopened` (server >= 7.135.0): evidence that a DECIDED gate was reopened by the engine. `reason` = the engine's reopen reason; `decision` / `decidedAtMs` / `decisionNote?` = the
+        decision made BEFORE the reopen (the same three keys as a `decided` body). An unreadable earlier decision ⇒ the three keys are absent TOGETHER (only `reason` stays; `decisionNote` may always be absent).
+        Single-instant read: if the row is decided and reopened between the two reads the server re-judges (three rounds in a row ⇒ falls back to plain `parked`).
+      additionalProperties: false
+      required: [reason]
+      properties:
+        reason: { $ref: '#/components/schemas/ToolApprovalReopenReason' }
+        decision: { type: string, enum: [allow, deny] }
+        decidedAtMs: { type: integer }
+        decisionNote: { type: string }
     ToolApprovalReadVoid:
       allOf:
         - $ref: '#/components/schemas/ToolApprovalReadProjection'
@@ -22217,8 +22581,8 @@ components:
         match:
           allOf: [{ $ref: '#/components/schemas/RuleOfferMatch' }]
           description: >
-            The match form — the same seven-member vocabulary as a card's rule offer (`RuleOfferMatch`, the server's
-            `PERSISTED_RULE_MATCHES`): `exact` / `prefix` / `wildcard` / `subpath` / `path`, and from server >= 7.118.0
+            The match form — the same ten-member vocabulary as a card's rule offer (`RuleOfferMatch`, the server's
+            `PERSISTED_RULE_MATCHES`): `exact` / `prefix` / `wildcard` / `pattern` (server >= 7.135.0: the mid-star command form) / `subpath` / `path`, and from server >= 7.118.0
             `name` / `name_prefix` (a `Skill(<name>)` / `Skill(<prefix>:*)` rule).
         command: { type: string, description: 'What the matcher actually compares against, parsed out of `rule` at mint time and stored so no consumer re-parses. Trust this + `match`, not your own parse of `rule`.' }
         adds: