@sema-agent/sdk 8.2.0 → 8.4.0

package/openapi.yaml

@@ -1453,7 +1453,7 @@ paths:
                 required: [sessionId, leafId]
                 properties:
                   sessionId: { type: string }
-                  leafId: { type: string, nullable: true, description: "null = session exists but has no entries yet." }
+                  leafId: { type: ["string", "null"], description: "null = session exists but has no entries yet." }
         '304': { description: 'Leaf unchanged since the presented ETag (no body).' }
         '401': { $ref: '#/components/responses/Unauthorized' }
         '404': { $ref: '#/components/responses/NotFound' }
@@ -5633,6 +5633,121 @@ components:
           properties:
             clampTolerance: { type: number }
 
+    TerminalCause:
+      description: >
+        🔴 BREAKING (server >= 7.64.0, core 7.6.0 design/390 D-8) — WHY the run ended, as ONE tagged cause
+        and the ONLY terminal record a `TaskResult` carries. It REPLACES the eight parallel plane keys of
+        7.63.0 and earlier (`status` / `errorCode` / `errorMessage` / `blockedReason` / `checkpointToken` /
+        `checkpointId` / `checkpointGate` / `workspaceRestoreMode`), all of which are GONE from this schema —
+        no optional compatibility twin ships, because two spellings of one fact on one wire is two writers on
+        one semantic surface.
+        TRIAGE ON `terminal.kind`. The legacy five-word `status` (and the seven flat words) is a DERIVATION:
+        call the engine's `terminalProjection(terminal)` — the ONE cause->plane derivation — never hand-roll it.
+        Which pause reads as `suspended` and which as `needs_review` is decided by the engine's pause registry,
+        not by this service.
+        🔴 The service's OWN columns and envelopes are UNCHANGED and still speak the five words: the `status` /
+        `errorCode` columns on `GET /v1/runs/:id`, the task-list row `status`, the `/decide` 200 body's
+        `status` / `errorCode` / `errorMessage`, and the fleet row's terminal word. Only their data source moved
+        (projected once from the cause).
+      oneOf:
+        - $ref: '#/components/schemas/TerminalCause_completed'
+        - $ref: '#/components/schemas/TerminalCause_failed'
+        - $ref: '#/components/schemas/TerminalCause_blocked'
+        - $ref: '#/components/schemas/PausedCause'
+      discriminator:
+        propertyName: kind
+        mapping:
+          completed: '#/components/schemas/TerminalCause_completed'
+          failed: '#/components/schemas/TerminalCause_failed'
+          blocked: '#/components/schemas/TerminalCause_blocked'
+          paused: '#/components/schemas/PausedCause'
+
+    TerminalCause_completed:
+      type: object
+      additionalProperties: false
+      description: 'The run finished (a person''s clean halt included — see `TaskResult.haltedByUser`).'
+      required: [kind]
+      properties:
+        kind: { const: completed }
+
+    TerminalCause_failed:
+      type: object
+      additionalProperties: false
+      description: 'A limit, a provider failure, an abort, an invalid output…'
+      required: [kind]
+      properties:
+        kind: { const: failed }
+        code:
+          type: string
+          description: >
+            The machine code this failure carried — the seat the retired flat `errorCode` occupied, now
+            STRUCTURALLY owned by the failure arm ("a code belongs to a failure" is the shape, not a
+            cross-field convention). OPEN SET, dotted namespaces so a caller can prefix-match a whole class:
+            `limits.max_tokens_exceeded` / `limits.max_cost_exceeded` / `limits.max_turns_exceeded` /
+            `limits.max_walltime_exceeded` / `config.*` / `resume_at.*`; brain codes (`auth` / `network` /
+            `rate_limit` / …) and `conflict` stay FLAT. Two EXTERNAL stop causes are deliberately NOT
+            `limits.*` (retrying them needs a new environment / a freed window, not a smaller budget):
+            `env.lifetime_expired` and `usage.window_exhausted`.
+            Governance codes arrive here too, and WHICH leg remaps one to an HTTP status differs per code —
+            do not generalize from one to the other: (a) `memory.admission_denied` /
+            `memory.admission_required` are remapped to 403/503 ONLY on the synchronous `POST /v1/tasks`;
+            on `POST /v1/runs` -> `GET /v1/runs/{taskId}` and on the SSE `done` frame they ride a 200 result.
+            (b) `usage.window_exhausted` is a 429 only when the PRE-ADMISSION gate catches it; caught in the
+            race after admission it is NOT remapped on any leg, including the synchronous 200.
+            A NESTED orchestrator that met a durable pause it cannot drive stamps `unexpected.suspended` /
+            `unexpected.needs_review` and carries that pause on `nestedPause`.
+            Consumers MUST branch with a `default` arm. Absent = the failure never had a code.
+        message: { type: string, description: 'Human-readable failure text. Absent when there was none.' }
+        nestedPause:
+          allOf: [{ $ref: '#/components/schemas/PausedCause' }]
+          description: >
+            The durable pause this failure STANDS IN FOR — set ONLY at a nested hard boundary (verify /
+            cascade): the nested leg paused on a durable gate the orchestrator cannot drive, so at ITS
+            boundary the pause is reported as a failure while the pause's own cause travels here verbatim.
+            🔴 On the wire it carries NO `token` — the same withholding rule as the top-level `paused` arm
+            (see `PausedCause`); `gate` / `checkpointId` are present as usual.
+            Absent on every failure the engine itself assembles.
+
+    TerminalCause_blocked:
+      type: object
+      additionalProperties: false
+      description: 'The agent could not finish and said why (a governance verdict is NOT a failure).'
+      required: [kind, reason]
+      properties:
+        kind: { const: blocked }
+        reason: { type: string, description: 'Why the agent could not finish.' }
+
+    PausedCause:
+      type: object
+      additionalProperties: false
+      description: >
+        A durable pause committed a checkpoint and the run is resumable.
+        🔴 THE `token` SEAT IS NEVER ON THE WIRE. It is the resume CAPABILITY (token-as-auth) and never leaves
+        the service — the SAME discipline the retired top-level `checkpointToken` had, only the credential
+        changed address (`src/terminal.ts` `stripResumeToken` removes it on both reachable paths: this arm and
+        `TerminalCause_failed.nestedPause`). To act on this pause call
+        `POST /v1/approvals/{sessionId}/decide` and reconcile by `checkpointId`.
+      required: [kind, gate]
+      properties:
+        kind: { const: paused }
+        gate:
+          allOf: [{ $ref: '#/components/schemas/CheckpointGate' }]
+          description: 'WHICH pause — who/what must resume it. Same word as the park row''s `gate.kind`.'
+        checkpointId:
+          type: string
+          description: >
+            The pause's NON-SECRET stable identity — the display/correlation key to log or render where the
+            token must not travel. Absent on pre-identity checkpoints.
+        restoreMode:
+          type: string
+          enum: [snapshot, park_only]
+          description: >
+            HOW the paused task's remote workspace comes back, present whenever the pause captured one.
+            `snapshot` = the VM was suspended into a snapshot (provider billing typically stops).
+            `park_only` = the env declared itself non-suspendable (an SSH host / an ADB device) so NOTHING was
+            paused: the machine keeps running and keeps costing. ABSENT for a process-local pause — a
+            scheduler that assumes "paused => idle and free" must be able to see the difference.
+
     TaskResult:
       type: object
       # 🔴 **刻意不封闭**(census 轴一裁定,2026-07-30)。此前是「没写」= JSON Schema 默认开放,分不清
@@ -5642,12 +5757,21 @@ components:
       # 这里改成 false 会让 spec 与本仓自己的类型面互相打脸,并且把「引擎加字段」判成 wire 违约(它不是)。
       # 收紧这一面的正解不是 additionalProperties,是把引擎真发的键**逐个登记**(字段级 drift 门的活)。
       additionalProperties: true
-      description: Synchronous task result (`POST /v1/tasks`).
-      required: [taskId, sessionId, status, stats]
+      description: >
+        Synchronous task result (`POST /v1/tasks`). 🔴 BREAKING at server 7.64.0: the terminal is ONE tagged
+        cause (`terminal`), not the eight parallel plane keys — see `TerminalCause`.
+      required: [taskId, sessionId, terminal, stats]
       properties:
         taskId: { type: string }
         sessionId: { type: string }
-        status: { $ref: '#/components/schemas/RunStatus' }
+        terminal:
+          allOf: [{ $ref: '#/components/schemas/TerminalCause' }]
+          description: >
+            🔴 server >= 7.64.0 — the ONE terminal record. Branch on `terminal.kind`. The eight retired plane
+            keys (`status` / `errorCode` / `errorMessage` / `blockedReason` / `checkpointToken` /
+            `checkpointId` / `checkpointGate` / `workspaceRestoreMode`) are GONE from this schema and this
+            SDK ships NO compatibility projection: a consumer that still needs the five-word `status` calls
+            the engine's `terminalProjection(terminal)` itself.
         result: { type: string }
         activeTaskId:
           type: [string, 'null']
@@ -5678,20 +5802,13 @@ components:
         salvagedOutput:
           type: string
           description: Partial output preserved when the run could not complete normally (best-effort salvage).
-        blockedReason:
-          type: string
-          description: Why a `blocked` status was reached (human-readable).
-        checkpointGate:
-          description: >
-            The gate kind that produced `checkpointToken` when the run suspended. Deliberately UNTYPED here —
-            the shape is core's and still evolving; treat it as opaque and branch on `status`/`errorCode` instead.
         toolCallId:
           type: string
           description: >
             [4913] (server 7.41+) — the PENDING tool call's id when this result is a durable park
-            (`status` suspended/needs_review with a `tool_approval` pending action); same key and meaning as the
+            (`terminal.kind === "paused"` with a `tool_approval` pending action); same key and meaning as the
             `tool_approval` frame's `toolCallId` (server >= 1.307). ABSENT (key omitted, never null) on a
-            tool-less park (resource_limit / plan_review / task_done), on every terminal result, and when the
+            tool-less park (resource_limit / plan_review / task_done), on every non-paused cause, and when the
             server-side checkpoint read failed — consumers test presence.
         degraded:
           type: object
@@ -5716,21 +5833,6 @@ components:
           description: >
             The task's structured (schema-constrained) output when one was requested. Shape is caller-defined,
             so this is intentionally untyped.
-        errorCode:
-          type: string
-          description: >
-            Result-level terminal code (NOT an HTTP error). Includes `budget.precall` / `budget.exceeded`
-            (cost gate, non-retryable) — branch on this, not on a 4xx (pinned wire contract).
-            Governance codes also arrive HERE, and WHICH leg renders them as an HTTP status differs per code —
-            do not generalize from one to the other:
-            (a) `memory.admission_denied` / `memory.admission_required` (server >=7.0.0) are remapped to 403/503
-            ONLY on the synchronous `POST /v1/tasks`; on `POST /v1/runs` -> `GET /v1/runs/{taskId}` and on the
-            SSE `done` frame they ride a 200 result (those legs have no second chance at a status line).
-            (b) `usage.window_exhausted` is a 429 only when the PRE-ADMISSION gate catches it (all three submit
-            endpoints). When the window is exhausted in the race after admission, the engine's refusal is NOT
-            remapped on any leg — it lands in the result, including a 200 from the synchronous `POST /v1/tasks`.
-            Branch on this field, never on the status alone.
-        errorMessage: { type: string }
         retryAfterMs:
           type: integer
           description: >
@@ -5751,6 +5853,51 @@ components:
             rounds: { type: integer }
             findings: { type: array, items: { type: string } }
 
+    LegacyPlaneTaskResult:
+      type: object
+      additionalProperties: true
+      description: >
+        🔴 THE SHAPE THAT IS ON DISK — a task result written by server 7.63.0 or earlier, in the retired FLAT
+        plane form. It appears ONLY on the faces that REPLAY PERSISTED BYTES, and only on a deployment that was
+        upgraded across 7.64.0: `GET /v1/runs/:id` -> `result` (the service passes the stored blob through
+        verbatim, redaction only — `src/http/routes/runs.ts`) and the durable-ledger replay of the `done` frame.
+        NOTHING WRITES IT ANY MORE: the write path mints exactly one shape (`TaskResult`, with `terminal`).
+        🔴 THIS IS NOT A COMPATIBILITY TWIN. The rule against "two spellings of one fact on one wire" is about
+        WRITERS: two producers of one semantic surface. Here there is ONE writer and a READ face that admits the
+        bytes a now-retired writer actually left on disk — the same distinction the service draws for its own
+        two-generation reader (`persistedPlaneOf`, whose header records the two reproducible regressions that
+        deleting it caused: a 500 on every historical `GET /v1/runs/:id`, and unredacted credentials replayed
+        from old ledger rows).
+        NARROWING: `"terminal" in result` — present = the current cause form, absent = this shape. Do NOT narrow
+        on `status` alone: the SSE conflict envelope (`ActiveRunConflictDoneResult`) also carries `status`.
+        🔴 `terminal` IS REFUSED HERE, and that clause is load-bearing rather than decorative: the two
+        generations are MUTUALLY EXCLUSIVE on disk (7.63.0 wrote `status` and never `terminal`; 7.64.0 writes
+        `terminal` and never `status`), and without the refusal a MALFORMED current result — `terminal: null`,
+        an unknown cause kind, a `paused` cause that still carries its `token` — would fail the `TaskResult`
+        arm and then be LAUNDERED through this one, so the read faces would silently lose every negative
+        control `TaskResult` enforces while a consumer narrowing on `"terminal" in result` walks straight into
+        it. The documented discriminant and the enforced one are the same clause.
+      not: { required: [terminal] }
+      required: [taskId, sessionId, status, stats]
+      properties:
+        taskId: { type: string }
+        sessionId: { type: string }
+        status: { $ref: '#/components/schemas/RunStatus' }
+        result: { type: string }
+        stats: { $ref: '#/components/schemas/TaskStats' }
+        errorCode: { type: string, description: 'The retired flat terminal code. Its successor is `TerminalCause.failed.code`.' }
+        errorMessage: { type: string, description: 'The retired flat failure text. Successor: `TerminalCause.failed.message`.' }
+        blockedReason: { type: string, description: 'The retired flat governance reason. Successor: `TerminalCause.blocked.reason`.' }
+        checkpointGate:
+          description: >
+            The retired flat pause gate — UNTYPED here on purpose, because these are bytes an older generation
+            wrote and this contract does not re-litigate their shape. Successor: `TerminalCause.paused.gate`
+            (typed as `CheckpointGate`).
+        salvagedOutput: { type: string }
+        model: { type: string }
+        toolCallId: { type: string }
+        retryAfterMs: { type: integer }
+
     RunReceipt:
       type: object
       # 封闭(census 轴一,2026-07-30):producer 铸造点 routes/runs.ts 与 idem 重放臂各自逐字写死
@@ -5769,7 +5916,12 @@ components:
       description: >
         Run state (`GET /v1/runs/:id`) — live shape per the pinned wire contract Drift 2: `result` is the NESTED TaskResult
         object (output text in result.result, stats in result.stats; NO top-level stats), and the error text
-        field is `error` (not errorMessage; errorCode is floated up from result.errorCode).
+        field is `error` (not errorMessage).
+        🔴 server >= 7.64.0 — this ROW's own `status` / `errorCode` columns are UNCHANGED and still speak the
+        five words; only their SOURCE moved. The nested `result` is the engine result itself and therefore
+        changed shape with it (`result.terminal`, no plane keys): the row's `errorCode` column is now projected
+        from `result.terminal` (`src/http/routes/runs.ts` -> `persistedPlaneOf`, which also reads the flat bytes
+        7.63.0 and earlier wrote to disk), NOT copied from a `result.errorCode` that no longer exists.
       # 封闭(census 轴一,2026-07-30;A-075.21 回填后 12 键):铸造点 routes/runs.ts 是一个逐键写死的
       # 字面量(taskId/sessionId/status/msSinceLastActivity/crossSliceUsage/result/supervisorCost/
       # suggestions/errorCode/error/jobId/source),与本 properties 一一对上;只有 taskId/sessionId/status
@@ -5806,10 +5958,21 @@ components:
             spentMicroUsd: { type: integer, description: 'Integer micro-USD; absent on unpriced deployments (unknown, not 0).' }
             maxSlices: { type: integer }
             sliceCount: { type: integer }
-        result: { $ref: '#/components/schemas/TaskResult' }
+        result:
+          oneOf:
+            - $ref: '#/components/schemas/TaskResult'
+            - $ref: '#/components/schemas/LegacyPlaneTaskResult'
+          description: >
+            🔴 A READ-OF-DISK face, so it carries TWO generations of bytes (see `LegacyPlaneTaskResult`): the
+            current cause form on anything server >= 7.64.0 wrote, and the retired flat form on rows written
+            before the upgrade. The service passes the stored blob through verbatim (redaction only) and does
+            NOT back-fill `terminal`. Narrow on `"terminal" in result`.
         errorCode:
           type: string
-          description: Result-level terminal code (e.g. `budget.exceeded`, `cancelled`); NOT an HTTP error.
+          description: >
+            Result-level terminal code (e.g. `budget.exceeded`, `cancelled`); NOT an HTTP error. This ROW COLUMN
+            is unchanged at 7.64.0 — only its source moved (projected from `result.terminal`, or read straight
+            off a legacy flat blob).
         error: { type: string }
         jobId:
           type: string
@@ -6080,20 +6243,29 @@ components:
               input: { description: tool-call — redacted args. }
               callId: { type: string }
               isError: { type: boolean }
-              # 🔴 core >=5.18.1 (#187) —— 与 `Event_tool_end.settledBy` **同一个值**:server 的共享挑键器
-              # `toolResultFieldsOf`(src/trace/project.ts)同时喂 turns 面与 trace SSE 面,而写侧
-              # `toolEndEventData` 喂 durable 账本 —— 三面一个真源,所以这里的词表与那边逐字相同。
-              settledBy:
+              # 🔴 BREAKING (server >=7.64.0, core 7.6.0 S6-A) —— 与 `Event_tool_end.gate` **同一个值**:server 的
+              # 共享挑键器 `toolResultFieldsOf`(src/trace/project.ts)同时喂 turns 面与 trace SSE 面,而写侧
+              # `toolEndEventData` 喂 durable 账本 —— 三面一个真源。退役的 `settledBy` 与它的三兄弟
+              # (`resolution`/`autoDenied`/`approver`)在这三面上一并删除。
+              gate:
+                allOf: [{ $ref: '#/components/schemas/GateOutcome' }]
+                description: >
+                  tool-result — the WHOLE record of this call''s gate pass (see `GateOutcome`). The READ leg
+                  screens it INDEPENDENTLY of the write leg (a ledger row can come from any engine generation or
+                  a third-party producer), so a defective record is withheld here too. Absence is not a fact
+                  about the call.
+              delivered:
+                allOf: [{ $ref: '#/components/schemas/McpDelivered' }]
+                description: 'tool-result — MCP delivery verdict; read with `errorCode`. Absent on every non-MCP-failure result.'
+              errorCode:
                 type: string
-                enum: [human, timeout, aborted]
                 description: >
-                  tool-result — HOW this call was settled when it went through an approval: `human` = somebody
-                  actually answered; `timeout` = the approval window elapsed; `aborted` = abort / unclonable
-                  arguments / out-of-contract. Present ONLY on the settled call.
-                  ABSENCE CARRIES NO SEMANTICS (an older worker, or a posture arm that deliberately leaves it
-                  unset — the two are indistinguishable), so absent is neither "human" nor "no approval
-                  happened". The read leg re-validates the closed set independently of the write leg, because a
-                  ledger row can come from any engine generation.
+                  tool-result — the machine code for WHY this call failed, verbatim from any tool''s
+                  `ToolResult.details.code` (OPEN set; the MCP family within it is core''s closed
+                  `McpFailureKind` word list since 7.6.0). Same key and semantics as `Event_tool_end.errorCode`.
+              gatedCallId:
+                type: string
+                description: 'tool-result — WHICH tool call a durable park is holding (core >= 5.55.0); absent on a tool-less park.'
         tokens:
           type: object
           properties:
@@ -6684,6 +6856,293 @@ components:
             and the history PULL answers the no-oracle 404 `not_found.blob`, while the REST of the sync
             surface keeps working.
 
+        # ─── S-139(sdk 8.3.0):对 server 7.60.0 的整体重对账补齐的 19 位 ───────────────────────
+        # 行号 = server 7.60.0 树的 `src/http/routes/capabilities.ts`。语义与谓词的全文在
+        # `packages/sdk/src/types.ts` 的 `Capabilities` 同名成员上(逐条亲读 server 源码转述);
+        # 这里只留 codegen 需要的形与一句定性。机械对账门 = `test/server-keyset-parity.test.ts`。
+        deviceExecutor:
+          description: >
+            device lane (capabilities.ts:162). Object OR `false` — same tri-state family as `fleet`.
+            Predicate = `deps.deviceHub` present, byte-identical to the `GET /v1/device/ws` upgrade
+            handler's mount condition. `wsPath` is deliberately on the wire (hard-coding it downstream
+            would turn a path change into a cross-repo breaking change). Device COUNT / online state are
+            deliberately NOT advertised (that is the `/v1/devices/*` admin face).
+          oneOf:
+            - type: boolean
+              enum: [false]
+            - type: object
+              required: [enabled, protocolVersion, maxInflightPerDevice, wsPath]
+              additionalProperties: true
+              properties:
+                enabled: { type: boolean, enum: [true] }
+                protocolVersion: { type: integer }
+                maxInflightPerDevice: { type: integer }
+                wsPath: { type: string }
+        memoryEngine:
+          description: >
+            Memory ENGINE posture (capabilities.ts:210 = `projectMemoryEngineCapability`). Object = the
+            memory face is really lit, `false` = dark. NOT the same thing as `memory`/`memoryWrite` (those
+            advertise the RETIRED MemoryStore HTTP verbs and stay false forever) — the engine has NO HTTP
+            verbs, so a true here does NOT mean there are memory read/write endpoints to call.
+            `vectorMode: null` = this leg has no rung indicator (the `file` engine), NOT "the rung is null".
+          oneOf:
+            - type: boolean
+              enum: [false]
+            - type: object
+              required: [backend, vectorMode]
+              additionalProperties: true
+              properties:
+                backend: { type: string, enum: [file, pg, tidb] }
+                # 🔴 openapi **3.1**:可空用 `type: [T, "null"]`,`nullable` 不是 3.1 关键字(会被静默忽略)。
+                # `null` 也必须进 enum,否则真校验器把 file 引擎的常态答判非法。
+                vectorMode: { type: ["string", "null"], enum: [native, portable, lexical, null] }
+        sql:
+          type: ["object", "null"]
+          additionalProperties: true
+          description: >
+            This deployment's SQL transaction read semantics (capabilities.ts:216 =
+            `projectSqlEngineCapability`), read back AFTER connection initialization set it — same source as
+            the operator `GET /v1/diagnostics/wiring` `sqlEngine` section. `null` = NO SQL backend here
+            (env-only worker / local file backend), NOT "could not read it". `txnMode: null` = this engine
+            has no such indicator, NOT "optimistic".
+          required: [engine, isolation, txnMode]
+          properties:
+            engine: { type: string, enum: [tidb, innodb, pg] }
+            isolation: { type: string }
+            txnMode: { type: ["string", "null"], enum: [pessimistic, null] }
+        sessionBackgroundable:
+          type: boolean
+          description: >
+            The REMOTE lane can detach (capabilities.ts:233 = `Boolean(deps.runStore)`): `POST
+            /v1/tasks/stream` with `x-detach-on-disconnect: true` survives client disconnect; come back via
+            the `X-Task-Id` response header and `GET /v1/runs/{id}` + `/events`. Deployment half only — the
+            per-request half (caller must pass `sessionId`) is not in this bit. Scope is the REMOTE lane;
+            never repurpose it to disable local backgrounding.
+        runMemoryCaptureOptOut:
+          type: boolean
+          description: >
+            `POST /v1/runs/{id}/memory/capture-optout` mid-run flip verb is present (capabilities.ts:237 =
+            `Boolean(deps.runStore)`). Absent ⇒ do not render the affordance. True only promises the
+            ENDPOINT exists, not that THIS run is live (non-live ⇒ 409 with a signposting body).
+        memoryBundle:
+          type: boolean
+          description: >
+            Governance carry-out bundle pair `POST /v1/memory/{export,import}` (operator lane) —
+            capabilities.ts:261, two conjuncts: both engine seams wired AND `operatorPrincipals` NON-EMPTY
+            (an empty roster makes those routes 403 for every identity). True does not promise the backend
+            has the bundle composite face (core then refuses loudly with `memory.export_incomplete`).
+        memoryCompliance:
+          type: boolean
+          description: >
+            Provenance / erasure compliance pair `GET /v1/memory/entries/{entryId}/provenance` and
+            `POST /v1/memory/erase` (operator lane) — capabilities.ts:273, same two-conjunct family as
+            `memoryBundle`. Deliberately NOT the same source as `memoryBundle` (a deployment can have the
+            bundle composite face without control-plane ownership, and vice versa).
+        memoryOrigin:
+          type: boolean
+          description: >
+            External-origin marking face (three routes under `/v1/memory/origin/*`, operator lane) —
+            capabilities.ts:287, same two-conjunct family. Same predicate as `memoryCompliance` TODAY but a
+            deliberately separate bit (two products; a deployment may want only one). True does not promise
+            the `GET …/external` answer is complete — there is no scope enumeration face, so an empty answer
+            must never be read as "the store is clean".
+        memoryConsolidationDriver:
+          type: boolean
+          description: >
+            Consolidation valve pair (`POST /v1/admin/memory/consolidation/run`, `GET
+            /v1/admin/memory/consolidation`, operator lane) — capabilities.ts:301. FALSE ⇒ those routes are
+            **404** (whole domain unmounted), NOT 501: do not branch on 501 here. Contrast
+            `memoryOptOutGrant`, whose false arm IS a 501.
+        memoryOptOutGrant:
+          type: boolean
+          description: >
+            memory-capture opt-out GRANT table admin (four routes under `/v1/admin/memory-optout`,
+            operator-only) — capabilities.ts:307. FALSE ⇒ **501** `capability.memory_optout_grant_required`
+            (change the deployment shape), as opposed to `memoryConsolidationDriver`'s 404 (turn the knob on).
+        permissionModeAuto:
+          type: object
+          additionalProperties: true
+          description: >
+            Default-state disclosure for `permissionMode: "auto"` (capabilities.ts:463; adjudicated by
+            `src/auto-mode-face.ts`). The parts are deliberately NOT folded into one boolean — "this binary
+            does not know auto" and "it knows auto but this box has no entitlement source" would collapse to
+            the same false, and a shell must do different things for those. `reason` is present ONLY when
+            `armed` is false; read its vocabulary as an OPEN set (server already grew it from four words to
+            six). `model` is omitted when the classifier route cannot be resolved (the server logs the
+            engine's refusal rather than 500-ing the read face). `?permissionMode=<five words>` folds the
+            caller's INTENT into the verdict; anything outside the five words is a 400
+            `request.field_invalid`.
+          # 🔴 required 只有**三位**:武装三键(intentArming / armed / reason)是 server >= 7.57.0 (S-80)
+          # 才有的,而本包的支持地板是 3.0.0 => every 7.x <= 7.56.0 server is inside the promised face and
+          # emits ONLY these three (verified verbatim against server tags v7.50.0 / v7.56.0). Requiring the
+          # arming triple would make a SUPPORTED server's legitimate response invalid.
+          required: [accepted, classifierSeat, entitlementSource]
+          properties:
+            accepted: { type: boolean, enum: [true] }
+            classifierSeat: { type: boolean }
+            entitlementSource: { type: boolean }
+            intentArming: { type: boolean, description: 'server >= 7.57.0 only. ABSENT together with `armed`/`reason` on <= 7.56.0.' }
+            armed:
+              type: boolean
+              description: >
+                server >= 7.57.0 only. Read as THREE states, not two: true = will arm; false = will not, and
+                `reason` is then present; ABSENT = an older server that does not report arming at all — never
+                fold that absence into false (it would render a 7.50 box that IS arming as "auto == default").
+            reason:
+              type: string
+              enum: [mode_not_auto, deployment_incapable, org_denied, local_denied, settings_denied, resolver_fault]
+            model: { type: string }
+        readFace:
+          type: ["string", "null"]
+          enum: [open, roots, null]
+          description: >
+            The EFFECTIVE READ containment rung this deployment explicitly declared (capabilities.ts:484 =
+            `deps.config.readFace ?? null`; env `READ_FACE` or config-center's `readFace.face` — same config
+            key, so this bit does not distinguish org-pushed from local). `null` = this deployment pinned
+            NOTHING and the engine default takes over; the server deliberately does NOT fold `null` into
+            `roots` (copying an upstream default onto the wire becomes a lie the day core changes it).
+            Minimal disclosure — the deny table itself is never on the capability face. There is NO
+            per-request `readFace` field on TaskRequest.
+        callerCwd:
+          type: boolean
+          description: >
+            Whether a caller-supplied `cwd` is actually HONORED (capabilities.ts:541 =
+            `cwdHonored(config) || deviceCwdHonored(config)`) — single-user `host` lane OR the `device` lane.
+            Byte-identical predicate to the submit-side gate in `boot/resolve-spec.ts`. Prefer this bit;
+            when absent (older worker) fall back to `projectContext` — that is the verbatim pre-bit behavior.
+        a2a:
+          type: boolean
+          description: >
+            The A2A CLIENT read face `GET /v1/sessions/{id}/a2a` exists (capabilities.ts:555, unconditional
+            `true` — like `mcp`): with no peers configured it returns an honest empty panel, so there is no
+            501 path to gate on. Deliberately a DIFFERENT predicate from `a2aInjection`.
+        a2aInjection:
+          type: boolean
+          description: >
+            This deployment HONORS a caller-supplied `body.a2aPeers` (capabilities.ts:556 =
+            `a2aInjectionHonored(config)`; three vetoes owned by `task-a2a.ts`: single-user AND `a2a`
+            unlocked AND compliance permits). FALSE is a FIELD gate, not a 4xx: the request still 200s and
+            the field is warned + ignored — EXCEPT under a config lock, where submit refuses 400
+            `config.locked_key`.
+        a2aServe:
+          type: boolean
+          description: >
+            Server-as-peer knob (capabilities.ts:564 = `config.a2aServe !== undefined`): true ⟺
+            `GET /.well-known/agent-card.json` and `POST /v1/a2a` exist; false ⟺ both 404. Scope is ROUTE
+            EXISTENCE, not "every method runs" — `message/send` / `tasks/get` additionally need a durable run
+            store (without it they answer a named JSON-RPC `-32004`).
+        agentRoster:
+          type: boolean
+          description: >
+            `GET /v1/agents/roster` background-agent roster read face (capabilities.ts:640 =
+            `Boolean(deps.backgroundAgentStore)`, byte-identical to that route's 501 gate). Scope is the
+            ENUMERATION face (content-free projection); subagent OUTPUT bodies go through
+            `/v1/runs/{id}/subagents/{handle}/output`, gated by `subagentOutput`.
+        retention:
+          type: ["object", "null"]
+          additionalProperties: true
+          description: >
+            Managed-retention deployment facts (capabilities.ts:654). `null` = the sweep lane is off
+            (default). `mode: audit-only` = it runs and judges but calls NO destructive method; `enforce` =
+            it really deletes. The predicate looks only at config because a box with `intervalSec > 0` and no
+            real executor CANNOT BOOT (`boot/retention-lane.ts` refuses at startup).
+          required: [mode, maxAgeDays]
+          properties:
+            mode: { type: string, enum: [audit-only, enforce] }
+            maxAgeDays: { type: integer }
+        workflowsGate:
+          type: object
+          additionalProperties: true
+          description: >
+            Self-orchestration denial disclosure (capabilities.ts:739). The two parts are deliberately not
+            folded: `engineCan` = core's `workflowsCapability`; `denial` = the DEPLOYMENT-level admission
+            refusal (closed set, today's only member `entitlement_resolver_absent`), `null` = this layer does
+            not refuse. Non-null means the engine is there but this deployment can grant it to NO principal
+            (half-configured) — signpost the OPERATOR, do not tell the user to retry. `denial: null` does NOT
+            mean "you are authorized" (that is per-principal). `workflows` is the PRODUCT of the two factors.
+          required: [engineCan, denial]
+          properties:
+            engineCan: { type: boolean }
+            denial:
+              type: ["string", "null"]
+              enum: [entitlement_resolver_absent, null]
+        writeProtection:
+          oneOf:
+            - $ref: '#/components/schemas/WriteProtectionCapability'
+            - type: 'null'
+          description: >
+            server >= 7.63.0 (S-138) — the WRITE-PROTECTION TABLE's posture on this deployment (see
+            `WriteProtectionCapability`). `null` = this process cannot say; an ABSENT key means an OLDER worker,
+            and "no key" is NOT "no table" — an absent seat on the engine side is precisely the DEFAULT TABLE
+            BEING IN PLACE.
+    WriteProtectionCapability:
+      type: object
+      additionalProperties: false
+      description: >
+        server >= 7.63.0 (S-138) — the WRITE-PROTECTION TABLE's posture on this deployment. The engine's
+        literal name table downgrades a locatable write (Write / Edit / NotebookEdit) that lands on a table
+        row from `allow` to `ask`, so a shell can tell in advance that those paths will raise a card.
+        🔴 THE THREE ARE DELIBERATELY NOT FOLDED INTO ONE BOOLEAN: folded, "the engine's default table is
+        in place" and "an operator swapped in a table of their own" both read `true`, and those two say
+        different things to an operator.
+        🔴 MINIMUM DISCLOSURE: the per-row names/kinds are NOT here — a deployment-authored row can carry
+        an internal path name, and listing them tells anyone who wants around them which names are NOT
+        protected. Rows live on the operator face `GET /v1/diagnostics/wiring` -> `writeProtection.rows`.
+        🔴 A PARALLEL MECHANISM, NOT THE SAME ONE: `SENSITIVE_WRITE_PATTERNS` (pattern-shaped write deny)
+        is reported separately and must never be folded into this bit — the two have different fixes.
+        The three-state reading of the SEAT itself lives at the reference point (`Capabilities.writeProtection`):
+        `null` = this process cannot say; key absent = an older worker (and "no key" is NOT "no table").
+      required: [armed, rows, replaced]
+      properties:
+        armed: { type: boolean, description: 'The effective table is non-empty => the engine really will raise a card on a row hit.' }
+        rows: { type: integer, description: 'How many rows the effective table has (contents stay on the operator face).' }
+        replaced: { type: boolean, description: 'The whole-table replacement knob was written => the default table is no longer in place as-is (an explicit EMPTY table counts — "the operator turned it off" is not "nothing was touched").' }
+
+
+    WriteProtectedRow:
+      type: object
+      additionalProperties: false
+      description: >
+        One row of the write-protection table (core `WriteProtectedRow`): a LITERAL name plus how it matches.
+        The `name` is also the row's stable identity — the string a refusal / ask message cites.
+      required: [name, kind]
+      properties:
+        name: { type: string }
+        kind:
+          type: string
+          enum: [basename, segment, segment-run]
+          description: >
+            `basename` = the target's LAST segment equals the row name · `segment` = ANY path segment equals it ·
+            `segment-run` = a CONSECUTIVE run of segments equals the row's `/`-separated segments.
+
+    WriteProtectionPosture:
+      type: object
+      additionalProperties: false
+      description: >
+        server >= 7.63.0 (S-138) — the OPERATOR face of the write-protection table (`GET /v1/diagnostics/wiring`
+        -> `writeProtection`). Same boot artefact as the tenant-facing `capabilities.writeProtection`, so the two
+        faces cannot tell different stories; this one adds the ROW CONTENTS, which the tenant face withholds.
+      required: [rows, source]
+      properties:
+        rows:
+          type: array
+          items: { $ref: '#/components/schemas/WriteProtectedRow' }
+          description: 'The effective table, verbatim from the engine''s own compile (the service recomputes nothing). Empty = an explicitly empty table.'
+        source:
+          type: string
+          enum: [default, extra, replace, off]
+          description: >
+            `default` = neither knob was written (the engine's default table is in place; the service does NOT
+            copy that table — the engine owns it) · `extra` = default plus additions · `replace` = whole-table
+            replacement · `off` = replaced with an EMPTY table (legal, and loud).
+        droppedDefaultRows:
+          type: array
+          items: { type: string }
+          description: >
+            The DEFAULT row names a whole-table replacement dropped. Present only on the replacement family
+            (`extra` / `default` cannot structurally drop a row). Row identity is judged by the ENGINE's own
+            fold rule, so a case-variant spelling is not reported as a loss.
+
     SkillSpec:
       type: object
       description: A per-request skill (passed as an object; core-native TaskSpec.skills shape).
@@ -9056,6 +9515,214 @@ components:
         parentToolCallId: { type: string }
         sourceTaskId: { type: string }
         bgAgentId: { type: string }
+    DeniedBy:
+      type: string
+      description: >
+        WHO REFUSED a call — the LAYER whose verdict is the deny (core 7.6.0 `DENIED_BY_VALUES`, 8 words,
+        CLOSED). The other question a deny raises — who ASKED — is answered by `AskOrigin`; the two used to
+        share one seven-word list in which `classifier` meant both.
+        `policy` = the deployment `ToolPolicy` denied (directly, or re-checking an approved edit), or the
+        approval-edit chain hit its round cap · `hook` = a PreToolUse hook denied, threw, or never answered ·
+        `org` = an organization policy rule denied · `classifier` = the auto-mode classifier denied directly ·
+        `plan_mode` = plan mode's read-only block on a write tool · `compliance` = the compliance call-time
+        lock · `write_protection` = an approved edit was rewritten onto a write-protected path no approval
+        covers · `ask_resolution` = the ask's own settlement IS the refusal (detail on `GateOutcome.settlement`).
+        🔴 CLOSED ON THIS WIRE, and deliberately not marked open: the engine's invariant screen
+        (`screenGateOutcome`) treats an out-of-set `deniedBy` as a DEFECT, and the service withholds a defective
+        record WHOLE (report + withhold). A word outside this set therefore cannot reach a consumer — it arrives
+        as the `gate` key being ABSENT, never as an unfamiliar word. Same rule for `Settlement.kind` and for
+        `GateOutcome.origin`.
+      enum: [policy, hook, org, classifier, plan_mode, compliance, write_protection, ask_resolution]
+
+    Settlement:
+      description: >
+        HOW the wait an ask was in ENDED — a DISCRIMINATED union on `kind` (core 7.6.0 `SETTLEMENT_KINDS`,
+        12 words, CLOSED). It is deliberately NOT a free product of `kind` x `who`: a free product can express
+        "human_allowed, ended by the engine's window" — a structurally complete record that contradicts itself.
+        `who` says WHICH PARTY ended it and its shape is fixed BY the word; `when` is epoch ms written at the
+        settlement site; a person's refusal carries the decider's own `note` when one was attached.
+        🔴 Single mint: every kind is composed by the ENGINE at the site whose wait ended. A host never mints a
+        word — it reports FACTS (a synchronous approver's `human`/`timeout`, a durable decide's
+        `decidedBy: "person" | "sla_timeout"`) and core turns them into the word.
+        Server-side projection note: `who.approver` and `note` are host-derived / decider-authored text and are
+        secret-redacted (and `note` length-bounded) before they reach this wire.
+      oneOf:
+        - $ref: '#/components/schemas/Settlement_human'
+        - $ref: '#/components/schemas/Settlement_approval_window_expired'
+        - $ref: '#/components/schemas/Settlement_denial_limit_window_expired'
+        - $ref: '#/components/schemas/Settlement_park_sla_expired'
+        - $ref: '#/components/schemas/Settlement_fail_closed'
+
+    Settlement_human:
+      type: object
+      additionalProperties: false
+      description: 'A person (or the approver acting for one) decided. `human_refused` may carry the decider''s own note.'
+      required: [kind, who, when]
+      properties:
+        kind: { type: string, enum: [human_allowed, human_refused] }
+        who:
+          type: object
+          additionalProperties: false
+          required: [party]
+          properties:
+            party: { const: person }
+            approver: { type: string, description: 'The attribution the approval channel reported. Absent = the channel reported no name — NEVER read as "nobody approved".' }
+        when: { type: integer, format: int64, description: 'Epoch ms, written at the settlement site.' }
+        note: { type: string, description: 'The refusing decider''s own words, when one was attached. A refusal WITHOUT a note is a bare "no".' }
+
+    Settlement_approval_window_expired:
+      type: object
+      additionalProperties: false
+      description: 'An approval window elapsed with no answer — the engine''s own approval factory window, or a synchronous host approver reporting its own window elapsed.'
+      required: [kind, who, when]
+      properties:
+        kind: { const: approval_window_expired }
+        who:
+          oneOf:
+            - type: object
+              additionalProperties: false
+              required: [party, window]
+              properties:
+                party: { const: engine }
+                window: { const: approval_factory }
+            - type: object
+              additionalProperties: false
+              required: [party]
+              properties:
+                party: { const: host }
+        when: { type: integer, format: int64 }
+
+    Settlement_denial_limit_window_expired:
+      type: object
+      additionalProperties: false
+      description: 'The classifier denial-limit fallback''s auto-deny window (core''s own timer over the synchronous leg) elapsed with no answer.'
+      required: [kind, who, when]
+      properties:
+        kind: { const: denial_limit_window_expired }
+        who:
+          type: object
+          additionalProperties: false
+          required: [party, window]
+          properties:
+            party: { const: engine }
+            window: { const: denial_limit }
+        when: { type: integer, format: int64 }
+
+    Settlement_park_sla_expired:
+      type: object
+      additionalProperties: false
+      description: >
+        A DURABLE park''s SLA deadline passed and the host''s sweep resolved it as a deny. A store
+        `expire`/`reap` produces no `tool_end` and therefore no settlement.
+      required: [kind, who, when]
+      properties:
+        kind: { const: park_sla_expired }
+        who:
+          type: object
+          additionalProperties: false
+          required: [party]
+          properties:
+            party: { const: host }
+            approver: { type: string }
+        when: { type: integer, format: int64 }
+
+    Settlement_fail_closed:
+      type: object
+      additionalProperties: false
+      description: >
+        The fail-closed family — nobody ended the wait, the situation did. `no_approver` (headless: no approver
+        or question face is wired, or the deny posture string) · `approver_unavailable` (the approver answered
+        the ROUTING question "nobody reachable" and no park took the ask) · `approver_error` (it threw) ·
+        `approver_contract` (it answered outside its contract) · `presentation_failed` (args/edit could not be
+        safely presented or adopted) · `blanket_allow_refused` (a blanket `onAsk:"allow"` met a
+        `requiresRealApproval` ask) · `task_aborted` (the wait''s abort signal ended it).
+      required: [kind, who, when]
+      properties:
+        kind:
+          type: string
+          enum: [no_approver, approver_unavailable, approver_error, approver_contract, presentation_failed, blanket_allow_refused, task_aborted]
+        who:
+          type: object
+          additionalProperties: false
+          required: [party]
+          properties:
+            party: { const: none }
+        when: { type: integer, format: int64 }
+
+    GateDisposition:
+      description: 'The final disposition of one tool-gate pass. A deny NAMES the layer that refused.'
+      oneOf:
+        - type: object
+          additionalProperties: false
+          required: [kind]
+          properties:
+            kind: { const: allowed }
+        - type: object
+          additionalProperties: false
+          required: [kind, deniedBy]
+          properties:
+            kind: { const: denied }
+            deniedBy: { $ref: '#/components/schemas/DeniedBy' }
+
+    GateOutcome:
+      type: object
+      additionalProperties: false
+      description: >
+        🔴 BREAKING (server >= 7.64.0, core 7.6.0 design/390 S6-A) — the WHOLE record of ONE tool-gate pass.
+        It REPLACES the four orthogonal words of 7.63.0 and earlier (`settledBy` / `resolution` / `autoDenied` /
+        `approver`, all four DELETED with no alias): their pairing rules lived only in comments, and consumers
+        had to infer semantics from ABSENCE ("a `timeout` with no `resolution` means a durable park expired").
+        Minted ONCE by the engine (the gate''s exit; the decide lane for a durable park) and projected without
+        re-derivation onto three faces — the `permissionDenied` observer payload, this `tool_end` frame, and the
+        durable row''s resolved outcome — so the three cannot tell different stories.
+        The three members are orthogonal but bound by four engine invariants: (I1) `settlement` present <=>
+        `origin` present — they describe the SAME ask; (I2) `deniedBy === "ask_resolution"` => `settlement`
+        present AND a refusal kind; (I3) a `human_allowed` settlement beside a `denied` disposition means a
+        LATER re-check vetoed a person''s approval, so `deniedBy` is one of the veto layers (`policy` / `hook` /
+        `org` / `write_protection`) and the approver stays on the settlement; (I4) an `allowed` disposition has
+        `settlement` absent or `human_allowed`.
+        🔴 NOTHING here is read out of an ABSENCE: an ordinary allow with no ask is
+        `{disposition:{kind:"allowed"}}`, a direct policy deny is `{disposition:{kind:"denied",deniedBy:"policy"}}`,
+        and neither carries a settlement because neither settled one.
+        🔴 The SERVICE withholds a record that fails the engine''s invariant screen (report + withhold, counter
+        `server.trace.gate-outcome-defective`) — so "a gate should have been here but the key is absent" has a
+        fourth cause besides the three below: that record was defective. The four are indistinguishable on the
+        wire; a consumer falls back to `isError` + the message text.
+      required: [disposition]
+      properties:
+        disposition: { $ref: '#/components/schemas/GateDisposition' }
+        settlement:
+          allOf: [{ $ref: '#/components/schemas/Settlement' }]
+          description: 'Present only when THIS pass settled an ask. Same-present/same-absent as `origin` (I1).'
+        origin:
+          allOf:
+            - { $ref: '#/components/schemas/AskOrigin' }
+            # 🔴 闭集执法**只在这一面**:引擎的 `screenGateOutcome` 对 `origin` 判成员,出集即记录缺陷,而
+            #   服务对缺陷记录是整条不上帧 ⇒ 词表外的值在这条 wire 上到不了消费端。审批帧那一面不判成员,
+            #   所以 `AskOrigin` 本体保持真开(见该 schema 的长注)。这张 enum 是本 spec 里该词表的**唯一**
+            #   执法点;core 加词时改这一处。
+            - enum: [content_question, unresolvable, org_unavailable, org_rule, hook, ask_rule, denial_limit_fallback, shell_gate_tighten, safety_tighten, policy]
+          description: >
+            WHO ASKED. Same-present/same-absent as `settlement` (I1). CLOSED here (and only here) — see the
+            enum note above.
+
+    McpDelivered:
+      type: string
+      description: >
+        Whether a failed MCP request REACHED the server (core 7.6.0 `MCP_DELIVERY_VERDICTS`, CLOSED).
+        `yes` = the server answered (a `protocol` rejection proves the exchange happened) · `no` = provably
+        never sent (a connect-phase errno, a spawn failure, a malformed declaration, a server already known
+        dead) — safe to retry, nothing executed · `unknown` = the client stopped waiting or lost the pipe
+        mid-exchange, so the request MAY have executed and a write-capable tool''s side effects must be
+        verified before a retry.
+        🔴 READ IT WITH `errorCode`, never alone: the SAME `connection_closed` is directly retryable at `no`
+        and must be investigated at `unknown` — which is exactly why the verdict is its own field and not
+        folded into the class.
+        ⚠️ `no` says the CALLER''S TOOL CALL was not sent; it does NOT promise the server received zero bytes
+        (an elicitation during the dial may already have crossed the connection) — core''s contract, passed
+        through verbatim.
+      enum: [yes, no, unknown]
+
     Event_tool_end:
       type: object
       description: >
@@ -9063,7 +9730,19 @@ components:
         (TextContent|ImageContent)[] block array) and degrades to a single TRUNCATED string over the core size cap
         (`truncated: true`). Absent ⇒ the tool produced no body. 🔴 UNTRUSTED RAW + observability-only: the service
         has redactDeep'd + size-bounded it; a consumer MAY further bound, MUST never re-feed it to a model.
-      allOf: [{ $ref: '#/components/schemas/EventIdentity' }]
+      allOf:
+        - { $ref: '#/components/schemas/EventIdentity' }
+        # 🔴 现役写口与退役四词**互斥**(S-170 codex r2 [medium] 验真后补):退役四词只出现在 <=7.63.0 写下的
+        #   durable 行上,而那种行结构上**没有** `gate`(7.63.0 压根不铸它)。所以「`gate` 与四词同帧」在
+        #   任何一代的真字节里都不存在 —— 它只可能是现役写口回吐退役键,或一条自相矛盾的合成记录。
+        #   不拒它,「四词只在回放里」这句话就没有任何机器在守(标记键 `x-legacy-replay-only` 是给人和
+        #   codegen 读的,不执法)。
+        - not:
+            anyOf:
+              - { required: [gate, settledBy] }
+              - { required: [gate, resolution] }
+              - { required: [gate, autoDenied] }
+              - { required: [gate, approver] }
       additionalProperties: false   # 封闭 + identity 本地镜像:见 Event_reasoning 处的长注
       required: [type, toolCallId, toolName, isError]
       properties:
@@ -9078,19 +9757,60 @@ components:
         output: {}   # NON-UNIFORM: string | (TextContent|ImageContent)[] | (truncated) string. Absent ⇒ no body.
         truncated: { type: boolean }
         totalChars: { type: integer, description: 'core >=1.442 (RB-210): honest ORIGINAL size when truncated — sum of each block''s true size (text=chars, image/document=base64 bytes), no JSON-wrapping overhead. Absent on older cores / untruncated results.' }  # true ⇒ output was size-bounded to a truncated string.
-        # 🔴 core >=5.18.1 (#187). Closed set, mirrored here as `enum` (the vocabulary's owner is the engine).
-        # ABSENCE CARRIES NO SEMANTICS: it is either an older caller, or a posture arm (headless auto-deny /
-        # blanket onAsk) that deliberately leaves it unset — the two are indistinguishable, so absent is neither
-        # "human" nor "no approval happened". Read the run row / checkpoint face to judge a run's fate.
+        # 🔴 BREAKING (server >=7.64.0, core 7.6.0 S6-A): `settledBy` / `resolution` / `autoDenied` / `approver`
+        # are RETIRED and replaced by the ONE `gate` record below. NO 7.64.0+ writer mints them, and the TS type
+        # does NOT carry them — nobody should code against a dead vocabulary.
+        # 🔴 They are still DECLARED here, and only for one reason: this arm is `additionalProperties: false`, and
+        # the durable-ledger replay leg (`GET /v1/runs/:id/events`) passes a stored `tool_end` row through
+        # VERBATIM (the service's `redactLedgerEventData` returns the row unchanged for this type). Server 7.63.0
+        # and earlier really did write all four into that ledger, so on a deployment upgraded across 7.64.0 those
+        # bytes reach a consumer — and without a declaration that is not "four fields we cannot read", it is the
+        # WHOLE FRAME judged invalid (the same failure family as `permissionRules` and `errorCode` before it).
+        # Same doctrine as `LegacyPlaneTaskResult`: the write face mints ONE shape; a face that replays persisted
+        # bytes admits what the retired writer actually left on disk. `x-legacy-replay-only: true` marks them so a
+        # code generator / a reader can tell them apart from live keys at a glance.
         settledBy:
           type: string
           enum: [human, timeout, aborted]
+          x-legacy-replay-only: true
           description: >
-            core >=5.18.1 (#187) — HOW this call was settled when it went through an approval:
-            `human` = somebody actually answered; `timeout` = the approval window elapsed;
-            `aborted` = abort / unclonable arguments / out-of-contract. Present ONLY on the settled call.
-            Absent = an older caller OR a posture arm that does not fill it — do NOT infer a semantic
-            from the missing key.
+            RETIRED at server 7.64.0 (core 7.6.0 S6-A) — superseded by `gate.settlement`. Appears ONLY when a
+            durable ledger row written by server <= 7.63.0 is replayed. Never minted by a current writer; not on
+            the SDK type. Do not branch on it.
+        resolution:
+          type: string
+          x-legacy-replay-only: true
+          description: 'RETIRED at 7.64.0 — superseded by `gate.settlement.kind`. Replay-only, see `settledBy`.'
+        autoDenied:
+          const: true
+          x-legacy-replay-only: true
+          description: 'RETIRED at 7.64.0 — superseded by `gate.disposition` + `gate.settlement`. Replay-only, see `settledBy`.'
+        approver:
+          type: string
+          x-legacy-replay-only: true
+          description: 'RETIRED at 7.64.0 — superseded by `gate.settlement.who.approver`. Replay-only, see `settledBy`.'
+        gate:
+          allOf: [{ $ref: '#/components/schemas/GateOutcome' }]
+          description: >
+            🔴 server >= 7.64.0 — the WHOLE record of the gate pass this call went through: who allowed it or
+            which LAYER refused it (`disposition`), how the wait it consumed ended (`settlement`, carrying the
+            refusing person and their own note), and who ASKED (`origin`).
+            🔴 ABSENCE IS NOT A FACT ABOUT THIS CALL: the gate never saw it (an unarmed gate, a deferred
+            re-send, an orphan picked up by reconcile) — or the record was defective and the service withheld
+            it (see `GateOutcome`). Never read a semantic out of the missing key.
+        delivered:
+          allOf: [{ $ref: '#/components/schemas/McpDelivered' }]
+          description: >
+            core >= 7.6.0 (S6-B) — whether THIS failed MCP request reached the server. Present only on an MCP
+            failure: every successful call and every non-MCP failure omits it, and the absence carries NO
+            semantics. Read it WITH `errorCode` (see `McpDelivered`).
+        gatedCallId:
+          type: string
+          description: >
+            core >= 5.55.0 (#333) — WHICH tool call a durable park is holding, minted by the engine from the
+            committed checkpoint''s pending action (a tool may not self-report it). Present only on a park
+            frame; absent on a park that holds no tool call (resource_limit / plan_review / task_done) —
+            ABSENT, never guessed.
         # 🔴 core >=5.9.0 (W3 / [2535]). OPEN SET — deliberately a bare `type: string`, NOT an enum.
         # This arm is `additionalProperties: false`, and the server's `toolEndEventData` has been emitting
         # `errorCode` since 5.9.0, so omitting it made every legitimate frame carrying one fail strict
@@ -9105,6 +9825,12 @@ components:
             when `isError` is true. OPEN SET: a verbatim passthrough of any tool's `ToolResult.details.code`.
             The engine's own codes (`gate.parked`, `tool.not_found`) are only two examples; the fs tools
             already emit `path_not_in_root` / `readonly_out_of_root`, and self-registered tools may add more.
+            🔴 core >= 7.6.0 — the MCP family within this open set is now the CLOSED `McpFailureKind` word list
+            (`connect_refused` / `connection_failed` / `connection_closed` / `http_status` / `not_mcp_response` /
+            `spawn_failed` / `timeout` / `protocol` / `invalid_config` / `unknown`); the retired
+            `MCP_FAILURE_CODES` spellings — including `network` and the `http_<status>` encoding — are gone,
+            and an HTTP status now rides the structured `httpStatus` seat on `wiring_manifest.mcp[]` instead of
+            being baked into the code. The set as a WHOLE stays open (a tool owns its own codes).
             Consumers MUST branch with a `default` arm and MUST NOT exhaustively switch on known values.
             The service enforces only a length bound (>128 chars = malformed, the whole key is DROPPED rather
             than truncated — truncating would mint a code core never sent). NOTE: this is a DIFFERENT
@@ -9469,6 +10195,80 @@ components:
                 renders "don't ask again" without reading this bit is advertising an outcome it cannot promise.
                 🔴 Same three-way reading as `syncWired`: present-and-false = concept known, not armed here;
                 absent = the worker never sent the key. Honestly `false` on server 7.12.0.
+        modelGate:
+          type: object
+          additionalProperties: false
+          description: >
+            core >= 7.3.x (design/385 片2b), server >= 7.58 — TENANT-visible: which tools the tool-MODEL gate
+            removed from THIS session and how to get them back. All three keys are engine-derived (`class` = the
+            merged gate table''s class row key, `removed` = wire tool names, `restore` = the engine''s own
+            recovery line), so the service passes them verbatim.
+            🔴 ALL-OR-NOTHING: the service mints the section only when all three keys are present and
+            well-formed — half a section would read as "these are the only tools that were removed".
+            ABSENT = this run had nothing gated (the service never mints an empty section or `removed: []`).
+          required: [class, removed, restore]
+          properties:
+            class: { type: string }
+            removed: { type: array, items: { type: string } }
+            restore: { type: string }
+        autoMode:
+          type: object
+          additionalProperties: false
+          description: >
+            core >= 7.3.1 (#529), server >= 7.59 — TENANT-visible: did AUTO mode actually arm on THIS leg, and
+            if not, which arm did it stop at. Sibling of `GET /v1/capabilities.permissionModeAuto`, which
+            answers the BEFORE question ("would a submit right now arm?"); this section answers the AFTER one
+            ("did the leg that really ran arm?").
+            🔴 `reason` is core''s closed word list passed through VERBATIM and is deliberately NOT normalised
+            onto the service''s own six-word `PermissionModeAutoUnarmedReason` set: the two tables answer
+            different questions at different granularity (core''s single `denied` covers the service''s
+            `org_denied` + `local_denied`, and a settings-level kill-switch folds into core''s `no_intent`,
+            not `denied`, because it rewrites the MODE before the intent seat is ever written). To tell those
+            apart, read `/v1/capabilities`.
+            🔴 ABSENCE IS NOT "not applicable" (core''s own words: it means an older mint or an external
+            derivation) — never fold it to `armed: false`. A self-contradicting pair (`armed` disagreeing with
+            `reason === "armed"`, core''s own in-section invariant) makes the service withhold the WHOLE section.
+          required: [armed, reason]
+          properties:
+            armed: { type: boolean }
+            reason: { type: string, description: 'core''s word (`armed` / `no_intent` / `no_face` / `denied` / `resolver_fault` / `latch_open` today). Open on read — branch known, keep a default arm.' }
+        mcp:
+          type: array
+          description: >
+            core >= 7.5.0 (#562), server >= 7.60 — TENANT-visible: one row per MCP server THIS leg declared —
+            did it connect, if not which failure class, and how many tools it mounted.
+            🔴 AN EMPTY ARRAY IS NOT ABSENCE: `[]` means "this leg declared no servers"; a missing key means an
+            older mint or an external derivation. Never fold one into the other.
+            🔴 The engine''s `error` free text is DELIBERATELY NOT PROJECTED (it is remote-author text, and core
+            already owns the single redaction mint point for it). The actionable cause is `errorCode`.
+            A row missing `name` or `status` is dropped individually — the other servers'' rows still ship.
+          items:
+            type: object
+            additionalProperties: false
+            required: [name, status]
+            properties:
+              name: { type: string, description: 'The declared server name.' }
+              status: { type: string, description: 'Three-word engine set (connected / failed / …). Open on read.' }
+              source: { type: string, description: 'The declarer''s own layer label, echoed verbatim by core (single-line, length-capped).' }
+              toolCount: { type: integer, description: 'Tools mounted. ABSENT rather than 0 — a minted 0 would read as "connected with no tools".' }
+              errorCode:
+                type: string
+                description: >
+                  core >= 7.6.0 — the `McpFailureKind` word (`connect_refused` / `connection_failed` /
+                  `connection_closed` / `http_status` / `not_mcp_response` / `spawn_failed` / `timeout` /
+                  `protocol` / `invalid_config` / `unknown`). The retired 7.5.0 spellings — `network` and the
+                  `http_<status>` encoding — are GONE; an HTTP status now rides `httpStatus`.
+                  Deliberately NOT enumerated here: the vocabulary''s single owner is the engine, and mirroring
+                  it would swallow a newly minted word as a violation. Switch with a `default` arm.
+              delivered:
+                allOf: [{ $ref: '#/components/schemas/McpDelivered' }]
+                description: 'core >= 7.6.0 (S6-B) — did the request reach that server. Read WITH `errorCode`.'
+              httpStatus:
+                type: integer
+                description: >
+                  core >= 7.6.0 (S6-B) — the status the endpoint answered with; rides ONLY with
+                  `errorCode === "http_status"` (401/403 = re-authorize, 5xx = that end is down). ABSENT rather
+                  than 0.
         governance:
           type: object
           additionalProperties: false
@@ -9501,6 +10301,16 @@ components:
         `memory.harvest_quarantined` `{count, moved, escalated, reason?}` — `moved` and `escalated` MUST NOT be
         subtracted from each other (an in-place tombstone counts as both) · `memory.delegation_static_mark_waived`
         `{reason, subagentType?, sessionId?}`.
+        `config.durable_gate_unavailable` — a per-principal `forceDurableGate` entitlement took effect on a leg
+        with NO checkpoint store, so every ask on that leg settles on the LIVE chain (answered in-stream where a
+        live approval / question face exists, fail-closed denied where none does) and NO durable approval record
+        is written. `{sessionId, runId, principal?, cause, liveApprover, liveQuestionFace}`.
+        🔴 `cause` is a CLOSED two-word set: `no_deployment_store` (this deployment wired no store) and
+        `task_store_disabled` (`TaskSpec.checkpointStore: "disabled"` — the per-run off switch).
+        ⚠️ server >= 7.64.0 / core 7.6.0 (D-9) RENAMED that second word from `task_store_null`, and the off
+        switch itself became the WORD `"disabled"` instead of `null` (a string is not nullish, so the ordinary
+        coalesce is the whole resolution rule and no reader has to remember a null test). A consumer still
+        matching `task_store_null` matches nothing.
         A notice whose `detail.sessionId` is absent is HONESTLY NOT DELIVERED (the server never guesses a session),
         so the frame's absence does NOT mean "did not happen" — the operator-facing structured log always has the
         full family. `detail` is already redacted + size-bounded by the server; still treat it as external text.
@@ -9553,14 +10363,28 @@ components:
         kind:
           type: string
           description: >
+            The SIX known kinds (`server src/http/wire-gate.ts` `WIRE_GATE_KINDS`), listed for codegen and
+            autocomplete — NOT a closed set, and deliberately NOT an `enum` (see the note below):
             `human` — plain HITL approval (budget-auto-approvable). `irreversible_ask` — design/37
             irreversibility / design/70 egress tighten; NOT budgetable (load-bearing safety gate).
             `resource_limit` — design/74 cost/token/time slice boundary; resolve `{decision:"continue"}`.
             `needs_review` — design/76 dry-run/shadow → durable `needs_review` TERMINAL (post-prediction
             review, disjoint from the approval family). `task_done` — design/38 Path A background sub-task
-            handle (door B never sees it).
-          enum: [human, irreversible_ask, resource_limit, needs_review, task_done]
+            handle (door B never sees it). `plan_review` — [2400] TR-8 / design/80 D-B PRE-ACTION plan
+            review, resolved at `POST /v1/assistant/tasks/:id/plan_review` (3-state), never at `/decide`.
+            An unknown future kind is VALID on the wire: branch on `kind` and render it generically.
           x-open-enum: true   # do not close this union — an unknown future kind is VALID on the wire
+          # 🔴 顶层 `enum` **已删**(S-170,codex r1 [high] 验真后修)—— 它与本 schema 自己声明的开集语义
+          #   直接矛盾,而矛盾的那一头在执法:
+          #    ① 那张表停在**五**词,漏了 `plan_review` —— 它自 [2400] TR-8 起就是**现役**门(SDK 的
+          #       `CheckpointGate.kind` 与 server 的 `WIRE_GATE_KINDS` 六词都有它),下面 catch-all 臂的注
+          #       甚至还把它当成「未来的未知 kind」举例。一次 plan_review park 的整条响应因此被判违约。
+          #    ② 就算补齐第六词,顶层 `enum` 仍是**合取**的:`x-open-enum` 只是意图标记,标准 JSON Schema
+          #       的 `enum` 照样执法 ⇒ core 加第七个门的当天,每一条那类 park 响应全线违约。
+          #   ⇒ **kind 的合法性只由下面的 `oneOf` 一处决定**(具名臂管已知词的形状,catch-all 管未知词),
+          #   规则从两处变一处。已知词表留在本描述里给 codegen / 自动补全读,不再是第二道执法点。
+          #   (本车把 `terminal.paused.gate` 指向本 schema 之后,这条既存缺陷的射程从 `suspended` 帧扩到了
+          #    每一条 park 终局 —— 所以在本车里修,而不是留给下一车。)
         reason: { type: string, description: 'present on human / irreversible_ask / resource_limit / needs_review (not task_done).' }
         toolName: { type: string, description: 'present on human / irreversible_ask.' }
       oneOf:
@@ -9579,12 +10403,16 @@ components:
         - type: object       # design/38 Path A background sub-task handle (door B never sees it)
           required: [kind]
           properties: { kind: { const: task_done } }
-        - type: object       # OPEN SET — unknown future kind (e.g. design/80 D-B plan_review); render generically, never crash
+        - type: object       # [2400] TR-8 / design/80 D-B — PRE-ACTION plan review; resolved at POST /v1/assistant/tasks/:id/plan_review
+          required: [kind, reason]
+          properties: { kind: { const: plan_review } }
+        - type: object       # OPEN SET — a future kind this contract predates; render generically, never crash
           required: [kind]
-          # 🔴 the pinned wire contract: exclude the 5 KNOWN kinds so a known kind matches ONLY its const member above
+          # 🔴 the pinned wire contract: exclude the KNOWN kinds so a known kind matches ONLY its const member above
           #   (not also this fallback) → keeps `oneOf` unambiguous AND preserves each kind's shape validation.
-          #   This fallback matches ONLY a future kind this contract predates. Add new known kinds to the enum.
-          properties: { kind: { type: string, not: { enum: [human, irreversible_ask, resource_limit, needs_review, task_done] } } }
+          #   This fallback matches ONLY a future kind this contract predates. Add new known kinds to the enum
+          #   AND to this exclusion list (S-170: `plan_review` was a KNOWN kind sitting in neither).
+          properties: { kind: { type: string, not: { enum: [human, irreversible_ask, resource_limit, needs_review, task_done, plan_review] } } }
 
     Event_suspended:
       type: object
@@ -10089,6 +10917,53 @@ components:
             parentToolCallId: { type: string }
             depth: { type: integer }
             agentName: { type: string }
+        # ─── S-139(sdk 8.3.0):对 server 7.60.0 的整体重对账补齐的 9 位 ────────────────────────
+        # 长 description 的单一真源在 `packages/sdk/src/resources/tool-approvals.ts` 的同名成员上;
+        # 这里只留 codegen 需要的形与硬条款一句。机械对账门 = `test/server-keyset-parity.test.ts`。
+        requiresRealApproval:
+          type: boolean
+          enum: [true]
+          description: >
+            server >= 7.30.0 (core 5.37, #283), "tool_approval" only, ADDITIVE: the SAFETY-class provenance
+            bit core stamps at the gate. Present (true) or ABSENT — never encoded as false. Deliberately a
+            DIFFERENT contract from the card's `risk.requiresRealApproval` (which is an always-present
+            boolean): the card form needs the durable ask store, and this key is what lets a LIVE-ONLY
+            deployment read the bit at all. Present ⇒ every automatic allowance (remembered rules,
+            bypassPermissions posture) stands down.
+        origin: { $ref: '#/components/schemas/AskOrigin' }
+        inputHasBidi:
+          type: boolean
+          enum: [true]
+          description: >
+            server >= 7.45.0 (E-14), "tool_approval" only, ADDITIVE: the TO-BE-EXECUTED input (`args`)
+            contains Unicode bidi control characters — what the eye reads may not be the byte order that
+            runs. DISCLOSURE bit, bytes unchanged (sanitising would change the bytes about to execute, which
+            is WORSE than not disclosing); rendering is the shell's. Present (true) or ABSENT; absence !=
+            "verified clean". Computed BEFORE the byte cap, so it can ride a frame whose `args` were omitted.
+        expiresAtMs:
+          type: integer
+          description: >
+            server >= 7.34.0 (#288), "tool_approval" only, ADDITIVE: window triple (with `expiresInMs` and
+            `serverNowMs`, same names/semantics as on ApprovalRequestFrame) so the LEGACY frame family can
+            render a countdown too. `expiresAtMs` = this ask's absolute deadline on the server clock. The
+            three keys are BORN AND ABSENT TOGETHER — any frame that gets emitted carries all three.
+        expiresInMs:
+          type: integer
+          description: 'Window triple (see expiresAtMs): max(0, expiresAtMs - serverNowMs), computed at mint time.'
+        serverNowMs:
+          type: integer
+          description: 'Window triple (see expiresAtMs): the server clock at FRAME MINT time — the countdown anchor; use it to correct local clock skew.'
+        ruleOffersAbsence: { $ref: '#/components/schemas/RuleOffersAbsence' }
+        denialLimitFallback: { $ref: '#/components/schemas/DenialLimitFallback' }
+        parked:
+          type: boolean
+          enum: [true]
+          description: >
+            server >= 7.42.0 (#329), "tool_approval_complete" ONLY, ADDITIVE: the explicit discriminator for
+            the PARK sense of `outcome: "expired"` (which is one word with three landings). Present ⇔ THIS ask
+            settled through the park route ⇒ render "moved to the background queue", not "the card died".
+            🔴 ABSENCE MUST NOT BE READ AS "really denied": a store-less deployment, a deny policy, and a
+            sibling VOIDed in a batch all emit no such key — absence only means "no park evidence".
         outcome:
           type: string
           enum: [allowed, denied, expired]
@@ -10226,6 +11101,10 @@ components:
         probeCause: { type: object, additionalProperties: true, description: 'server >= 7.17.0: structured reversibility-probe tightening cause — same shape and semantics as ToolApprovalFrame.probeCause ({code, roots:{shown,total}, further?:{shown,total}}); frame and card carry the SAME value (one narrow-read function server-side). See that key for the full contract.' }
         ruleEvidence: { type: object, additionalProperties: true, description: 'server >= 7.23.0: rule-provenance evidence — same shape and semantics as ToolApprovalFrame.ruleEvidence (each member a value or a NAMED absence word; display/reconciliation metadata, never adjudication input). Frame and card carry the SAME value. See that key for the full contract.' }
         delegation: { $ref: '#/components/schemas/ApprovalCardDelegation' }
+        # S-139(sdk 8.3.0):同 A-057.④ 的理由 —— server 早随卡投出(帧与卡同一只窄读函数 ⇒ 同值),
+        # 但本 schema 此前只在帧上公示过。长 description 的单一真源在 ToolApprovalFrame 的同名键。
+        ruleOffersAbsence: { $ref: '#/components/schemas/RuleOffersAbsence' }
+        denialLimitFallback: { $ref: '#/components/schemas/DenialLimitFallback' }
 
     RuleSuggestion:
       type: object
@@ -10248,6 +11127,87 @@ components:
           description: '`exact` = this one command only (`Bash(git status)`); `prefix` = word-boundary prefix (`Bash(git status:*)`). Closed vocabulary — an unknown value is not a candidate this contract describes; do not render it as redeemable.'
         command: { type: string, maxLength: 512, description: 'The command pattern inside the rule, for a shell that would rather not re-parse `rule`.' }
 
+    # ─── S-139(sdk 8.3.0):对 server 7.60.0 整体重对账带进来的四张型面 ───────────────────────
+    AskOrigin:
+      type: string
+      x-open-enum: true
+      # 🔴 顶层 `enum` **不放这里**(S-170 codex r2 [medium] 验真后修,与本车对 `CheckpointGate` 的处置同款):
+      #   词表属主是引擎、而且它**真的长过**(core 7.6.0 从 8 词加到 10 词),而 `tool_approval` 帧这一面
+      #   server 只判非空串、不判成员(`src/tool-approval.ts` 帧铸点)⇒ 留一个 `enum` 在这里,core 加词的
+      #   当天,一个**合法**的审批卡就会被严格消费端拒收。`x-open-enum` 只是意图标记,不解除 enum 的执法 ——
+      #   这正是本车刚从 `CheckpointGate` 拆掉的那个假开集,不在这里换个地方重犯。
+      #   闭集**执法**只属于**筛过的**那一面(`GateOutcome.origin`:引擎的 `screenGateOutcome` 判成员,
+      #   出集即整条不上帧),所以那张 enum 落在**那个引用点**,恰一处。已知十词见下面的描述。
+      description: >
+        WHO raised an ask (`ToolApprovalFrame.origin`; server >= 7.57.0 / core 7.5.0, S-125③/#564) — core's
+        `ASK_ORIGINS`, ENGINE-STAMPED at the gate (core's words: "engine-stamped at the gate, never a policy's
+        claim"), transcribed verbatim by the server, which deliberately mints no second eligibility table of
+        its own.
+
+        🔴 READ AS AN OPEN SET. The vocabulary's sole owner is core and it has grown before; branch with a
+        default arm and treat an unknown word as "unknown origin", never as "no origin".
+        🔴 NOT interchangeable with `governanceForced`: this says which KIND of authority asked, that one says
+        whether THIS DEPLOYMENT's ops governance layer is the gate — `origin: policy` covers any deployment
+        ToolPolicy's ask, so a governance-produced ask and an ordinary one look identical in this one word.
+
+        🔴 core 7.6.0 ADDED TWO WORDS (the set was eight through core 7.5.x): `shell_gate_tighten` = the gate's
+        own irreversibility tighten raised the ask over a tier the COARSE `shellGate` doctrine installed (a
+        shell command under `shellGate: "classify"` / `"always"`), and `safety_tighten` = the gate's own
+        post-fold tightens over an EXPLICIT fact of the call (an egress mark, an irreversibility mark, a
+        peer-message referral in auto mode, a write onto the write-protected table). They are separate words
+        precisely so a deny observer or an approval card can say WHICH engine layer raised the question — one
+        word could not. Both are classifier-eligible (arming auto mode is the deployment's explicit choice to
+        let the classifier resolve those classes).
+
+        The SAME type is the `origin` member of `GateOutcome` on `tool_end` — one vocabulary, two faces.
+
+    RuleOffersAbsence:
+      type: string
+      enum: [mandated, shadowed, lane_cannot_speak]
+      description: >
+        WHY `ruleOffers` is absent while the rule lane IS present (`ToolApprovalFrame.ruleOffersAbsence` and
+        `ApprovalCard.ruleOffersAbsence`; server >= 7.55.0 / core #490 fix ②, S-15). The engine names which
+        door is shut: `mandated` = this ask must be confirmed every time (🔴 this arm must NOT point the user
+        at writing a rule — a rule would not silence it, and saying so sends them into a loop); `shadowed` = a
+        rule matched but could not clear it (the machine-readable twin of `persistedRuleShadowed`);
+        `lane_cannot_speak` = the engine could mint no coverable form for this command.
+
+        Engine-side MUTUALLY EXCLUSIVE with `ruleOffers`. 🔴 ABSENCE IS NOT AN ASSERTION — it covers both
+        "there are offers" and the three structural doors, and one frame cannot tell them apart. ADVISORY
+        display metadata, NEVER adjudication input. The frame and the stored `card_json` go through the SAME
+        server-side narrow read, so both faces carry identical values; a word outside the set is treated as
+        malformed and the key is not minted at all (the server never passes an unknown word through).
+
+    DenialLimitKind:
+      type: string
+      enum: [consecutive, total]
+      description: 'Which bound tripped in a `DenialLimitFallback` — the consecutive-refusal limit or the cumulative one.'
+
+    DenialLimitFallback:
+      type: object
+      additionalProperties: false
+      required: [consecutive, total, limit, autoDenyAfterMs]
+      description: >
+        The auto-mode classifier's DENIAL-LIMIT FALLBACK card (`ToolApprovalFrame.denialLimitFallback` and
+        `ApprovalCard.denialLimitFallback`; server >= 7.57.0 / core 7.4.0 #548, S-114): the call that hit the
+        consecutive (default 3) or cumulative (default 20) refusal limit is no longer silently denied — it
+        becomes a card a HUMAN must decide. The same mint also stamps `requiresRealApproval`; the two are twins.
+
+        🔴 ALL FOUR MEMBERS ARE REQUIRED: core's shape has no optional member, so "one missing" is a bad value
+        rather than an older core, and the server drops the whole key instead of half-minting a card whose
+        counts would be misread.
+        🔴 `autoDenyAfterMs` (ms; `0` = not armed — the deployment turned the knob off, or a TOTAL-tier card
+        waits for a person) is for RENDERING THE COUNTDOWN ONLY. Never start a second timer from it: the window
+        is executed by the ENGINE, and two overlapping windows are worse than the original defect and silent.
+        🔴 ABSENCE IS NOT AN ASSERTION — the vast majority of asks are not fallback cards.
+        ⚠️ The durable (parked) leg does NOT carry this key today; the card's copy rides `card_json`, which is
+        a different leg from the parked row's `pendingAction`.
+      properties:
+        consecutive: { type: integer, description: 'Consecutive refusals at the moment the limit tripped.' }
+        total: { type: integer, description: 'Cumulative refusals at the moment the limit tripped.' }
+        limit: { $ref: '#/components/schemas/DenialLimitKind' }
+        autoDenyAfterMs: { type: integer, description: 'This card''s own auto-deny window in ms; 0 = not armed. Countdown rendering only.' }
+
     RuleOfferMatch:
       type: string
       description: >
@@ -10928,8 +11888,15 @@ components:
          · `ActiveRunConflictDoneResult` — the SSE lane's REJECTION terminal: when the session already has an
            active run, the submit's 409 is encoded as this done frame (`src/http/routes/tasks.ts`), and it
            carries NO `taskId` / `sessionId` / `stats`.
-        Narrow on the presence of `stats` (required on TaskResult, absent from the conflict shape), or on
-        `errorCode === "conflict.session_active_run"`. `status` does NOT discriminate — both shapes carry it.
+        Narrow in TWO steps: `stats` present (an engine result) vs absent (the conflict envelope) — or match
+        `errorCode === "conflict.session_active_run"` — and then, among the engine results, `"terminal" in result`
+        (the current cause form) vs absent (`LegacyPlaneTaskResult`, the flat bytes an older generation left in
+        the durable ledger; a REPLAYED frame on an upgraded deployment can be that shape).
+        🔴 server >= 7.64.0 — the two arms are now told apart by their KEYS, not by a shared word: the normal
+        terminal carries `terminal` (the tagged cause) and NO `status`; the conflict shape carries the flat
+        `status: "failed"` + `errorCode` because it is the SERVICE's own rejection envelope, not an engine
+        result, and it did not change. `status` therefore appears on exactly one arm — but keep narrowing on
+        `stats` / `errorCode`, which are the discriminants the service pins.
       additionalProperties: false   # 封闭:帧本身只有 {type,result,replay?};`result` 内部按臂各自裁定(TaskResult 开集,冲突形封闭)
       required: [type, result]
       properties:
@@ -10938,6 +11905,7 @@ components:
           oneOf:
             - $ref: '#/components/schemas/TaskResult'
             - $ref: '#/components/schemas/ActiveRunConflictDoneResult'
+            - $ref: '#/components/schemas/LegacyPlaneTaskResult'
         replay:
           type: boolean
           description: >
@@ -11819,7 +12787,9 @@ components:
         core's assembly self-evidence manifest (core >=5.14.0 `WiringManifest`). TWO HALVES, ONE shape (a
         consumer must line the two faces up, so they are not split into separate types) — but which keys
         belong to which half is DETERMINATE, not "usually": `leg`, `ask.effective` and `configFingerprint`
-        are EFFECTIVE-half only (the live `wiring_manifest` event) and the STATIC half
+        are EFFECTIVE-half only (the live `wiring_manifest` event) — as are the three per-leg sections the
+        event schema declares (`modelGate`, `autoMode`, `mcp`), which describe what THIS leg did and have no
+        static counterpart — and the STATIC half
         (GET /v1/diagnostics/wiring) NEVER mints them; every other section, plus `governance`, is always
         present on the static half. Fields stay optional because core may add or drop sections and that
         must not hard-break a client — read by half, and never wait on a key the half never sends.
@@ -11907,12 +12877,52 @@ components:
 
     WiringDiagnostics:
       type: object
-      description: 'GET /v1/diagnostics/wiring response (operator-only). No per-leg history by design.'
+      description: >
+        GET /v1/diagnostics/wiring response (operator-only). No per-leg history by design.
+        🔴 Every posture key here answers "what can THIS PROCESS say", so its absent form is an explicit
+        `null` — never an empty shell that would read as a real answer. `null` = this process cannot say
+        (it was not assembled by the composition root, or the facility is not wired).
       required: [static, serverGates]
       additionalProperties: false
       properties:
         static: { $ref: '#/components/schemas/WiringManifest' }
         serverGates: { $ref: '#/components/schemas/ServerWiringGates' }
+        writeProtection:
+          oneOf:
+            - $ref: '#/components/schemas/WriteProtectionPosture'
+            - type: 'null'
+          description: >
+            server >= 7.63.0 (S-138) — the write-protection table, WITH row contents (operator face only; the
+            tenant face `capabilities.writeProtection` carries counts alone). Same boot artefact as that bit.
+        memoryPosture:
+          type: ["object", "null"]
+          additionalProperties: true
+          description: >
+            server >= 7.30 (#252) — the memory plane's posture (backend / vector mode / lit-or-dark and why /
+            embedder identity). Facts that used to live only in the startup log, which is neither queryable nor
+            aggregatable across replicas. NOT YET MIRRORED KEY-BY-KEY in this SDK generation: declared here so a
+            strict consumer stops rejecting a real operator response, read it as opaque.
+        sqlEngine:
+          type: ["object", "null"]
+          additionalProperties: true
+          description: >
+            server >= 7.60 (S-131) — this deployment's SQL engine posture (engine / version / session isolation
+            level / TiDB transaction mode), READ BACK off a live connection rather than echoed from env.
+            `null` = no SQL backend. NOT YET MIRRORED KEY-BY-KEY in this SDK generation — read as opaque.
+        configApply:
+          type: ["object", "null"]
+          additionalProperties: true
+          description: >
+            server >= 7.5x (#322) — the config generation ledger's operator face (per-group appliedVersion,
+            deferredKeys with their reason, and a SANITISED lastRejected: key names and verdict text only,
+            never values). The three keys on `/health` are a narrow projection of this same reading.
+            NOT YET MIRRORED KEY-BY-KEY in this SDK generation — read as opaque.
+        mcpRevocations:
+          type: ["object", "null"]
+          additionalProperties: true
+          description: >
+            server >= 7.5x (#324, design/338) — the mid-turn MCP revocation list. `null` = this process has no
+            config pipeline (it cannot say). NOT YET MIRRORED KEY-BY-KEY in this SDK generation — read as opaque.
 
     SendfileLinkRow:
       type: object