@sema-agent/sdk 8.3.0 → 8.5.0

package/openapi.yaml

@@ -5633,6 +5633,121 @@ components:
           properties:
             clampTolerance: { type: number }
 
+    TerminalCause:
+      description: >
+        🔴 BREAKING (server >= 7.64.0, core 7.6.0 design/390 D-8) — WHY the run ended, as ONE tagged cause
+        and the ONLY terminal record a `TaskResult` carries. It REPLACES the eight parallel plane keys of
+        7.63.0 and earlier (`status` / `errorCode` / `errorMessage` / `blockedReason` / `checkpointToken` /
+        `checkpointId` / `checkpointGate` / `workspaceRestoreMode`), all of which are GONE from this schema —
+        no optional compatibility twin ships, because two spellings of one fact on one wire is two writers on
+        one semantic surface.
+        TRIAGE ON `terminal.kind`. The legacy five-word `status` (and the seven flat words) is a DERIVATION:
+        call the engine's `terminalProjection(terminal)` — the ONE cause->plane derivation — never hand-roll it.
+        Which pause reads as `suspended` and which as `needs_review` is decided by the engine's pause registry,
+        not by this service.
+        🔴 The service's OWN columns and envelopes are UNCHANGED and still speak the five words: the `status` /
+        `errorCode` columns on `GET /v1/runs/:id`, the task-list row `status`, the `/decide` 200 body's
+        `status` / `errorCode` / `errorMessage`, and the fleet row's terminal word. Only their data source moved
+        (projected once from the cause).
+      oneOf:
+        - $ref: '#/components/schemas/TerminalCause_completed'
+        - $ref: '#/components/schemas/TerminalCause_failed'
+        - $ref: '#/components/schemas/TerminalCause_blocked'
+        - $ref: '#/components/schemas/PausedCause'
+      discriminator:
+        propertyName: kind
+        mapping:
+          completed: '#/components/schemas/TerminalCause_completed'
+          failed: '#/components/schemas/TerminalCause_failed'
+          blocked: '#/components/schemas/TerminalCause_blocked'
+          paused: '#/components/schemas/PausedCause'
+
+    TerminalCause_completed:
+      type: object
+      additionalProperties: false
+      description: 'The run finished (a person''s clean halt included — see `TaskResult.haltedByUser`).'
+      required: [kind]
+      properties:
+        kind: { const: completed }
+
+    TerminalCause_failed:
+      type: object
+      additionalProperties: false
+      description: 'A limit, a provider failure, an abort, an invalid output…'
+      required: [kind]
+      properties:
+        kind: { const: failed }
+        code:
+          type: string
+          description: >
+            The machine code this failure carried — the seat the retired flat `errorCode` occupied, now
+            STRUCTURALLY owned by the failure arm ("a code belongs to a failure" is the shape, not a
+            cross-field convention). OPEN SET, dotted namespaces so a caller can prefix-match a whole class:
+            `limits.max_tokens_exceeded` / `limits.max_cost_exceeded` / `limits.max_turns_exceeded` /
+            `limits.max_walltime_exceeded` / `config.*` / `resume_at.*`; brain codes (`auth` / `network` /
+            `rate_limit` / …) and `conflict` stay FLAT. Two EXTERNAL stop causes are deliberately NOT
+            `limits.*` (retrying them needs a new environment / a freed window, not a smaller budget):
+            `env.lifetime_expired` and `usage.window_exhausted`.
+            Governance codes arrive here too, and WHICH leg remaps one to an HTTP status differs per code —
+            do not generalize from one to the other: (a) `memory.admission_denied` /
+            `memory.admission_required` are remapped to 403/503 ONLY on the synchronous `POST /v1/tasks`;
+            on `POST /v1/runs` -> `GET /v1/runs/{taskId}` and on the SSE `done` frame they ride a 200 result.
+            (b) `usage.window_exhausted` is a 429 only when the PRE-ADMISSION gate catches it; caught in the
+            race after admission it is NOT remapped on any leg, including the synchronous 200.
+            A NESTED orchestrator that met a durable pause it cannot drive stamps `unexpected.suspended` /
+            `unexpected.needs_review` and carries that pause on `nestedPause`.
+            Consumers MUST branch with a `default` arm. Absent = the failure never had a code.
+        message: { type: string, description: 'Human-readable failure text. Absent when there was none.' }
+        nestedPause:
+          allOf: [{ $ref: '#/components/schemas/PausedCause' }]
+          description: >
+            The durable pause this failure STANDS IN FOR — set ONLY at a nested hard boundary (verify /
+            cascade): the nested leg paused on a durable gate the orchestrator cannot drive, so at ITS
+            boundary the pause is reported as a failure while the pause's own cause travels here verbatim.
+            🔴 On the wire it carries NO `token` — the same withholding rule as the top-level `paused` arm
+            (see `PausedCause`); `gate` / `checkpointId` are present as usual.
+            Absent on every failure the engine itself assembles.
+
+    TerminalCause_blocked:
+      type: object
+      additionalProperties: false
+      description: 'The agent could not finish and said why (a governance verdict is NOT a failure).'
+      required: [kind, reason]
+      properties:
+        kind: { const: blocked }
+        reason: { type: string, description: 'Why the agent could not finish.' }
+
+    PausedCause:
+      type: object
+      additionalProperties: false
+      description: >
+        A durable pause committed a checkpoint and the run is resumable.
+        🔴 THE `token` SEAT IS NEVER ON THE WIRE. It is the resume CAPABILITY (token-as-auth) and never leaves
+        the service — the SAME discipline the retired top-level `checkpointToken` had, only the credential
+        changed address (`src/terminal.ts` `stripResumeToken` removes it on both reachable paths: this arm and
+        `TerminalCause_failed.nestedPause`). To act on this pause call
+        `POST /v1/approvals/{sessionId}/decide` and reconcile by `checkpointId`.
+      required: [kind, gate]
+      properties:
+        kind: { const: paused }
+        gate:
+          allOf: [{ $ref: '#/components/schemas/CheckpointGate' }]
+          description: 'WHICH pause — who/what must resume it. Same word as the park row''s `gate.kind`.'
+        checkpointId:
+          type: string
+          description: >
+            The pause's NON-SECRET stable identity — the display/correlation key to log or render where the
+            token must not travel. Absent on pre-identity checkpoints.
+        restoreMode:
+          type: string
+          enum: [snapshot, park_only]
+          description: >
+            HOW the paused task's remote workspace comes back, present whenever the pause captured one.
+            `snapshot` = the VM was suspended into a snapshot (provider billing typically stops).
+            `park_only` = the env declared itself non-suspendable (an SSH host / an ADB device) so NOTHING was
+            paused: the machine keeps running and keeps costing. ABSENT for a process-local pause — a
+            scheduler that assumes "paused => idle and free" must be able to see the difference.
+
     TaskResult:
       type: object
       # 🔴 **刻意不封闭**(census 轴一裁定,2026-07-30)。此前是「没写」= JSON Schema 默认开放,分不清
@@ -5642,12 +5757,21 @@ components:
       # 这里改成 false 会让 spec 与本仓自己的类型面互相打脸,并且把「引擎加字段」判成 wire 违约(它不是)。
       # 收紧这一面的正解不是 additionalProperties,是把引擎真发的键**逐个登记**(字段级 drift 门的活)。
       additionalProperties: true
-      description: Synchronous task result (`POST /v1/tasks`).
-      required: [taskId, sessionId, status, stats]
+      description: >
+        Synchronous task result (`POST /v1/tasks`). 🔴 BREAKING at server 7.64.0: the terminal is ONE tagged
+        cause (`terminal`), not the eight parallel plane keys — see `TerminalCause`.
+      required: [taskId, sessionId, terminal, stats]
       properties:
         taskId: { type: string }
         sessionId: { type: string }
-        status: { $ref: '#/components/schemas/RunStatus' }
+        terminal:
+          allOf: [{ $ref: '#/components/schemas/TerminalCause' }]
+          description: >
+            🔴 server >= 7.64.0 — the ONE terminal record. Branch on `terminal.kind`. The eight retired plane
+            keys (`status` / `errorCode` / `errorMessage` / `blockedReason` / `checkpointToken` /
+            `checkpointId` / `checkpointGate` / `workspaceRestoreMode`) are GONE from this schema and this
+            SDK ships NO compatibility projection: a consumer that still needs the five-word `status` calls
+            the engine's `terminalProjection(terminal)` itself.
         result: { type: string }
         activeTaskId:
           type: [string, 'null']
@@ -5678,20 +5802,13 @@ components:
         salvagedOutput:
           type: string
           description: Partial output preserved when the run could not complete normally (best-effort salvage).
-        blockedReason:
-          type: string
-          description: Why a `blocked` status was reached (human-readable).
-        checkpointGate:
-          description: >
-            The gate kind that produced `checkpointToken` when the run suspended. Deliberately UNTYPED here —
-            the shape is core's and still evolving; treat it as opaque and branch on `status`/`errorCode` instead.
         toolCallId:
           type: string
           description: >
             [4913] (server 7.41+) — the PENDING tool call's id when this result is a durable park
-            (`status` suspended/needs_review with a `tool_approval` pending action); same key and meaning as the
+            (`terminal.kind === "paused"` with a `tool_approval` pending action); same key and meaning as the
             `tool_approval` frame's `toolCallId` (server >= 1.307). ABSENT (key omitted, never null) on a
-            tool-less park (resource_limit / plan_review / task_done), on every terminal result, and when the
+            tool-less park (resource_limit / plan_review / task_done), on every non-paused cause, and when the
             server-side checkpoint read failed — consumers test presence.
         degraded:
           type: object
@@ -5716,21 +5833,6 @@ components:
           description: >
             The task's structured (schema-constrained) output when one was requested. Shape is caller-defined,
             so this is intentionally untyped.
-        errorCode:
-          type: string
-          description: >
-            Result-level terminal code (NOT an HTTP error). Includes `budget.precall` / `budget.exceeded`
-            (cost gate, non-retryable) — branch on this, not on a 4xx (pinned wire contract).
-            Governance codes also arrive HERE, and WHICH leg renders them as an HTTP status differs per code —
-            do not generalize from one to the other:
-            (a) `memory.admission_denied` / `memory.admission_required` (server >=7.0.0) are remapped to 403/503
-            ONLY on the synchronous `POST /v1/tasks`; on `POST /v1/runs` -> `GET /v1/runs/{taskId}` and on the
-            SSE `done` frame they ride a 200 result (those legs have no second chance at a status line).
-            (b) `usage.window_exhausted` is a 429 only when the PRE-ADMISSION gate catches it (all three submit
-            endpoints). When the window is exhausted in the race after admission, the engine's refusal is NOT
-            remapped on any leg — it lands in the result, including a 200 from the synchronous `POST /v1/tasks`.
-            Branch on this field, never on the status alone.
-        errorMessage: { type: string }
         retryAfterMs:
           type: integer
           description: >
@@ -5751,6 +5853,51 @@ components:
             rounds: { type: integer }
             findings: { type: array, items: { type: string } }
 
+    LegacyPlaneTaskResult:
+      type: object
+      additionalProperties: true
+      description: >
+        🔴 THE SHAPE THAT IS ON DISK — a task result written by server 7.63.0 or earlier, in the retired FLAT
+        plane form. It appears ONLY on the faces that REPLAY PERSISTED BYTES, and only on a deployment that was
+        upgraded across 7.64.0: `GET /v1/runs/:id` -> `result` (the service passes the stored blob through
+        verbatim, redaction only — `src/http/routes/runs.ts`) and the durable-ledger replay of the `done` frame.
+        NOTHING WRITES IT ANY MORE: the write path mints exactly one shape (`TaskResult`, with `terminal`).
+        🔴 THIS IS NOT A COMPATIBILITY TWIN. The rule against "two spellings of one fact on one wire" is about
+        WRITERS: two producers of one semantic surface. Here there is ONE writer and a READ face that admits the
+        bytes a now-retired writer actually left on disk — the same distinction the service draws for its own
+        two-generation reader (`persistedPlaneOf`, whose header records the two reproducible regressions that
+        deleting it caused: a 500 on every historical `GET /v1/runs/:id`, and unredacted credentials replayed
+        from old ledger rows).
+        NARROWING: `"terminal" in result` — present = the current cause form, absent = this shape. Do NOT narrow
+        on `status` alone: the SSE conflict envelope (`ActiveRunConflictDoneResult`) also carries `status`.
+        🔴 `terminal` IS REFUSED HERE, and that clause is load-bearing rather than decorative: the two
+        generations are MUTUALLY EXCLUSIVE on disk (7.63.0 wrote `status` and never `terminal`; 7.64.0 writes
+        `terminal` and never `status`), and without the refusal a MALFORMED current result — `terminal: null`,
+        an unknown cause kind, a `paused` cause that still carries its `token` — would fail the `TaskResult`
+        arm and then be LAUNDERED through this one, so the read faces would silently lose every negative
+        control `TaskResult` enforces while a consumer narrowing on `"terminal" in result` walks straight into
+        it. The documented discriminant and the enforced one are the same clause.
+      not: { required: [terminal] }
+      required: [taskId, sessionId, status, stats]
+      properties:
+        taskId: { type: string }
+        sessionId: { type: string }
+        status: { $ref: '#/components/schemas/RunStatus' }
+        result: { type: string }
+        stats: { $ref: '#/components/schemas/TaskStats' }
+        errorCode: { type: string, description: 'The retired flat terminal code. Its successor is `TerminalCause.failed.code`.' }
+        errorMessage: { type: string, description: 'The retired flat failure text. Successor: `TerminalCause.failed.message`.' }
+        blockedReason: { type: string, description: 'The retired flat governance reason. Successor: `TerminalCause.blocked.reason`.' }
+        checkpointGate:
+          description: >
+            The retired flat pause gate — UNTYPED here on purpose, because these are bytes an older generation
+            wrote and this contract does not re-litigate their shape. Successor: `TerminalCause.paused.gate`
+            (typed as `CheckpointGate`).
+        salvagedOutput: { type: string }
+        model: { type: string }
+        toolCallId: { type: string }
+        retryAfterMs: { type: integer }
+
     RunReceipt:
       type: object
       # 封闭(census 轴一,2026-07-30):producer 铸造点 routes/runs.ts 与 idem 重放臂各自逐字写死
@@ -5769,7 +5916,12 @@ components:
       description: >
         Run state (`GET /v1/runs/:id`) — live shape per the pinned wire contract Drift 2: `result` is the NESTED TaskResult
         object (output text in result.result, stats in result.stats; NO top-level stats), and the error text
-        field is `error` (not errorMessage; errorCode is floated up from result.errorCode).
+        field is `error` (not errorMessage).
+        🔴 server >= 7.64.0 — this ROW's own `status` / `errorCode` columns are UNCHANGED and still speak the
+        five words; only their SOURCE moved. The nested `result` is the engine result itself and therefore
+        changed shape with it (`result.terminal`, no plane keys): the row's `errorCode` column is now projected
+        from `result.terminal` (`src/http/routes/runs.ts` -> `persistedPlaneOf`, which also reads the flat bytes
+        7.63.0 and earlier wrote to disk), NOT copied from a `result.errorCode` that no longer exists.
       # 封闭(census 轴一,2026-07-30;A-075.21 回填后 12 键):铸造点 routes/runs.ts 是一个逐键写死的
       # 字面量(taskId/sessionId/status/msSinceLastActivity/crossSliceUsage/result/supervisorCost/
       # suggestions/errorCode/error/jobId/source),与本 properties 一一对上;只有 taskId/sessionId/status
@@ -5806,10 +5958,21 @@ components:
             spentMicroUsd: { type: integer, description: 'Integer micro-USD; absent on unpriced deployments (unknown, not 0).' }
             maxSlices: { type: integer }
             sliceCount: { type: integer }
-        result: { $ref: '#/components/schemas/TaskResult' }
+        result:
+          oneOf:
+            - $ref: '#/components/schemas/TaskResult'
+            - $ref: '#/components/schemas/LegacyPlaneTaskResult'
+          description: >
+            🔴 A READ-OF-DISK face, so it carries TWO generations of bytes (see `LegacyPlaneTaskResult`): the
+            current cause form on anything server >= 7.64.0 wrote, and the retired flat form on rows written
+            before the upgrade. The service passes the stored blob through verbatim (redaction only) and does
+            NOT back-fill `terminal`. Narrow on `"terminal" in result`.
         errorCode:
           type: string
-          description: Result-level terminal code (e.g. `budget.exceeded`, `cancelled`); NOT an HTTP error.
+          description: >
+            Result-level terminal code (e.g. `budget.exceeded`, `cancelled`); NOT an HTTP error. This ROW COLUMN
+            is unchanged at 7.64.0 — only its source moved (projected from `result.terminal`, or read straight
+            off a legacy flat blob).
         error: { type: string }
         jobId:
           type: string
@@ -6080,20 +6243,29 @@ components:
               input: { description: tool-call — redacted args. }
               callId: { type: string }
               isError: { type: boolean }
-              # 🔴 core >=5.18.1 (#187) —— 与 `Event_tool_end.settledBy` **同一个值**:server 的共享挑键器
-              # `toolResultFieldsOf`(src/trace/project.ts)同时喂 turns 面与 trace SSE 面,而写侧
-              # `toolEndEventData` 喂 durable 账本 —— 三面一个真源,所以这里的词表与那边逐字相同。
-              settledBy:
+              # 🔴 BREAKING (server >=7.64.0, core 7.6.0 S6-A) —— 与 `Event_tool_end.gate` **同一个值**:server 的
+              # 共享挑键器 `toolResultFieldsOf`(src/trace/project.ts)同时喂 turns 面与 trace SSE 面,而写侧
+              # `toolEndEventData` 喂 durable 账本 —— 三面一个真源。退役的 `settledBy` 与它的三兄弟
+              # (`resolution`/`autoDenied`/`approver`)在这三面上一并删除。
+              gate:
+                allOf: [{ $ref: '#/components/schemas/GateOutcome' }]
+                description: >
+                  tool-result — the WHOLE record of this call''s gate pass (see `GateOutcome`). The READ leg
+                  screens it INDEPENDENTLY of the write leg (a ledger row can come from any engine generation or
+                  a third-party producer), so a defective record is withheld here too. Absence is not a fact
+                  about the call.
+              delivered:
+                allOf: [{ $ref: '#/components/schemas/McpDelivered' }]
+                description: 'tool-result — MCP delivery verdict; read with `errorCode`. Absent on every non-MCP-failure result.'
+              errorCode:
                 type: string
-                enum: [human, timeout, aborted]
                 description: >
-                  tool-result — HOW this call was settled when it went through an approval: `human` = somebody
-                  actually answered; `timeout` = the approval window elapsed; `aborted` = abort / unclonable
-                  arguments / out-of-contract. Present ONLY on the settled call.
-                  ABSENCE CARRIES NO SEMANTICS (an older worker, or a posture arm that deliberately leaves it
-                  unset — the two are indistinguishable), so absent is neither "human" nor "no approval
-                  happened". The read leg re-validates the closed set independently of the write leg, because a
-                  ledger row can come from any engine generation.
+                  tool-result — the machine code for WHY this call failed, verbatim from any tool''s
+                  `ToolResult.details.code` (OPEN set; the MCP family within it is core''s closed
+                  `McpFailureKind` word list since 7.6.0). Same key and semantics as `Event_tool_end.errorCode`.
+              gatedCallId:
+                type: string
+                description: 'tool-result — WHICH tool call a durable park is holding (core >= 5.55.0); absent on a tool-less park.'
         tokens:
           type: object
           properties:
@@ -6831,6 +7003,9 @@ components:
             `roots` (copying an upstream default onto the wire becomes a lie the day core changes it).
             Minimal disclosure — the deny table itself is never on the capability face. There is NO
             per-request `readFace` field on TaskRequest.
+            server >= 7.65.0 (S-167): on a SINGLE-USER TURNKEY worker (REQUIRE_PRINCIPAL unset) with no
+            READ_FACE set this bit is `"open"` (posture-derived), where 7.64.0 answered `null`; multi-tenant
+            workers still answer `null`. Provenance lives on the operator face `diagnostics.wiring.readFace`.
         callerCwd:
           type: boolean
           description: >
@@ -6894,6 +7069,105 @@ components:
             denial:
               type: ["string", "null"]
               enum: [entitlement_resolver_absent, null]
+        writeProtection:
+          oneOf:
+            - $ref: '#/components/schemas/WriteProtectionCapability'
+            - type: 'null'
+          description: >
+            server >= 7.63.0 (S-138) — the WRITE-PROTECTION TABLE's posture on this deployment (see
+            `WriteProtectionCapability`). `null` = this process cannot say; an ABSENT key means an OLDER worker,
+            and "no key" is NOT "no table" — an absent seat on the engine side is precisely the DEFAULT TABLE
+            BEING IN PLACE.
+    WriteProtectionCapability:
+      type: object
+      additionalProperties: false
+      description: >
+        server >= 7.63.0 (S-138) — the WRITE-PROTECTION TABLE's posture on this deployment. The engine's
+        literal name table downgrades a locatable write (Write / Edit / NotebookEdit) that lands on a table
+        row from `allow` to `ask`, so a shell can tell in advance that those paths will raise a card.
+        🔴 THE THREE ARE DELIBERATELY NOT FOLDED INTO ONE BOOLEAN: folded, "the engine's default table is
+        in place" and "an operator swapped in a table of their own" both read `true`, and those two say
+        different things to an operator.
+        🔴 MINIMUM DISCLOSURE: the per-row names/kinds are NOT here — a deployment-authored row can carry
+        an internal path name, and listing them tells anyone who wants around them which names are NOT
+        protected. Rows live on the operator face `GET /v1/diagnostics/wiring` -> `writeProtection.rows`.
+        🔴 A PARALLEL MECHANISM, NOT THE SAME ONE: `SENSITIVE_WRITE_PATTERNS` (pattern-shaped write deny)
+        is reported separately and must never be folded into this bit — the two have different fixes.
+        The three-state reading of the SEAT itself lives at the reference point (`Capabilities.writeProtection`):
+        `null` = this process cannot say; key absent = an older worker (and "no key" is NOT "no table").
+      required: [armed, rows, replaced]
+      properties:
+        armed: { type: boolean, description: 'The effective table is non-empty => the engine really will raise a card on a row hit.' }
+        rows: { type: integer, description: 'How many rows the effective table has (contents stay on the operator face).' }
+        replaced: { type: boolean, description: 'The whole-table replacement knob was written => the default table is no longer in place as-is (an explicit EMPTY table counts — "the operator turned it off" is not "nothing was touched").' }
+
+
+    WriteProtectedRow:
+      type: object
+      additionalProperties: false
+      description: >
+        One row of the write-protection table (core `WriteProtectedRow`): a LITERAL name plus how it matches.
+        The `name` is also the row's stable identity — the string a refusal / ask message cites.
+      required: [name, kind]
+      properties:
+        name: { type: string }
+        kind:
+          type: string
+          enum: [basename, segment, segment-run]
+          description: >
+            `basename` = the target's LAST segment equals the row name · `segment` = ANY path segment equals it ·
+            `segment-run` = a CONSECUTIVE run of segments equals the row's `/`-separated segments.
+
+    WriteProtectionPosture:
+      type: object
+      additionalProperties: false
+      description: >
+        server >= 7.63.0 (S-138) — the OPERATOR face of the write-protection table (`GET /v1/diagnostics/wiring`
+        -> `writeProtection`). Same boot artefact as the tenant-facing `capabilities.writeProtection`, so the two
+        faces cannot tell different stories; this one adds the ROW CONTENTS, which the tenant face withholds.
+      required: [rows, source]
+      properties:
+        rows:
+          type: array
+          items: { $ref: '#/components/schemas/WriteProtectedRow' }
+          description: 'The effective table, verbatim from the engine''s own compile (the service recomputes nothing). Empty = an explicitly empty table.'
+        source:
+          type: string
+          enum: [default, extra, replace, off]
+          description: >
+            `default` = neither knob was written (the engine's default table is in place; the service does NOT
+            copy that table — the engine owns it) · `extra` = default plus additions · `replace` = whole-table
+            replacement · `off` = replaced with an EMPTY table (legal, and loud).
+        droppedDefaultRows:
+          type: array
+          items: { type: string }
+          description: >
+            The DEFAULT row names a whole-table replacement dropped. Present only on the replacement family
+            (`extra` / `default` cannot structurally drop a row). Row identity is judged by the ENGINE's own
+            fold rule, so a case-variant spelling is not reported as a loss.
+
+    ReadFacePosture:
+      type: object
+      additionalProperties: false
+      description: >
+        server >= 7.65.0 (S-167) — the READ containment rung of this deployment AND WHO SET IT (operator face
+        `GET /v1/diagnostics/wiring` -> `readFace`). `face` is the same boot artefact as the tenant-facing
+        `capabilities.readFace` (`null` = nothing pinned by this deployment, the engine default is in force).
+        `source` is a CLOSED four-word set on the server (exhaustive switch — adding a word is a compile error
+        there): `env` = this machine's READ_FACE env var (wins over everything) · `center` = the config-center
+        readFace domain (restart-to-apply) · `posture` = derived from the single-user turnkey posture
+        (REQUIRE_PRINCIPAL unset ⇒ `open`; server >= 7.65.0 behaviour change) · `engine-default` = not pinned.
+        `note` is a human-facing pointer for operators. Minimal disclosure: the deny table is never on this face.
+      required: [face, source, note]
+      properties:
+        face:
+          type: ["string", "null"]
+          enum: [open, roots, null]
+        source:
+          type: string
+          enum: [env, center, posture, engine-default]
+        note:
+          type: string
 
     SkillSpec:
       type: object
@@ -9267,6 +9541,214 @@ components:
         parentToolCallId: { type: string }
         sourceTaskId: { type: string }
         bgAgentId: { type: string }
+    DeniedBy:
+      type: string
+      description: >
+        WHO REFUSED a call — the LAYER whose verdict is the deny (core 7.6.0 `DENIED_BY_VALUES`, 8 words,
+        CLOSED). The other question a deny raises — who ASKED — is answered by `AskOrigin`; the two used to
+        share one seven-word list in which `classifier` meant both.
+        `policy` = the deployment `ToolPolicy` denied (directly, or re-checking an approved edit), or the
+        approval-edit chain hit its round cap · `hook` = a PreToolUse hook denied, threw, or never answered ·
+        `org` = an organization policy rule denied · `classifier` = the auto-mode classifier denied directly ·
+        `plan_mode` = plan mode's read-only block on a write tool · `compliance` = the compliance call-time
+        lock · `write_protection` = an approved edit was rewritten onto a write-protected path no approval
+        covers · `ask_resolution` = the ask's own settlement IS the refusal (detail on `GateOutcome.settlement`).
+        🔴 CLOSED ON THIS WIRE, and deliberately not marked open: the engine's invariant screen
+        (`screenGateOutcome`) treats an out-of-set `deniedBy` as a DEFECT, and the service withholds a defective
+        record WHOLE (report + withhold). A word outside this set therefore cannot reach a consumer — it arrives
+        as the `gate` key being ABSENT, never as an unfamiliar word. Same rule for `Settlement.kind` and for
+        `GateOutcome.origin`.
+      enum: [policy, hook, org, classifier, plan_mode, compliance, write_protection, ask_resolution]
+
+    Settlement:
+      description: >
+        HOW the wait an ask was in ENDED — a DISCRIMINATED union on `kind` (core 7.6.0 `SETTLEMENT_KINDS`,
+        12 words, CLOSED). It is deliberately NOT a free product of `kind` x `who`: a free product can express
+        "human_allowed, ended by the engine's window" — a structurally complete record that contradicts itself.
+        `who` says WHICH PARTY ended it and its shape is fixed BY the word; `when` is epoch ms written at the
+        settlement site; a person's refusal carries the decider's own `note` when one was attached.
+        🔴 Single mint: every kind is composed by the ENGINE at the site whose wait ended. A host never mints a
+        word — it reports FACTS (a synchronous approver's `human`/`timeout`, a durable decide's
+        `decidedBy: "person" | "sla_timeout"`) and core turns them into the word.
+        Server-side projection note: `who.approver` and `note` are host-derived / decider-authored text and are
+        secret-redacted (and `note` length-bounded) before they reach this wire.
+      oneOf:
+        - $ref: '#/components/schemas/Settlement_human'
+        - $ref: '#/components/schemas/Settlement_approval_window_expired'
+        - $ref: '#/components/schemas/Settlement_denial_limit_window_expired'
+        - $ref: '#/components/schemas/Settlement_park_sla_expired'
+        - $ref: '#/components/schemas/Settlement_fail_closed'
+
+    Settlement_human:
+      type: object
+      additionalProperties: false
+      description: 'A person (or the approver acting for one) decided. `human_refused` may carry the decider''s own note.'
+      required: [kind, who, when]
+      properties:
+        kind: { type: string, enum: [human_allowed, human_refused] }
+        who:
+          type: object
+          additionalProperties: false
+          required: [party]
+          properties:
+            party: { const: person }
+            approver: { type: string, description: 'The attribution the approval channel reported. Absent = the channel reported no name — NEVER read as "nobody approved".' }
+        when: { type: integer, format: int64, description: 'Epoch ms, written at the settlement site.' }
+        note: { type: string, description: 'The refusing decider''s own words, when one was attached. A refusal WITHOUT a note is a bare "no".' }
+
+    Settlement_approval_window_expired:
+      type: object
+      additionalProperties: false
+      description: 'An approval window elapsed with no answer — the engine''s own approval factory window, or a synchronous host approver reporting its own window elapsed.'
+      required: [kind, who, when]
+      properties:
+        kind: { const: approval_window_expired }
+        who:
+          oneOf:
+            - type: object
+              additionalProperties: false
+              required: [party, window]
+              properties:
+                party: { const: engine }
+                window: { const: approval_factory }
+            - type: object
+              additionalProperties: false
+              required: [party]
+              properties:
+                party: { const: host }
+        when: { type: integer, format: int64 }
+
+    Settlement_denial_limit_window_expired:
+      type: object
+      additionalProperties: false
+      description: 'The classifier denial-limit fallback''s auto-deny window (core''s own timer over the synchronous leg) elapsed with no answer.'
+      required: [kind, who, when]
+      properties:
+        kind: { const: denial_limit_window_expired }
+        who:
+          type: object
+          additionalProperties: false
+          required: [party, window]
+          properties:
+            party: { const: engine }
+            window: { const: denial_limit }
+        when: { type: integer, format: int64 }
+
+    Settlement_park_sla_expired:
+      type: object
+      additionalProperties: false
+      description: >
+        A DURABLE park''s SLA deadline passed and the host''s sweep resolved it as a deny. A store
+        `expire`/`reap` produces no `tool_end` and therefore no settlement.
+      required: [kind, who, when]
+      properties:
+        kind: { const: park_sla_expired }
+        who:
+          type: object
+          additionalProperties: false
+          required: [party]
+          properties:
+            party: { const: host }
+            approver: { type: string }
+        when: { type: integer, format: int64 }
+
+    Settlement_fail_closed:
+      type: object
+      additionalProperties: false
+      description: >
+        The fail-closed family — nobody ended the wait, the situation did. `no_approver` (headless: no approver
+        or question face is wired, or the deny posture string) · `approver_unavailable` (the approver answered
+        the ROUTING question "nobody reachable" and no park took the ask) · `approver_error` (it threw) ·
+        `approver_contract` (it answered outside its contract) · `presentation_failed` (args/edit could not be
+        safely presented or adopted) · `blanket_allow_refused` (a blanket `onAsk:"allow"` met a
+        `requiresRealApproval` ask) · `task_aborted` (the wait''s abort signal ended it).
+      required: [kind, who, when]
+      properties:
+        kind:
+          type: string
+          enum: [no_approver, approver_unavailable, approver_error, approver_contract, presentation_failed, blanket_allow_refused, task_aborted]
+        who:
+          type: object
+          additionalProperties: false
+          required: [party]
+          properties:
+            party: { const: none }
+        when: { type: integer, format: int64 }
+
+    GateDisposition:
+      description: 'The final disposition of one tool-gate pass. A deny NAMES the layer that refused.'
+      oneOf:
+        - type: object
+          additionalProperties: false
+          required: [kind]
+          properties:
+            kind: { const: allowed }
+        - type: object
+          additionalProperties: false
+          required: [kind, deniedBy]
+          properties:
+            kind: { const: denied }
+            deniedBy: { $ref: '#/components/schemas/DeniedBy' }
+
+    GateOutcome:
+      type: object
+      additionalProperties: false
+      description: >
+        🔴 BREAKING (server >= 7.64.0, core 7.6.0 design/390 S6-A) — the WHOLE record of ONE tool-gate pass.
+        It REPLACES the four orthogonal words of 7.63.0 and earlier (`settledBy` / `resolution` / `autoDenied` /
+        `approver`, all four DELETED with no alias): their pairing rules lived only in comments, and consumers
+        had to infer semantics from ABSENCE ("a `timeout` with no `resolution` means a durable park expired").
+        Minted ONCE by the engine (the gate''s exit; the decide lane for a durable park) and projected without
+        re-derivation onto three faces — the `permissionDenied` observer payload, this `tool_end` frame, and the
+        durable row''s resolved outcome — so the three cannot tell different stories.
+        The three members are orthogonal but bound by four engine invariants: (I1) `settlement` present <=>
+        `origin` present — they describe the SAME ask; (I2) `deniedBy === "ask_resolution"` => `settlement`
+        present AND a refusal kind; (I3) a `human_allowed` settlement beside a `denied` disposition means a
+        LATER re-check vetoed a person''s approval, so `deniedBy` is one of the veto layers (`policy` / `hook` /
+        `org` / `write_protection`) and the approver stays on the settlement; (I4) an `allowed` disposition has
+        `settlement` absent or `human_allowed`.
+        🔴 NOTHING here is read out of an ABSENCE: an ordinary allow with no ask is
+        `{disposition:{kind:"allowed"}}`, a direct policy deny is `{disposition:{kind:"denied",deniedBy:"policy"}}`,
+        and neither carries a settlement because neither settled one.
+        🔴 The SERVICE withholds a record that fails the engine''s invariant screen (report + withhold, counter
+        `server.trace.gate-outcome-defective`) — so "a gate should have been here but the key is absent" has a
+        fourth cause besides the three below: that record was defective. The four are indistinguishable on the
+        wire; a consumer falls back to `isError` + the message text.
+      required: [disposition]
+      properties:
+        disposition: { $ref: '#/components/schemas/GateDisposition' }
+        settlement:
+          allOf: [{ $ref: '#/components/schemas/Settlement' }]
+          description: 'Present only when THIS pass settled an ask. Same-present/same-absent as `origin` (I1).'
+        origin:
+          allOf:
+            - { $ref: '#/components/schemas/AskOrigin' }
+            # 🔴 闭集执法**只在这一面**:引擎的 `screenGateOutcome` 对 `origin` 判成员,出集即记录缺陷,而
+            #   服务对缺陷记录是整条不上帧 ⇒ 词表外的值在这条 wire 上到不了消费端。审批帧那一面不判成员,
+            #   所以 `AskOrigin` 本体保持真开(见该 schema 的长注)。这张 enum 是本 spec 里该词表的**唯一**
+            #   执法点;core 加词时改这一处。
+            - enum: [content_question, unresolvable, org_unavailable, org_rule, hook, ask_rule, denial_limit_fallback, shell_gate_tighten, safety_tighten, policy]
+          description: >
+            WHO ASKED. Same-present/same-absent as `settlement` (I1). CLOSED here (and only here) — see the
+            enum note above.
+
+    McpDelivered:
+      type: string
+      description: >
+        Whether a failed MCP request REACHED the server (core 7.6.0 `MCP_DELIVERY_VERDICTS`, CLOSED).
+        `yes` = the server answered (a `protocol` rejection proves the exchange happened) · `no` = provably
+        never sent (a connect-phase errno, a spawn failure, a malformed declaration, a server already known
+        dead) — safe to retry, nothing executed · `unknown` = the client stopped waiting or lost the pipe
+        mid-exchange, so the request MAY have executed and a write-capable tool''s side effects must be
+        verified before a retry.
+        🔴 READ IT WITH `errorCode`, never alone: the SAME `connection_closed` is directly retryable at `no`
+        and must be investigated at `unknown` — which is exactly why the verdict is its own field and not
+        folded into the class.
+        ⚠️ `no` says the CALLER''S TOOL CALL was not sent; it does NOT promise the server received zero bytes
+        (an elicitation during the dial may already have crossed the connection) — core''s contract, passed
+        through verbatim.
+      enum: [yes, no, unknown]
+
     Event_tool_end:
       type: object
       description: >
@@ -9274,7 +9756,19 @@ components:
         (TextContent|ImageContent)[] block array) and degrades to a single TRUNCATED string over the core size cap
         (`truncated: true`). Absent ⇒ the tool produced no body. 🔴 UNTRUSTED RAW + observability-only: the service
         has redactDeep'd + size-bounded it; a consumer MAY further bound, MUST never re-feed it to a model.
-      allOf: [{ $ref: '#/components/schemas/EventIdentity' }]
+      allOf:
+        - { $ref: '#/components/schemas/EventIdentity' }
+        # 🔴 现役写口与退役四词**互斥**(S-170 codex r2 [medium] 验真后补):退役四词只出现在 <=7.63.0 写下的
+        #   durable 行上,而那种行结构上**没有** `gate`(7.63.0 压根不铸它)。所以「`gate` 与四词同帧」在
+        #   任何一代的真字节里都不存在 —— 它只可能是现役写口回吐退役键,或一条自相矛盾的合成记录。
+        #   不拒它,「四词只在回放里」这句话就没有任何机器在守(标记键 `x-legacy-replay-only` 是给人和
+        #   codegen 读的,不执法)。
+        - not:
+            anyOf:
+              - { required: [gate, settledBy] }
+              - { required: [gate, resolution] }
+              - { required: [gate, autoDenied] }
+              - { required: [gate, approver] }
       additionalProperties: false   # 封闭 + identity 本地镜像:见 Event_reasoning 处的长注
       required: [type, toolCallId, toolName, isError]
       properties:
@@ -9289,19 +9783,60 @@ components:
         output: {}   # NON-UNIFORM: string | (TextContent|ImageContent)[] | (truncated) string. Absent ⇒ no body.
         truncated: { type: boolean }
         totalChars: { type: integer, description: 'core >=1.442 (RB-210): honest ORIGINAL size when truncated — sum of each block''s true size (text=chars, image/document=base64 bytes), no JSON-wrapping overhead. Absent on older cores / untruncated results.' }  # true ⇒ output was size-bounded to a truncated string.
-        # 🔴 core >=5.18.1 (#187). Closed set, mirrored here as `enum` (the vocabulary's owner is the engine).
-        # ABSENCE CARRIES NO SEMANTICS: it is either an older caller, or a posture arm (headless auto-deny /
-        # blanket onAsk) that deliberately leaves it unset — the two are indistinguishable, so absent is neither
-        # "human" nor "no approval happened". Read the run row / checkpoint face to judge a run's fate.
+        # 🔴 BREAKING (server >=7.64.0, core 7.6.0 S6-A): `settledBy` / `resolution` / `autoDenied` / `approver`
+        # are RETIRED and replaced by the ONE `gate` record below. NO 7.64.0+ writer mints them, and the TS type
+        # does NOT carry them — nobody should code against a dead vocabulary.
+        # 🔴 They are still DECLARED here, and only for one reason: this arm is `additionalProperties: false`, and
+        # the durable-ledger replay leg (`GET /v1/runs/:id/events`) passes a stored `tool_end` row through
+        # VERBATIM (the service's `redactLedgerEventData` returns the row unchanged for this type). Server 7.63.0
+        # and earlier really did write all four into that ledger, so on a deployment upgraded across 7.64.0 those
+        # bytes reach a consumer — and without a declaration that is not "four fields we cannot read", it is the
+        # WHOLE FRAME judged invalid (the same failure family as `permissionRules` and `errorCode` before it).
+        # Same doctrine as `LegacyPlaneTaskResult`: the write face mints ONE shape; a face that replays persisted
+        # bytes admits what the retired writer actually left on disk. `x-legacy-replay-only: true` marks them so a
+        # code generator / a reader can tell them apart from live keys at a glance.
         settledBy:
           type: string
           enum: [human, timeout, aborted]
+          x-legacy-replay-only: true
           description: >
-            core >=5.18.1 (#187) — HOW this call was settled when it went through an approval:
-            `human` = somebody actually answered; `timeout` = the approval window elapsed;
-            `aborted` = abort / unclonable arguments / out-of-contract. Present ONLY on the settled call.
-            Absent = an older caller OR a posture arm that does not fill it — do NOT infer a semantic
-            from the missing key.
+            RETIRED at server 7.64.0 (core 7.6.0 S6-A) — superseded by `gate.settlement`. Appears ONLY when a
+            durable ledger row written by server <= 7.63.0 is replayed. Never minted by a current writer; not on
+            the SDK type. Do not branch on it.
+        resolution:
+          type: string
+          x-legacy-replay-only: true
+          description: 'RETIRED at 7.64.0 — superseded by `gate.settlement.kind`. Replay-only, see `settledBy`.'
+        autoDenied:
+          const: true
+          x-legacy-replay-only: true
+          description: 'RETIRED at 7.64.0 — superseded by `gate.disposition` + `gate.settlement`. Replay-only, see `settledBy`.'
+        approver:
+          type: string
+          x-legacy-replay-only: true
+          description: 'RETIRED at 7.64.0 — superseded by `gate.settlement.who.approver`. Replay-only, see `settledBy`.'
+        gate:
+          allOf: [{ $ref: '#/components/schemas/GateOutcome' }]
+          description: >
+            🔴 server >= 7.64.0 — the WHOLE record of the gate pass this call went through: who allowed it or
+            which LAYER refused it (`disposition`), how the wait it consumed ended (`settlement`, carrying the
+            refusing person and their own note), and who ASKED (`origin`).
+            🔴 ABSENCE IS NOT A FACT ABOUT THIS CALL: the gate never saw it (an unarmed gate, a deferred
+            re-send, an orphan picked up by reconcile) — or the record was defective and the service withheld
+            it (see `GateOutcome`). Never read a semantic out of the missing key.
+        delivered:
+          allOf: [{ $ref: '#/components/schemas/McpDelivered' }]
+          description: >
+            core >= 7.6.0 (S6-B) — whether THIS failed MCP request reached the server. Present only on an MCP
+            failure: every successful call and every non-MCP failure omits it, and the absence carries NO
+            semantics. Read it WITH `errorCode` (see `McpDelivered`).
+        gatedCallId:
+          type: string
+          description: >
+            core >= 5.55.0 (#333) — WHICH tool call a durable park is holding, minted by the engine from the
+            committed checkpoint''s pending action (a tool may not self-report it). Present only on a park
+            frame; absent on a park that holds no tool call (resource_limit / plan_review / task_done) —
+            ABSENT, never guessed.
         # 🔴 core >=5.9.0 (W3 / [2535]). OPEN SET — deliberately a bare `type: string`, NOT an enum.
         # This arm is `additionalProperties: false`, and the server's `toolEndEventData` has been emitting
         # `errorCode` since 5.9.0, so omitting it made every legitimate frame carrying one fail strict
@@ -9316,6 +9851,12 @@ components:
             when `isError` is true. OPEN SET: a verbatim passthrough of any tool's `ToolResult.details.code`.
             The engine's own codes (`gate.parked`, `tool.not_found`) are only two examples; the fs tools
             already emit `path_not_in_root` / `readonly_out_of_root`, and self-registered tools may add more.
+            🔴 core >= 7.6.0 — the MCP family within this open set is now the CLOSED `McpFailureKind` word list
+            (`connect_refused` / `connection_failed` / `connection_closed` / `http_status` / `not_mcp_response` /
+            `spawn_failed` / `timeout` / `protocol` / `invalid_config` / `unknown`); the retired
+            `MCP_FAILURE_CODES` spellings — including `network` and the `http_<status>` encoding — are gone,
+            and an HTTP status now rides the structured `httpStatus` seat on `wiring_manifest.mcp[]` instead of
+            being baked into the code. The set as a WHOLE stays open (a tool owns its own codes).
             Consumers MUST branch with a `default` arm and MUST NOT exhaustively switch on known values.
             The service enforces only a length bound (>128 chars = malformed, the whole key is DROPPED rather
             than truncated — truncating would mint a code core never sent). NOTE: this is a DIFFERENT
@@ -9680,6 +10221,80 @@ components:
                 renders "don't ask again" without reading this bit is advertising an outcome it cannot promise.
                 🔴 Same three-way reading as `syncWired`: present-and-false = concept known, not armed here;
                 absent = the worker never sent the key. Honestly `false` on server 7.12.0.
+        modelGate:
+          type: object
+          additionalProperties: false
+          description: >
+            core >= 7.3.x (design/385 片2b), server >= 7.58 — TENANT-visible: which tools the tool-MODEL gate
+            removed from THIS session and how to get them back. All three keys are engine-derived (`class` = the
+            merged gate table''s class row key, `removed` = wire tool names, `restore` = the engine''s own
+            recovery line), so the service passes them verbatim.
+            🔴 ALL-OR-NOTHING: the service mints the section only when all three keys are present and
+            well-formed — half a section would read as "these are the only tools that were removed".
+            ABSENT = this run had nothing gated (the service never mints an empty section or `removed: []`).
+          required: [class, removed, restore]
+          properties:
+            class: { type: string }
+            removed: { type: array, items: { type: string } }
+            restore: { type: string }
+        autoMode:
+          type: object
+          additionalProperties: false
+          description: >
+            core >= 7.3.1 (#529), server >= 7.59 — TENANT-visible: did AUTO mode actually arm on THIS leg, and
+            if not, which arm did it stop at. Sibling of `GET /v1/capabilities.permissionModeAuto`, which
+            answers the BEFORE question ("would a submit right now arm?"); this section answers the AFTER one
+            ("did the leg that really ran arm?").
+            🔴 `reason` is core''s closed word list passed through VERBATIM and is deliberately NOT normalised
+            onto the service''s own six-word `PermissionModeAutoUnarmedReason` set: the two tables answer
+            different questions at different granularity (core''s single `denied` covers the service''s
+            `org_denied` + `local_denied`, and a settings-level kill-switch folds into core''s `no_intent`,
+            not `denied`, because it rewrites the MODE before the intent seat is ever written). To tell those
+            apart, read `/v1/capabilities`.
+            🔴 ABSENCE IS NOT "not applicable" (core''s own words: it means an older mint or an external
+            derivation) — never fold it to `armed: false`. A self-contradicting pair (`armed` disagreeing with
+            `reason === "armed"`, core''s own in-section invariant) makes the service withhold the WHOLE section.
+          required: [armed, reason]
+          properties:
+            armed: { type: boolean }
+            reason: { type: string, description: 'core''s word (`armed` / `no_intent` / `no_face` / `denied` / `resolver_fault` / `latch_open` today). Open on read — branch known, keep a default arm.' }
+        mcp:
+          type: array
+          description: >
+            core >= 7.5.0 (#562), server >= 7.60 — TENANT-visible: one row per MCP server THIS leg declared —
+            did it connect, if not which failure class, and how many tools it mounted.
+            🔴 AN EMPTY ARRAY IS NOT ABSENCE: `[]` means "this leg declared no servers"; a missing key means an
+            older mint or an external derivation. Never fold one into the other.
+            🔴 The engine''s `error` free text is DELIBERATELY NOT PROJECTED (it is remote-author text, and core
+            already owns the single redaction mint point for it). The actionable cause is `errorCode`.
+            A row missing `name` or `status` is dropped individually — the other servers'' rows still ship.
+          items:
+            type: object
+            additionalProperties: false
+            required: [name, status]
+            properties:
+              name: { type: string, description: 'The declared server name.' }
+              status: { type: string, description: 'Three-word engine set (connected / failed / …). Open on read.' }
+              source: { type: string, description: 'The declarer''s own layer label, echoed verbatim by core (single-line, length-capped).' }
+              toolCount: { type: integer, description: 'Tools mounted. ABSENT rather than 0 — a minted 0 would read as "connected with no tools".' }
+              errorCode:
+                type: string
+                description: >
+                  core >= 7.6.0 — the `McpFailureKind` word (`connect_refused` / `connection_failed` /
+                  `connection_closed` / `http_status` / `not_mcp_response` / `spawn_failed` / `timeout` /
+                  `protocol` / `invalid_config` / `unknown`). The retired 7.5.0 spellings — `network` and the
+                  `http_<status>` encoding — are GONE; an HTTP status now rides `httpStatus`.
+                  Deliberately NOT enumerated here: the vocabulary''s single owner is the engine, and mirroring
+                  it would swallow a newly minted word as a violation. Switch with a `default` arm.
+              delivered:
+                allOf: [{ $ref: '#/components/schemas/McpDelivered' }]
+                description: 'core >= 7.6.0 (S6-B) — did the request reach that server. Read WITH `errorCode`.'
+              httpStatus:
+                type: integer
+                description: >
+                  core >= 7.6.0 (S6-B) — the status the endpoint answered with; rides ONLY with
+                  `errorCode === "http_status"` (401/403 = re-authorize, 5xx = that end is down). ABSENT rather
+                  than 0.
         governance:
           type: object
           additionalProperties: false
@@ -9712,6 +10327,16 @@ components:
         `memory.harvest_quarantined` `{count, moved, escalated, reason?}` — `moved` and `escalated` MUST NOT be
         subtracted from each other (an in-place tombstone counts as both) · `memory.delegation_static_mark_waived`
         `{reason, subagentType?, sessionId?}`.
+        `config.durable_gate_unavailable` — a per-principal `forceDurableGate` entitlement took effect on a leg
+        with NO checkpoint store, so every ask on that leg settles on the LIVE chain (answered in-stream where a
+        live approval / question face exists, fail-closed denied where none does) and NO durable approval record
+        is written. `{sessionId, runId, principal?, cause, liveApprover, liveQuestionFace}`.
+        🔴 `cause` is a CLOSED two-word set: `no_deployment_store` (this deployment wired no store) and
+        `task_store_disabled` (`TaskSpec.checkpointStore: "disabled"` — the per-run off switch).
+        ⚠️ server >= 7.64.0 / core 7.6.0 (D-9) RENAMED that second word from `task_store_null`, and the off
+        switch itself became the WORD `"disabled"` instead of `null` (a string is not nullish, so the ordinary
+        coalesce is the whole resolution rule and no reader has to remember a null test). A consumer still
+        matching `task_store_null` matches nothing.
         A notice whose `detail.sessionId` is absent is HONESTLY NOT DELIVERED (the server never guesses a session),
         so the frame's absence does NOT mean "did not happen" — the operator-facing structured log always has the
         full family. `detail` is already redacted + size-bounded by the server; still treat it as external text.
@@ -9764,14 +10389,28 @@ components:
         kind:
           type: string
           description: >
+            The SIX known kinds (`server src/http/wire-gate.ts` `WIRE_GATE_KINDS`), listed for codegen and
+            autocomplete — NOT a closed set, and deliberately NOT an `enum` (see the note below):
             `human` — plain HITL approval (budget-auto-approvable). `irreversible_ask` — design/37
             irreversibility / design/70 egress tighten; NOT budgetable (load-bearing safety gate).
             `resource_limit` — design/74 cost/token/time slice boundary; resolve `{decision:"continue"}`.
             `needs_review` — design/76 dry-run/shadow → durable `needs_review` TERMINAL (post-prediction
             review, disjoint from the approval family). `task_done` — design/38 Path A background sub-task
-            handle (door B never sees it).
-          enum: [human, irreversible_ask, resource_limit, needs_review, task_done]
+            handle (door B never sees it). `plan_review` — [2400] TR-8 / design/80 D-B PRE-ACTION plan
+            review, resolved at `POST /v1/assistant/tasks/:id/plan_review` (3-state), never at `/decide`.
+            An unknown future kind is VALID on the wire: branch on `kind` and render it generically.
           x-open-enum: true   # do not close this union — an unknown future kind is VALID on the wire
+          # 🔴 顶层 `enum` **已删**(S-170,codex r1 [high] 验真后修)—— 它与本 schema 自己声明的开集语义
+          #   直接矛盾,而矛盾的那一头在执法:
+          #    ① 那张表停在**五**词,漏了 `plan_review` —— 它自 [2400] TR-8 起就是**现役**门(SDK 的
+          #       `CheckpointGate.kind` 与 server 的 `WIRE_GATE_KINDS` 六词都有它),下面 catch-all 臂的注
+          #       甚至还把它当成「未来的未知 kind」举例。一次 plan_review park 的整条响应因此被判违约。
+          #    ② 就算补齐第六词,顶层 `enum` 仍是**合取**的:`x-open-enum` 只是意图标记,标准 JSON Schema
+          #       的 `enum` 照样执法 ⇒ core 加第七个门的当天,每一条那类 park 响应全线违约。
+          #   ⇒ **kind 的合法性只由下面的 `oneOf` 一处决定**(具名臂管已知词的形状,catch-all 管未知词),
+          #   规则从两处变一处。已知词表留在本描述里给 codegen / 自动补全读,不再是第二道执法点。
+          #   (本车把 `terminal.paused.gate` 指向本 schema 之后,这条既存缺陷的射程从 `suspended` 帧扩到了
+          #    每一条 park 终局 —— 所以在本车里修,而不是留给下一车。)
         reason: { type: string, description: 'present on human / irreversible_ask / resource_limit / needs_review (not task_done).' }
         toolName: { type: string, description: 'present on human / irreversible_ask.' }
       oneOf:
@@ -9790,12 +10429,16 @@ components:
         - type: object       # design/38 Path A background sub-task handle (door B never sees it)
           required: [kind]
           properties: { kind: { const: task_done } }
-        - type: object       # OPEN SET — unknown future kind (e.g. design/80 D-B plan_review); render generically, never crash
+        - type: object       # [2400] TR-8 / design/80 D-B — PRE-ACTION plan review; resolved at POST /v1/assistant/tasks/:id/plan_review
+          required: [kind, reason]
+          properties: { kind: { const: plan_review } }
+        - type: object       # OPEN SET — a future kind this contract predates; render generically, never crash
           required: [kind]
-          # 🔴 the pinned wire contract: exclude the 5 KNOWN kinds so a known kind matches ONLY its const member above
+          # 🔴 the pinned wire contract: exclude the KNOWN kinds so a known kind matches ONLY its const member above
           #   (not also this fallback) → keeps `oneOf` unambiguous AND preserves each kind's shape validation.
-          #   This fallback matches ONLY a future kind this contract predates. Add new known kinds to the enum.
-          properties: { kind: { type: string, not: { enum: [human, irreversible_ask, resource_limit, needs_review, task_done] } } }
+          #   This fallback matches ONLY a future kind this contract predates. Add new known kinds to the enum
+          #   AND to this exclusion list (S-170: `plan_review` was a KNOWN kind sitting in neither).
+          properties: { kind: { type: string, not: { enum: [human, irreversible_ask, resource_limit, needs_review, task_done, plan_review] } } }
 
     Event_suspended:
       type: object
@@ -10513,7 +11156,14 @@ components:
     # ─── S-139(sdk 8.3.0):对 server 7.60.0 整体重对账带进来的四张型面 ───────────────────────
     AskOrigin:
       type: string
-      enum: [content_question, unresolvable, org_unavailable, org_rule, hook, ask_rule, denial_limit_fallback, policy]
+      x-open-enum: true
+      # 🔴 顶层 `enum` **不放这里**(S-170 codex r2 [medium] 验真后修,与本车对 `CheckpointGate` 的处置同款):
+      #   词表属主是引擎、而且它**真的长过**(core 7.6.0 从 8 词加到 10 词),而 `tool_approval` 帧这一面
+      #   server 只判非空串、不判成员(`src/tool-approval.ts` 帧铸点)⇒ 留一个 `enum` 在这里,core 加词的
+      #   当天,一个**合法**的审批卡就会被严格消费端拒收。`x-open-enum` 只是意图标记,不解除 enum 的执法 ——
+      #   这正是本车刚从 `CheckpointGate` 拆掉的那个假开集,不在这里换个地方重犯。
+      #   闭集**执法**只属于**筛过的**那一面(`GateOutcome.origin`:引擎的 `screenGateOutcome` 判成员,
+      #   出集即整条不上帧),所以那张 enum 落在**那个引用点**,恰一处。已知十词见下面的描述。
       description: >
         WHO raised an ask (`ToolApprovalFrame.origin`; server >= 7.57.0 / core 7.5.0, S-125③/#564) — core's
         `ASK_ORIGINS`, ENGINE-STAMPED at the gate (core's words: "engine-stamped at the gate, never a policy's
@@ -10526,6 +11176,17 @@ components:
         whether THIS DEPLOYMENT's ops governance layer is the gate — `origin: policy` covers any deployment
         ToolPolicy's ask, so a governance-produced ask and an ordinary one look identical in this one word.
 
+        🔴 core 7.6.0 ADDED TWO WORDS (the set was eight through core 7.5.x): `shell_gate_tighten` = the gate's
+        own irreversibility tighten raised the ask over a tier the COARSE `shellGate` doctrine installed (a
+        shell command under `shellGate: "classify"` / `"always"`), and `safety_tighten` = the gate's own
+        post-fold tightens over an EXPLICIT fact of the call (an egress mark, an irreversibility mark, a
+        peer-message referral in auto mode, a write onto the write-protected table). They are separate words
+        precisely so a deny observer or an approval card can say WHICH engine layer raised the question — one
+        word could not. Both are classifier-eligible (arming auto mode is the deployment's explicit choice to
+        let the classifier resolve those classes).
+
+        The SAME type is the `origin` member of `GateOutcome` on `tool_end` — one vocabulary, two faces.
+
     RuleOffersAbsence:
       type: string
       enum: [mandated, shadowed, lane_cannot_speak]
@@ -11253,8 +11914,15 @@ components:
          · `ActiveRunConflictDoneResult` — the SSE lane's REJECTION terminal: when the session already has an
            active run, the submit's 409 is encoded as this done frame (`src/http/routes/tasks.ts`), and it
            carries NO `taskId` / `sessionId` / `stats`.
-        Narrow on the presence of `stats` (required on TaskResult, absent from the conflict shape), or on
-        `errorCode === "conflict.session_active_run"`. `status` does NOT discriminate — both shapes carry it.
+        Narrow in TWO steps: `stats` present (an engine result) vs absent (the conflict envelope) — or match
+        `errorCode === "conflict.session_active_run"` — and then, among the engine results, `"terminal" in result`
+        (the current cause form) vs absent (`LegacyPlaneTaskResult`, the flat bytes an older generation left in
+        the durable ledger; a REPLAYED frame on an upgraded deployment can be that shape).
+        🔴 server >= 7.64.0 — the two arms are now told apart by their KEYS, not by a shared word: the normal
+        terminal carries `terminal` (the tagged cause) and NO `status`; the conflict shape carries the flat
+        `status: "failed"` + `errorCode` because it is the SERVICE's own rejection envelope, not an engine
+        result, and it did not change. `status` therefore appears on exactly one arm — but keep narrowing on
+        `stats` / `errorCode`, which are the discriminants the service pins.
       additionalProperties: false   # 封闭:帧本身只有 {type,result,replay?};`result` 内部按臂各自裁定(TaskResult 开集,冲突形封闭)
       required: [type, result]
       properties:
@@ -11263,6 +11931,7 @@ components:
           oneOf:
             - $ref: '#/components/schemas/TaskResult'
             - $ref: '#/components/schemas/ActiveRunConflictDoneResult'
+            - $ref: '#/components/schemas/LegacyPlaneTaskResult'
         replay:
           type: boolean
           description: >
@@ -12144,7 +12813,9 @@ components:
         core's assembly self-evidence manifest (core >=5.14.0 `WiringManifest`). TWO HALVES, ONE shape (a
         consumer must line the two faces up, so they are not split into separate types) — but which keys
         belong to which half is DETERMINATE, not "usually": `leg`, `ask.effective` and `configFingerprint`
-        are EFFECTIVE-half only (the live `wiring_manifest` event) and the STATIC half
+        are EFFECTIVE-half only (the live `wiring_manifest` event) — as are the three per-leg sections the
+        event schema declares (`modelGate`, `autoMode`, `mcp`), which describe what THIS leg did and have no
+        static counterpart — and the STATIC half
         (GET /v1/diagnostics/wiring) NEVER mints them; every other section, plus `governance`, is always
         present on the static half. Fields stay optional because core may add or drop sections and that
         must not hard-break a client — read by half, and never wait on a key the half never sends.
@@ -12232,12 +12903,58 @@ components:
 
     WiringDiagnostics:
       type: object
-      description: 'GET /v1/diagnostics/wiring response (operator-only). No per-leg history by design.'
+      description: >
+        GET /v1/diagnostics/wiring response (operator-only). No per-leg history by design.
+        🔴 Every posture key here answers "what can THIS PROCESS say", so its absent form is an explicit
+        `null` — never an empty shell that would read as a real answer. `null` = this process cannot say
+        (it was not assembled by the composition root, or the facility is not wired).
       required: [static, serverGates]
       additionalProperties: false
       properties:
         static: { $ref: '#/components/schemas/WiringManifest' }
         serverGates: { $ref: '#/components/schemas/ServerWiringGates' }
+        writeProtection:
+          oneOf:
+            - $ref: '#/components/schemas/WriteProtectionPosture'
+            - type: 'null'
+          description: >
+            server >= 7.63.0 (S-138) — the write-protection table, WITH row contents (operator face only; the
+            tenant face `capabilities.writeProtection` carries counts alone). Same boot artefact as that bit.
+        readFace:
+          $ref: '#/components/schemas/ReadFacePosture'
+          description: >
+            server >= 7.65.0 (S-167) — the READ containment rung plus its provenance (`env` / `center` /
+            `posture` / `engine-default`). Absent on older servers; never `null` on 7.65.0+ (the server always
+            has an answer — `face: null` is how "nothing pinned" is spelled, the SOURCE is still known).
+        memoryPosture:
+          type: ["object", "null"]
+          additionalProperties: true
+          description: >
+            server >= 7.30 (#252) — the memory plane's posture (backend / vector mode / lit-or-dark and why /
+            embedder identity). Facts that used to live only in the startup log, which is neither queryable nor
+            aggregatable across replicas. NOT YET MIRRORED KEY-BY-KEY in this SDK generation: declared here so a
+            strict consumer stops rejecting a real operator response, read it as opaque.
+        sqlEngine:
+          type: ["object", "null"]
+          additionalProperties: true
+          description: >
+            server >= 7.60 (S-131) — this deployment's SQL engine posture (engine / version / session isolation
+            level / TiDB transaction mode), READ BACK off a live connection rather than echoed from env.
+            `null` = no SQL backend. NOT YET MIRRORED KEY-BY-KEY in this SDK generation — read as opaque.
+        configApply:
+          type: ["object", "null"]
+          additionalProperties: true
+          description: >
+            server >= 7.5x (#322) — the config generation ledger's operator face (per-group appliedVersion,
+            deferredKeys with their reason, and a SANITISED lastRejected: key names and verdict text only,
+            never values). The three keys on `/health` are a narrow projection of this same reading.
+            NOT YET MIRRORED KEY-BY-KEY in this SDK generation — read as opaque.
+        mcpRevocations:
+          type: ["object", "null"]
+          additionalProperties: true
+          description: >
+            server >= 7.5x (#324, design/338) — the mid-turn MCP revocation list. `null` = this process has no
+            config pipeline (it cannot say). NOT YET MIRRORED KEY-BY-KEY in this SDK generation — read as opaque.
 
     SendfileLinkRow:
       type: object