@sema-agent/sdk 8.7.0 → 9.0.0

package/openapi.yaml

@@ -2511,6 +2511,13 @@ paths:
             approve carried no `answer` (the ONLY pre-claim rejection left on that leg; the retired codes
             `decide.parked_answer_unsupported` / `decide.parked_question_unsupported` are gone — an answer HAS
             a hookpoint now and a parked question CAN be approved, with an answer). SDK → DecideUnsupportedError.
+            PARKED **WORKFLOW-CHILD** variant (server >= 7.69.0, S-185):
+            `decide.workflow_remember_unsupported` — `remember:"session"` is REFUSED on that lane, fail-closed,
+            BEFORE anything is delivered (zero side effects; re-issue without `remember`). The repo-wide rule for
+            granting an exemption is "the engine COMMITTED this decision", and that lane's 200 does not carry the
+            proof (the child's binding / updatedInput / answer checks run later, inside the workflow's own
+            resume), so an exemption granted here could outlive a decision the engine then rejects. The body
+            carries `runId` (the WORKFLOW run) and NO `taskId`. SDK → DecideUnsupportedError, `.runId`.
           content:
             application/json:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
@@ -2545,6 +2552,18 @@ paths:
             `gate_not_plan_review` (§4c) → SDK `GateNotToolApprovalError`. Client action: route by the row's
             `gateKind` — `plan_review` → `POST /v1/assistant/tasks/{taskId}/plan_review`, `resource_limit` →
             `POST /v1/assistant/tasks/{taskId}/resume`. Retrying the same body never succeeds.
+            SEVENTH group (server >= 7.69.0 / S-185, the PARKED WORKFLOW-CHILD lane): `decide.workflow_host_unknown`
+            and `decide.workflow_host_not_parked`. The pending belongs to a workflow child that parked on an
+            approval gate, and the deployment could not hand the decision to that workflow's HOST session (the
+            engine's only deployment-facing channel for a parked workflow ordinal is a resume of the host, which
+            then re-invokes `Workflow({resumeFromRunId})`). Both bodies carry `runId` (the WORKFLOW run) and NO
+            `taskId`. NOTHING was consumed: the child's checkpoint stays PENDING and the card is still listable
+            and re-decidable. `_host_not_parked` = the host is not currently parked awaiting this run (it may
+            have been interrupted, taking an already-delivered decision with it — the decision is not persisted
+            anywhere) → retry once it parks again, or resume that `runId` yourself. `_host_unknown` = the run
+            carries no originating session at all (a directly started `runWorkflow`, not a Workflow tool call) →
+            NO retry value, a person resumes that `runId`. SDK → DecideWorkflowHostError (`.errorCode` splits the
+            two recovery verbs, `.runId` is the handle).
             SIXTH group (A-075.10, TIME-BASED retry-later pair): `resume.usage_window_exhausted` (#449 G1,
             core 5.60.1 — the deployment governance window on this run's ledger key is full; NOTHING was
             consumed or unpinned, the SAME token with the SAME decision redeems once the window slides) and
@@ -4620,10 +4639,18 @@ paths:
       x-status: gated            # server routes/rules.ts handleRuleList;同 cc-import 的部署谓词。SDK rules.list() 消费。
       summary: List the rules that are LIVE under a principal (keyset-paged, cursor bound to the revision).
       description: >
-        List the persisted allow rules currently live under one principal (tombstones already folded).
-        Ordering is deterministic — `(scope, rule)` lexicographic — because keyset paging's whole premise is
-        that the same data comes back in the same order every time. The order is decided by the server, NOT
-        by the store (core's `list()` promises none).
+        List the persisted rules currently live under one principal (tombstones already folded) — all THREE
+        behaviors from server >= 7.67.0, not the allow bucket alone.
+        Ordering is deterministic — `(scope, rule, behavior)` lexicographic from server >= 7.67.0, `(scope, rule)`
+        before it — because keyset paging's whole premise is that the same data comes back in the same order every
+        time. The order is decided by the server, NOT by the store (core's `list()` promises none).
+
+        🔴 THE CURSOR CARRIES A FORMAT GENERATION, BUMPED TO v2 IN 7.67.0 (the sort key gained `behavior`, since a
+        same-text deny/allow pair collided under the old two-part key and the strict `>` silently dropped the
+        sibling row at a page boundary). During a rolling upgrade or rollback the two generations REFUSE each
+        other's cursors with a 400 rather than each walking its own key shape — a governance listing going wrong
+        under an all-200 conversation is far more expensive than one re-listing. The cursor stays OPAQUE and the
+        handling is unchanged: echo it back verbatim, and on a 400 drop it and re-list from the top.
 
         🔴 THE CURSOR IS BOUND TO `(rev, principal, scope)` AND A MISMATCH IS REFUSED, NOT RESET. A rule set
         is read WHOLE, so there is no tearing WITHIN a page — tearing happens BETWEEN pages, when somebody
@@ -4688,12 +4715,16 @@ paths:
       tags: [rules]
       operationId: rulesRevoke
       x-status: gated            # server routes/rules.ts handleRuleRevoke;同 cc-import 的部署谓词。SDK rules.revoke() 消费。
-      summary: Revoke a persisted rule BY CONTENT — `(rule, scope)`, with no id in the path.
+      summary: Revoke a persisted rule BY CONTENT — `(behavior, rule, scope)`, with no id in the path.
       description: >
-        Revoke one persisted allow rule identified by its CONTENT pair `(rule, scope)`. There is no `:id`
-        path segment on purpose: a rule's identity IS that pair, the server mints no row id, and the engine's
-        `removePersistedRule` primitive (which this endpoint always goes through) works in observed-remove
-        form over the add dots.
+        Revoke one persisted rule identified by its CONTENT triple `(behavior, rule, scope)` — a pair before
+        server 7.67.0. There is no `:id` path segment on purpose: a rule's identity IS that triple, the server
+        mints no row id, and the engine's `removePersistedRule` primitive (which this endpoint always goes
+        through) works in observed-remove form over the add dots.
+
+        🔴 `behavior` IS REQUIRED AND HAS NO DEFAULT (server >= 7.67.0; omitting it is a 400
+        `request.body_shape`). Defaulting it would let a revoke aimed at an `allow` delete the same-text `deny` —
+        a refusal the operator meant to keep — while answering 200.
 
         🔴 IDEMPOTENT, AND DELIBERATELY NOT A 404. Revoking twice, or revoking something that was never
         there, is `200 {status:"no-op"}` — a "did this rule ever exist?" 404 would be an existence oracle
@@ -4725,7 +4756,7 @@ paths:
           content:
             application/json:
               schema: { $ref: '#/components/schemas/RuleRevokeResult' }
-        '400': { $ref: '#/components/responses/BadRequest' }        # request.body_shape — body is not {rule, scope, principal?}, or `scope` is not `global`/`project:<non-empty root>`
+        '400': { $ref: '#/components/responses/BadRequest' }        # request.body_shape — body is not {behavior, rule, scope, principal?} (server >= 7.67.0: `behavior` is REQUIRED and has no default), or `scope` is not `global`/`project:<non-empty root>`
         '401': { $ref: '#/components/responses/Unauthorized' }
         '403': { $ref: '#/components/responses/Forbidden' }         # auth.operator_only — revoking another principal's rule without explicit OPERATOR_PRINCIPALS membership
         '429': { $ref: '#/components/responses/RateLimited' }
@@ -7169,6 +7200,39 @@ components:
         note:
           type: string
 
+    PostureKnobReading:
+      type: object
+      additionalProperties: false
+      description: >
+        server >= 7.67.0 (S-178) — ONE deployment knob's reading: its value, WHO SET IT, and one operator-facing
+        pointer. Same shape as `ReadFacePosture`, whose value key is called `face` instead of `value`; both exist,
+        neither replaces the other.
+
+        🔴 WHY NOT A BARE VALUE: a bare boolean or number cannot answer "why is THIS machine on this setting, and
+        how do I pin it back". From 7.67.0 a single-user turnkey worker (REQUIRE_PRINCIPAL unset) derives
+        `DURABLE_APPROVAL` ON and a 24h approval window when neither is set, so a default FLIP has to be visible
+        on an operator surface or nobody sees it.
+
+        `source` is the CLOSED four-word set (exhaustive switch on the server — adding a word is a compile error
+        there), in PRECEDENCE order: `env` = pinned by this machine's env var (deployment sovereignty; beats any
+        published value) · `center` = applied from the config-center (restart-to-apply) · `posture` = derived from
+        the deployment shape (single-user turnkey) · `engine-default` = nothing pinned, the built-in default is in
+        force. Only `env`/`center` count as "an operator asked for this"; a posture-derived `true` does not.
+        `note` is PROSE for a human (per-knob, and on the `posture` arm it is that knob's own fact sentence) —
+        classify on `source`, never by matching `note`.
+
+        🔴 `value` IS NARROWED AT THE REFERENCE POINT, not here: the reading is one shape over many knobs, and a
+        second copy of the record per value type is how the three keys drift apart. Each `serverGates` row pins
+        its own `value` type beside the `$ref`.
+      required: [value, source, note]
+      properties:
+        value:
+          description: 'The knob''s effective value. Typed by the referencing site (boolean / integer / …).'
+        source:
+          type: string
+          enum: [env, center, posture, engine-default]
+        note: { type: string }
+
     SkillSpec:
       type: object
       description: A per-request skill (passed as an object; core-native TaskSpec.skills shape).
@@ -7386,6 +7450,107 @@ components:
           items: { type: string }
           description: 'E7 (SHIPPED) — the /effort picker default set (minimal/low/medium/high); present ONLY for a reasoning model.'
         atMentionable: { type: boolean, description: '#233/A-002.8 (SHIPPED) — @model mention allowlist verdict; present ONLY when the deployment configured an at-mention allowlist. Absent = no allowlist verdict, NOT "not mentionable" — do not narrow absence to false.' }
+        routePairing:
+          $ref: '#/components/schemas/RoutePairingStatus'
+          description: >-
+            #345 (server >=7.45, core 5.57.0 `routePairingStatus`) — this row's key<->URL pairing posture.
+            🔴 ALWAYS PRESENT on a >=7.45 worker: when the verdict cannot be reached the value is the WORD
+            `unknown`, not a missing key ("this worker does not adjudicate" and "this row could not be
+            adjudicated" must stay distinguishable on the wire). Declared here 2026-09-10 alongside `compat`:
+            this schema is CLOSED, and the key has been minted unconditionally since 7.45 — so every real
+            /v1/models response has been structurally rejected by a strict validator for the whole time (same
+            class as `hasBidiControls` on InboxRow). Optional here because the SDK's supported server floor is
+            3.0.0; the discriminant is the PEER'S VERSION, not this key's presence.
+        compat:
+          $ref: '#/components/schemas/ModelCompat'
+          description: >-
+            S-188 (server >=7.69.0, settings-schema >=1.10.0) — this row's wire-compatibility declaration for the
+            openai-completions lane. ABSENT = this model declared nothing; see ModelCompat for the two causes of
+            absence and why absence must NOT be rendered as "the operator did not write one".
+
+    ModelCompat:
+      # 新(8.9.0 / S-188):`ModelInfo.compat` 的形 = core `OpenAICompletionsCompat` 的逐字镜像。
+      # 词表在服务端**已判过**(src/model-compat.ts 的 readModelCompat:整只判形,任一键不合即整只丢),
+      # 所以这里写闭集 enum 是**如实**的,不是本仓自己加的一道门 —— 消费方不必再验一遍。
+      type: object
+      description: >
+        One model row's wire-compatibility declaration for the **openai-completions** lane (core
+        `OpenAICompletionsCompat`, mirrored key-for-key; server >= 7.69.0 / S-188). It says how THIS gateway takes
+        the thinking parameter and what the max-tokens field is called — no URL, no credential.
+        🔴 ABSENT has TWO indistinguishable causes: (a) the model genuinely declared nothing (the engine infers
+        from baseUrl / model id), or (b) the operator wrote one and the server DROPPED IT WHOLE (shape / word /
+        unknown key), logging a named warning and falling back to the engine's inference. So a panel must NOT
+        render "no compat" as "the operator did not configure one".
+        🔴 WHOLE-OR-NOTHING: the server refuses a partially valid declaration rather than keeping the good keys
+        (half a face on the wire is worse than none), so on the wire this object is always complete-and-legal or
+        entirely absent.
+        🔴 An EMPTY object never reaches the wire: the server's single mint point folds "all keys empty" (an
+        empty `reasoningEffortLevels` counts as unset) into "do not mint the key". `compat: {}` is therefore an
+        unrecognisable byte, not "declared but says nothing" — hence minProperties: 1.
+      additionalProperties: false
+      minProperties: 1
+      properties:
+        supportsReasoningEffort: { type: boolean, description: 'Does this endpoint accept `reasoning_effort` at all. Absent => the engine auto-detects from the URL.' }
+        reasoningEffortLevels:
+          type: array
+          minItems: 1
+          items: { $ref: '#/components/schemas/ModelThinkingLevel' }
+          description: >-
+            The effort tiers THIS endpoint really accepts (a subset of the six-rung ladder). Absent => the
+            engine's conservative default (minimal|low|medium|high), so a higher requested tier clamps DOWN
+            instead of 422-ing. Never empty on the wire (an empty declaration is folded into absence server-side).
+        maxTokensField:
+          type: string
+          enum: [max_tokens, max_completion_tokens]
+          description: 'Which field carries max tokens on this lane. Absent => inferred from the model id.'
+        requiresReasoningContentOnAssistantMessages: { type: boolean, description: 'Whether every replayed assistant message must carry an empty `reasoning_content` when reasoning is on.' }
+        thinkingFormat:
+          $ref: '#/components/schemas/ModelThinkingFormat'
+          description: 'How this gateway takes the thinking on/off parameter. Absent => the engine infers (default `openai`, i.e. `reasoning_effort`).'
+
+    ModelThinkingLevel:
+      # 六档思考梯(core ThinkingLevel)。CLOSED:server 铸 Model 那一刻逐词判成员,出集词让整只 compat 被丢。
+      type: string
+      enum: [minimal, low, medium, high, xhigh, max]
+      description: >-
+        One rung of the six-rung thinking ladder (core `ThinkingLevel`). CLOSED — the server judges membership
+        when it mints the Model, and an out-of-set word makes it drop the WHOLE `compat` declaration, so a word
+        outside this set cannot reach the wire. (`off` is NOT a rung: it means "no model-level default" and
+        belongs to a different knob.)
+
+    ModelThinkingFormat:
+      # thinkingFormat 七词闭集(core OpenAICompletionsCompat["thinkingFormat"])。同上,server 已判成员。
+      type: string
+      enum: [openai, openrouter, deepseek, together, zai, qwen, qwen-chat-template]
+      description: >-
+        The spelling this gateway takes the thinking parameter in (core
+        `OpenAICompletionsCompat.thinkingFormat`). CLOSED, judged server-side before it reaches the wire.
+        `openai` = `reasoning_effort` · `openrouter` = `reasoning:{effort}` · `deepseek` = `thinking:{type}` plus
+        `reasoning_effort` · `together` = `reasoning:{enabled}` plus `reasoning_effort` · `zai` / `qwen` =
+        top-level `enable_thinking` · `qwen-chat-template` = `chat_template_kwargs.enable_thinking` — the ONLY
+        spelling that can turn thinking OFF on a think-by-default vLLM/Qwen gateway.
+
+    RoutePairingStatus:
+      # #345 core RoutePairingStatus(`ok:${RoutePairingPosture}` | `broken:*` 两词 | unknown)。
+      # 🔴 **真开集,刻意不写 enum**:开/闭按**产方是否真判成员**定(8.4.0 拆 `CheckpointGate` 顶层 enum /
+      # 把 `AskOrigin` 改真开集的同一条判据)。core 的 `routePairingStatus` 把 `verdict.posture` **直接内插**
+      # 进 `ok:${…}`,server 的铸点与 core 的这只函数**全路径没有一处运行期成员判定** —— 一只自带
+      # `adjudicateRoute` 的 brain 供什么词就上什么词。写一条会执法的 enum = 假闭集,会把一台合法 worker
+      # 的真响应判违约。已知七词写在 description 里(消费端 switch 认已知词 + 一条 default 臂)。
+      type: string
+      x-open-enum: true
+      description: >-
+        A model row's key<->URL pairing posture (core `RoutePairingStatus`; server >= 7.45). OPEN on read —
+        the seven words below are today's set, branch on the known ones and keep a `default` arm. NON-SECRET — no
+        URL, no credential.
+        `ok:per-model` this model has its own credential · `ok:paired` deployment credential, and the model's URL
+        is on the deployment's declared root · `ok:unpinned` deployment credential but the deployment declared no
+        root, so the pairing is UNVERIFIABLE · `ok:keyless` no credential anywhere (a local unauthenticated
+        gateway) · `broken:credential_mismatch` / `broken:credential_missing` a real request WILL be refused by
+        the engine (flag it red) · `unknown` could not be adjudicated — render "unknown", NEVER "good" or "bad".
+        The verdict's frame of reference is the gateway root as of BRAIN CONSTRUCTION, so a live re-pointing of
+        the deployment root only shows up after a restart (both this reading and the real request judge from the
+        same snapshot).
 
     ElicitResponse:
       type: object
@@ -7588,8 +7753,25 @@ components:
       additionalProperties: false
       properties:
         label: { type: string, description: 'display label (redacted — LLM-authored).' }
-        status: { type: string, description: 'lifecycle status (the input vocabulary the display derivation reads).' }
-        displayStatus: { type: string, description: 'core deriveAgentDisplayStatus: running|queued|done|failed|interrupted — the canonical glyph vocabulary, one source of truth shared with the shell.' }
+        status:
+          type: string
+          description: >-
+            Lifecycle status — core `WorkflowItemStatus` passed through verbatim (running|completed|failed|parked;
+            OPEN on read, the vocabulary's owner is core). 🔴 `parked` (server >= 7.69.0 / core 7.10.0 #642) is an
+            AGENT-ROW word only: this ordinal durably paused at an approval gate and the whole run suspended on it
+            (a phase or group never parks — a parked agent ends the run, so the RUN-level status vocabulary does
+            not have this word). The row's redemption key (`parkedCheckpointToken`) is a resume CAPABILITY and is
+            NEVER projected onto the wire — it appears nowhere in this document by design.
+        displayStatus:
+          type: string
+          description: >-
+            core `deriveAgentDisplayStatus`: running|queued|done|failed|interrupted|parked — the canonical glyph
+            vocabulary, one source of truth shared with the shell. 🔴 `parked` is the SIXTH arm (core 7.10.0
+            #642, server >= 7.69.0): a durable approval gate is holding this agent. Before it existed a parked
+            agent fell through to another word, i.e. a card waiting on a human rendered as a glyph that asks for
+            no action. ALWAYS PRESENT — the server derives it with that pure function on every row. Open on read
+            (the vocabulary's owner is core), but the function has no default arm, so a word outside this set
+            means core grew the table.
         taskStatus: { type: string, description: 'the underlying task''s terminal TaskStatus (open vocabulary; core enum verbatim).' }
         callKey: { type: string, description: 'the stable deterministic identity of this ctx.agent call (resume-journal key).' }
         groupId: { type: string, description: 'the nesting ctx.workflow sub-group this agent ran under; absent = top-level.' }
@@ -7636,7 +7818,7 @@ components:
       additionalProperties: false
       properties:
         title: { type: string, description: 'phase title (redacted — LLM-authored).' }
-        status: { type: string, description: 'core WorkflowItemStatus, plus "pending" for a meta-preregistered phase not yet adopted.' }
+        status: { type: string, description: 'core WorkflowItemStatus (running|completed|failed; `parked` is an agent-row word only), plus "pending" for a meta-preregistered phase not yet adopted.' }
         startedAt: { type: integer, description: 'adoption time for a pre-registered phase (0 while still pending).' }
         endedAt: { type: integer }
         durationMs: { type: integer, description: 'endedAt − startedAt; absent until the phase ends.' }
@@ -7654,7 +7836,7 @@ components:
       properties:
         groupId: { type: string }
         parentGroupId: { type: string, description: 'absent = top-level (a child of the implicit root).' }
-        status: { type: string, description: 'core WorkflowItemStatus (running/completed/failed).' }
+        status: { type: string, description: 'core WorkflowItemStatus (running|completed|failed; a group never parks — `parked` is an agent-row word only).' }
         startedAt: { type: integer }
         endedAt: { type: integer }
         durationMs: { type: integer, description: 'endedAt − startedAt; absent until the group ends.' }
@@ -7880,13 +8062,31 @@ components:
         resultChars: { type: integer, description: 'server >=7.9.0 (A-002.6): the ORIGINAL result length in characters; present only alongside resultTruncated.' }
         tokens: { type: integer, description: 'present only when the result carried stats.' }
         turns: { type: integer, description: 'present only when the result carried stats.' }
+        parked:
+          type: boolean
+          enum: [true]
+          description: >-
+            server >= 7.69.0 / core 7.10.0 #642 — this ordinal is PARKED on a durable approval gate, waiting for a
+            decision. 🔴 NEVER minted as `false`: the park arm and the result arm carry the SAME payload (a
+            TaskResult whose terminal cause is `paused`), and the read face adds exactly this one bit, so an
+            ordinary row is simply ABSENT. Branch on `parked === true`, never on `!parked`. `status` is NOT
+            rewritten by this layer — it is that TaskResult's persisted plane status (`suspended` on a human
+            gate). 🔴 The oversize-stub arm (WorkflowJournalEntryTruncated) structurally CANNOT carry this key —
+            see its note; absence there is not an assertion.
 
     WorkflowJournalEntryTruncated:
       # 新(census 批2 四段):the truncated arm (workflows.ts) — an honest stub for a row whose
       # stored TaskResult exceeded the per-row 64KiB gate (SQL stores) or byte length (file/in-memory
       # fallback): the server never pulls the oversized payload into process memory.
       type: object
-      description: A journal row too large to project — an honest "too big to show" stub, never a silent 2000-char truncation of the real result.
+      description: >-
+        A journal row too large to project — an honest "too big to show" stub, never a silent 2000-char
+        truncation of the real result.
+        🔴 DELIBERATELY carries NO `parked` (server 7.69.0, one mint point shared by all three arms): a stub by
+        definition carries no payload-derived key — the SQL paging leg never pulled the payload back when the row
+        is over the bound, so it structurally cannot answer that bit, and minting it only on the file/in-memory
+        leg would fork the wire shape by backend. To decide "is this ordinal parked", read the `parked` of a
+        NON-stub row, or `agents[].status === "parked"` on GET /v1/workflows/:id. Absence here is NOT an assertion.
       required: [callKey, ordinal, truncated, resultBytes]
       additionalProperties: false
       properties:
@@ -8386,6 +8586,21 @@ components:
         is guaranteed by all four shapes; discriminate: `idempotent` -> replay; `decision` without `sessionId` ->
         parked receipt; `sessionId` + `bindingEnforced` (+ `status`) -> task-level acceptance / terminal.
         `taskId` rides `getActiveTaskId` on the terminal leg (omitted when there is no active row).
+        🔴 A FIFTH PROVENANCE, not a fifth key set (server >= 7.69.0 / S-185 — the PARKED WORKFLOW-CHILD lane):
+        when the pending belongs to a workflow child, the success body is byte-identically the TASK-LEVEL
+        ACCEPTANCE shape, but it is a wake of the workflow's **HOST session** — `taskId` is the host's FRESHLY
+        MINTED run id, not the child's. Two readings a consumer MUST get right:
+        (1) 🔴 the 200 is a **DELIVERY acceptance**, NOT "the gate is resolved". The child's checkpoint stays
+        PENDING until the workflow engine itself resolves it, so the card can still be on `/v1/approvals` right
+        after the 200 — NEVER remove the card from a UI on the strength of this 200; poll the HOST run
+        (`GET /v1/runs/{taskId}`) for progress instead. The background-redemption lane's 200 and the task-level
+        lane's 200 DO mean the engine committed the decision — one sentence ("approved and in effect") cannot be
+        used for both lanes.
+        (2) delivery can still be LOST: if the host run is interrupted before it re-invokes `Workflow`, the
+        decision goes with that invocation (it is not persisted anywhere) and a retry answers 409
+        `decide.workflow_host_not_parked`. Because the card was pending throughout, nothing is forged and the
+        approval can be re-decided once the host parks again.
+        The durable approval-queue projection is UNCHANGED — no key marks the workflow origin on any read face.
       required: []
       additionalProperties: false
       properties:
@@ -8652,6 +8867,12 @@ components:
         this spec over-declared decide bindings that never appeared on inbox wire at all. Four client repos were
         structurally zero-consumers, so server 3.4.0 narrowed the wire and this schema follows. For the tool face
         and decide bindings use /v1/approvals (PendingCheckpoint); for task attribution use /v1/assistant/tasks.
+        🔴 STILL CLOSED (sdk 8.9.0). Four keys the server had been minting onto this row went undeclared until
+        now — `requiresRealApproval` / `denialLimitFallback` / `origin` (server >= 7.57.0) and
+        `classifierUnavailable` (server >= 7.69.0) — so a strict validator rejected every row that carried one
+        and a generated client could not read them at all. They are declared below rather than tolerated: this
+        row stays closed, which is the whole point of the shape (an undeclared key is drift, and drift should be
+        loud).
       type: object
       required: [sessionId, scope, objective, input]
       additionalProperties: false
@@ -8678,11 +8899,47 @@ components:
             the /v1/approvals row's — the reading of absence does not). Absence = "not detected", never
             "confirmed clean". Declared here because this schema is CLOSED — without the key a strict validator
             rejects every >=7.53 inbox row that carries it.
+        requiresRealApproval:
+          type: boolean
+          enum: [true]
+          description: >-
+            server >= 7.57.0 (core 7.4.0 #557), ADDITIVE, present ONLY when true: this parked ask demanded REAL
+            HUMAN judgment — an inbox can say "only a person can clear this" without decoding the gate kind.
+            🔴 NEVER minted as `false` (the OMIT contract this row's other flags follow); absence is "not marked",
+            never "confirmed clearable without a person". The value comes WHOLE from core (`summarizeCheckpoint`
+            projects the park row's own bit) — the server neither recomputes nor redacts it.
+        denialLimitFallback:
+          $ref: '#/components/schemas/DenialLimitFallback'
+          description: >-
+            server >= 7.57.0 (core 7.4.0 #557), ADDITIVE — this parked ask IS the auto-mode classifier's
+            DENIAL-LIMIT fallback, carrying the counts that tripped the bound. 🔴 On a PARKED row
+            `autoDenyAfterMs` is ALWAYS `0` and a consumer MUST NOT start a countdown from it: the window is a
+            fact of the ask's ROUTE, armed only at a hand-out to a LIVE approver, and nothing counts down on the
+            parked lane (a park's expiry is the row's own `deadline`/ttl). Render the counts and the limit; there
+            is no countdown to render here. Core screens the four members before writing the row, so a
+            half-shaped value reads as ABSENT rather than reaching a consumer as a malformed card.
+        origin:
+          $ref: '#/components/schemas/AskOrigin'
+          description: >-
+            server >= 7.57.0 (core 7.5.0), ADDITIVE — WHICH AUTHORITY raised this parked ask, the same word the
+            synchronous card renders by (engine-stamped at the gate, never a policy's claim). Core writes it onto
+            the row ONLY when it is a member of the set, so an out-of-set word is not expected on THIS face — but
+            the vocabulary's owner is still core and it has grown before, so read it the same way as everywhere
+            else: branch known words, keep a `default` arm, and treat an unknown one as "unknown origin", never
+            as "no origin". A row minted before the bit existed reads absent (unreported), not "no authority".
         objective: { type: ['string', 'null'], description: 'task objective, null if unavailable.' }
         input:
           description: >
             REDACTED tool-args preview for display (null on gates without one, e.g. plan_review). Untyped by
             design (per-tool shape). The raw `toolInput` is deliberately NOT on this row.
+        classifierUnavailable:
+          $ref: '#/components/schemas/ClassifierUnavailable'
+          description: >-
+            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE — WHY this PARKED ask reached a human. The inbox is the
+            TRIAGE face, so `breaker_open` matters most here: it forecasts an approval storm rather than a
+            one-off question. The value comes WHOLE from core (`summarizeCheckpoint` echoes it only when the
+            cause is a member of the engine's set), so the server neither recomputes nor re-screens it. See
+            ClassifierUnavailable for the open-`cause` rule and the three shapes absence covers.
 
     InboxList:
       type: object
@@ -9344,6 +9601,14 @@ components:
         activeTaskId:
           type: string
           description: On a 409 — the task currently holding the session lock (see the Conflict response note).
+        runId:
+          type: string
+          description: >-
+            server >= 7.69.0 (S-185) — on the three `decide.workflow_*` codes ONLY: the WORKFLOW run's id. It is
+            the RECOVERY HANDLE (wait for the host session to park and re-decide, or resume that run directly).
+            🔴 NOT interchangeable with `taskId`: the workflow-child park lane mints no taskId at all (this
+            decision never landed on any run, so minting one would be a lie), and the other two decide lanes
+            mint no runId. Branch by `errorCode`, never fall back from one handle to the other.
 
     # ── Streaming event taxonomy (the UX 命脉). Each SSE `data:` line is one JSON-serialized AgentEvent. ──
     # TWO vocabularies (the pinned wire contract Drift 3). ⚠️ The two lines below are the SHAPE-DEFINING
@@ -9568,12 +9833,16 @@ components:
     DeniedBy:
       type: string
       description: >
-        WHO REFUSED a call — the LAYER whose verdict is the deny (core 7.6.0 `DENIED_BY_VALUES`, 8 words,
-        CLOSED). The other question a deny raises — who ASKED — is answered by `AskOrigin`; the two used to
-        share one seven-word list in which `classifier` meant both.
+        WHO REFUSED a call — the LAYER whose verdict is the deny (core `DENIED_BY_VALUES`; 8 words in 7.6.0,
+        NINE from core 7.9.0 / server >= 7.67.0, CLOSED). The other question a deny raises — who ASKED — is
+        answered by `AskOrigin`; the two used to share one seven-word list in which `classifier` meant both.
         `policy` = the deployment `ToolPolicy` denied (directly, or re-checking an approved edit), or the
         approval-edit chain hit its round cap · `hook` = a PreToolUse hook denied, threw, or never answered ·
-        `org` = an organization policy rule denied · `classifier` = the auto-mode classifier denied directly ·
+        `org` = an organization policy rule denied · `persisted_rule` = the person's OWN standing `deny` row
+        denied (the deny list of their settings, imported — reachable from core 7.9.0 #625's three-behavior
+        persisted rules). It is the personal-store sibling of `org`: same VETO family (it can overturn an approval
+        a person already gave, and it re-judges an edited command), which is why it is neither `policy` nor
+        `ask_resolution` · `classifier` = the auto-mode classifier denied directly ·
         `plan_mode` = plan mode's read-only block on a write tool · `compliance` = the compliance call-time
         lock · `write_protection` = an approved edit was rewritten onto a write-protected path no approval
         covers · `ask_resolution` = the ask's own settlement IS the refusal (detail on `GateOutcome.settlement`).
@@ -9582,7 +9851,7 @@ components:
         record WHOLE (report + withhold). A word outside this set therefore cannot reach a consumer — it arrives
         as the `gate` key being ABSENT, never as an unfamiliar word. Same rule for `Settlement.kind` and for
         `GateOutcome.origin`.
-      enum: [policy, hook, org, classifier, plan_mode, compliance, write_protection, ask_resolution]
+      enum: [policy, hook, org, persisted_rule, classifier, plan_mode, compliance, write_protection, ask_resolution]
 
     Settlement:
       description: >
@@ -9751,7 +10020,7 @@ components:
             #   服务对缺陷记录是整条不上帧 ⇒ 词表外的值在这条 wire 上到不了消费端。审批帧那一面不判成员,
             #   所以 `AskOrigin` 本体保持真开(见该 schema 的长注)。这张 enum 是本 spec 里该词表的**唯一**
             #   执法点;core 加词时改这一处。
-            - enum: [content_question, unresolvable, org_unavailable, org_rule, hook, ask_rule, denial_limit_fallback, shell_gate_tighten, safety_tighten, policy]
+            - enum: [content_question, unresolvable, org_unavailable, org_rule, rule_store_unavailable, hook, ask_rule, denial_limit_fallback, shell_gate_tighten, safety_tighten, policy]
           description: >
             WHO ASKED. Same-present/same-absent as `settlement` (I1). CLOSED here (and only here) — see the
             enum note above.
@@ -10292,33 +10561,7 @@ components:
             🔴 The engine''s `error` free text is DELIBERATELY NOT PROJECTED (it is remote-author text, and core
             already owns the single redaction mint point for it). The actionable cause is `errorCode`.
             A row missing `name` or `status` is dropped individually — the other servers'' rows still ship.
-          items:
-            type: object
-            additionalProperties: false
-            required: [name, status]
-            properties:
-              name: { type: string, description: 'The declared server name.' }
-              status: { type: string, description: 'Three-word engine set (connected / failed / …). Open on read.' }
-              source: { type: string, description: 'The declarer''s own layer label, echoed verbatim by core (single-line, length-capped).' }
-              toolCount: { type: integer, description: 'Tools mounted. ABSENT rather than 0 — a minted 0 would read as "connected with no tools".' }
-              errorCode:
-                type: string
-                description: >
-                  core >= 7.6.0 — the `McpFailureKind` word (`connect_refused` / `connection_failed` /
-                  `connection_closed` / `http_status` / `not_mcp_response` / `spawn_failed` / `timeout` /
-                  `protocol` / `invalid_config` / `unknown`). The retired 7.5.0 spellings — `network` and the
-                  `http_<status>` encoding — are GONE; an HTTP status now rides `httpStatus`.
-                  Deliberately NOT enumerated here: the vocabulary''s single owner is the engine, and mirroring
-                  it would swallow a newly minted word as a violation. Switch with a `default` arm.
-              delivered:
-                allOf: [{ $ref: '#/components/schemas/McpDelivered' }]
-                description: 'core >= 7.6.0 (S6-B) — did the request reach that server. Read WITH `errorCode`.'
-              httpStatus:
-                type: integer
-                description: >
-                  core >= 7.6.0 (S6-B) — the status the endpoint answered with; rides ONLY with
-                  `errorCode === "http_status"` (401/403 = re-authorize, 5xx = that end is down). ABSENT rather
-                  than 0.
+          items: { $ref: '#/components/schemas/WiringManifestMcpEntry' }
         governance:
           type: object
           additionalProperties: false
@@ -10453,6 +10696,28 @@ components:
         message varies with the memoryProvenance mode — matching on message text WILL break). `code` is an OPEN
         set (the server whitelist grows with core's code register): render a known code specially, fall back to
         `message` for an unknown one — never drop the frame.
+        🔴 This list is NOT the full register and is not meant to become one (server 7.69.0's whitelist holds 21
+        codes): `code` is OPEN, and only the codes with an EXTRA rendering rule are written out here.
+        `mcp.injection_dropped` (server >= 7.68.0) — one entry of the CALLER'S OWN request-leg MCP injection was
+        not mounted; `{sessionId, server, reason, field?}`, `reason` a four-word set (`malformed_entry` /
+        `name_reserved_by_deployment` / `gate_closed` / `over_cap`). The recovery verb is on the USER's side
+        (rename it, fix that key, drop a few servers) — without this notice all they see is "my .mcp.json seems
+        to do nothing". Minted at ASSEMBLY time, so `detail` structurally has NO runId; the join key is the
+        `server` name. ⚠️ The DELIVERY surface changed at server 7.69.0: 7.68.0 delivered it on the two FRESH
+        legs only, and 7.69.0 delivers it on the RESUME family too (all four resume legs share one
+        spec-resolver, which now passes the notice seat). Consequence for consumers that assert on ledger
+        CONTENTS: a resume leg's ledger MAY now carry one extra `engine_notice` row it did not before — assert
+        "may appear", never an exact row count or order (and consume idempotently: reconnect replay shows it again).
+        `delegation.ask_unresolvable` (server >= 7.69.0 / core 7.10.0 #648) — an `ask` reached a FINAL DENY with
+        NOBODY having ruled on it: the approver consulted for the call answered `unavailable` and no durable park
+        caught it afterwards. The deny itself is unchanged (`tool_end.gate.settlement.kind:"approver_unavailable"`
+        — that sentence IS the tool result); this code is the half the person watching notices could not see.
+        `{sessionId, toolName, toolCallId, settlementKind, parkLaneExisted}`; `toolCallId` joins to the
+        `tool_approval` card frame, `settlementKind` is passed through verbatim (the vocabulary's owner is core).
+        Deduplicated ONCE PER TOOL CALL. 🔴 `parkLaneExisted` is a DISCRIMINANT, not a count: `true` = a park lane
+        was armed but declined/failed (check the store, check authorisation), `false` = there was no lane at all
+        (wire one up). The two recovery verbs differ, so a consumer MUST render them apart — NEVER fold them into
+        one "nobody approved it".
         Starter whitelist (server 7.36): `memory.session_polluted` `{reason, sessionId?}` ·
         `memory.harvest_quarantined` `{count, moved, escalated, reason?}` — `moved` and `escalated` MUST NOT be
         subtracted from each other (an in-place tombstone counts as both) · `memory.delegation_static_mark_waived`
@@ -11129,6 +11394,12 @@ components:
     #    分两段:server ≤7.4.0 默认 OFF,≥7.5.0 默认 ON(BREAKING,见 server CHANGELOG)。──
     # 与上面的 ToolApprovalFrame 是**并行加帧,不替换**:开关打开时同一只 ask 出两帧(先 tool_approval,
     # 后 approval_request),两帧同带 `approvalId` ⇒ 消费端按它去重、优先渲染新帧。
+        classifierUnavailable:
+          $ref: '#/components/schemas/ClassifierUnavailable'
+          description: >-
+            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE, present only when the classifier was consulted and
+            could not run — WHY this ask reached a human. See ClassifierUnavailable for the open-`cause` rule and
+            the three shapes absence covers.
     ApprovalRequestFrame:
       type: object
       description: >
@@ -11261,6 +11532,12 @@ components:
         # 但本 schema 此前只在帧上公示过。长 description 的单一真源在 ToolApprovalFrame 的同名键。
         ruleOffersAbsence: { $ref: '#/components/schemas/RuleOffersAbsence' }
         denialLimitFallback: { $ref: '#/components/schemas/DenialLimitFallback' }
+        classifierUnavailable:
+          $ref: '#/components/schemas/ClassifierUnavailable'
+          description: >-
+            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE — WHY this ask reached a human. Frame and card carry
+            the SAME value (one narrow-read function server-side). See ClassifierUnavailable for the open-`cause`
+            rule and the three shapes absence covers.
 
     RuleSuggestion:
       type: object
@@ -11284,6 +11561,30 @@ components:
         command: { type: string, maxLength: 512, description: 'The command pattern inside the rule, for a shell that would rather not re-parse `rule`.' }
 
     # ─── S-139(sdk 8.3.0):对 server 7.60.0 整体重对账带进来的四张型面 ───────────────────────
+    ClassifierUnavailable:
+      # 8.9.0:三面(tool_approval 帧 / ApprovalCard / InboxRow)同形同值 ⇒ 具名单源,内联三份会各自漂。
+      type: object
+      description: >-
+        WHY this ask reached a human (server >= 7.69.0, core 7.10.0 #616): the auto-mode classifier was consulted
+        and could not run. Carried on all THREE faces with the same value — the live `tool_approval` frame, the
+        `ApprovalCard` (`card_json` / `approval_request`), and the `GET /v1/assistant/inbox` row. Under the auto
+        mode most calls are answered by the classifier, so the ones that DO reach a person are often exactly the
+        ones it could not answer — and the causes want different handling (the gateway is broken / it is too slow
+        / the breaker is OPEN, i.e. every following ask will arrive too). The inbox is the TRIAGE face, which is
+        where `breaker_open` is worth the most: it forecasts an approval storm, not a one-off question.
+        🔴 `cause` is an OPEN string and is deliberately NOT enumerated here. The vocabulary's single owner is the
+        engine (today: `error` / `timeout` / `breaker_open`); mirroring it would swallow a newly minted word as a
+        violation — the same rule as `AskOrigin` and the MCP `errorCode`. Switch on the known words and KEEP A
+        DEFAULT ARM.
+        🔴 ABSENCE IS NOT AN ASSERTION. It covers three shapes at once: the classifier ANSWERED (this ask is one
+        it ruled should go to a person) · this ask was not ELIGIBLE for the classifier · this deployment wired no
+        classifier at all. Never read absence as any claim about classifier health, and never as "the classifier
+        is fine". (`parse_error` does not set this bit, per the engine's contract.)
+      additionalProperties: false
+      required: [cause]
+      properties:
+        cause: { type: string, description: 'The engine''s cause word. OPEN — branch known words, default arm for the rest.' }
+
     AskOrigin:
       type: string
       x-open-enum: true
@@ -11293,7 +11594,7 @@ components:
       #   当天,一个**合法**的审批卡就会被严格消费端拒收。`x-open-enum` 只是意图标记,不解除 enum 的执法 ——
       #   这正是本车刚从 `CheckpointGate` 拆掉的那个假开集,不在这里换个地方重犯。
       #   闭集**执法**只属于**筛过的**那一面(`GateOutcome.origin`:引擎的 `screenGateOutcome` 判成员,
-      #   出集即整条不上帧),所以那张 enum 落在**那个引用点**,恰一处。已知十词见下面的描述。
+      #   出集即整条不上帧),所以那张 enum 落在**那个引用点**,恰一处。已知十一词见下面的描述。
       description: >
         WHO raised an ask (`ToolApprovalFrame.origin`; server >= 7.57.0 / core 7.5.0, S-125③/#564) — core's
         `ASK_ORIGINS`, ENGINE-STAMPED at the gate (core's words: "engine-stamped at the gate, never a policy's
@@ -11315,6 +11616,11 @@ components:
         word could not. Both are classifier-eligible (arming auto mode is the deployment's explicit choice to
         let the classifier resolve those classes).
 
+        🔴 core 7.9.0 ADDS AN ELEVENTH WORD (server >= 7.67.0): `rule_store_unavailable` = the gate's own
+        PERSISTED-RULE lane could not be READ for this call, so its deny/ask rows are unenforceable and the gate
+        fails closed to a person. It is the personal-store sibling of `org_unavailable` (a governance source that
+        cannot be read means ASK, never a silent allow).
+
         The SAME type is the `origin` member of `GateOutcome` on `tool_end` — one vocabulary, two faces.
 
     RuleOffersAbsence:
@@ -11356,8 +11662,13 @@ components:
         waits for a person) is for RENDERING THE COUNTDOWN ONLY. Never start a second timer from it: the window
         is executed by the ENGINE, and two overlapping windows are worse than the original defect and silent.
         🔴 ABSENCE IS NOT AN ASSERTION — the vast majority of asks are not fallback cards.
-        ⚠️ The durable (parked) leg does NOT carry this key today; the card's copy rides `card_json`, which is
-        a different leg from the parked row's `pendingAction`.
+        ⚠️ TWO LEGS CARRY IT, and they differ in ONE member. The live/card leg (`ToolApprovalFrame` /
+        `ApprovalCard` / `card_json`) can carry a NON-ZERO `autoDenyAfterMs`; the DURABLE leg — the parked row,
+        projected onto `InboxRow` since server >= 7.57.0 (core's park twin of the same member) — always carries
+        `0` there, because nothing counts down on a parked lane (see InboxRow.denialLimitFallback).
+        (Corrected 2026-09-10 against core's checkpoint-summary type and the server's inbox projection: this
+        sentence used to read "the durable (parked) leg does NOT carry this key today", which stopped being
+        true when the park twin landed.)
       properties:
         consecutive: { type: integer, description: 'Consecutive refusals at the moment the limit tripped.' }
         total: { type: integer, description: 'Cumulative refusals at the moment the limit tripped.' }
@@ -12943,12 +13254,18 @@ components:
         core's assembly self-evidence manifest (core >=5.14.0 `WiringManifest`). TWO HALVES, ONE shape (a
         consumer must line the two faces up, so they are not split into separate types) — but which keys
         belong to which half is DETERMINATE, not "usually": `leg`, `ask.effective` and `configFingerprint`
-        are EFFECTIVE-half only (the live `wiring_manifest` event) — as are the three per-leg sections the
-        event schema declares (`modelGate`, `autoMode`, `mcp`), which describe what THIS leg did and have no
-        static counterpart — and the STATIC half
+        are EFFECTIVE-half only (the live `wiring_manifest` event) — as are the four per-leg sections
+        `modelGate`, `autoMode`, `mcp` and `tools`, which describe what THIS leg did and have no static
+        counterpart — and the STATIC half
         (GET /v1/diagnostics/wiring) NEVER mints them; every other section, plus `governance`, is always
         present on the static half. Fields stay optional because core may add or drop sections and that
         must not hard-break a client — read by half, and never wait on a key the half never sends.
+        🔴 EVERY section is declared HERE, each saying which half mints it (sdk 8.9.0). Before that, `tools`
+        was declared while its three effective-half siblings were not, and `permissionRules` — which the
+        engine mints UNCONDITIONALLY, i.e. on BOTH halves — was missing altogether, so a generated client
+        reading GET /v1/diagnostics/wiring could not see it at all. "Two halves, one shape" is the stated
+        doctrine of this schema; omitting a section because one half does not mint it contradicts it and
+        splits consumers into two groups reading two different manifests.
         🔴 `governance` and `configFingerprint` appear ONLY on an operator-scoped face. A tenant stream
         gets neither — and NOT just the section: core hashes the WHOLE manifest unsalted and governance is
         four booleans, so the fingerprint alone would let a tenant brute-force sixteen combinations against
@@ -13019,11 +13336,100 @@ components:
           description: >
             server >= 7.66.0 (design/388 B-4) — the leg's whole tool roster. EFFECTIVE half only (the diagnostics
             endpoint's static half never carries it); absent as a whole when core's typebox check rejects it.
+        permissionRules:
+          type: object
+          description: >
+            core >= 5.18.0 (design/179) / >= 5.23.0 (design/182 §7/§9), server >= 7.6.0 — is a PERSISTED
+            PERMISSION RULE store wired, how far does a "don't ask again" travel, and is an org governance layer
+            armed over that lane. 🔴 BOTH HALVES: the engine mints this section unconditionally, so it rides the
+            static `GET /v1/diagnostics/wiring` face too — read it before offering a "don't ask again"
+            affordance. `false` is a REAL reading ("no rule lane on this worker"), never "too old to know"; only
+            the whole key being absent means "never sent it". TENANT-visible (deliberately outside the
+            operator-only `governance` section). Full per-key contract: see Event_wiring_manifest.permissionRules.
+          properties:
+            storeWired: { type: boolean }
+            syncWired: { type: boolean }
+            orgGoverned: { type: boolean }
+        mcp:
+          type: array
+          description: >
+            core >= 7.5.0 (#562) / >= 7.6.0 (S6-B), server >= 7.60 — one row per MCP server THIS leg declared.
+            EFFECTIVE half only. 🔴 An empty array is NOT absence (`[]` = "this leg declared no servers").
+            Full per-key contract: see Event_wiring_manifest.mcp.
+          items: { $ref: '#/components/schemas/WiringManifestMcpEntry' }
+        modelGate:
+          type: object
+          description: >
+            core >= 7.3.x (design/385 片2b), server >= 7.58 — which tools the tool-MODEL gate removed from THIS
+            session and how to get them back. EFFECTIVE half only; ALL-OR-NOTHING (absent = nothing was gated,
+            never an empty section). Full contract: see Event_wiring_manifest.modelGate.
+          required: [class, removed, restore]
+          properties:
+            class: { type: string }
+            removed: { type: array, items: { type: string } }
+            restore: { type: string }
+        autoMode:
+          type: object
+          description: >
+            core >= 7.3.1 (#529), server >= 7.59 — did AUTO mode arm on THIS leg, and if not which arm it stopped
+            at. EFFECTIVE half only. 🔴 `reason` is core's closed word list passed through VERBATIM (branch known
+            words, keep a default arm); ABSENCE IS NOT "not applicable" — never fold it to `armed: false`. The
+            server projects exactly these two keys (core's `breaker` sub-fact is NOT projected onto the wire).
+            Full contract: see Event_wiring_manifest.autoMode.
+          required: [armed, reason]
+          properties:
+            armed: { type: boolean }
+            reason: { type: string }
+    WiringManifestMcpEntry:
+      # 8.9.0:从 `Event_wiring_manifest.mcp.items` 的内联形**提取**为具名 schema —— 同一份行形现在被
+      # 两处引用(live 帧与 `WiringManifest` 的静态/两半形),内联会立刻变成两份会各自漂的镜像。
+      type: object
+      description: >
+        One row of a leg's MCP wiring manifest: did that declared server connect, if not which failure class,
+        and how many tools it mounted. A row missing `name` or `status` is dropped INDIVIDUALLY — the other
+        servers' rows still ship. 🔴 The engine's `error` free text is DELIBERATELY NOT PROJECTED (remote-author
+        text; core owns the single redaction mint point). The actionable cause is `errorCode`.
+      additionalProperties: false
+      required: [name, status]
+      properties:
+        name: { type: string, description: 'The declared server name.' }
+        status: { type: string, description: 'Three-word engine set (connected / failed / …). Open on read.' }
+        source: { type: string, description: 'The declarer''s own layer label, echoed verbatim by core (single-line, length-capped).' }
+        toolCount: { type: integer, description: 'Tools mounted. ABSENT rather than 0 — a minted 0 would read as "connected with no tools".' }
+        errorCode:
+          type: string
+          description: >
+            core >= 7.6.0 — the `McpFailureKind` word (`connect_refused` / `connection_failed` /
+            `connection_closed` / `http_status` / `not_mcp_response` / `spawn_failed` / `timeout` /
+            `protocol` / `invalid_config` / `unknown`). The retired 7.5.0 spellings — `network` and the
+            `http_<status>` encoding — are GONE; an HTTP status now rides `httpStatus`.
+            Deliberately NOT enumerated here: the vocabulary's single owner is the engine, and mirroring
+            it would swallow a newly minted word as a violation. Switch with a `default` arm.
+        delivered:
+          allOf: [{ $ref: '#/components/schemas/McpDelivered' }]
+          description: 'core >= 7.6.0 (S6-B) — did the request reach that server. Read WITH `errorCode`.'
+        httpStatus:
+          type: integer
+          description: >
+            core >= 7.6.0 (S6-B) — the status the endpoint answered with; rides ONLY with
+            `errorCode === "http_status"` (401/403 = re-authorize, 5xx = that end is down). ABSENT rather
+            than 0.
+
     ServerWiringGates:
       type: object
       description: >
-        The server's OWN assembly predicates (the half core's manifest does not cover).
-      required: [streamApproval, durableApproval, checkpointStore]
+        The server's OWN assembly predicates (the half core's manifest does not cover) — server
+        `routes/diagnostics.ts` `buildServerWiringGates`.
+
+        🔴 BREAKING (server >= 7.67.0 / S-178): the three POSTURE-FAMILY knobs are now `{value, source, note}`
+        readings instead of bare values, and two of those rows are NEW. `streamApproval` is a GATE reading (a
+        different axis: is this leg live) and `checkpointStore` is a presence bit — neither is a knob, so neither
+        changed by one byte. Migration: `serverGates.durableApproval` -> `serverGates.durableApproval.value`.
+
+        ⚠️ THIS SCHEMA DESCRIBES ONE GENERATION (same treatment as `TaskResult.terminal` in SDK 8.4.0): against a
+        worker < 7.67.0 `durableApproval` is still a bare boolean on the wire and the other two keys are absent.
+        The discriminator is the PEER'S VERSION, not the presence of these keys.
+      required: [streamApproval, durableApproval, streamAskWindowMs, sessionAutoTitle, checkpointStore]
       additionalProperties: false
       properties:
         streamApproval:
@@ -13033,7 +13439,39 @@ components:
             same five-way predicate that gates `capabilities.streamApproval` and the decision endpoint's
             501 — so the diagnostics page and the consumer-facing behavior cannot disagree.
           enum: [active, no_tool_approval, protocol_disabled, no_backend, volatile_ask_ledger, no_park_facility]
-        durableApproval: { type: boolean, description: 'DURABLE_APPROVAL is on.' }
+        durableApproval:
+          allOf:
+            - { $ref: '#/components/schemas/PostureKnobReading' }
+            - properties: { value: { type: boolean } }
+          description: >
+            `DURABLE_APPROVAL` (the durable-checkpoint gate's master switch) AND who set it. 🔴 On a single-user
+            turnkey worker (REQUIRE_PRINCIPAL unset) the ABSENT default is now ON — conjoined with a durable store
+            actually being present, so a `DB_BACKEND=memory` worker still mints nothing. A multi-tenant worker's
+            absent default is unchanged (off). Pin it back with `DURABLE_APPROVAL=false` on the machine
+            (`source: "env"` always wins).
+        streamAskWindowMs:
+          allOf:
+            - { $ref: '#/components/schemas/PostureKnobReading' }
+            # 🔴 `number`,不是 `integer`:server 的 `parseNumOrFail`(config.ts)只判 `Number.isFinite`,
+            #   于是 `STREAM_ASK_WINDOW_MS=300000.5` 是一个**能启动**的部署,而这个值原样上诊断面 ——
+            #   写 `integer` 会把一台合法 worker 的真实响应判违约。下界 0 是**真有**的拒启门(负窗拒启)。
+            - properties: { value: { type: number, minimum: 0 } }
+          description: >
+            The approval window in milliseconds AND who set it. 🔴 On a single-user turnkey worker the absent
+            default moved from 5 minutes to 24 HOURS (a person stepping away for ten minutes should not come back
+            to a run that settled itself unattended); multi-tenant is unchanged at 300000. Pin it back with
+            `STREAM_ASK_WINDOW_MS=300000`.
+            ⚠️ POSTURE ONLY FILLS AN EMPTY SEAT: where the derived 24h would collide with the existing
+            cross-knob refuse-to-start inequality (`WINDOW + ADHOC_GRACE < ORPHAN_TTL`), posture YIELDS back to the
+            engine default 300000 and reports `source: "engine-default"` rather than refusing to boot a deployment
+            that changed nothing.
+        sessionAutoTitle:
+          allOf:
+            - { $ref: '#/components/schemas/PostureKnobReading' }
+            - properties: { value: { type: boolean } }
+          description: >
+            `SESSION_AUTO_TITLE` AND who set it. Its default is the SAME on every deployment shape (true), so this
+            knob has NO posture arm — an unset one reads `source: "engine-default"` and says so in `note`.
         checkpointStore: { type: boolean, description: 'A checkpoint store is wired (= the park facility exists).' }
 
     WiringDiagnostics:
@@ -13706,12 +14144,32 @@ components:
             kind: { type: string, enum: [project] }
             root: { type: string, minLength: 1, description: 'The canonical directory this rule is scoped to. NEVER empty — an empty prefix contains EVERY cwd, which would silently promote a project rule to a global one.' }
 
+    RuleBehavior:
+      type: string
+      description: >
+        WHICH OF THE THREE a persisted rule is (core `RULE_BEHAVIORS`, closed; listed in PRECEDENCE order, so
+        when rules of more than one behavior speak for one call the earliest member decides).
+
+        🔴 A RULE'S IDENTITY IS THE TRIPLE (behavior, text, scope) — core `sameRuleIdentity`; server >= 7.67.0 /
+        core 7.9.0 #625. The same text under two behaviors is TWO DIFFERENT ROWS, which is why the revoke body
+        requires this field and deliberately gives it NO default: a delete aimed at an `allow` that got defaulted
+        onto the same-text `deny` removes a refusal the operator meant to keep, and answers 200.
+        `allow` = the standing form of one recorded human approval ("don't ask again" on a card); `deny` / `ask` =
+        the standing forms of "never run this" and "ask me every time", the same content-form rules the engine
+        reads out of a settings file's deny/ask lists. ONE grammar, ONE canonical spelling and ONE matcher family
+        serve all three — the behavior is a FIELD BESIDE the text, never part of it.
+      enum: [deny, ask, allow]
+
     RuleCandidate:
       type: object
-      description: 'One candidate rule: the canonical text plus the scope it would land in (core `RuleCandidate`).'
+      description: >
+        One candidate rule: WHICH BEHAVIOR it is, the canonical text, and the scope it would land in (core
+        `RuleCandidate`). `behavior` is new in server >= 7.67.0 / core 7.9.0 #625 — a card mints `allow`
+        candidates only (a card is one person's yes), while the settings import now carries all three lists.
       additionalProperties: false
-      required: [rule, scope]
+      required: [behavior, rule, scope]
       properties:
+        behavior: { $ref: '#/components/schemas/RuleBehavior' }
         rule: { type: string, maxLength: 512 }
         scope: { $ref: '#/components/schemas/RuleScope' }
 
@@ -13781,8 +14239,14 @@ components:
         `uncovered` is a TWO-KEY RECORD, not a list: the two layers this version does not read are named in the
         TYPE, so an empty list, a missing member or a duplicate is not expressible. A preview that reported only
         the layers it read would be claiming a completeness it does not have.
+
+        🔴 server >= 7.67.0 / core 7.9.0 #625 — THE DENY AND ASK LISTS ARE IMPORTED TOO. Until then only the allow
+        bucket was read and deny/ask entries were counted into an `uncovered.denyAskBuckets` seat that said "left
+        in place"; now every candidate carries its own `behavior` and that seat is GONE — an entry that did not
+        become a candidate is in `skipped` with its reason. A consumer rendering `uncovered.denyAskBuckets` reads
+        `candidates[].behavior` instead.
       additionalProperties: false
-      required: [candidates, skipped, layers, uncovered]
+      required: [candidates, skipped, translated, layers, uncovered]
       properties:
         candidates:
           type: array
@@ -13792,6 +14256,25 @@ components:
           type: array
           items: { $ref: '#/components/schemas/CcImportSkippedRule' }
           description: 'Entries that did not become candidates. `reason` is PROSE, not a code — see the schema.'
+        translated:
+          type: array
+          description: >
+            ALWAYS EMPTY in this version — a compatibility seat core keeps on the wire shape (core
+            `ImportPreview.translated`, verbatim). It once carried entries whose MATCH FORM was rewritten on the
+            way in (the other product's space-star suggestion form translated to this lane's colon-star). That
+            translation is retired: space-star is now a first-class match form of this lane's own grammar, so an
+            entry's match form imports as the file states it and nothing is ever pushed here. A reader rendering a
+            "rewritten spellings" column from this seat renders an empty column, correctly.
+            ⚠️ Declared here from SDK 8.8.0 on: core has always emitted the key, so a closed schema without it
+            judged every real 200 body a violation (a staleness fix, not a behavior change).
+          items:
+            type: object
+            additionalProperties: false
+            required: [from, to, scope]
+            properties:
+              from: { type: string }
+              to: { type: string }
+              scope: { $ref: '#/components/schemas/RuleScope' }
         layers:
           type: array
           items: { $ref: '#/components/schemas/CcImportLayerReport' }
@@ -13831,9 +14314,12 @@ components:
         indeterminate, release the claim and answer 503 `state.rule_import_retry` (server rules-consent.ts) —
         so this schema honestly describes the two-value `status` only.
       additionalProperties: false
-      required: [candidateIndex, rule, scope, status, alreadyRedeemed, dot]
+      required: [candidateIndex, behavior, rule, scope, status, alreadyRedeemed, dot]
       properties:
         candidateIndex: { type: integer, description: 'Index into the prepare preview''s candidate set (candidate space).' }
+        behavior:
+          allOf: [{ $ref: '#/components/schemas/RuleBehavior' }]
+          description: 'server >= 7.67.0 / core 7.9.0 #625 — which of the three the landed row is (same value as the same-index candidate in the preview; one leg of the identity triple).'
         rule: { type: string, description: 'Canonical rule text.' }
         scope: { $ref: '#/components/schemas/RuleScope' }
         status:
@@ -13915,27 +14401,71 @@ components:
     PersistedRule:
       type: object
       description: >
-        One LIVE persisted allow rule as `GET /v1/rules` puts it on the wire (server `PersistedRuleWireRow`).
+        One LIVE persisted rule as `GET /v1/rules` puts it on the wire (server `PersistedRuleWireRow`).
         Tombstones are already folded — every row here is live at `RuleListResult.rev`.
         🔴 `scope` is the DISCRIMINANT STRING (`global` / `project:<root>`), NOT the `RuleScope` object the
         import lane speaks: this is the exact byte sequence the revoke body wants back, so echo it VERBATIM
         rather than re-serializing a parsed form (an equivalent-but-differently-spelled root matches nothing).
-        The rule lane is ALLOW-only; deny/ask rules are the tightening direction and never appear here.
+
+        🔴 THREE BEHAVIORS, NOT ALLOW-ONLY (server >= 7.67.0 / core 7.9.0 #625). Until 7.66.0 this schema said
+        "the rule lane is ALLOW-only; deny/ask rules are the tightening direction and never appear here" — that
+        sentence is now false, and `behavior` is the leg of the identity triple a revoke has to echo back.
       additionalProperties: false
-      required: [rule, scope, tool, match, command, adds]
+      required: [behavior, rule, scope, tool, match, command, adds, source, status]
       properties:
+        behavior:
+          allOf: [{ $ref: '#/components/schemas/RuleBehavior' }]
+          description: 'Which of the three this row is. Part of the row''s IDENTITY — pass it back VERBATIM to revoke, or the delete aims at another behavior''s same-text row.'
         rule: { type: string, description: 'Canonical rule text — `Bash(git status)` (exact) or `Bash(git status:*)` (prefix). Pass back VERBATIM to revoke.' }
         scope: { type: string, description: 'Scope discriminant string: `global`, or `project:<root>` with a NON-EMPTY root. Pass back VERBATIM to revoke.' }
-        tool: { type: string, enum: [Bash], description: 'The one tool the v1 rule lane speaks for. The field exists so a later version can widen without a shape change — read it, do not assume it.' }
+        tool:
+          type: string
+          # 🔴 只钉非空,**不借**输入面那条 `maxLength: 190`(server 的 `LocalImportRowSchema` 帽的是**收进来的**
+          #   行;列举面出去的行不过那道尺)。借一条别的面的约束来判这一面,迟早把一条合法行判成违约。
+          minLength: 1
+          description: >
+            Which tool this row speaks for. 🔴 NOT A CLOSED SET from server >= 7.67.0 / core 7.9.0 #625 (the
+            `enum: [Bash]` written here through SDK 8.7.0 is gone): the tool set is DERIVED from the engine
+            catalogue's path-target declarations — `Bash` is the command grammar, any tool declaring a
+            `pathTarget` (`Read` / `Write` / `Edit` / `Glob` / `Grep` / `NotebookEdit`, …) is the path grammar.
+            The test is "does the engine's rule grammar speak for this name", and that roster lives in the
+            engine's catalogue, not on this wire. READ IT; do not switch over a closed list. A name the grammar
+            does not know is still a 400 on the input faces.
         match:
           type: string
-          enum: [exact, prefix]
-          description: '`exact` = this one command only; `prefix` = word-boundary prefix. (core reserves a `wildcard` form for v2 that no current version produces.)'
+          enum: [exact, prefix, wildcard, subpath, path]
+          description: >
+            The match form (core `PersistedRuleMatch`, five members). `exact` = this one command only ·
+            `prefix` = word-boundary prefix (the historical colon-star spelling, and the only spelling for a
+            compound prefix) · `wildcard` = the space-star form, the SAME predicate as `prefix` on a single
+            command body · `subpath` = the directory (read-containment) form, which never admits a command ·
+            `path` = NEW in server >= 7.67.0, the path-family pattern grammar for deny/ask/allow rules (`//abs`,
+            `~/`, root-relative, cwd-relative; `*` within a segment, `**` across segments).
+            SDK 8.7.0 and earlier declared only the first two — a consumer rendering this cell off a closed list
+            must add the other three.
         command: { type: string, description: 'What the matcher actually compares against, parsed out of `rule` at mint time and stored so no consumer re-parses. Trust this + `match`, not your own parse of `rule`.' }
         adds:
           type: array
           description: 'Every LIVE add of this rule (see RuleAdd — a real set, deliberately not folded).'
           items: { $ref: '#/components/schemas/RuleAdd' }
+        source:
+          type: string
+          enum: [user, project, session]
+          description: >
+            Which source this row came from (server >= 7.57.0 / core 7.5.0 design/389). DERIVED FROM `scope`
+            (`global`<->`user`, `project`<->`project`, `session`<->`session`) — the row never carries a second
+            source byte that could drift from its scope. With only the durable partition wired today the reachable
+            values are `user | project`.
+            ⚠️ The IMPORT faces do NOT accept this key (nor `status`): POSTing a listing row straight back to
+            local-import is a 400. Declared here from SDK 8.8.0 on — the server has emitted it since 7.57.0, so a
+            closed schema without it judged every real listing row a violation.
+        status:
+          type: string
+          enum: [live, shadowed-by-org]
+          description: >
+            The row's STANDING (server >= 7.57.0 / design/389): `live`, or `shadowed-by-org` when an org deny
+            covers its command pattern. With no org partition wired today it is always `live` — branch on BOTH
+            values now rather than optimising the constant away. Same staleness note as `source`.
 
     RuleListResult:
       type: object
@@ -13963,8 +14493,15 @@ components:
       # 封闭:server 侧 zod 是 `.strict()` —— 把 `scope` 拼成 `scopes` 的客户端应当场知道,而不是
       # 拿到一个「删掉了 global 那条」的意外结果。
       additionalProperties: false
-      required: [rule, scope]
+      required: [behavior, rule, scope]
       properties:
+        behavior:
+          allOf: [{ $ref: '#/components/schemas/RuleBehavior' }]
+          description: >
+            🔴 REQUIRED from server >= 7.67.0 (omit it and the body is a 400 `request.body_shape`) — WHICH
+            BEHAVIOR's row to revoke, VERBATIM as the listing gave it. 🔴 DELIBERATELY NO DEFAULT: a revoke aimed
+            at an `allow` that got defaulted onto the same-text `deny` deletes a refusal that was meant to stay,
+            and hands the caller a 200. core's `sameRuleIdentity` names this exact failure.
         rule: { type: string, minLength: 1, maxLength: 1024, description: 'The canonical rule text, VERBATIM as `RuleListResult.rules[].rule` gave it.' }
         scope: { type: string, minLength: 1, maxLength: 4104, description: 'The scope discriminant string — `global` or `project:<root>` with a NON-EMPTY root (an empty root would match every cwd). VERBATIM as the listing gave it. Cap = "project:".length + server MAX_CWD_CHARS (8+4096) — the 1088 previously written here was the same stale independent copy the server itself fixed (rules.ts MAX_RULE_SCOPE_CHARS 顶注), found by the A-335 anchor sweep.' }
         principal: { type: string, minLength: 1, maxLength: 190, description: 'OPERATOR-ONLY cross-tenant revoke. Absent (or your own principal) = revoke your own rule.' }