@sema-agent/sdk 8.8.0 → 9.1.0

package/openapi.yaml

@@ -918,6 +918,104 @@ paths:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
+  /v1/runs/{taskId}/memory/capture-optout:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+      - $ref: '#/components/parameters/TaskIdPath'
+    post:
+      tags: [runs]
+      operationId: runsMemoryCaptureOptOut
+      x-status: live             # server >= 7.70.0 — the mid-run flip verb for the session memory-capture opt-out.
+      summary: Opt this SESSION out of long-term memory capture, mid-run.
+      description: >
+        "We got into something that should not be remembered." From this moment the session commits NOTHING to
+        long-term memory, already-committed contributions leave the consolidation pool, and write-root residue
+        is swept. ONE-WAY: there is no reverse verb, repeat calls are idempotent (`outcome:"existed"`), and
+        getting capture back needs a NEW session.
+        🔴 The SAME record as the `memoryCapture:"off"` submit-time declaration, reached through a second
+        ingress — so "declare it on the next submit" is the fallback for MOST refusals. It is not the answer to
+        all of them: read the per-errorCode recovery notes on the 409/503 arms below (one 409 is a PARTIAL
+        SUCCESS whose retry lane is this very verb, one names another replica, and one is a deployment-shape
+        fact the declaration hits too).
+        Owner-gated on the VERIFIED principal (a bare sessionId relay would let anyone switch off anyone's
+        memory); a non-owner gets the SAME 404 string as an unknown run (no existence oracle). The engine
+        re-adjudicates the per-principal entitlement at flip time — the service does not replicate that ruling.
+        Runs no model (not billable, no drain/roster gate); rate-limited as a mutating verb. Gate the UI entry
+        on `capabilities.runMemoryCaptureOptOut`.
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false      # STRICT server-side — a mistyped key is a 400, not "no reason given".
+              properties:
+                reason: { type: string, minLength: 1, maxLength: 500, description: 'Optional one-line audit note. Does not affect the ruling.' }
+      responses:
+        '200':
+          description: Flipped — `created` on the first call, `existed` on an idempotent repeat.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/MemoryCaptureOptOutResult' }
+        '400':
+          description: >-
+            errorCode "request.body_shape" — the body must be `{}` or `{ reason }` (non-empty, at most 500
+            chars); this verb takes no other keys.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '403':
+          description: >-
+            errorCode "memory.capture_optout_denied" — this principal's entitlement does not permit the opt-out.
+            TERMINAL: the verdict is a deployment/center fact, so retrying changes nothing.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '404': { $ref: '#/components/responses/NotFound' }
+        '409':
+          description: >-
+            Four DIFFERENT situations share this status; the recovery action is per errorCode, not per status.
+            (1) "steering.not_running" — this verb needs a LIVE turn and there is none. THREE of its four causes
+            (terminal / parked / no steerable face on this replica) are fixed the same way: declare
+            `memoryCapture: "off"` on this session's next NEW submit. ⚠️ For a PARKED run that matters twice
+            over — a resumed continuation rebuilds its spec from the PERSISTED body and cannot take a new
+            declaration, so content captured until that next submit stays captured. The FOURTH cause is
+            different: when the run is live on ANOTHER replica the service says so explicitly, and the recovery
+            is to RESEND this verb to the owning replica (the next-submit declaration also works).
+            (2) "memory.capture_optout_sweep_failed" — 🔴 PARTIAL SUCCESS, not a rejection: the one-way opt-out
+            record STANDS (capture is already off) and only the residue sweep failed on named paths. A repeat
+            call IS the retry lane; leaving it un-retried leaves that named residue on the authoritative plane.
+            (3) "memory.capture_optout_unavailable" — this run mounted no memory session, so there is nothing to
+            opt out of; no action is owed.
+            (4) "config.memory_capture_unsupported" — a DEPLOYMENT-SHAPE fact (no capture record store on this
+            worker, so the record would not survive to a resume replica). 🔴 The submit-time declaration hits the
+            SAME wall on this shape — do not advertise it as the workaround; the fix is on the deployment.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '422':
+          description: 'errorCode "steering.invalid_content" — the engine refused the reason payload.'
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '429':
+          description: >-
+            errorCode "limit.rate_exceeded" — mutating verb, rate-limited only (no quota/lease gate; it runs no
+            model). `Retry-After` (seconds) set.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '501': { $ref: '#/components/responses/NotImplemented' }
+        '503':
+          description: >-
+            errorCode "memory.capture_optout_unpersisted" — the record could not be durably written (a store-mark
+            failure, or a failing consolidation-epoch bump). The engine REFUSES rather than holding the flip
+            in-process, so capture is still ON. RETRYABLE (the verb is idempotent).
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+
   /v1/runs/{taskId}/subagents/{target}/output:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -2511,6 +2609,13 @@ paths:
             approve carried no `answer` (the ONLY pre-claim rejection left on that leg; the retired codes
             `decide.parked_answer_unsupported` / `decide.parked_question_unsupported` are gone — an answer HAS
             a hookpoint now and a parked question CAN be approved, with an answer). SDK → DecideUnsupportedError.
+            PARKED **WORKFLOW-CHILD** variant (server >= 7.69.0, S-185):
+            `decide.workflow_remember_unsupported` — `remember:"session"` is REFUSED on that lane, fail-closed,
+            BEFORE anything is delivered (zero side effects; re-issue without `remember`). The repo-wide rule for
+            granting an exemption is "the engine COMMITTED this decision", and that lane's 200 does not carry the
+            proof (the child's binding / updatedInput / answer checks run later, inside the workflow's own
+            resume), so an exemption granted here could outlive a decision the engine then rejects. The body
+            carries `runId` (the WORKFLOW run) and NO `taskId`. SDK → DecideUnsupportedError, `.runId`.
           content:
             application/json:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
@@ -2545,6 +2650,18 @@ paths:
             `gate_not_plan_review` (§4c) → SDK `GateNotToolApprovalError`. Client action: route by the row's
             `gateKind` — `plan_review` → `POST /v1/assistant/tasks/{taskId}/plan_review`, `resource_limit` →
             `POST /v1/assistant/tasks/{taskId}/resume`. Retrying the same body never succeeds.
+            SEVENTH group (server >= 7.69.0 / S-185, the PARKED WORKFLOW-CHILD lane): `decide.workflow_host_unknown`
+            and `decide.workflow_host_not_parked`. The pending belongs to a workflow child that parked on an
+            approval gate, and the deployment could not hand the decision to that workflow's HOST session (the
+            engine's only deployment-facing channel for a parked workflow ordinal is a resume of the host, which
+            then re-invokes `Workflow({resumeFromRunId})`). Both bodies carry `runId` (the WORKFLOW run) and NO
+            `taskId`. NOTHING was consumed: the child's checkpoint stays PENDING and the card is still listable
+            and re-decidable. `_host_not_parked` = the host is not currently parked awaiting this run (it may
+            have been interrupted, taking an already-delivered decision with it — the decision is not persisted
+            anywhere) → retry once it parks again, or resume that `runId` yourself. `_host_unknown` = the run
+            carries no originating session at all (a directly started `runWorkflow`, not a Workflow tool call) →
+            NO retry value, a person resumes that `runId`. SDK → DecideWorkflowHostError (`.errorCode` splits the
+            two recovery verbs, `.runId` is the handle).
             SIXTH group (A-075.10, TIME-BASED retry-later pair): `resume.usage_window_exhausted` (#449 G1,
             core 5.60.1 — the deployment governance window on this run's ledger key is full; NOTHING was
             consumed or unpinned, the SAME token with the SAME decision redeems once the window slides) and
@@ -5213,7 +5330,9 @@ components:
       type: object
       description: >
         Common request body. `[additionalProperties]` mirrors the service passthrough — scenario-specific fields
-        (code-review's `repo`/`council`/`debate`/`rounds`, etc.) ride here.
+        (code-review's `repo`/`lenses`/`rounds`, etc.) ride here. NOTE (sdk 9.1.0): `council`/`debate` used to be
+        named here as passthrough examples, but the service declares them as TOP-LEVEL typed keys and reads them
+        on two seams outside the scenario builder, so they are declared properties below.
       required: [objective]
       additionalProperties: true
       properties:
@@ -5299,6 +5418,40 @@ components:
             (mcpInjectionHonored = requirePrincipal!==true); multi-tenant ignores it (fail-closed). Merge:
             deployment/center baseline wins on name collision (caller can ADD, never SHADOW).
           items: { $ref: '#/components/schemas/McpServerSpec' }
+        a2aPeers:
+          type: array
+          maxItems: 32
+          description: >
+            Per-request A2A peers — remote agents this task may call. HONORED only on a SINGLE-USER deployment
+            that has neither locked the `a2a` key nor had `a2a_peers` denied by its compliance posture (the same
+            three-veto predicate `capabilities.a2aInjection` advertises); multi-tenant ignores the field, and a
+            LOCKED deployment refuses the whole request with 400 `config.locked_key`.
+            🔴 Declaring a peer declares an OUTBOUND WRITE channel: every skill it advertises mounts with
+            `egress:true` + `effect:"write"` (core's ruling); `toolAxes` is the caller's explicit override face.
+            🔴 A malformed entry drops the WHOLE peer (named in a warn), never "drop the bad key and keep the
+            peer": `allowSkills` is a NARROWING field whose absence means "no restriction", so a half-applied
+            entry would turn a narrowing intent into a widening. The request itself is not rejected.
+            The center/config baseline wins on a name clash (the peer name IS the tool namespace segment). Over
+            the 32-entry cap the surplus entries are DROPPED and named too — same disposition as a malformed
+            entry, not a 400.
+          items: { $ref: '#/components/schemas/A2aServerSpec' }
+        council:
+          type: boolean
+          description: >
+            The `code-review` scenario's EXPENSIVE tier — fan the review out to N parallel lenses plus an
+            arbiter (`run_council`) instead of the lead reviewing in-line. Read on TWO seams and both matter:
+            the scenario builder mounts the council tool, and spec resolution treats it as an EXPLICIT team
+            declaration (widening the task's wall-clock tenancy budget and suppressing the value router's
+            auto-escalation). Only a literal `true` counts on both seams. On other scenarios the first seam is
+            inert while the second still applies.
+        debate:
+          type: boolean
+          description: >
+            Run the L2 peer-debate rounds on top of `council`. 🔴 The two seams are ASYMMETRIC — this is not a
+            standalone switch: the scenario builder reads it only INSIDE the `council === true` branch (sending
+            `debate:true` alone produces no debate rounds), while the explicit-team predicate is
+            `council || debate` (sending it alone still widens the budget and suppresses auto-escalation).
+            Literal `true` only, same as `council`.
         resumeAt:
           type: string
           description: >
@@ -5484,6 +5637,22 @@ components:
           items: { type: string }
           description: Capability names the caller requires; the worker refuses up front rather than 501-ing mid-run.
         memoryWrite: { type: boolean, description: Allow this task to WRITE user memory (read is governed separately). }
+        memoryCapture:
+          type: string
+          enum: [off]
+          description: >
+            server >= 7.70.0 — the SESSION-level memory-capture OPT-OUT declaration: "off" means "this session
+            does not enter long-term memory". A ONE-MEMBER closed set: there is NO "on" spelling, absence is the
+            only way to say "capture as usual".
+            🔴 A DIFFERENT AXIS from `memoryWrite`: that one pauses writes for THIS run and can be flipped back
+            per run; this one is a ONE-WAY, one-shot session record (later resumes never capture, repeat
+            declarations are idempotent, and getting capture back needs a NEW session).
+            🔴 The spelling gate is loud on BOTH legs (no resume downgrade): "OFF" / a boolean / anything else
+            is a 400 `request.field_invalid` — silently dropping a privacy request as a typo is the banned
+            direction. A deployment policy that refuses this principal's opt-out answers 403
+            `memory.capture_optout_denied` (terminal). A worker older than 7.70.0 IGNORES the key silently, so
+            it is not a capability probe. Rides the persisted body onto resume legs.
+            Mid-run flip: POST /v1/runs/{taskId}/memory/capture-optout (the same record, a second ingress).
         settings:
           type: object
           description: >
@@ -7264,6 +7433,71 @@ components:
             face drops the whole server.
           additionalProperties: { $ref: '#/components/schemas/McpToolFace' }
 
+    A2aServerSpec:
+      type: object
+      description: >
+        One per-request A2A peer (`TaskRequest.a2aPeers[]`). These six keys are exactly what the service's
+        normalizer copies through — anything else on the entry never reaches the engine. `name`/`url` are
+        required; if ANY present key is malformed the WHOLE peer is dropped (and named in a warn), because a
+        half-applied entry can turn a narrowing intent into a widening.
+      required: [name, url]
+      additionalProperties: false
+      properties:
+        name:
+          type: string
+          minLength: 1
+          maxLength: 128
+          description: 'Stable local name; also the tool-namespace segment (`a2a__<peer>__<skill>`).'
+        url:
+          type: string
+          description: 'The peer service URL; doubles as the origin the well-known agent-card path resolves against. http(s) ONLY.'
+        cardUrl:
+          type: string
+          description: >
+            Explicit agent-card location. When set it is used ALONE (no well-known probing behind the operator's
+            back), so a malformed value drops the peer rather than falling back.
+        headers:
+          type: object
+          additionalProperties: { type: string }
+          description: 'Static headers sent on every request to this peer.'
+        principalHeader:
+          type: string
+          description: >
+            Header name the Runner injects this run's AUTHENTICATED principal into (the model can neither read
+            nor set it). Absent principal => the header is not sent; the peer must then default to deny/public.
+        allowSkills:
+          type: array
+          items: { type: string }
+          description: >
+            Allowlist of remote skill ids to mount. ⚠️ ABSENCE means "no restriction" (core's semantic), so this
+            is a NARROWING key — never express narrowing by omitting it.
+        toolAxes:
+          type: object
+          description: >
+            Per-skill safety-axis overrides keyed by the peer's REMOTE skill id. The caller is the trust root,
+            so this may LOWER the fail-closed default (`egress:true` + `effect:"write"`) as well as raise it.
+            ⚠️ Lowering `effect` WITHOUT clearing `egress` is a combination the engine refuses by design.
+          additionalProperties:
+            type: object
+            additionalProperties: false
+            properties:
+              effect: { type: string, enum: [read, write, idempotent] }
+              egress: { type: boolean }
+              irreversibility: { type: string, enum: [always, never] }
+
+    MemoryCaptureOptOutResult:
+      type: object
+      description: >
+        200 body of POST /v1/runs/{taskId}/memory/capture-optout. `outcome` is a closed two-word set:
+        `created` = this call wrote the one-way session record; `existed` = the session had already opted out
+        (idempotent replay).
+      required: [taskId, sessionId, outcome]
+      additionalProperties: false
+      properties:
+        taskId: { type: string }
+        sessionId: { type: string }
+        outcome: { type: string, enum: [created, existed] }
+
     MemoryEntryFrontmatter:
       type: object
       description: >
@@ -7431,6 +7665,107 @@ components:
           items: { type: string }
           description: 'E7 (SHIPPED) — the /effort picker default set (minimal/low/medium/high); present ONLY for a reasoning model.'
         atMentionable: { type: boolean, description: '#233/A-002.8 (SHIPPED) — @model mention allowlist verdict; present ONLY when the deployment configured an at-mention allowlist. Absent = no allowlist verdict, NOT "not mentionable" — do not narrow absence to false.' }
+        routePairing:
+          $ref: '#/components/schemas/RoutePairingStatus'
+          description: >-
+            #345 (server >=7.45, core 5.57.0 `routePairingStatus`) — this row's key<->URL pairing posture.
+            🔴 ALWAYS PRESENT on a >=7.45 worker: when the verdict cannot be reached the value is the WORD
+            `unknown`, not a missing key ("this worker does not adjudicate" and "this row could not be
+            adjudicated" must stay distinguishable on the wire). Declared here 2026-09-10 alongside `compat`:
+            this schema is CLOSED, and the key has been minted unconditionally since 7.45 — so every real
+            /v1/models response has been structurally rejected by a strict validator for the whole time (same
+            class as `hasBidiControls` on InboxRow). Optional here because the SDK's supported server floor is
+            3.0.0; the discriminant is the PEER'S VERSION, not this key's presence.
+        compat:
+          $ref: '#/components/schemas/ModelCompat'
+          description: >-
+            S-188 (server >=7.69.0, settings-schema >=1.10.0) — this row's wire-compatibility declaration for the
+            openai-completions lane. ABSENT = this model declared nothing; see ModelCompat for the two causes of
+            absence and why absence must NOT be rendered as "the operator did not write one".
+
+    ModelCompat:
+      # 新(8.9.0 / S-188):`ModelInfo.compat` 的形 = core `OpenAICompletionsCompat` 的逐字镜像。
+      # 词表在服务端**已判过**(src/model-compat.ts 的 readModelCompat:整只判形,任一键不合即整只丢),
+      # 所以这里写闭集 enum 是**如实**的,不是本仓自己加的一道门 —— 消费方不必再验一遍。
+      type: object
+      description: >
+        One model row's wire-compatibility declaration for the **openai-completions** lane (core
+        `OpenAICompletionsCompat`, mirrored key-for-key; server >= 7.69.0 / S-188). It says how THIS gateway takes
+        the thinking parameter and what the max-tokens field is called — no URL, no credential.
+        🔴 ABSENT has TWO indistinguishable causes: (a) the model genuinely declared nothing (the engine infers
+        from baseUrl / model id), or (b) the operator wrote one and the server DROPPED IT WHOLE (shape / word /
+        unknown key), logging a named warning and falling back to the engine's inference. So a panel must NOT
+        render "no compat" as "the operator did not configure one".
+        🔴 WHOLE-OR-NOTHING: the server refuses a partially valid declaration rather than keeping the good keys
+        (half a face on the wire is worse than none), so on the wire this object is always complete-and-legal or
+        entirely absent.
+        🔴 An EMPTY object never reaches the wire: the server's single mint point folds "all keys empty" (an
+        empty `reasoningEffortLevels` counts as unset) into "do not mint the key". `compat: {}` is therefore an
+        unrecognisable byte, not "declared but says nothing" — hence minProperties: 1.
+      additionalProperties: false
+      minProperties: 1
+      properties:
+        supportsReasoningEffort: { type: boolean, description: 'Does this endpoint accept `reasoning_effort` at all. Absent => the engine auto-detects from the URL.' }
+        reasoningEffortLevels:
+          type: array
+          minItems: 1
+          items: { $ref: '#/components/schemas/ModelThinkingLevel' }
+          description: >-
+            The effort tiers THIS endpoint really accepts (a subset of the six-rung ladder). Absent => the
+            engine's conservative default (minimal|low|medium|high), so a higher requested tier clamps DOWN
+            instead of 422-ing. Never empty on the wire (an empty declaration is folded into absence server-side).
+        maxTokensField:
+          type: string
+          enum: [max_tokens, max_completion_tokens]
+          description: 'Which field carries max tokens on this lane. Absent => inferred from the model id.'
+        requiresReasoningContentOnAssistantMessages: { type: boolean, description: 'Whether every replayed assistant message must carry an empty `reasoning_content` when reasoning is on.' }
+        thinkingFormat:
+          $ref: '#/components/schemas/ModelThinkingFormat'
+          description: 'How this gateway takes the thinking on/off parameter. Absent => the engine infers (default `openai`, i.e. `reasoning_effort`).'
+
+    ModelThinkingLevel:
+      # 六档思考梯(core ThinkingLevel)。CLOSED:server 铸 Model 那一刻逐词判成员,出集词让整只 compat 被丢。
+      type: string
+      enum: [minimal, low, medium, high, xhigh, max]
+      description: >-
+        One rung of the six-rung thinking ladder (core `ThinkingLevel`). CLOSED — the server judges membership
+        when it mints the Model, and an out-of-set word makes it drop the WHOLE `compat` declaration, so a word
+        outside this set cannot reach the wire. (`off` is NOT a rung: it means "no model-level default" and
+        belongs to a different knob.)
+
+    ModelThinkingFormat:
+      # thinkingFormat 七词闭集(core OpenAICompletionsCompat["thinkingFormat"])。同上,server 已判成员。
+      type: string
+      enum: [openai, openrouter, deepseek, together, zai, qwen, qwen-chat-template]
+      description: >-
+        The spelling this gateway takes the thinking parameter in (core
+        `OpenAICompletionsCompat.thinkingFormat`). CLOSED, judged server-side before it reaches the wire.
+        `openai` = `reasoning_effort` · `openrouter` = `reasoning:{effort}` · `deepseek` = `thinking:{type}` plus
+        `reasoning_effort` · `together` = `reasoning:{enabled}` plus `reasoning_effort` · `zai` / `qwen` =
+        top-level `enable_thinking` · `qwen-chat-template` = `chat_template_kwargs.enable_thinking` — the ONLY
+        spelling that can turn thinking OFF on a think-by-default vLLM/Qwen gateway.
+
+    RoutePairingStatus:
+      # #345 core RoutePairingStatus(`ok:${RoutePairingPosture}` | `broken:*` 两词 | unknown)。
+      # 🔴 **真开集,刻意不写 enum**:开/闭按**产方是否真判成员**定(8.4.0 拆 `CheckpointGate` 顶层 enum /
+      # 把 `AskOrigin` 改真开集的同一条判据)。core 的 `routePairingStatus` 把 `verdict.posture` **直接内插**
+      # 进 `ok:${…}`,server 的铸点与 core 的这只函数**全路径没有一处运行期成员判定** —— 一只自带
+      # `adjudicateRoute` 的 brain 供什么词就上什么词。写一条会执法的 enum = 假闭集,会把一台合法 worker
+      # 的真响应判违约。已知七词写在 description 里(消费端 switch 认已知词 + 一条 default 臂)。
+      type: string
+      x-open-enum: true
+      description: >-
+        A model row's key<->URL pairing posture (core `RoutePairingStatus`; server >= 7.45). OPEN on read —
+        the seven words below are today's set, branch on the known ones and keep a `default` arm. NON-SECRET — no
+        URL, no credential.
+        `ok:per-model` this model has its own credential · `ok:paired` deployment credential, and the model's URL
+        is on the deployment's declared root · `ok:unpinned` deployment credential but the deployment declared no
+        root, so the pairing is UNVERIFIABLE · `ok:keyless` no credential anywhere (a local unauthenticated
+        gateway) · `broken:credential_mismatch` / `broken:credential_missing` a real request WILL be refused by
+        the engine (flag it red) · `unknown` could not be adjudicated — render "unknown", NEVER "good" or "bad".
+        The verdict's frame of reference is the gateway root as of BRAIN CONSTRUCTION, so a live re-pointing of
+        the deployment root only shows up after a restart (both this reading and the real request judge from the
+        same snapshot).
 
     ElicitResponse:
       type: object
@@ -7633,8 +7968,25 @@ components:
       additionalProperties: false
       properties:
         label: { type: string, description: 'display label (redacted — LLM-authored).' }
-        status: { type: string, description: 'lifecycle status (the input vocabulary the display derivation reads).' }
-        displayStatus: { type: string, description: 'core deriveAgentDisplayStatus: running|queued|done|failed|interrupted — the canonical glyph vocabulary, one source of truth shared with the shell.' }
+        status:
+          type: string
+          description: >-
+            Lifecycle status — core `WorkflowItemStatus` passed through verbatim (running|completed|failed|parked;
+            OPEN on read, the vocabulary's owner is core). 🔴 `parked` (server >= 7.69.0 / core 7.10.0 #642) is an
+            AGENT-ROW word only: this ordinal durably paused at an approval gate and the whole run suspended on it
+            (a phase or group never parks — a parked agent ends the run, so the RUN-level status vocabulary does
+            not have this word). The row's redemption key (`parkedCheckpointToken`) is a resume CAPABILITY and is
+            NEVER projected onto the wire — it appears nowhere in this document by design.
+        displayStatus:
+          type: string
+          description: >-
+            core `deriveAgentDisplayStatus`: running|queued|done|failed|interrupted|parked — the canonical glyph
+            vocabulary, one source of truth shared with the shell. 🔴 `parked` is the SIXTH arm (core 7.10.0
+            #642, server >= 7.69.0): a durable approval gate is holding this agent. Before it existed a parked
+            agent fell through to another word, i.e. a card waiting on a human rendered as a glyph that asks for
+            no action. ALWAYS PRESENT — the server derives it with that pure function on every row. Open on read
+            (the vocabulary's owner is core), but the function has no default arm, so a word outside this set
+            means core grew the table.
         taskStatus: { type: string, description: 'the underlying task''s terminal TaskStatus (open vocabulary; core enum verbatim).' }
         callKey: { type: string, description: 'the stable deterministic identity of this ctx.agent call (resume-journal key).' }
         groupId: { type: string, description: 'the nesting ctx.workflow sub-group this agent ran under; absent = top-level.' }
@@ -7681,7 +8033,7 @@ components:
       additionalProperties: false
       properties:
         title: { type: string, description: 'phase title (redacted — LLM-authored).' }
-        status: { type: string, description: 'core WorkflowItemStatus, plus "pending" for a meta-preregistered phase not yet adopted.' }
+        status: { type: string, description: 'core WorkflowItemStatus (running|completed|failed; `parked` is an agent-row word only), plus "pending" for a meta-preregistered phase not yet adopted.' }
         startedAt: { type: integer, description: 'adoption time for a pre-registered phase (0 while still pending).' }
         endedAt: { type: integer }
         durationMs: { type: integer, description: 'endedAt − startedAt; absent until the phase ends.' }
@@ -7699,7 +8051,7 @@ components:
       properties:
         groupId: { type: string }
         parentGroupId: { type: string, description: 'absent = top-level (a child of the implicit root).' }
-        status: { type: string, description: 'core WorkflowItemStatus (running/completed/failed).' }
+        status: { type: string, description: 'core WorkflowItemStatus (running|completed|failed; a group never parks — `parked` is an agent-row word only).' }
         startedAt: { type: integer }
         endedAt: { type: integer }
         durationMs: { type: integer, description: 'endedAt − startedAt; absent until the group ends.' }
@@ -7925,13 +8277,31 @@ components:
         resultChars: { type: integer, description: 'server >=7.9.0 (A-002.6): the ORIGINAL result length in characters; present only alongside resultTruncated.' }
         tokens: { type: integer, description: 'present only when the result carried stats.' }
         turns: { type: integer, description: 'present only when the result carried stats.' }
+        parked:
+          type: boolean
+          enum: [true]
+          description: >-
+            server >= 7.69.0 / core 7.10.0 #642 — this ordinal is PARKED on a durable approval gate, waiting for a
+            decision. 🔴 NEVER minted as `false`: the park arm and the result arm carry the SAME payload (a
+            TaskResult whose terminal cause is `paused`), and the read face adds exactly this one bit, so an
+            ordinary row is simply ABSENT. Branch on `parked === true`, never on `!parked`. `status` is NOT
+            rewritten by this layer — it is that TaskResult's persisted plane status (`suspended` on a human
+            gate). 🔴 The oversize-stub arm (WorkflowJournalEntryTruncated) structurally CANNOT carry this key —
+            see its note; absence there is not an assertion.
 
     WorkflowJournalEntryTruncated:
       # 新(census 批2 四段):the truncated arm (workflows.ts) — an honest stub for a row whose
       # stored TaskResult exceeded the per-row 64KiB gate (SQL stores) or byte length (file/in-memory
       # fallback): the server never pulls the oversized payload into process memory.
       type: object
-      description: A journal row too large to project — an honest "too big to show" stub, never a silent 2000-char truncation of the real result.
+      description: >-
+        A journal row too large to project — an honest "too big to show" stub, never a silent 2000-char
+        truncation of the real result.
+        🔴 DELIBERATELY carries NO `parked` (server 7.69.0, one mint point shared by all three arms): a stub by
+        definition carries no payload-derived key — the SQL paging leg never pulled the payload back when the row
+        is over the bound, so it structurally cannot answer that bit, and minting it only on the file/in-memory
+        leg would fork the wire shape by backend. To decide "is this ordinal parked", read the `parked` of a
+        NON-stub row, or `agents[].status === "parked"` on GET /v1/workflows/:id. Absence here is NOT an assertion.
       required: [callKey, ordinal, truncated, resultBytes]
       additionalProperties: false
       properties:
@@ -8431,6 +8801,21 @@ components:
         is guaranteed by all four shapes; discriminate: `idempotent` -> replay; `decision` without `sessionId` ->
         parked receipt; `sessionId` + `bindingEnforced` (+ `status`) -> task-level acceptance / terminal.
         `taskId` rides `getActiveTaskId` on the terminal leg (omitted when there is no active row).
+        🔴 A FIFTH PROVENANCE, not a fifth key set (server >= 7.69.0 / S-185 — the PARKED WORKFLOW-CHILD lane):
+        when the pending belongs to a workflow child, the success body is byte-identically the TASK-LEVEL
+        ACCEPTANCE shape, but it is a wake of the workflow's **HOST session** — `taskId` is the host's FRESHLY
+        MINTED run id, not the child's. Two readings a consumer MUST get right:
+        (1) 🔴 the 200 is a **DELIVERY acceptance**, NOT "the gate is resolved". The child's checkpoint stays
+        PENDING until the workflow engine itself resolves it, so the card can still be on `/v1/approvals` right
+        after the 200 — NEVER remove the card from a UI on the strength of this 200; poll the HOST run
+        (`GET /v1/runs/{taskId}`) for progress instead. The background-redemption lane's 200 and the task-level
+        lane's 200 DO mean the engine committed the decision — one sentence ("approved and in effect") cannot be
+        used for both lanes.
+        (2) delivery can still be LOST: if the host run is interrupted before it re-invokes `Workflow`, the
+        decision goes with that invocation (it is not persisted anywhere) and a retry answers 409
+        `decide.workflow_host_not_parked`. Because the card was pending throughout, nothing is forged and the
+        approval can be re-decided once the host parks again.
+        The durable approval-queue projection is UNCHANGED — no key marks the workflow origin on any read face.
       required: []
       additionalProperties: false
       properties:
@@ -8697,6 +9082,12 @@ components:
         this spec over-declared decide bindings that never appeared on inbox wire at all. Four client repos were
         structurally zero-consumers, so server 3.4.0 narrowed the wire and this schema follows. For the tool face
         and decide bindings use /v1/approvals (PendingCheckpoint); for task attribution use /v1/assistant/tasks.
+        🔴 STILL CLOSED (sdk 8.9.0). Four keys the server had been minting onto this row went undeclared until
+        now — `requiresRealApproval` / `denialLimitFallback` / `origin` (server >= 7.57.0) and
+        `classifierUnavailable` (server >= 7.69.0) — so a strict validator rejected every row that carried one
+        and a generated client could not read them at all. They are declared below rather than tolerated: this
+        row stays closed, which is the whole point of the shape (an undeclared key is drift, and drift should be
+        loud).
       type: object
       required: [sessionId, scope, objective, input]
       additionalProperties: false
@@ -8723,11 +9114,47 @@ components:
             the /v1/approvals row's — the reading of absence does not). Absence = "not detected", never
             "confirmed clean". Declared here because this schema is CLOSED — without the key a strict validator
             rejects every >=7.53 inbox row that carries it.
+        requiresRealApproval:
+          type: boolean
+          enum: [true]
+          description: >-
+            server >= 7.57.0 (core 7.4.0 #557), ADDITIVE, present ONLY when true: this parked ask demanded REAL
+            HUMAN judgment — an inbox can say "only a person can clear this" without decoding the gate kind.
+            🔴 NEVER minted as `false` (the OMIT contract this row's other flags follow); absence is "not marked",
+            never "confirmed clearable without a person". The value comes WHOLE from core (`summarizeCheckpoint`
+            projects the park row's own bit) — the server neither recomputes nor redacts it.
+        denialLimitFallback:
+          $ref: '#/components/schemas/DenialLimitFallback'
+          description: >-
+            server >= 7.57.0 (core 7.4.0 #557), ADDITIVE — this parked ask IS the auto-mode classifier's
+            DENIAL-LIMIT fallback, carrying the counts that tripped the bound. 🔴 On a PARKED row
+            `autoDenyAfterMs` is ALWAYS `0` and a consumer MUST NOT start a countdown from it: the window is a
+            fact of the ask's ROUTE, armed only at a hand-out to a LIVE approver, and nothing counts down on the
+            parked lane (a park's expiry is the row's own `deadline`/ttl). Render the counts and the limit; there
+            is no countdown to render here. Core screens the four members before writing the row, so a
+            half-shaped value reads as ABSENT rather than reaching a consumer as a malformed card.
+        origin:
+          $ref: '#/components/schemas/AskOrigin'
+          description: >-
+            server >= 7.57.0 (core 7.5.0), ADDITIVE — WHICH AUTHORITY raised this parked ask, the same word the
+            synchronous card renders by (engine-stamped at the gate, never a policy's claim). Core writes it onto
+            the row ONLY when it is a member of the set, so an out-of-set word is not expected on THIS face — but
+            the vocabulary's owner is still core and it has grown before, so read it the same way as everywhere
+            else: branch known words, keep a `default` arm, and treat an unknown one as "unknown origin", never
+            as "no origin". A row minted before the bit existed reads absent (unreported), not "no authority".
         objective: { type: ['string', 'null'], description: 'task objective, null if unavailable.' }
         input:
           description: >
             REDACTED tool-args preview for display (null on gates without one, e.g. plan_review). Untyped by
             design (per-tool shape). The raw `toolInput` is deliberately NOT on this row.
+        classifierUnavailable:
+          $ref: '#/components/schemas/ClassifierUnavailable'
+          description: >-
+            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE — WHY this PARKED ask reached a human. The inbox is the
+            TRIAGE face, so `breaker_open` matters most here: it forecasts an approval storm rather than a
+            one-off question. The value comes WHOLE from core (`summarizeCheckpoint` echoes it only when the
+            cause is a member of the engine's set), so the server neither recomputes nor re-screens it. See
+            ClassifierUnavailable for the open-`cause` rule and the three shapes absence covers.
 
     InboxList:
       type: object
@@ -9389,6 +9816,14 @@ components:
         activeTaskId:
           type: string
           description: On a 409 — the task currently holding the session lock (see the Conflict response note).
+        runId:
+          type: string
+          description: >-
+            server >= 7.69.0 (S-185) — on the three `decide.workflow_*` codes ONLY: the WORKFLOW run's id. It is
+            the RECOVERY HANDLE (wait for the host session to park and re-decide, or resume that run directly).
+            🔴 NOT interchangeable with `taskId`: the workflow-child park lane mints no taskId at all (this
+            decision never landed on any run, so minting one would be a lie), and the other two decide lanes
+            mint no runId. Branch by `errorCode`, never fall back from one handle to the other.
 
     # ── Streaming event taxonomy (the UX 命脉). Each SSE `data:` line is one JSON-serialized AgentEvent. ──
     # TWO vocabularies (the pinned wire contract Drift 3). ⚠️ The two lines below are the SHAPE-DEFINING
@@ -9461,6 +9896,13 @@ components:
         - $ref: '#/components/schemas/Event_tool_approval_complete'
         - $ref: '#/components/schemas/Event_approval_request'
         - $ref: '#/components/schemas/Event_approval_revoke'
+        # sdk 9.1.0: two LIVE-leg arms the service has been emitting while neither this union nor the
+        #   SDK's declared them — `text_end` since server 7.66.0 (segment boundary; retires the idle-flush
+        #   heuristic) and `tool_roster_delta` since server 7.70.0 (run-time roster change). A generated client
+        #   had no arm to switch on and dropped both. Found by the mechanical frame-arm reconciliation gate
+        #   (server `routes/tasks.ts` mint points x this union), which now runs on every build.
+        - $ref: '#/components/schemas/Event_text_end'
+        - $ref: '#/components/schemas/Event_tool_roster_delta'
       discriminator:
         propertyName: type
         mapping:
@@ -9504,6 +9946,8 @@ components:
           tool_approval_complete: '#/components/schemas/Event_tool_approval_complete'
           approval_request: '#/components/schemas/Event_approval_request'
           approval_revoke: '#/components/schemas/Event_approval_revoke'
+          text_end: '#/components/schemas/Event_text_end'
+          tool_roster_delta: '#/components/schemas/Event_tool_roster_delta'
 
     # design/99 §E2 (SHIPPED, core TaskEventIdentity) — additive per-event identity on every CONTENT event (NOT on
     # the lifecycle arms turn_end/compacted/suspended/done/failed). eventId = uuidv7 dedup/resume handle (the durable
@@ -9593,6 +10037,27 @@ components:
         parentToolCallId: { type: string }
         sourceTaskId: { type: string }
         bgAgentId: { type: string }
+    Event_text_end:
+      type: object
+      description: >
+        LIVE stream only (server >= 7.66.0, core 5.62.0) — the END-OF-SEGMENT signal for one assistant text
+        segment. `content` is the segment's AUTHORITATIVE full text (same trust class as `text_delta`, same
+        zero content transformation). It retires the "no delta for N ms => the segment must be over" idle-flush
+        heuristic: the boundary is now stated by the engine, not guessed by a timer.
+        🔴 A TRUNCATED segment gets NO such frame (core deliberately withholds it) — "no text_end" does NOT
+        mean "the segment is still going". 🔴 The durable leg does not append it (the batched `text` event
+        carries the same final prose), so GET /v1/runs/{id}/events never replays it. Both mint points are in
+        `routes/tasks.ts`: the top stream (all four identity keys) and the forwarded sub-agent leg (first two).
+      allOf: [{ $ref: '#/components/schemas/EventIdentity' }]
+      additionalProperties: false   # 封闭 + identity 本地镜像:见 Event_reasoning 处的长注
+      required: [type, content]
+      properties:
+        type: { const: text_end }
+        content: { type: string }
+        eventId: { type: string }
+        parentToolCallId: { type: string }
+        sourceTaskId: { type: string }
+        bgAgentId: { type: string }
     Event_tool_start:
       type: object
       allOf: [{ $ref: '#/components/schemas/EventIdentity' }]
@@ -10341,33 +10806,7 @@ components:
             🔴 The engine''s `error` free text is DELIBERATELY NOT PROJECTED (it is remote-author text, and core
             already owns the single redaction mint point for it). The actionable cause is `errorCode`.
             A row missing `name` or `status` is dropped individually — the other servers'' rows still ship.
-          items:
-            type: object
-            additionalProperties: false
-            required: [name, status]
-            properties:
-              name: { type: string, description: 'The declared server name.' }
-              status: { type: string, description: 'Three-word engine set (connected / failed / …). Open on read.' }
-              source: { type: string, description: 'The declarer''s own layer label, echoed verbatim by core (single-line, length-capped).' }
-              toolCount: { type: integer, description: 'Tools mounted. ABSENT rather than 0 — a minted 0 would read as "connected with no tools".' }
-              errorCode:
-                type: string
-                description: >
-                  core >= 7.6.0 — the `McpFailureKind` word (`connect_refused` / `connection_failed` /
-                  `connection_closed` / `http_status` / `not_mcp_response` / `spawn_failed` / `timeout` /
-                  `protocol` / `invalid_config` / `unknown`). The retired 7.5.0 spellings — `network` and the
-                  `http_<status>` encoding — are GONE; an HTTP status now rides `httpStatus`.
-                  Deliberately NOT enumerated here: the vocabulary''s single owner is the engine, and mirroring
-                  it would swallow a newly minted word as a violation. Switch with a `default` arm.
-              delivered:
-                allOf: [{ $ref: '#/components/schemas/McpDelivered' }]
-                description: 'core >= 7.6.0 (S6-B) — did the request reach that server. Read WITH `errorCode`.'
-              httpStatus:
-                type: integer
-                description: >
-                  core >= 7.6.0 (S6-B) — the status the endpoint answered with; rides ONLY with
-                  `errorCode === "http_status"` (401/403 = re-authorize, 5xx = that end is down). ABSENT rather
-                  than 0.
+          items: { $ref: '#/components/schemas/WiringManifestMcpEntry' }
         governance:
           type: object
           additionalProperties: false
@@ -10391,6 +10830,56 @@ components:
         parentToolCallId: { type: string }
         sourceTaskId: { type: string }
         bgAgentId: { type: string }
+    Event_tool_roster_delta:
+      type: object
+      description: >
+        LIVE stream only (server >= 7.70.0, core 7.8.0) — a RUN-TIME roster change.
+        `wiring_manifest.tools` is the snapshot taken when this leg started; this frame is the increment after
+        it: one refresh that actually changed the roster emits EXACTLY one frame (ordered after the manifest and
+        before that refresh's own `tool_end`).
+        🔴 A `delta.fromDigest` that does not match what the consumer holds is NOT a rejection: `delta.roster`
+        is the new state regardless — record a skew and re-sync from the whole roster (only `delta.summary`
+        becomes unusable). 🔴 Half a roster never reaches the wire: the service drops the WHOLE frame when
+        core's own typebox check rejects the payload. 🔴 Neither durable leg appends it, so it never replays on
+        GET /v1/runs/{id}/events — after a reconnect re-sync from the `wiring_manifest.tools` snapshot instead
+        of waiting for a replacement delta.
+      allOf: [{ $ref: '#/components/schemas/EventIdentity' }]
+      additionalProperties: false   # 封闭 + identity 本地镜像:见 Event_reasoning 处的长注
+      required: [type, delta]
+      properties:
+        type: { const: tool_roster_delta }
+        delta: { $ref: '#/components/schemas/ToolRosterDelta' }
+        eventId: { type: string }
+        parentToolCallId: { type: string }
+        sourceTaskId: { type: string }
+        bgAgentId: { type: string }
+    ToolRosterDelta:
+      type: object
+      description: >
+        core `ToolRosterDelta` (core 7.8.0) — the payload of `tool_roster_delta`. `roster` is the WHOLE
+        post-change roster and positions come from IT, never from `summary`; the three `summary` lists are
+        pairwise disjoint and a `changed` name's new row lives in `roster`.
+        🔴 OPEN on purpose (`additionalProperties: true`), unlike the frame that carries it. The rule: a schema is
+        CLOSED where the SERVICE builds the object key by key (every `Event_*` arm), and OPEN where the service
+        forwards a CORE-owned payload VERBATIM and keeps no key table of its own. This payload is the latter (the
+        service passes `delta` through after core's own typebox check), so closing it would turn a future core key
+        into "every legitimate frame is a violation". `ToolRoster` is closed despite the same provenance because
+        the service DOES keep a compile-time key table for it.
+      required: [fromDigest, roster, summary]
+      additionalProperties: true
+      properties:
+        fromDigest:
+          type: string
+          description: 'The digest the consumer is expected to hold. A mismatch is a SKEW (re-sync from `roster`), never a rejection.'
+        roster: { $ref: '#/components/schemas/ToolRoster' }
+        summary:
+          type: object
+          required: [added, removed, changed]
+          additionalProperties: true      # same rule as the parent — core owns this payload's key table.
+          properties:
+            added: { type: array, items: { type: string } }
+            removed: { type: array, items: { type: string } }
+            changed: { type: array, items: { type: string } }
     ToolRoster:
       type: object
       description: >
@@ -10431,7 +10920,13 @@ components:
         capabilityId: { type: string }
         effect: { type: string, enum: [read, write, idempotent] }
         egress: { type: boolean }
-        irreversibility: { type: string, enum: [always, never] }
+        irreversibility:
+          type: string
+          enum: [always, maybe, never]
+          description: >
+            core's THREE-word set (`never` / `maybe` / `always`). `maybe` is a real emitted value (e.g. a shell
+            tool under a classifying gate), so a two-word mirror rejects an entire legitimate roster and leaves
+            the consumer on stale state.
         contentOrigin: { type: string, enum: [local, execution, external] }
         family: { type: string, enum: [shell, file-read, file-write, search, web, delegate, plan, scaffold, memory, protocol, other] }
         pathTarget: { $ref: '#/components/schemas/McpToolPathTarget' }
@@ -10502,6 +10997,28 @@ components:
         message varies with the memoryProvenance mode — matching on message text WILL break). `code` is an OPEN
         set (the server whitelist grows with core's code register): render a known code specially, fall back to
         `message` for an unknown one — never drop the frame.
+        🔴 This list is NOT the full register and is not meant to become one (server 7.69.0's whitelist holds 21
+        codes): `code` is OPEN, and only the codes with an EXTRA rendering rule are written out here.
+        `mcp.injection_dropped` (server >= 7.68.0) — one entry of the CALLER'S OWN request-leg MCP injection was
+        not mounted; `{sessionId, server, reason, field?}`, `reason` a four-word set (`malformed_entry` /
+        `name_reserved_by_deployment` / `gate_closed` / `over_cap`). The recovery verb is on the USER's side
+        (rename it, fix that key, drop a few servers) — without this notice all they see is "my .mcp.json seems
+        to do nothing". Minted at ASSEMBLY time, so `detail` structurally has NO runId; the join key is the
+        `server` name. ⚠️ The DELIVERY surface changed at server 7.69.0: 7.68.0 delivered it on the two FRESH
+        legs only, and 7.69.0 delivers it on the RESUME family too (all four resume legs share one
+        spec-resolver, which now passes the notice seat). Consequence for consumers that assert on ledger
+        CONTENTS: a resume leg's ledger MAY now carry one extra `engine_notice` row it did not before — assert
+        "may appear", never an exact row count or order (and consume idempotently: reconnect replay shows it again).
+        `delegation.ask_unresolvable` (server >= 7.69.0 / core 7.10.0 #648) — an `ask` reached a FINAL DENY with
+        NOBODY having ruled on it: the approver consulted for the call answered `unavailable` and no durable park
+        caught it afterwards. The deny itself is unchanged (`tool_end.gate.settlement.kind:"approver_unavailable"`
+        — that sentence IS the tool result); this code is the half the person watching notices could not see.
+        `{sessionId, toolName, toolCallId, settlementKind, parkLaneExisted}`; `toolCallId` joins to the
+        `tool_approval` card frame, `settlementKind` is passed through verbatim (the vocabulary's owner is core).
+        Deduplicated ONCE PER TOOL CALL. 🔴 `parkLaneExisted` is a DISCRIMINANT, not a count: `true` = a park lane
+        was armed but declined/failed (check the store, check authorisation), `false` = there was no lane at all
+        (wire one up). The two recovery verbs differ, so a consumer MUST render them apart — NEVER fold them into
+        one "nobody approved it".
         Starter whitelist (server 7.36): `memory.session_polluted` `{reason, sessionId?}` ·
         `memory.harvest_quarantined` `{count, moved, escalated, reason?}` — `moved` and `escalated` MUST NOT be
         subtracted from each other (an in-place tombstone counts as both) · `memory.delegation_static_mark_waived`
@@ -11178,6 +11695,12 @@ components:
     #    分两段:server ≤7.4.0 默认 OFF,≥7.5.0 默认 ON(BREAKING,见 server CHANGELOG)。──
     # 与上面的 ToolApprovalFrame 是**并行加帧,不替换**:开关打开时同一只 ask 出两帧(先 tool_approval,
     # 后 approval_request),两帧同带 `approvalId` ⇒ 消费端按它去重、优先渲染新帧。
+        classifierUnavailable:
+          $ref: '#/components/schemas/ClassifierUnavailable'
+          description: >-
+            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE, present only when the classifier was consulted and
+            could not run — WHY this ask reached a human. See ClassifierUnavailable for the open-`cause` rule and
+            the three shapes absence covers.
     ApprovalRequestFrame:
       type: object
       description: >
@@ -11310,6 +11833,12 @@ components:
         # 但本 schema 此前只在帧上公示过。长 description 的单一真源在 ToolApprovalFrame 的同名键。
         ruleOffersAbsence: { $ref: '#/components/schemas/RuleOffersAbsence' }
         denialLimitFallback: { $ref: '#/components/schemas/DenialLimitFallback' }
+        classifierUnavailable:
+          $ref: '#/components/schemas/ClassifierUnavailable'
+          description: >-
+            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE — WHY this ask reached a human. Frame and card carry
+            the SAME value (one narrow-read function server-side). See ClassifierUnavailable for the open-`cause`
+            rule and the three shapes absence covers.
 
     RuleSuggestion:
       type: object
@@ -11333,6 +11862,30 @@ components:
         command: { type: string, maxLength: 512, description: 'The command pattern inside the rule, for a shell that would rather not re-parse `rule`.' }
 
     # ─── S-139(sdk 8.3.0):对 server 7.60.0 整体重对账带进来的四张型面 ───────────────────────
+    ClassifierUnavailable:
+      # 8.9.0:三面(tool_approval 帧 / ApprovalCard / InboxRow)同形同值 ⇒ 具名单源,内联三份会各自漂。
+      type: object
+      description: >-
+        WHY this ask reached a human (server >= 7.69.0, core 7.10.0 #616): the auto-mode classifier was consulted
+        and could not run. Carried on all THREE faces with the same value — the live `tool_approval` frame, the
+        `ApprovalCard` (`card_json` / `approval_request`), and the `GET /v1/assistant/inbox` row. Under the auto
+        mode most calls are answered by the classifier, so the ones that DO reach a person are often exactly the
+        ones it could not answer — and the causes want different handling (the gateway is broken / it is too slow
+        / the breaker is OPEN, i.e. every following ask will arrive too). The inbox is the TRIAGE face, which is
+        where `breaker_open` is worth the most: it forecasts an approval storm, not a one-off question.
+        🔴 `cause` is an OPEN string and is deliberately NOT enumerated here. The vocabulary's single owner is the
+        engine (today: `error` / `timeout` / `breaker_open`); mirroring it would swallow a newly minted word as a
+        violation — the same rule as `AskOrigin` and the MCP `errorCode`. Switch on the known words and KEEP A
+        DEFAULT ARM.
+        🔴 ABSENCE IS NOT AN ASSERTION. It covers three shapes at once: the classifier ANSWERED (this ask is one
+        it ruled should go to a person) · this ask was not ELIGIBLE for the classifier · this deployment wired no
+        classifier at all. Never read absence as any claim about classifier health, and never as "the classifier
+        is fine". (`parse_error` does not set this bit, per the engine's contract.)
+      additionalProperties: false
+      required: [cause]
+      properties:
+        cause: { type: string, description: 'The engine''s cause word. OPEN — branch known words, default arm for the rest.' }
+
     AskOrigin:
       type: string
       x-open-enum: true
@@ -11410,8 +11963,13 @@ components:
         waits for a person) is for RENDERING THE COUNTDOWN ONLY. Never start a second timer from it: the window
         is executed by the ENGINE, and two overlapping windows are worse than the original defect and silent.
         🔴 ABSENCE IS NOT AN ASSERTION — the vast majority of asks are not fallback cards.
-        ⚠️ The durable (parked) leg does NOT carry this key today; the card's copy rides `card_json`, which is
-        a different leg from the parked row's `pendingAction`.
+        ⚠️ TWO LEGS CARRY IT, and they differ in ONE member. The live/card leg (`ToolApprovalFrame` /
+        `ApprovalCard` / `card_json`) can carry a NON-ZERO `autoDenyAfterMs`; the DURABLE leg — the parked row,
+        projected onto `InboxRow` since server >= 7.57.0 (core's park twin of the same member) — always carries
+        `0` there, because nothing counts down on a parked lane (see InboxRow.denialLimitFallback).
+        (Corrected 2026-09-10 against core's checkpoint-summary type and the server's inbox projection: this
+        sentence used to read "the durable (parked) leg does NOT carry this key today", which stopped being
+        true when the park twin landed.)
       properties:
         consecutive: { type: integer, description: 'Consecutive refusals at the moment the limit tripped.' }
         total: { type: integer, description: 'Cumulative refusals at the moment the limit tripped.' }
@@ -12997,12 +13555,18 @@ components:
         core's assembly self-evidence manifest (core >=5.14.0 `WiringManifest`). TWO HALVES, ONE shape (a
         consumer must line the two faces up, so they are not split into separate types) — but which keys
         belong to which half is DETERMINATE, not "usually": `leg`, `ask.effective` and `configFingerprint`
-        are EFFECTIVE-half only (the live `wiring_manifest` event) — as are the three per-leg sections the
-        event schema declares (`modelGate`, `autoMode`, `mcp`), which describe what THIS leg did and have no
-        static counterpart — and the STATIC half
+        are EFFECTIVE-half only (the live `wiring_manifest` event) — as are the four per-leg sections
+        `modelGate`, `autoMode`, `mcp` and `tools`, which describe what THIS leg did and have no static
+        counterpart — and the STATIC half
         (GET /v1/diagnostics/wiring) NEVER mints them; every other section, plus `governance`, is always
         present on the static half. Fields stay optional because core may add or drop sections and that
         must not hard-break a client — read by half, and never wait on a key the half never sends.
+        🔴 EVERY section is declared HERE, each saying which half mints it (sdk 8.9.0). Before that, `tools`
+        was declared while its three effective-half siblings were not, and `permissionRules` — which the
+        engine mints UNCONDITIONALLY, i.e. on BOTH halves — was missing altogether, so a generated client
+        reading GET /v1/diagnostics/wiring could not see it at all. "Two halves, one shape" is the stated
+        doctrine of this schema; omitting a section because one half does not mint it contradicts it and
+        splits consumers into two groups reading two different manifests.
         🔴 `governance` and `configFingerprint` appear ONLY on an operator-scoped face. A tenant stream
         gets neither — and NOT just the section: core hashes the WHOLE manifest unsalted and governance is
         four booleans, so the fingerprint alone would let a tenant brute-force sixteen combinations against
@@ -13073,6 +13637,85 @@ components:
           description: >
             server >= 7.66.0 (design/388 B-4) — the leg's whole tool roster. EFFECTIVE half only (the diagnostics
             endpoint's static half never carries it); absent as a whole when core's typebox check rejects it.
+        permissionRules:
+          type: object
+          description: >
+            core >= 5.18.0 (design/179) / >= 5.23.0 (design/182 §7/§9), server >= 7.6.0 — is a PERSISTED
+            PERMISSION RULE store wired, how far does a "don't ask again" travel, and is an org governance layer
+            armed over that lane. 🔴 BOTH HALVES: the engine mints this section unconditionally, so it rides the
+            static `GET /v1/diagnostics/wiring` face too — read it before offering a "don't ask again"
+            affordance. `false` is a REAL reading ("no rule lane on this worker"), never "too old to know"; only
+            the whole key being absent means "never sent it". TENANT-visible (deliberately outside the
+            operator-only `governance` section). Full per-key contract: see Event_wiring_manifest.permissionRules.
+          properties:
+            storeWired: { type: boolean }
+            syncWired: { type: boolean }
+            orgGoverned: { type: boolean }
+        mcp:
+          type: array
+          description: >
+            core >= 7.5.0 (#562) / >= 7.6.0 (S6-B), server >= 7.60 — one row per MCP server THIS leg declared.
+            EFFECTIVE half only. 🔴 An empty array is NOT absence (`[]` = "this leg declared no servers").
+            Full per-key contract: see Event_wiring_manifest.mcp.
+          items: { $ref: '#/components/schemas/WiringManifestMcpEntry' }
+        modelGate:
+          type: object
+          description: >
+            core >= 7.3.x (design/385 片2b), server >= 7.58 — which tools the tool-MODEL gate removed from THIS
+            session and how to get them back. EFFECTIVE half only; ALL-OR-NOTHING (absent = nothing was gated,
+            never an empty section). Full contract: see Event_wiring_manifest.modelGate.
+          required: [class, removed, restore]
+          properties:
+            class: { type: string }
+            removed: { type: array, items: { type: string } }
+            restore: { type: string }
+        autoMode:
+          type: object
+          description: >
+            core >= 7.3.1 (#529), server >= 7.59 — did AUTO mode arm on THIS leg, and if not which arm it stopped
+            at. EFFECTIVE half only. 🔴 `reason` is core's closed word list passed through VERBATIM (branch known
+            words, keep a default arm); ABSENCE IS NOT "not applicable" — never fold it to `armed: false`. The
+            server projects exactly these two keys (core's `breaker` sub-fact is NOT projected onto the wire).
+            Full contract: see Event_wiring_manifest.autoMode.
+          required: [armed, reason]
+          properties:
+            armed: { type: boolean }
+            reason: { type: string }
+    WiringManifestMcpEntry:
+      # 8.9.0:从 `Event_wiring_manifest.mcp.items` 的内联形**提取**为具名 schema —— 同一份行形现在被
+      # 两处引用(live 帧与 `WiringManifest` 的静态/两半形),内联会立刻变成两份会各自漂的镜像。
+      type: object
+      description: >
+        One row of a leg's MCP wiring manifest: did that declared server connect, if not which failure class,
+        and how many tools it mounted. A row missing `name` or `status` is dropped INDIVIDUALLY — the other
+        servers' rows still ship. 🔴 The engine's `error` free text is DELIBERATELY NOT PROJECTED (remote-author
+        text; core owns the single redaction mint point). The actionable cause is `errorCode`.
+      additionalProperties: false
+      required: [name, status]
+      properties:
+        name: { type: string, description: 'The declared server name.' }
+        status: { type: string, description: 'Three-word engine set (connected / failed / …). Open on read.' }
+        source: { type: string, description: 'The declarer''s own layer label, echoed verbatim by core (single-line, length-capped).' }
+        toolCount: { type: integer, description: 'Tools mounted. ABSENT rather than 0 — a minted 0 would read as "connected with no tools".' }
+        errorCode:
+          type: string
+          description: >
+            core >= 7.6.0 — the `McpFailureKind` word (`connect_refused` / `connection_failed` /
+            `connection_closed` / `http_status` / `not_mcp_response` / `spawn_failed` / `timeout` /
+            `protocol` / `invalid_config` / `unknown`). The retired 7.5.0 spellings — `network` and the
+            `http_<status>` encoding — are GONE; an HTTP status now rides `httpStatus`.
+            Deliberately NOT enumerated here: the vocabulary's single owner is the engine, and mirroring
+            it would swallow a newly minted word as a violation. Switch with a `default` arm.
+        delivered:
+          allOf: [{ $ref: '#/components/schemas/McpDelivered' }]
+          description: 'core >= 7.6.0 (S6-B) — did the request reach that server. Read WITH `errorCode`.'
+        httpStatus:
+          type: integer
+          description: >
+            core >= 7.6.0 (S6-B) — the status the endpoint answered with; rides ONLY with
+            `errorCode === "http_status"` (401/403 = re-authorize, 5xx = that end is down). ABSENT rather
+            than 0.
+
     ServerWiringGates:
       type: object
       description: >