@sema-agent/sdk 9.5.0 → 9.7.0

package/openapi.yaml

@@ -83,6 +83,25 @@ info:
       • New contract fields are OPTIONAL with no default (CORE-PRINCIPLES §6).
       • Async results are delivered by POLL (`GET /v1/runs/:id`) or SSE (`/v1/runs/:id/events`).
         There is NO generic webhook/callback and NO signing (SERVICE-CORE-CONTEXT §2.4).
+      • 🔴 STRING-LENGTH UNIT (applies to EVERY `maxLength`/`minLength` in this file). The producer's own
+        gates are JavaScript `.length`, i.e. **UTF-16 code units**; JSON Schema counts **code points**.
+        The two agree across the entire BMP and differ only on supplementary characters (emoji, rare CJK,
+        musical symbols), each of which costs 2 units but 1 code point. => near a bound, a value made of
+        supplementary characters can pass this schema and still be refused by the producer. THAT DIRECTION
+        IS DELIBERATE: a schema looser than the producer yields a loud, readable 4xx naming the field, while
+        a schema tighter than the producer makes a client refuse a request the producer would have accepted —
+        an invisible false refusal whose symptom is indistinguishable from a server rejection (this contract
+        shipped exactly that defect on `SkillSpec.content` for several releases). Halving every bound to be
+        safe for all-supplementary input would refuse roughly half of the legal range on ordinary text, so the
+        bounds here state the producer's number verbatim and this convention states the unit. A client that
+        must pre-check exactly counts UTF-16 units itself.
+        (`maxLength` is the only keyword involved: it counts code points and that is not configurable. A
+        `pattern` could count code units — but only on validators whose regex engine is UTF-16-based and
+        non-unicode-mode, which is implementation-specific rather than contract-portable, and it would cost a
+        full regex scan of a megabyte-scale payload. The unit is therefore stated, not encoded.)
+      • The same unit applies to every BYTE-sounding phrase in this file unless it says UTF-8 explicitly: the
+        producer's guards are character/unit counts, so a non-ASCII value is NOT twice as expensive against
+        them. Do not pre-check these bounds with a byte length.
   x-sources:
     - ../docs/SERVICE-CORE-CONTEXT.md   # §2 wire answers, §4 verb surface (authoritative producer input)
     - ../docs/CORE-PRINCIPLES.md        # §2 secret discipline, §3 principal-first, §5 contract-as-anchor, §6 optional-no-default
@@ -2060,6 +2079,77 @@ paths:
               schema: { $ref: '#/components/schemas/McpStatusPanel' }
         '401': { $ref: '#/components/responses/Unauthorized' }
 
+  /v1/sessions/{sessionId}/mcp/reconnect:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+      - in: path
+        name: sessionId
+        required: true
+        schema: { type: string }
+    post:
+      tags: [sessions]
+      operationId: sessionsMcpReconnect
+      x-status: live             # S-381 (server 7.85.0; core 7.22.0 #857); SDK sessions.mcpReconnect.
+      summary: Re-dial ONE named MCP server inside a live session (a TRANSACTION, not a refresh button).
+      description: >
+        S-381 (server >= 7.85.0; core 7.22.0 #857) — re-dial the transport of ONE NAMED MCP server WITHOUT
+        ending the task. Body is `{ server }`: required, non-empty, at most 190 characters, and the body gate
+        is STRICT — a misspelled key is refused, never stripped-and-ignored, and there is NO all-servers form
+        (re-dialing everything would CLOSE the healthy connections, and a stdio server that owns a device
+        cannot be re-dialed while the old connection still holds it). A bad body ⇒ 400 `request.body_shape`.
+        🔴 A TRANSACTION, NOT A REFRESH BUTTON (core's own words — this sentence belongs in the UI copy): the
+        old connection is closed BEFORE the new dial, so a FAILED re-dial spends a working connection — the
+        server stays disconnected, ITS TOOLS ARE WITHDRAWN from the model's roster, and in-flight calls fail.
+        Offering "reconnect" on a HEALTHY server is offering a transaction.
+        🔴 `outcome` IS THE ONLY DISCRIMINATOR AND ALL THREE STATES ARE HTTP 200 (the status answers only
+        "did the verb reach the engine", the same law as steer's "branch on `delivery`, not the status"):
+        `accepted` = core's `reconnected`; `refused` = core's `refused` OR `not_declared` (an unknown server
+        name is a ROSTER fact, not an engine-capability fact); `unsupported` = THE SERVER'S OWN WORD (core has
+        none) for "this run declared no MCP at all" (core throws `mcp.reconnect_unavailable`) — and that arm is
+        an ALWAYS-FIVE-KEY body `{taskId, sessionId, server, outcome, reason}`: with no core result the server
+        coins NO `prefix`/`toolCount`/`added`/`removed`/`toolNames`. Consumers MUST branch on `outcome` and
+        must NOT read `body.added` unconditionally.
+        🔴 `toolNames` is PRESENT-IFF core supplied `tools` (NOT keyed off `outcome`): `[]` (a failed dial) and
+        ABSENT (an arm that never touched the connection) are two different sentences. It is the roster THIS
+        re-dial asserted for its own `prefix` domain, NOT "what the model finally sees" — core filters again by
+        the deployment's exclusion table before mounting, and a refused axis-fold mounts none, so this key is a
+        SUPERSET in both shapes. For "what actually got mounted" read a roster face.
+        Next action comes from `status` (machine-readable: `errorCode` is core's `McpFailureKind` word — do not
+        narrow it, switch with a default arm; `httpStatus` 401 is a re-authorize door); `reason` is HUMAN TEXT
+        (server-redacted, length-bounded) and must NOT be parsed.
+        Gates, the same family as steer / capture-optout: 501 `capability.run_store_required` (no durable run
+        ledger) · 501 `capability.session_ownership_required` (no `sessionStorage.ownerOf`) · 400
+        `request.path_malformed` (bad percent-encoding in the id) · 404 `not_found.session` — unknown session
+        AND someone else's session answer the SAME code and SAME message (deliberate: no existence oracle); an
+        EXPLICIT operator may re-dial any tenant's session · 422 `steering.invalid_content` · 409
+        `steering.not_running` with FOUR arms behind ONE code (parked awaiting a decision / already terminal /
+        live on ANOTHER replica / no live steerable face here). A re-dial is LEG-LOCAL — a durable resume dials
+        every declared server afresh — so "park a re-dial until resume" is structurally not a shape, and this
+        face deliberately has no park leg. Probe with `capabilities.mcpReconnect`; absent ⇒ probe by 404/405.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required: [server]
+              properties:
+                server: { type: string, minLength: 1, maxLength: 190, description: 'The ONE named MCP server to re-dial (the declared name). Required; there is no all-servers form. The cap is load-bearing: the string is relayed into an operator notice detail.' }
+      responses:
+        '200':
+          description: >-
+            The re-dial receipt. Branch on `outcome`; the `unsupported` arm is an always-five-key body.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/SessionMcpReconnectResult' }
+        '400': { $ref: '#/components/responses/BadRequest' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '404': { $ref: '#/components/responses/NotFound' }
+        '409': { $ref: '#/components/responses/Conflict' }
+        '422': { $ref: '#/components/responses/UnprocessableEntity' }
+        '501': { $ref: '#/components/responses/NotImplemented' }
+
   /v1/sessions/{sessionId}/memory-status:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -2559,9 +2649,24 @@ paths:
         `data.type` — proxy-safe dispatch. Cross-replica by
         construction (polls the SHARED checkpoint table). 15-min cap + heartbeats; a DB blip retries, never
         kills the stream. Scope = the caller's principal (operator/trace token = fleet-wide).
+        🔴 TWO MORE EVENTS (server >= 7.87.0 / S-454 P1; cli L-397): this leg now has TWO diff sources, not one.
+        `live_pending` = a LIVE (in-stream) ask entered or its wire projection changed (UPSERT semantics;
+        payload = a `LivePendingRow` spread plus `serverNowMs`, AND IT CARRIES `frame`, so a consumer can render
+        the card straight from the push). `live_resolved` = a live ask left (settled / window expired / entry
+        gone — ALL THREE ARE ONE FRAME: "why it left" is for the consumer to fetch, the push does not conclude
+        it; payload = `{type, approvalId, serverNowMs}`). First-tick order: `pending…` → `live_pending…` →
+        `synced` (and `synced.count` still counts ONLY the durable queue).
+        🔴 THE TWO WORDS DELIBERATELY DO NOT REUSE `pending`/`resolved`: those are keyed by
+        `(sessionId, toolCallId)` and decided at `POST /v1/approvals/{sessionId}/decide`, while a live row is
+        keyed by `approvalId` and decided at `POST /v1/tool-approvals/{approvalId}/respond`. Sharing one word
+        would eventually send a live card to the decide door — a 404 with no wire evidence of the mistake.
+        ⚠️ Both live words come from an IN-PROCESS window projection, so their cross-replica reach is exactly
+        that of `GET /v1/approvals`'s `livePending` — narrower than the durable pair above. The deployment
+        without a live approval face (coordinator unwired) emits neither, and the stream's bytes are identical
+        to 7.86.0's (capability absent = zero change, not an empty event).
       responses:
         '200':
-          description: text/event-stream of meta/pending/resolved frames.
+          description: text/event-stream of meta/pending/resolved/live_pending/live_resolved frames.
           content:
             text/event-stream:
               schema: { type: string }
@@ -2602,9 +2707,15 @@ paths:
             string; `remember` not `"session"`; `checkpointToken`/`boundCallId`/`boundInputHash` not a string)
             · "request.field_conflict" (`remember` without `decision:"approve"`; TC-5.4 answer coherence —
             approving a pending AskUserQuestion REQUIRES `answer`, and `answer` is only valid on that approve)
-            · "remember_not_in_proof" / "updated_input_not_in_proof" (`remember` / `updatedInput` on a
-            direct-door worker — not covered by the decision proof) · "remember_requires_binding" (`remember`
-            without the D-1 binding echo). PARKED variant (server 5.12.0, core 5.7.0 RB-459):
+            · "remember_not_in_proof" / "updated_input_not_in_proof" / "checkpoint_token_not_in_proof"
+            (`remember` / `updatedInput` / `checkpointToken` on a direct-door worker — not covered by the
+            decision proof; the third one is server >= 7.87.0 / S-452, and its message points at the
+            replacement: bind the decision with `boundCallId` + `boundInputHash`. Refusing it loses nothing —
+            the token was only ever a staleness check, and on the direct door that check is already covered by
+            the proof's binding. A compliant client never sends it: this SDK deleted the field at 1.0.0)
+            · "request.field_invalid" ALSO covers an unrecognised key inside `answer` (server >= 7.87.0 /
+            S-452: the closed answer shape — the message names the key paths and the body carries `unknownKeys`)
+            · "remember_requires_binding" (`remember` without the D-1 binding echo). PARKED variant (server 5.12.0, core 5.7.0 RB-459):
             `decide.parked_answer_required` — the parked child's pending action is an AskUserQuestion and the
             approve carried no `answer` (the ONLY pre-claim rejection left on that leg; the retired codes
             `decide.parked_answer_unsupported` / `decide.parked_question_unsupported` are gone — an answer HAS
@@ -2996,8 +3107,15 @@ paths:
               schema: { $ref: '#/components/schemas/AssistantTaskStatus' }
         '400':
           description: >
-            Bad/missing `decision`; `edit` without a non-empty `editedPlan`; `editedPlan` present on
-            approve/reject (FORBIDDEN); non-string `reason`.
+            `ErrorResponse`-shaped. Codes: "request.body_shape" (bad/missing `decision`, OR an unrecognised
+            top-level key — server >= 7.86.0 / S-438 key closure, the body carries `unknownKeys` /
+            `unsupportedKeys`) · "request.field_conflict" (`edit` without a non-empty `editedPlan`;
+            `editedPlan` present on approve/reject; `permissionModeAfter` sent with `edit`/`reject`;
+            `permissionModeAfter` on a task that was not submitted with `permissionMode:"plan"`) ·
+            "request.field_invalid" (non-string `reason`; `permissionModeAfter` outside the two-word closed
+            set — zero widening arm) · "request.path_malformed" (a bad percent-encoded path segment —
+            server >= 7.86.0 / S-430 turned that family from 500 `internal.error` into a 400 across 16 doors).
+            413 `reason_too_large` rides its own status.
           content:
             application/json:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
@@ -5014,11 +5132,16 @@ paths:
       tags: [metrics]
       operationId: metricsSummary
       x-status: draft            # ops surface; uses a metricsToken (NOT a principal). Shape loose.
-      x-sdk: none                # DELIBERATELY not in @sema-agent/sdk (2026-07-27 定性): ops/observability face, credential = metricsToken not a principal; README walks curl. Revocable — delete this key + the gate exemption to bring it in.
       summary: Worker health/cost summary (ops).
       description: >
-        Uses `metricsToken` (operator), not `x-agent-principal`. Shape is loose/ops-defined. Deliberately
-        NOT wrapped by the SDK (see the `x-sdk` key) — ops tooling reads it with curl.
+        Uses `metricsToken` (operator) OR a full authToken, not `x-agent-principal`.
+        ⚠️ The `x-sdk: none` key that used to sit here ("deliberately not in @sema-agent/sdk", 2026-07-27) was
+        STALE and is deleted at sdk 9.7.0: the SDK has wrapped this face since the 2026-07-17 coverage batch
+        (`client.metrics.summary()`), and since 9.7.0 the two S-451 keys are named on the returned type
+        (`MetricsSummaryOps`). The path stays on the spec-path gate's spec-only exemption list for a DIFFERENT
+        reason, now written there: that gate's SDK-side extractor only collects `/v1/...` literals, so a
+        non-`/v1` path can never match — the exemption compensates for the EXTRACTOR's scope, not for a
+        missing verb.
       security:
         - metricsToken: []
       responses:
@@ -5026,11 +5149,9 @@ paths:
           description: Metrics summary (shape draft).
           content:
             application/json:
-              # 🔴 census 批2 五段:CLOSED against the real emitter — `sendJson(res, 200, { model,
-              # ...deps.metrics.summarize() })` (server.ts) is a fixed key set (server observability/
-              # metrics.ts `MetricsSummary`), not an ops free-for-all. Left `x-status: draft` / `x-sdk: none`
-              # untouched (still deliberately outside the SDK's wrapped surface) — closing the SHAPE and
-              # keeping it un-wrapped are independent axes.
+              # 🔴 census 批2 五段把它按真铸点 CLOSED(`{ model, ...deps.metrics.summarize() }` 是定键集,
+              # 不是 ops free-for-all)。sdk 9.7.0 **改开**并补上生产方早已多出来的三键 —— 理由与 receipts
+              # 在 `MetricsSummaryOps` 的 description 里(投影型响应体开集;请求体仍封闭)。
               schema: { $ref: '#/components/schemas/MetricsSummaryOps' }
         '401': { $ref: '#/components/responses/Unauthorized' }
 
@@ -5297,6 +5418,20 @@ components:
                   waitMs: { type: integer }
                   decision: { type: string }
                   toolName: { type: string }
+                  toolCallId:
+                    type: string
+                    description: >-
+                      core 7.23.0 (#897), server >= 7.87.0 — the engine's own call id, passed through verbatim.
+                      🔴 ABSENT MEANS "NOT JOINABLE", NOT "no call": three of the four mint sites (an inherited
+                      grant being reused, the durable-resume leg, the park self-check's synthetic row) may have
+                      no call identity to give. 🔴 JOIN BY THIS KEY — never by row count or position: a
+                      multi-leg aggregation (verify / cascade / repair-loop) pushes each leg's gates as a
+                      BLOCK, so the order is "leg completion order concatenated", and a consumer's own
+                      permission ledger legitimately has a DIFFERENT number of rows. A right-hand key existing
+                      is not a reason to mint a parallel ledger elsewhere: the engine's is authoritative.
+                      ⚠️ Since server 7.84.0 (S-394) the model-authored `toolArg` here goes through the SAME
+                      redactor as `result`, so credential-shaped BYTES CHANGE (anything else is byte-identical)
+                      — a consumer hashing these fields for identity must move off them.
       required: [turns, tokens]
       # 🔴 OPEN: the engine may carry fields not named here (live-observed, e.g. extra costBreakdown axes) — the SDK
       # passes them through rather than dropping, so consumers must not assume this list is exhaustive.
@@ -5418,11 +5553,16 @@ components:
             Server cap 16384 chars → 400.
         skills:
           type: array
-          maxItems: 10
           description: >
             Per-request user skills (LIVE, service 170c384) — progressive disclosure, same
             mechanism as scenario skills. Merge: scenario WINS on name collision (user's dropped, warn-logged).
-            Caps server-enforced; violations 400 with the offending rule named.
+            🔴 server >= 7.78.1 (hard BREAKING, no alias): the ITEM-COUNT cap (was 10), the `description` 1024-char
+            cap and the `name` 64-char cap are GONE — and so are their three refusal messages, so a consumer branch
+            anchored on them can be deleted (a refusal turned into an acceptance: no harm in the other direction).
+            The only size gate left on this face is `SkillSpec.content` <= 1 MiB (the engine's own load gate);
+            bulk is otherwise bounded by the NON-skill-specific 8 MiB request-body cap. Per-turn cost belongs to the
+            LISTING RENDERER, not to this gate: turn it down with `settings.skillListingBudgetFraction` /
+            `settings.skillListingMaxDescChars`.
           items: { $ref: '#/components/schemas/SkillSpec' }
         reasoningEffort:
           type: string
@@ -5681,6 +5821,33 @@ components:
             `memory.capture_optout_denied` (terminal). A worker older than 7.70.0 IGNORES the key silently, so
             it is not a capability probe. Rides the persisted body onto resume legs.
             Mid-run flip: POST /v1/runs/{taskId}/memory/capture-optout (the same record, a second ingress).
+        memory:
+          type: string
+          enum: [off]
+          description: >
+            server >= 7.84.0 (S-405 / core #863 W3; mint `src/http/wire-types.ts:309`) — the REQUEST-level
+            "no memory face at all" declaration: "off" means THIS RUN mounts no memory face (no `# Memory`
+            section, no index, none of the three memory tools, no write admission). A ONE-MEMBER closed set:
+            there is NO "on" spelling, absence is the only way to say "memory as usual".
+            🔴 THREE ORTHOGONAL AXES, do not mix them up: this key = "this RUN mounts no memory face";
+            `memoryCapture:"off"` = "memory stays mounted, but THIS SESSION's content never enters long-term
+            memory"; `memoryWrite:false` = "this run reads memory as usual, the harvest just does not commit".
+            🔴 SENDING BOTH IS NOT BUYING BOTH (contract §12.7, verified against core `prepare-memory.js:48/:55`):
+            core conjoins the capture leg with the engine mount, so on a turn carrying `memory:"off"` the
+            capture opt-out's ONE-WAY session record DOES NOT LAND ⇒ the next turn without this key captures as
+            usual. To make the session permanently uncaptured, do NOT send this key on that turn.
+            ⚠️ Honest scope: this is "no memory face", NOT a filesystem ban — if the memory root sits inside the
+            workspace this run was granted, ordinary Read/Write still go through the ordinary fences.
+            ⚠️ The FACT IS KEPT, not erased: the server passes it through as `TaskSpec.memory.enabled:false`
+            (it does not drop the spec) ⇒ the terminal observation face reads `disabled`, not `no-spec`.
+            ⚠️ Same name, different thing from the legacy `GET /v1/capabilities.memory` bit (always false — the
+            RETIRED MemoryStore verb family). Do not read that bit to decide whether this key is available.
+            🔴 NO CAPABILITY BIT: 7.78.1–7.83.x can trial-by-400 (the spelling gate refuses); older workers
+            cannot be probed (they ignore it silently).
+            🔴 The spelling gate is loud on BOTH legs: "OFF" / a boolean / anything else is a 400
+            `request.field_invalid` (fresh admission and the resume replay share ONE predicate,
+            `singleMemberOffFieldIssue`; on the resume leg it folds to 409 `resume_blocked_by_policy`).
+            Rides the persisted body onto resume legs.
         settings:
           type: object
           description: >
@@ -5690,7 +5857,24 @@ components:
             service ACTIVELY interprets this bundle (task-settings.ts: permissions + permissions.defaultMode +
             model + outputStyle + env shipped in the 1.26.0 v1 scope; hooks was deferred at that point and wired
             in a later batch — both are live and interpreted today, not a raw uninterpreted passthrough);
-            `permissions.defaultMode`'s specific fold is documented on `TaskRequest.permissionMode`. OPEN object.
+            `permissions.defaultMode`'s specific fold is documented on `TaskRequest.permissionMode`.
+            🔴 ON THIS SUBMIT FACE THE KEY SET IS CLOSED (server >= 7.57.0 for the sub-tree): accepted top-level keys
+            are `env` / `hooks` / `model` / `outputStyle` / `permissions` / `skillListingBudgetFraction` /
+            `skillListingMaxDescChars` / `ultracode` / `webSearch`, and accepted `permissions.*` keys are
+            `allow` / `ask` / `defaultMode` / `deny` / `disableAutoMode`; anything else is 400 `request.body_shape`
+            with the names in the refusal's `unknownKeys` / `unsupportedKeys` arrays (REFUSED, not dropped — a dropped
+            key reads as "in effect" to the caller). The object stays OPEN here because the same `SemaSettings`
+            schema also serves the local `settings.json` wiring, where deferred CC keys are legal.
+            🔴 `skillListingBudgetFraction` (number in (0,1]) / `skillListingMaxDescChars` (positive integer),
+            server >= 7.78.1: the SKILL-LISTING RENDER BUDGET, passed to the engine with ZERO processing
+            (no clamping, no conversion, no folding) — ABSENT means the key is not written at all (the server does
+            NOT restate the engine defaults, CC-identical `0.01` / `1536`), and an out-of-domain value is
+            400 `request.field_invalid` on the fresh leg (the resume replay leg drops it instead of 4xx).
+            ⚠️ `skillListingBudgetFraction` is a ONE-WAY knob — turning it DOWN works, turning it UP does not:
+            the engine's listing budget is `min(window x fraction, 8000 bytes)` and 8000 is a STRUCTURAL ceiling of
+            the delivery lane, so raising it only helps a model whose declared window is below 200 000 tokens.
+            The engine's own twin code `config.skill_listing_budget_invalid` (400) is NOT reachable through this
+            submit leg today — it belongs to callers that build a `TaskSpec` directly.
           additionalProperties: true
         cwd: { type: string, description: Working directory for the execution env. }
         selfOrchestration: { type: boolean, description: Permit S8 self-orchestration (run_workflow) inside this task. }
@@ -6620,9 +6804,106 @@ components:
       properties:
         id: { type: string }
         status: { type: string, enum: [running, completed, failed, needs_human] }
-        result: {}
+        result:
+          allOf: [{ $ref: '#/components/schemas/LeaderRunResult' }]
+          description: >
+            The leader run's terminal payload. sdk 9.7.0 declares the two segments a consumer actually renders
+            (`conflict` / `salvaged`) and leaves the rest open — see `LeaderRunResult`. (The SDK's TS side keeps
+            `LeaderRecord.result: unknown` for one more version: pointing it at the named type is a NARROWING,
+            which RELEASE.md reserves for a major. Cast it: `record.result as LeaderRunResult`.)
         error: { type: string }
 
+    LeaderRunResult:
+      type: object
+      additionalProperties: true
+      description: >
+        The `result` of a leader run (server `leader/leader.ts` `LeaderResult`). Only the segments a consumer
+        really renders are declared; the rest passes through (leader is a gated v2 lane and its result carries
+        server-internal shapes — mirroring all of them here would just create a second copy that drifts).
+        🔴 S-113 / clay C-R63 ④ (server >= 7.83.0): A MERGE THAT DOES NOT APPLY IS HANDED TO THE USER (the CC
+        shape). The apply conflict no longer starts a conflict-resolver model: `ok:false` plus the `conflict`
+        segment, and the run's status is the EXISTING third terminal `needs_human` (no new status word). The
+        user takes `workers[].branch` + `files` and merges/cherry-picks. SAME BATCH, DELETED WITH ZERO ALIASES:
+        `merge.conflictsResolved`, `conflictResolverCostUsd`, and the `merge-conflict` member of
+        `replan.trigger` — a consumer that read them goes tsc-red, and that IS the notice.
+      properties:
+        ok: { type: boolean, description: 'Did the whole wave succeed (always false on a conflict terminal).' }
+        conflict:
+          type: object
+          additionalProperties: true
+          description: >
+            The wave that would not merge (server >= 7.83.0; ONE mint — `conflictSegment` — shared by the main
+            path and the collapse path, so "the same situation, two different terminals" is structurally gone).
+            ABSENT = no conflict on this wave, OR an older server — the two look the same, so do not infer a
+            version from absence.
+          required: [baseSha, files, workers]
+          properties:
+            baseSha: { type: string, description: "The user's merge base = this wave's durable base." }
+            files: { type: array, items: { type: string }, description: 'Paths carrying conflict markers / .rej (CONTENTS NOT INCLUDED).' }
+            filesTruncated:
+              type: boolean
+              enum: [true]
+              description: >-
+                Present only when the list hit the CAP. 🔴 ABSENCE DOES NOT MEAN "this is all of it" (corrected
+                at sdk 9.7.0 after a codex finding was verified against the server's own probe arm in
+                `leader/merge.ts`): this flag reflects the CAP and nothing else. The list is assembled by two
+                shell probes (`grep -rIl` for conflict markers + `find -name '*.rej'`), and when either leg
+                fails the server honestly returns a possibly EMPTY or partial `files` while logging one line
+                (`merge_conflict_files_probe_failed`) — there is NO discriminator for that shape on the wire.
+                ⇒ A `conflict` segment with an empty (or implausibly short) `files` must NOT be rendered as
+                "no conflicting files"; render "the list may be incomplete" and point the user at `rejHead`
+                and `workers[].branch`. A bit that separates "probe failed" from "there really are no more"
+                would have to come from the server; this SDK does not mint a second judge for it.
+            workers:
+              type: array
+              description: 'EVERY completed worker. `applied:false` = that worker''s patch is not in the tree (the conflicting one, or one queued behind it — apply is sequential and stops at the first failure). The branch comes from the provisioning registry, so it always has a value: the user checks it out.'
+              items:
+                type: object
+                additionalProperties: true
+                required: [workerId, branch, applied]
+                properties:
+                  workerId: { type: string }
+                  branch: { type: string }
+                  applied: { type: boolean }
+            rejHead: { type: string, description: 'Head of the .rej (through the server''s existing artifact redaction, <= 2 KiB) — FOR A HUMAN TO LOOK AT, not to parse.' }
+        salvaged:
+          type: array
+          description: >
+            Patches of the workers that did not merge (best-effort; present only when non-empty). 🔴 Since
+            7.83.0 a CONFLICT terminal carries EVERY worker's patch (it used to carry only the unfinished ones):
+            the integration sandbox is destroyed in a `finally`, so the branches are not guaranteed to still be
+            on a remote — the patch itself is the deliverable, and the consumer should give the user a way to
+            save it. ⚠️ `patch` is WORKER-AUTHORED CODE (untrusted text): render it, save it, never feed it back
+            to a model.
+          items:
+            type: object
+            additionalProperties: true
+            required: [workerId, sessionId, patch]
+            properties:
+              workerId: { type: string }
+              sessionId: { type: string }
+              patch: { type: string }
+        suspended:
+          type: array
+          description: 'Resume handles of suspended workers (C4) — their checkpoints and paused envs are intact.'
+          items:
+            type: object
+            additionalProperties: true
+            required: [workerId, sessionId]
+            properties:
+              workerId: { type: string }
+              sessionId: { type: string }
+        route: { type: string, description: 'single = a one-subtask plan; fanout = N.' }
+        error: { type: string, description: 'Planning/provisioning failed before fan-out.' }
+        replan:
+          type: object
+          additionalProperties: true
+          description: 'Replan-lite: which trigger won arbitration and what was done. 🔴 The closed set LOST `merge-conflict` in 7.83.0 (S-113, hard breaking, zero aliases): a merge that does not apply is no longer replanned, it is handed to the user.'
+          properties:
+            trigger: { type: string, description: 'suspended | budget | verify-fail | worker-failed.' }
+            redispatched: { type: array, items: { type: string } }
+            collapsed: { type: string }
+
     ApprovalDecision:
       type: object
       description: HITL decision (`POST /v1/approvals/:sessionId/decide`).
@@ -6634,12 +6915,23 @@ components:
             AskUserQuestion answer — TRUE WIRE SHAPE (worker-validated, 400 otherwise; found in prod
             integration, service-pinned): {answers:[{header, selected:string[], note?}]} where header matches
             the question's header. Omit for a plain F4 approve/deny.
+            🔴 CLOSED SHAPE (server >= 7.87.0 / S-452): an unrecognised key ANYWHERE in this object (including
+            inside `answers[]`) is REFUSED — 400 `request.field_invalid`, naming the KEY PATHS in the message
+            and in the `unknownKeys` machine table. Refused rather than dropped, because a misspelled
+            `selected` would silently drop part of the operator's own typed answer with a 200 on top (#157
+            family). Accepted: `answers`, `answers[].header`, `answers[].selected`, `answers[].note`.
+            ⚠️ THE TWO LEGS DIFFER IN STRICTNESS and the live one is not the contract: on this DURABLE leg
+            `answers[]` must be non-empty and each `selected` non-empty (an empty array is a 400), while the
+            LIVE leg (`POST /v1/questions/{id}/respond`) only checks that it is an array (an empty one has a
+            headless-default meaning there).
           type: object
+          additionalProperties: false
           properties:
             answers:
               type: array
               items:
                 type: object
+                additionalProperties: false
                 required: [header, selected]
                 properties:
                   header: { type: string }
@@ -7287,6 +7579,66 @@ components:
             `WriteProtectionCapability`). `null` = this process cannot say; an ABSENT key means an OLDER worker,
             and "no key" is NOT "no table" — an absent seat on the engine side is precisely the DEFAULT TABLE
             BEING IN PLACE.
+        webSearch:
+          type: object
+          additionalProperties: true
+          description: >
+            server >= 7.82.1 (S-382; mint `routes/capabilities.ts:236` =
+            `projectWebSearchCapability(deps.webSearchProvider)`) — THIS DEPLOYMENT'S DEFAULT WEBSEARCH BACKEND.
+            The closed set is TYPED FROM the server's `WEB_SEARCH_PROVIDERS` tuple (`plugins/web-search.ts:70`,
+            the repo's single provider word table) plus `"none"`; the predicate is the very
+            `webSearchConfigFromEnv()` product boot USED TO BUILD the backend, so "the bit says brave while
+            tavily is wired" is structurally impossible.
+            🔴 `backend:"none"` AND AN ABSENT KEY ARE OPPOSITE DISPOSITIONS — never fold them: `"none"` = this
+            box has NO search backend (render "unavailable"); ABSENT = an older worker (< 7.82.1) ⇒ render
+            "cannot tell". Reading absence as `"none"` renders a correctly-configured older deployment as
+            having no search.
+            🔴 NO INTERNALS: the endpoint (a SearXNG instance URL), the API key and the quota never ride this
+            wire, and the per-request `settings.webSearch` override is deliberately NOT echoed — this bit
+            advertises the DEPLOYMENT DEFAULT and must not drift with the caller.
+          required: [backend]
+          properties:
+            backend: { type: string, description: 'brave | tavily | searxng | none — closed set typed from the server''s provider tuple; unknown words are a newer server, not an error.' }
+        mcpReconnect:
+          type: boolean
+          description: >
+            server >= 7.85.0 (S-381 / core 7.22.0 #857; mint `routes/capabilities.ts:264` =
+            `Boolean(deps.runStore) && Boolean(deps.sessionStorage?.ownerOf)`) — presence of
+            `POST /v1/sessions/{sessionId}/mcp/reconnect`. FACILITY DEPENDENCY, two conjuncts: a durable run
+            ledger (the verb reaches the live stream through the run row) AND the session-ownership face (the
+            inbound owner gate is fail-closed; without it the whole door is 501). Both 501s derive from the SAME
+            deps as this bit, so "says yes but 501s" is structurally impossible.
+            🔴 True only promises the ENDPOINT IS THERE: not that there is a live run right now (otherwise 409
+            `steering.not_running`), and not that this run declared any MCP server at all (undeclared ⇒ HTTP 200
+            with `outcome:"unsupported"`, which is not an error). ABSENT = an older worker ⇒ probe by 404/405,
+            do not render a dead affordance.
+        executionLane:
+          type: object
+          additionalProperties: true
+          description: >
+            server >= 7.86.0 (S-426; mint `routes/capabilities.ts:602` =
+            `projectExecutionLaneCapability(deps.config)`) — THE EXECUTION LANE, SELF-REPORTED. Before it, "do
+            this engine's tools run on THIS machine" could only be guessed from a three-way circumstantial
+            conjunction (shell spawned it AND no remote URL AND `REMOTE_EXEC` in {unset, host}) — none of which
+            the engine said, and which drifts the moment the shell talks to a remote engine (it reads ITS OWN
+            box's env).
+            `provider` is typed from the server's `RemoteExecProvider` (`execution-lane-caps.ts:50`, derived
+            from the `ServiceConfigFlat["remoteExec"]` discriminated union); `REMOTE_EXEC` UNSET ⇒ `"host"` is
+            CONTRACT, not a fallback. Honest cost: the server internally has a finer word (`in-process` — that
+            lane mounts NO hands at all) which this bit folds into `host`, so a consumer cannot tell "hands on
+            this box" from "no hands at all"; that is a DIFFERENT AXIS, not a reason to re-point the lane word.
+            `toolsOnThisHost` is owned by `task-cwd.ts`'s `toolsRunOnThisHost` — the SAME FUNCTION that decides
+            whether a self-scanned skill gets a `baseDir`.
+            🔴 THE IMPLICATION IS ONE-WAY: `toolsOnThisHost:false` ⇒ `skills[].baseDir` is never sent (that is
+            the promise); the converse does NOT hold — `true` is only necessary (a flat `skills/<name>.md` has
+            no directory of its own; plugin-sourced skills go through a loader that never passes the switch),
+            so under `true` read `baseDir` as PRESENT-IFF.
+            🔴 NO INTERNALS: k8s apiUrl / ssh host / adb serial / image / credentials / mountPath never ride here.
+            An ABSENT key must NOT be read as either side — that is exactly the state this bit was minted to end.
+          required: [provider, toolsOnThisHost]
+          properties:
+            provider: { type: string, description: 'host | e2b | k8s | ssh | adb | local-docker | device — typed from the server''s RemoteExecProvider; `REMOTE_EXEC` unset ⇒ `host`.' }
+            toolsOnThisHost: { type: boolean, description: 'The tools run on the process that answered this request (server-absolute paths mean something to the model''s tools).' }
     WriteProtectionCapability:
       type: object
       additionalProperties: false
@@ -7413,12 +7765,19 @@ components:
 
     SkillSpec:
       type: object
-      description: A per-request skill (passed as an object; core-native TaskSpec.skills shape).
+      description: >-
+        A per-request skill (passed as an object; core-native TaskSpec.skills shape).
+        🔴 server >= 7.78.1: `name` / `description` carry NO length cap any more (the engine's listing renderer
+        trims descriptions and falls back to name-only within its own byte budget — it never REFUSES a skill for
+        being long). `content` keeps the one real gate: 1 MiB, the twin of the engine's load gate (over it the
+        engine refuses the skill outright at load time, so the HTTP face answers first where the caller can read it).
+        The bound is 1 048 576 **UTF-16 code units** (`MAX_SKILL_CONTENT_CHARS`); see the STRING-LENGTH UNIT
+        convention in `info.description` for why this `maxLength` states that number verbatim.
       required: [name, description, content]
       properties:
-        name: { type: string, maxLength: 64 }
-        description: { type: string, maxLength: 1024 }
-        content: { type: string, maxLength: 32768 }
+        name: { type: string, minLength: 1 }
+        description: { type: string }
+        content: { type: string, minLength: 1, maxLength: 1048576 }
 
     McpServerSpec:
       type: object
@@ -7623,16 +7982,24 @@ components:
     MetricsSummaryOps:
       type: object
       description: >
-        200 body of GET /metrics/summary — `{ model, ...MetricsSummary }` (server.ts; server
-        observability/metrics.ts `MetricsSummary` interface + `summarize()`, all keys unconditional).
-        Ops/observability face (`x-sdk: none` on the path) — closed here for census fidelity, but this
-        does NOT change its SDK-wrapping status.
+        200 body of GET /metrics/summary — `{ model, ...MetricsSummary }` (server `boot/stage-10-http-server`
+        + `observability/metrics.ts` `MetricsSummary` / `summarize()`; every key unconditional).
+        🔴 OPEN as of sdk 9.7.0, and that is a RULING with a receipt: this schema was closed at the 2026-07-30
+        census and by 7.87.0 the producer had moved THREE keys ahead of it (`limitCeilingAfterAnswer` since
+        #677, `httpErrorsByClass` / `httpErrorsByRoute` since S-451) — i.e. a REAL summary body from a current
+        server failed this schema outright, which is the same disease `LivePendingRow` shipped with. A
+        RESPONSE PROJECTION is therefore declared key-by-key AND left open (the producer ships independently
+        and adds keys additively between SDK releases); REQUEST bodies stay closed, because there the enforcer
+        is the server's own strict gate.
+        ⚠️ The SDK DOES wrap this face (`client.metrics.summary()` → `MetricsSummaryOps`, since the
+        2026-07-17 coverage batch). The old `x-sdk: none` key on the path said otherwise and was simply stale;
+        it is gone. What remains true is the CREDENTIAL: a `metricsToken` (or a full authToken), not a principal.
       required:
         [model, runsActive, tasks, tokensTotal, costUsd, costUsdByModel, costUnknown, unpricedCalls,
          taskDurationAvgSec, brainFirstTokenAvgMs, brainCallAvgMs, cacheHitRateAvg, promptCacheLowHit,
          rateLimited, costQuotaRejected, budgetExceeded, degraded, degenerate, memoryConsolidationOps,
          planCacheRecurrence, cascade, verifications, councilRuns, toolErrors]
-      additionalProperties: false
+      additionalProperties: true
       properties:
         model: { type: string }
         runsActive: { type: integer }
@@ -7667,6 +8034,33 @@ components:
         verifications: { type: object, additionalProperties: { type: integer } }
         councilRuns: { type: object, additionalProperties: { type: integer } }
         toolErrors: { type: object, additionalProperties: { type: integer } }
+        limitCeilingAfterAnswer:
+          type: object
+          additionalProperties: { type: integer }
+          description: >-
+            server #677 — answer-time ceiling hits (walltime/turns) by origin. ⚠️ A DIFFERENT DENOMINATOR from
+            `budgetExceeded`: this one is minted on the deps-level notice seat and covers EVERY engine run
+            (background children, delegated nested legs, the leader lane), while `budgetExceeded` is only
+            incremented by the HTTP submit leg's `finalizeTaskResult`. Adding the two is only meaningful inside
+            that narrower total.
+        httpErrorsByClass:
+          type: object
+          additionalProperties: { type: integer }
+          description: >-
+            S-451 (server >= 7.87.0) — HTTP FAILURES in the window, aggregated by status CLASS. The keys are
+            only `"4xx"` / `"5xx"` (2xx/3xx never enter). ⚠️ `"4xx"` INCLUDES `499` (the server's label for
+            "client disconnected before the response finished", which is normal on SSE long-connections) — to
+            look at a real storm, read `httpErrorsByRoute` alongside it. An EMPTY OBJECT means zero failures in
+            the window (the key is always present; absence is NOT how zero is spelled). The whole key absent =
+            an older server.
+        httpErrorsByRoute:
+          type: object
+          additionalProperties: { type: integer }
+          description: >-
+            S-451 (server >= 7.87.0) — the TOP 10 route labels by failures (4xx+5xx combined), descending. The
+            label is the low-cardinality form (ids folded to `:id`; anything off the route table lands on
+            `"other"`). This is the "where did those 180 404s actually land" cell. Empty object = zero failures;
+            key absent = an older server.
 
     ModelInfo:
       type: object
@@ -8480,7 +8874,18 @@ components:
         elapsedMs: { type: integer }
         tokens: { type: integer }
         # tokenDir REMOVED (engine ruling 2026-06-28): dead field, 0 producer / 0 consumer — spec caught up 2026-07-26.
-        queuedCount: { type: integer }
+        queuedCount:
+          type: integer
+          description: >-
+            🔴 PHANTOM KEY — NO server version ever emits it (verified against the published 7.87.0 bytes:
+            the row type declares it and the fleet route's per-key table forwards it, but NO producer writes it
+            — not `publishTask`'s call sites, not core's bg-sink tick, not the durable reconcile leg — and the
+            wire contract does not mention it either). The server deleted it as a DEAD KEY (S-459, zero
+            behavioural impact since `!== undefined` was always false). It stays declared here only because
+            removing an exported field is BREAKING = major-only; it is registered with its deletion condition
+            in `test/_keyset-divergence.ts` (`FLEET_TASK_ROW_PHANTOM_KEYS`) and goes with the next major.
+            DO NOT read it as "queue depth is already reported" — a permanently absent optional key is a FALSE
+            LEAD. Real queue depth needs a NEW key WITH a producer, not this one resurrected.
         awaitingPlanApproval: { type: boolean }
         currentAction: { type: string, description: "The child's most recent tool intent as one human-readable line (UNTRUSTED argument head, redacted server-side)." }
         currentTool:
@@ -8835,9 +9240,21 @@ components:
       description: >-
         A live (in-stream) pending ask inside its streamApproval window (#315, server ≥7.43). Decide it via
         POST /v1/tool-approvals/{approvalId}/respond — NOT the /decide route (that is the durable rows' door).
-        Deliberately narrow: tool input/args are NOT listed (no second redaction surface — details ride the
-        SSE tool_approval frame). Optional flags are only-if-true (absent is NEVER encoded as false).
-      additionalProperties: false
+        Optional flags are only-if-true (absent is NEVER encoded as false).
+        🔴 THE "tool input/args are NOT listed" NARROWING IS GONE (server >= 7.87.0 / S-454 P1). The old reason
+        was "details ride the stream frame" — but a SUSPENDED ask never has a stream frame (at mint time it had
+        no delivery target at all, so it suspends for a 1h window), and for it that reason is structurally
+        false: without the card body on this row a consumer can list the ask and still not render it. The row
+        therefore carries `frame` — the very card frame that ask WOULD have emitted — for EVERY live row (the
+        rule set does not fork on `suspended`: an ask that does have a live stream carrying one extra copy of
+        its own card is harmless).
+        🔴 THIS SCHEMA IS OPEN (`additionalProperties: true`) as of sdk 9.7.0, and that is a RULING, not a slip:
+        it was closed, and when 7.87.0 minted `frame` every strict consumer stopped accepting a perfectly legal
+        row — the whole `livePending` array became unreadable rather than "one field short". A producer that
+        ships independently of this SDK adds keys additively between SDK releases, so a RESPONSE projection is
+        declared key-by-key AND left open; the REQUEST bodies stay closed (there the enforcer is the server's
+        own strict gate, so closing is description, not guesswork).
+      additionalProperties: true
       required: [approvalId, toolName, ts, expiresAtMs]
       properties:
         approvalId: { type: string, description: 'The SAME id the respond endpoint takes (wire uuidv7).' }
@@ -8849,6 +9266,20 @@ components:
         governanceForced: { type: boolean, enum: [true] }
         fromSubagent: { type: boolean, enum: [true], description: 'The ask originates from a delegated subagent.' }
         originTaskId: { type: string, description: 'S-52 C2 (server ≥7.52, A-075.87): the delegated child taskId (= the child''s core runSourceTaskId, uuid) — correlates this live ask to the child run row. Minted by the SAME conditional spread as `fromSubagent`: the two keys are always both present or both absent (三键恒等亲证在案).' }
+        contentKind: { type: string, description: 'S-62 (server >= 7.6x): content-question kind — `content_ask` when the gated tool is AskUserQuestion (the SAME word as the two durable read faces and core''s summarize face). Absent = an ordinary tool ask. Display/triage only; it NEVER takes part in decision routing.' }
+        frame:
+          allOf: [{ $ref: '#/components/schemas/ToolApprovalFrame' }]
+          description: >-
+            server >= 7.87.0 (S-454 P1; cli L-397) — THE CARD FRAME THIS ASK WOULD HAVE EMITTED. It is the SAME
+            OBJECT as the server's `PendingApproval.frame` (the one construction site in `askBroadcast`, already
+            redacted / byte-capped / window-keys filled), shared by the suspended and the reachable path — so
+            this is NOT a second card projection computed for the list, and there is no second redaction surface.
+            🔴 INVARIANT: `frame.approvalId === row.approvalId` (verified at 7.87.0's merge review). When one ask
+            was registered as pending more than once and the FIRST registration was cancelled, the frame's id
+            used to point at the dead registration (responding by it 404s); the server now hands out a shallow
+            copy with the id aligned to THIS row whenever the two differ. Always decide by the row's id.
+            🔴 ABSENT = an older server (<= 7.86.0); from 7.87.0 it is ALWAYS present (a required slot on the
+            entry) and is never minted as `null`.
 
     ApprovalStaleCurrentPending:
       type: object
@@ -9454,12 +9885,38 @@ components:
       description: >
         ASSISTANT-WIRE-CONTRACT §4c — `POST /v1/assistant/tasks/:id/plan_review` body (3-state). `editedPlan` is
         REQUIRED iff `decision==="edit"` (FORBIDDEN otherwise → 400).
+        🔴 THE BODY KEY SET IS CLOSED (server >= 7.86.0 / S-438): an unrecognised top-level key is refused with
+        400 `request.body_shape` plus the `unknownKeys` / `unsupportedKeys` machine tables — refused rather
+        than dropped, because a misspelled `permissionModeAfter` would otherwise silently leave the task
+        read-only after its plan was approved.
       required: [decision]
       additionalProperties: false
       properties:
         decision: { type: string, enum: [approve, edit, reject] }
         editedPlan: { type: string, description: 'the operator''s revised plan — required iff decision==="edit".' }
         reason: { type: string }
+        permissionModeAfter:
+          type: string
+          enum: [default, acceptEdits]
+          description: >
+            server >= 7.86.0 (S-433, P1; mints `routes/approvals-assistant.ts:1021/1024/1148`) — WHICH
+            PERMISSION MODE THIS TASK CONTINUES IN once the plan is approved. Before this key, approving a plan
+            was a BLANK CHEQUE: the plan was approved while the read-only clamp stayed on and every write kept
+            asking. `acceptEdits` = writes stop asking; `default` = keep asking (AND is the folded value when
+            the key is absent, so an older shell executes plans unchanged).
+            🔴 THREE 400s, each with its own code: a value outside the two-word closed set ⇒
+            `request.field_invalid` (ZERO widening arm — this bit decides whether the model has hands after
+            approval, so folding a misspelling into either mode is a silent downgrade on the security axis);
+            sending it with `edit`/`reject` ⇒ `request.field_conflict` (core: those two send the plan back to be
+            redone and the read-only clamp stays — dropping it there would let the caller believe the mode was
+            settled); sending it for a task that was NOT submitted with `permissionMode:"plan"` ⇒
+            `request.field_conflict` (approving the plan lifts no read-only restriction there).
+            ⚠️ DIRECT-DOOR deployments: this key rides the HMAC envelope's TRAILING EXTENSION OBJECT (server
+            7.87.0: `{answer?, permissionModeAfter?}`, present keys in lexicographic order; 7.86.0's bare
+            trailing slot is DELETED with zero double-read) ⇒ a signer must sign the new shape, and mixed
+            versions are 401 in both directions.
+            ⚠️ The key name is final: `permissionModeAfter` (the build brief once said `nextPermissionMode`,
+            which never shipped — zero aliases).
 
     SessionRecord:
       type: object
@@ -9734,11 +10191,18 @@ components:
       description: >
         `GET /v1/sessions/{sessionId}/memory-status` 200 body (server >=7.53, S-53 seam①): `sessionId` + the
         five `SessionMemoryStatus` keys copied ONE BY ONE when present (the server forbids spreading and forbids
-        defaults — the five conditional copies ARE the closed set). Per-key absence meaning = exactly
+        defaults — the five conditional copies ARE the closed set), plus the DEPLOYMENT bit
+        `autoConsolidationArmed` (server >= 7.85.0, always present). Per-key absence meaning = exactly
         `SessionMemoryStatus` (a healthy zero-history session omits `optOutSource` and `lastCaptureAt`). Keys
-        are mirrored locally rather than via allOf so the closed schema stays self-describing (spec rule:
-        closed + allOf must mirror every key).
-      additionalProperties: false
+        are mirrored locally rather than via allOf so the schema stays self-describing (spec rule: a closed
+        schema plus allOf must mirror every key).
+        🔴 OPEN as of sdk 9.7.0 — same ruling, same receipt as `MetricsSummaryOps` / `LivePendingRow`: this was
+        closed at S-53 and server 7.85.0 then added a sixth key, so a REAL body from a current server failed the
+        schema. A response PROJECTION is declared key-by-key AND left open (the producer ships independently and
+        adds keys additively between SDK releases); request bodies stay closed.
+        ⚠️ SCOPE OF THAT RULING IN THIS BATCH: only the schemas this batch had to GROW were opened (the growth
+        itself is the proof). Re-judging every other closed response schema is a separate car.
+      additionalProperties: true
       required: [sessionId]
       properties:
         sessionId: { type: string, description: 'The session the status is about (echo of the path segment, percent-decoded).' }
@@ -9747,6 +10211,87 @@ components:
         foldedCount: { type: integer, description: 'See SessionMemoryStatus.foldedCount.' }
         optOutSource: { type: string, enum: [record, fault], description: 'See SessionMemoryStatus.optOutSource — absent = no opt-out record (healthy), never a fault by itself.' }
         lastCaptureAt: { type: integer, description: 'See SessionMemoryStatus.lastCaptureAt (ms epoch) — absent on a session with no committed contribution (healthy) as well as on an unreadable ledger.' }
+        autoConsolidationArmed:
+          type: boolean
+          description: >-
+            server >= 7.85.0 (S-403 / core 7.22.0 #863 W1; mint `routes/sessions.ts:744` =
+            `deps.memoryAutoConsolidationArmed`, computed ONCE at boot through core's single reader
+            `autoRunOnRecommendationEffective`) — IS AUTOMATIC MEMORY CONSOLIDATION ARMED ON THIS DEPLOYMENT.
+            🔴 NOT one of the five core-derived session keys: those are per-SESSION derivations whose absence
+            is meaningful per key; this one is a DEPLOYMENT fact and is ALWAYS PRESENT on >= 7.85.0. Absent =
+            an older worker ⇒ "unknown"; NEVER fold it to `false` (that renders a box which is auto-egressing
+            its whole memory store to the consolidation model as one that is not).
+            🔴 `true` = a terminal harvest that crosses the threshold auto-runs one host consolidation (memory
+            content auto-egresses to the configured model). A DIFFERENT QUESTION from `captureOptedOut` (does
+            THIS SESSION enter long-term memory) — do not read them together.
+            The same fact is readable by an operator as `wiring_manifest.autoConsolidation` (present-iff armed);
+            one fact, one source — the tenant face has only this key.
+
+    McpReconnectServerStatus:
+      type: object
+      additionalProperties: true
+      description: >
+        The `status` segment of `POST /v1/sessions/{sessionId}/mcp/reconnect` (server >= 7.85.0 / S-381; mint
+        `routes/mcp-reconnect.ts` `projectStatus`) — core's `McpServerStatus` projected BY THIS FACE.
+        ⚠️ The SAME core type is projected TWICE with DIFFERENT key sets and the two are deliberately NOT
+        merged: the `/mcp` panel projects `{name, status, serverInfo?, toolNames?, error?}` only, while this
+        face adds `errorCode` / `httpStatus` / `delivered` / `transportClosed`. Folding them would make the
+        panel's consumers wait for four keys that never come.
+        🔴 BRANCH ON THE MACHINE FIELDS, NEVER PARSE `reason`: `errorCode` is core's `McpFailureKind` word
+        (owner is the engine — switch with a default arm, do not narrow), `httpStatus` 401 is a re-authorize
+        door, `spawn_failed` is a missing binary.
+      required: [name, status]
+      properties:
+        name: { type: string }
+        status: { type: string, description: 'connected | failed (open set — the word table owner is the engine).' }
+        errorCode: { type: string, description: 'core `McpFailureKind`. Open set; switch with a default arm.' }
+        httpStatus: { type: integer, description: 'Only alongside errorCode `http_status` (401/403 = re-authorize; 5xx = that end is down). ABSENT rather than 0.' }
+        delivered: { type: string, enum: [yes, no, unknown], description: 'Did the request reach that server — read together with errorCode.' }
+        serverInfo:
+          type: object
+          properties:
+            name: { type: string }
+            version: { type: string }
+        error: { type: string, description: 'Remote-authored text: server-redacted and truncated to 200 chars. HUMAN-READ ONLY, never parsed.' }
+        transportClosed: { type: boolean, description: 'Whether that transport is already closed (the old connection is always closed BEFORE the new dial — see the "one transaction" note on the operation).' }
+
+    SessionMcpReconnectResult:
+      type: object
+      additionalProperties: true
+      description: >
+        200 body of `POST /v1/sessions/{sessionId}/mcp/reconnect` (server >= 7.85.0 / S-381 / core 7.22.0 #857;
+        mint `routes/mcp-reconnect.ts` `projectResult`). Branch on `outcome` — all three states are HTTP 200.
+        🔴 The `unsupported` arm (this run declared NO MCP) is an ALWAYS-FIVE-KEY body
+        `{taskId, sessionId, server, outcome, reason}`: with no core result the server coins no
+        `prefix`/`toolCount`/`added`/`removed`/`toolNames`, so reading `added` unconditionally is a bug.
+        🔴 `toolNames` is PRESENT-IFF core supplied `tools` (not keyed off `outcome`) and is a SUPERSET of what
+        the model finally sees (core filters again before mounting) — see the operation description.
+      required: [taskId, sessionId, server, outcome]
+      properties:
+        taskId: { type: string, description: 'The live run this re-dial rode (this session''s active run) — follow it via GET /v1/runs/{taskId}/events.' }
+        sessionId: { type: string, description: 'Echo of the path segment (percent-decoded).' }
+        server: { type: string, description: 'The named server that was re-dialed.' }
+        outcome: { type: string, description: 'accepted | refused | unsupported — the ONLY discriminator (all three are 200). `unsupported` is the SERVER''s word, not core''s.' }
+        prefix: { type: string, description: 'The tool-name prefix domain of that server. Absent on the `unsupported` arm.' }
+        toolCount: { type: integer, description: 'Tool count in that domain after the dial. Absent (never 0) on the `unsupported` arm.' }
+        added: { type: array, items: { type: string } }
+        removed: { type: array, items: { type: string } }
+        toolNames:
+          type: array
+          items: { type: string }
+          description: 'The roster THIS re-dial asserted for its own prefix domain (present-iff core supplied `tools`). A SUPERSET of what gets mounted; `[]` (failed dial) and ABSENT (never touched the connection) are different sentences.'
+        reason: { type: string, description: 'Human sentence (server-redacted, 200-char bound). NEVER parse it — the machine face is `status`.' }
+        status: { $ref: '#/components/schemas/McpReconnectServerStatus' }
+        listingIncomplete:
+          type: object
+          additionalProperties: true
+          description: 'The listing walk did not finish ⇒ do NOT treat `toolNames` as complete. `reason` is core''s word; `pages` is how many pages were walked.'
+          required: [reason, pages]
+          properties:
+            reason: { type: string }
+            pages: { type: integer }
+            budgetMs: { type: integer }
+            error: { type: string }
 
     # ── 2c session-sync (P1d) — the cloud-as-a-SYNC-PEER schemas ──────────────────────────────────────────────
     SyncEntry:
@@ -9994,6 +10539,12 @@ components:
             The two 501 families are deliberately NOT interchangeable: `capability.*` means this deployment did
             not wire that surface (change the deployment / hide the entry point), `feature.*` means the surface
             exists but its switch is off (ask an admin to turn it on).
+            🔴 `request.path_malformed` IS NOW THE WHOLE FAMILY'S ANSWER (server >= 7.86.0 / S-430): an id
+            segment that is not valid percent-encoding answers 400 on EVERY id-bearing door. Twelve of those
+            doors used to let the bare `decodeURIComponent` throw a `URIError` straight through the top-level
+            catch and answered 500 `internal.error` — a caller-side mistake reported as a server fault, which
+            also made it a retry-worthy-looking code. A consumer that branched on 500 for those paths must move
+            the branch to the 400 (the fix is the caller's either way: re-encode the id).
         error: { type: string }
         errorMessage: { type: string }
         activeTaskId:
@@ -11130,6 +11681,41 @@ components:
             that wires none reports nothing at all. The server never invents `mounted: false` when it cannot
             read the bit — the whole section goes absent instead (a minted false would read as "really not
             mounted").
+        writeProtection:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestWriteProtection' }]
+          description: >
+            core 7.20.1 (#853 / clay C-R55 丙), server >= 7.80.1 — TENANT-visible: which TARGET READING this
+            leg's write-protection judge got. EFFECTIVE half only.
+            🔴 ABSENCE IS A THIRD STATE (core present-iff a judge was compiled; a deployment with
+            `writeProtectedPaths: []` omits the whole section) — NEVER fold it to `"spelling-only"`, which
+            means "a judge IS there and only reads spellings".
+            ⚠️ Same name, different thing from `capabilities.writeProtection` / the diagnostics endpoint's
+            `writeProtection`: those are THIS SERVER'S assembled NAME TABLE (a boot product); this is core's
+            per-leg SELF-REPORT of the judge's reading.
+        readDeny:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestReadDeny' }]
+          description: >
+            core 7.22.0 (#889 / C-R60), server >= 7.85.0 — OPERATOR face only (stripped on every tenant
+            stream, and deliberately NOT carried by `GET /v1/diagnostics/wiring` either): which BUILT-IN
+            sensitive-path read-deny TIERS materially activate rows on this deployment.
+            🔴 PRESENT IFF at least one built-in row judges this leg. Absence = no built-in row judges it (a
+            POSITIVE fact), NOT "no read is deny-judged" — a deployment's own `READ_DENY_PATTERNS` is
+            deliberately never reported (pattern TEXT is deployment material, not an enum).
+            🔴 AN EMPTY ARRAY IS NEVER EMITTED ("off" and "on to nothing" are one fact) ⇒ treat `[]` as a bad
+            producer. The tier vocabulary is owned by core — do not narrow it on the consumer side.
+            ⚠️ Deployment semantics flipped in core 7.22.0: `READ_DENY_BUILTIN_TIERS` UNSET = OFF.
+        autoConsolidation:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestAutoConsolidation' }]
+          description: >
+            core 7.21.0 (#761), server >= 7.82.0 — OPERATOR face only (stripped on every tenant stream): is
+            automatic memory consolidation ARMED.
+            🔴 PRESENT IFF armed, and the only present shape is `{ onRecommendation: true }` (core's construct
+            gate refuses an armed-but-unrunnable state). ABSENT = NOT ARMED (a positive fact) — never read it
+            as `false`, never as "unknown". Armed means a terminal harvest over the threshold auto-runs one
+            host consolidation: memory content auto-egresses to the configured model, which is why it sits in
+            the operator family beside `governance`.
+            ⚠️ The tenant-readable twin of the same fact is `GET /v1/sessions/{sessionId}/memory-status`'s
+            `autoConsolidationArmed` (always present, a real boolean). One fact, one source, two faces.
         governance:
           type: object
           additionalProperties: false
@@ -12140,6 +12726,41 @@ components:
             frame and the inbox row; the `card_json` card deliberately does NOT carry it (it travels with `origin`,
             which is not on the card). Absence = `origin` is not that word — NOT an assertion that the rule store
             is healthy.
+        readRootCandidate:
+          type: object
+          required: [dir, clearsThisAsk]
+          additionalProperties: false
+          properties:
+            dir:
+              type: string
+              minLength: 1
+              maxLength: 1024
+              description: >-
+                The ABSOLUTE, lexically-folded directory to add to this session's read roots, spelled by the read
+                boundary itself — THE STRING SHOWN IS THE STRING TO ADD. A shell may render a shortened / `~` form,
+                but must echo THIS string back verbatim. The server carries it whole or drops the whole key
+                (a malformed shape, or a `dir` over 1024 UTF-16 code units ⇒ the key is ABSENT — never truncated,
+                because a truncated directory is a DIFFERENT directory and adding it would not clear this ask;
+                see the STRING-LENGTH UNIT convention in `info.description` for this `maxLength`'s counting unit).
+            clearsThisAsk:
+              type: boolean
+              enum: [true]
+              description: >-
+                Shape, not value — the domain is the literal `true` only, so this seat cannot be quietly widened
+                into a "might help" hint.
+          description: >-
+            server >= 7.78.1 (core 7.19.0), ADDITIVE, LIVE `tool_approval` FRAME ONLY — the clearing directory for
+            an OUT-OF-ROOT READ ask: add `dir` to this session's read roots (the shell's existing `/add-dir`) and
+            the same call stops asking.
+            🔴 READ PRESENCE ONLY, NEVER ABSENCE. Absence is NOT "nothing can be done": it also covers sensitive-path
+            deny rows (pattern-judged — no root changes them), commands the read boundary cannot parse (heredoc /
+            newline / command substitution / an argument used as the program), unexpanded globs, recursive walks,
+            and every ask NOT raised by the read boundary — every ask on server <= 7.78.0 has this shape too.
+            ⚠️ THIS FACE ONLY: `card_json`, the §2 inbox row, the `/v1/approvals` rich row and the park face carry
+            NO twin of this seat in this version — a PARKED out-of-root read ask still renders that single card.
+            ⚠️ Known shapes (upstream-registered, so a shell must NOT render this option as a guarantee):
+            `cd X && cat Y` yields X's PARENT directory; and on a deployment that normalizes declared read roots
+            (e.g. `/tmp/x` stored as `/private/tmp/x`) the same call may ask once more after the root is added.
     ApprovalRequestFrame:
       type: object
       description: >
@@ -14022,6 +14643,16 @@ components:
     WiringManifest:
       type: object
       description: >
+        🔴 ONE RULE FOR EVERY "EFFECTIVE HALF ONLY" KEY (sdk 9.7.0, after a codex adversarial-review [high]):
+        this schema's only consumer today is `GET /v1/diagnostics/wiring`'s `static` half, and every key marked
+        "effective half only" (`leg`, `ask.effective`, `configFingerprint`, `tools`, `hooks`, `lsp`,
+        `modelGate`, `autoMode`, `writeProtection`, `readDeny`, `autoConsolidation`) is ALWAYS ABSENT on that
+        wire ⇒ THEIR ABSENCE HERE CARRIES NO INFORMATION. The per-key absence readings ("absent = not armed",
+        "absent = a third state", …) hold for the LIVE FRAME (`Event_wiring_manifest`) and must not be carried
+        over to this response. For the facts behind those keys: a tenant reads
+        `GET /v1/sessions/{sessionId}/memory-status` (`autoConsolidationArmed`); an operator subscribes to that
+        leg's live stream (the governance segment and these three sections exist only on a projection that
+        KNOWS the caller's identity).
         core's assembly self-evidence manifest (core >=5.14.0 `WiringManifest`). TWO HALVES, ONE shape (a
         consumer must line the two faces up, so they are not split into separate types) — but which keys
         belong to which half is DETERMINATE, not "usually": `leg`, `ask.effective` and `configFingerprint`
@@ -14165,6 +14796,78 @@ components:
             core 7.18.0 (#789), server >= 7.78.0 — the LSP seam. EFFECTIVE half only; present iff a manager
             seat resolved. `mounted` and `lane` are INDEPENDENT facts — never fold them into one.
             Full per-key contract: see Event_wiring_manifest.lsp.
+        writeProtection:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestWriteProtection' }]
+          description: >
+            core 7.20.1 (#853), server >= 7.80.1 — TENANT-visible: which target reading this leg's
+            write-protection judge got. EFFECTIVE HALF ONLY ⇒ ALWAYS ABSENT ON THIS ENDPOINT, and absence
+            HERE carries no information (see this schema's own description for the one rule that governs
+            every effective-half-only key). The three-state reading ("absence = no judge at all, never fold
+            it to `spelling-only`") is the LIVE FRAME's reading — do not apply it to this response.
+            Full per-key contract: see Event_wiring_manifest.writeProtection.
+        readDeny:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestReadDeny' }]
+          description: >
+            core 7.22.0 (#889), server >= 7.85.0 — OPERATOR face only, effective half only, AND the server
+            explicitly rules it off this endpoint ⇒ always absent here; absence HERE says nothing about the
+            deployment's tiers. The present-iff / never-empty-array reading belongs to the operator LIVE
+            projection. Full per-key contract: see Event_wiring_manifest.readDeny.
+        autoConsolidation:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestAutoConsolidation' }]
+          description: >
+            core 7.21.0 (#761), server >= 7.82.0 — OPERATOR face only, EFFECTIVE HALF ONLY ⇒ ALWAYS ABSENT ON
+            THIS ENDPOINT. 🔴 DO NOT read absence here as "not armed": that renders a deployment which IS
+            auto-egressing its whole memory store as one that is not. The present-iff-armed reading belongs to
+            the operator LIVE projection; for "is this deployment armed", read
+            `GET /v1/sessions/{sessionId}/memory-status`'s `autoConsolidationArmed` (always present, a real
+            boolean). Full per-key contract: see Event_wiring_manifest.autoConsolidation.
+    WiringManifestWriteProtection:
+      # sdk 9.7.0:与 `WiringManifestMcpEntry` / `WiringManifestLspSeam` 同一条裁定 —— 同一段形被 live 帧与
+      # 静态诊断面两处引用,内联就是两份会各自漂的镜像,所以具名单源。
+      type: object
+      additionalProperties: false
+      description: >
+        The `wiring_manifest.writeProtection` section (core 7.20.1 #853 / clay C-R55 丙) — which TARGET
+        READING this leg's write-protection judge got. `"target"` = the judge holds the execution environment
+        and re-judges on the RESOLVED target when the spelling missed (a write that reaches a protected row
+        through an alias or a symlink is cleared); `"spelling-only"` = no environment, the spelling IS the
+        whole verdict. ABSENCE (the section itself) is a THIRD state — no judge was compiled at all.
+      required: [targetView]
+      properties:
+        targetView: { type: string, description: "core's two-word closed set (`spelling-only` / `target`); read as open — the vocabulary owner is the engine." }
+
+    WiringManifestReadDeny:
+      type: object
+      additionalProperties: false
+      description: >
+        The `wiring_manifest.readDeny` section (core 7.22.0 #889 / C-R60) — the BUILT-IN sensitive-path
+        read-deny tiers that MATERIALLY activate rows on this leg, in core's own tier order (NOT the tiers the
+        operator typed: one whose every row the exclude list removed is not named). OPERATOR audience.
+      required: [builtinTiers]
+      properties:
+        builtinTiers:
+          type: array
+          minItems: 1
+          items: { type: string }
+          description: >
+            Tier names, core-owned vocabulary (today `credentials` / `shell-history` / `browser` / `wallet` /
+            `agent-config`) — passed through verbatim, never narrowed here. AN EMPTY ARRAY IS NEVER EMITTED.
+
+    WiringManifestAutoConsolidation:
+      type: object
+      additionalProperties: false
+      description: >
+        The `wiring_manifest.autoConsolidation` section (core 7.21.0 #761) — PRESENT IFF automatic memory
+        consolidation is EFFECTIVELY armed on this deployment. OPERATOR audience: armed means memory content
+        auto-egresses to the configured consolidation model after a qualifying terminal harvest, and it is not
+        observable to the caller at all (the run happens host-side, fire-and-forget, after the harvest).
+      required: [onRecommendation]
+      properties:
+        onRecommendation:
+          type: boolean
+          enum: [true]
+          description: "core's ONLY present shape — the construct gate refuses an armed-but-unrunnable state, so this is a SHAPE, not a value."
+
     WiringManifestHookEntry:
       # sdk 9.5.0:与 `WiringManifestMcpEntry` 同一条裁定 —— 同一份行形被 live 帧与静态诊断面两处引用,
       # 内联就是两份会各自漂的镜像,所以一开始就具名。