@sema-agent/sdk 9.8.0 → 9.9.0

package/openapi.yaml

@@ -4517,6 +4517,359 @@ paths:
         '422': { description: 'errorCode "memory_sync_invalid_body" — the request failed the typed shape gate.' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
+  /v1/memory/entries/{entryId}/provenance:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+      - in: path
+        name: entryId
+        required: true
+        schema: { type: string }
+        description: 'The memory entry id, percent-encoded. A malformed escape → 400 `request.id_invalid`.'
+    get:
+      tags: [memory]
+      operationId: memoryEntryProvenance
+      x-status: live             # design/316 item ③ (server >= 7.46.0); route is always mounted and answers 501 itself. SDK memory.provenance().
+      summary: One entry's provenance account (operator lane).
+      description: >
+        design/316 item ③ — the machine-readable answer to "who wrote this in, what state is it in, has it been
+        moved" for an auditor holding an entry id. AUDIENCE IS OPERATOR / COMPLIANCE, not a shell knob: the
+        owner-facing self-service faces are `GET /v1/memory/export` and `POST /v1/sessions/{id}/memory/erase`.
+
+        GATE ORDER: identity (401 `auth.principal_required`) → authorization (403 `auth.operator_only`) →
+        capability (501 `capability.memory_engine_required`) → shape (400). AUTHORIZATION BEFORE CAPABILITY, on
+        purpose: a caller who can reach nothing must not be able to read the deployment's shape off it.
+        Capability bit: `memoryCompliance` — mounted AND `OPERATOR_PRINCIPALS` non-empty. It is NOT a synonym of
+        `memoryBundle` (that one asks about the backend's v2-c composite face; this one asks whether the backend
+        OWNS THE ENGINE CONTROL PLANE, `controlPlaneRoot` — the file memory backend does, pg/tidb do not).
+        ⚠️ The bit does NOT include "credentials ready": this route sits behind the deployment-wide rewrite gate,
+        so a worker with no service credential (and without an explicit `ALLOW_UNAUTHED_WRITES`) answers 503
+        `auth.service_token_required` BEFORE routing while the bit still reads `true`.
+
+        The 200 body is core's `EntryProvenanceAccount` ITSELF — not wrapped, not projected, not padded. The
+        account form is an OPEN discriminated shape, so writing a whitelist in the middle would restate a
+        structure that drifts with core. This is DELIBERATELY THE OPPOSITE of the import report (an explicit
+        whitelist there): the test is "is a new key silently reaching the wire dangerous?" — in a disposition
+        list, yes; in a STATEMENT OF FACT, withholding a field is the dangerous half.
+      responses:
+        '200':
+          description: The entry's assembled provenance account (core's, verbatim).
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/EntryProvenanceAccount' }
+        '400': { description: 'errorCode "request.id_invalid" — the entry id could not be decoded.' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '403': { description: 'errorCode "auth.operator_only" — provenance and erasure are operator-only deployment actions.' }
+        '500':
+          description: >
+            errorCode "internal.memory_control_plane_corrupt" — core's FAIL-CLOSED refusal: the control plane
+            cannot be read soundly and it will not assemble an answer over an account it cannot vouch for.
+            core's diagnostic text rides VERBATIM (it names which ledger is damaged) — show it to the operator in
+            full. 🔴 The code is TWO-MEANINGED and core carries NO discriminator for it today, so DO NOT sniff the
+            message to tell them apart: (1) BEFORE the operation — nothing happened, repair/rebuild the ledger;
+            (2) AFTER it landed (ERASE ONLY) — the deletions and their evidence anchor ARE COMMITTED and only the
+            residue enumeration failed, so the action is to replay with the SAME `requestId`. Never read (2) as
+            "nothing was deleted". ("internal.error" is the unclassified 500; its text is not echoed.)
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '501': { description: 'errorCode "capability.memory_engine_required" — this deployment has no memory engine whose backend owns the engine control plane. Change the deployment shape; retrying will not help.' }
+
+  /v1/memory/erase:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+    post:
+      tags: [memory]
+      operationId: memoryErase
+      x-status: live             # design/316 item ③ (server >= 7.46.0). SDK memory.erase().
+      summary: Explicitly authorized compliance erasure (operator lane).
+      description: >
+        design/316 item ③ — the deliverable a compliance caller archives. Gate order, capability bit and the
+        rewrite-gate caveat are VERBATIM those of `GET /v1/memory/entries/{entryId}/provenance`.
+
+        The request body is handed to the engine AS SENT: the server adds, drops and rewrites nothing. In
+        particular `allowUnevidenced` is NEVER INJECTED — the degraded lane is a HUMAN authorization statement,
+        and a middle layer ticking it is that layer signing for the caller. The selector's whole judgment
+        (exactly one of `ids`/`scope`/`sessionId`, de-duplication, types) belongs to core, so a
+        form-right-meaning-wrong body such as `{"ids": [...], "scope": "..."}` reaches the engine and comes back
+        400 `config.memory_erasure_request`.
+
+        🔴 IDEMPOTENCY HAS TWO LEGS WITH DIFFERENT CONTRACTS — read `evidenceCapability` BEFORE deciding whether a
+        retry is safe. `"journal"`: `requestId` is the idempotency identity; a resend READS BACK the ids pinned by
+        the anchor row and never re-resolves, and reusing an id under a DIFFERENT selector is refused loudly (409
+        `memory.erasure_selector_mismatch`). `"none"` (the explicit `allowUnevidenced` degradation): core's words
+        are "same requestId = a NEW request (re-resolved — replay convergence is not promised)" — A RESEND IS A
+        SECOND REAL DELETE. 🔴 DO NOT put an automatic retry policy on this endpoint.
+
+        ⚠️ THE MASS-DELETION FUSE DOES NOT APPLY: a whole-scope / whole-session selector is LEGAL here (the fuse
+        guards "files quietly vanished during harvest"; an explicitly authorized erasure vouches for itself by
+        enumerating every id in the attestation). `residuals.propagation` is core's self-declared boundary:
+        deletion is a THIS-STORE fact, remote-peer convergence is the sync deployment's half to prove.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: '#/components/schemas/MemoryErasureRequest' }
+      responses:
+        '200':
+          description: The erasure attestation (core's, verbatim).
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/MemoryErasureAttestation' }
+        '400':
+          description: >
+            Three codes, three different operator actions — deliberately not folded into one.
+            "request.request_id_required": `requestId` missing / empty / non-string. It is THIS request's
+            idempotency identity and the server never mints one for you, so a RETRY MUST CARRY THE SAME ID (a lost
+            ack must not open a second real delete). "request.body_shape": the top-level JSON shape is wrong, or a
+            key that rewrites an object's prototype was smuggled in as a selector key. "config.memory_erasure_request":
+            core's own verdict — the shape passed, the SELECTOR does not (not exactly one of ids/scope/sessionId,
+            empty/duplicated ids, …).
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '403': { description: 'errorCode "auth.operator_only" — provenance and erasure are operator-only deployment actions.' }
+        '409':
+          description: >
+            Three core-minted codes, passed through verbatim; branch on `errorCode` (the status cannot tell them
+            apart). "memory.erasure_evidence_unavailable": this backend has NO evidence face and the caller did not
+            opt into the degraded lane — deliberately NOT 501, because the caller holds a real choice
+            (`allowUnevidenced: true`) and a 501 would send someone off to change a deployment that is fine.
+            "memory.erasure_selector_mismatch": this `requestId` was first executed under a DIFFERENT selector —
+            mint a new id. "memory.erasure_census_incomplete": the store-wide projection census could not be read in
+            full, so the attestation refuses to claim a clean sweep — core states nothing was deleted and nothing
+            recorded; repair the filesystem fault and retry.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '500':
+          description: 'errorCode "internal.memory_control_plane_corrupt" — see the same response on `GET /v1/memory/entries/{entryId}/provenance`; meaning (2) of that two-meaninged code (deletions COMMITTED, residue enumeration failed) occurs on THIS endpoint only.'
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '501': { description: 'errorCode "capability.memory_engine_required" — this deployment has no memory engine whose backend owns the engine control plane.' }
+
+  /v1/memory/origin/external:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+      - in: query
+        name: scopes
+        required: true
+        schema: { type: string }
+        description: >
+          One or more memory scope keys. Comma-separated (`?scopes=a,b`) and/or REPEATED (`?scopes=a&scopes=b`) —
+          both forms are merged in full, then trimmed per segment, emptied segments dropped, de-duplicated in
+          order. Scope keys carry `:` / `@` / `/`, so every key is percent-encoded before the separators are
+          joined. ⚠️ A scope key containing a LITERAL COMMA is not expressible on this query (the server decodes
+          before it splits).
+      - in: query
+        name: originAware
+        required: false
+        schema: { type: string, enum: ['1'] }
+        description: >
+          design/383 S-6 / S-50 §3 (F3) — the ORIGIN FENCE capability declaration. The server has no per-client
+          version visibility, so an absent flag is read as "an old client", and an old client's strict/strip parse
+          SILENTLY DROPS the `origin` marker — flattening a "known external" entry into unmarked text that the
+          consumer then quotes or writes back as clean content, laundering the provenance away.
+          🔴 EVERY row of THIS face carries a marker, so WITHOUT `originAware=1` the whole list is withheld and the
+          response carries `withheldOriginTagged: <n>` instead (minted only when n > 0). That is the fence working,
+          not a bug: an operator tool must declare it knows the origin key family before it can see them.
+          Only the literal `1` is accepted (no loose parsing of `true`/`yes`).
+    get:
+      tags: [memory]
+      operationId: memoryOriginExternal
+      x-status: live             # design/316 item ② (server >= 7.46.0). SDK memory.originExternal() (which always declares originAware=1).
+      summary: Every externally-marked entry in the named scopes, with its provenance account (operator lane).
+      description: >
+        design/316 item ② — a memory entry may carry an EXTERNAL-ORIGIN marker: its content came from material the
+        model READ (a web page, a third-party doc, someone else's repo) rather than from first-hand facts in the
+        session. The marker does not mean "poisoned", it means "VERIFY BEFORE USE", and it rides along into every
+        mount. Gate order, capability caveat and the rewrite gate are verbatim those of item ③; the bit here is
+        `memoryOrigin` (same predicate as `memoryCompliance` TODAY, but deliberately a SECOND bit — they are two
+        product faces and a deployment may one day open only one of them; do not cache them as one).
+
+        🔴 THE ANSWER COVERS ONLY THE SCOPES YOU NAMED, AND AN EMPTY RESULT MUST NEVER BE READ AS "THE STORE IS
+        CLEAN". This server generation has no scope-enumeration read face, so scope names are supplied by the
+        caller and INCOMPLETENESS IS SILENT (an empty array and "these scopes are clean" are the same bytes on the
+        wire). An auditing script must guarantee its own list is complete (the keys are the same ones
+        `GET /v1/memory/export?scope=` takes). The echoed `scopes` is THE SET ACTUALLY AUDITED after
+        normalization — it is returned so the coverage itself is observable rather than inferred from what the
+        caller remembers sending.
+
+        Each row's `provenance` IS the `EntryProvenanceAccount` of item ③ (same discriminated form, same
+        pass-through discipline). An entry that is also CHALLENGED is still listed here — the exclusion rides
+        inside the provenance account, and a human must SEE it in order to adjudicate it.
+      responses:
+        '200':
+          description: The audited scopes (normalized, echoed) and one row per marked entry.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/MemoryOriginExternalResult' }
+        '400': { description: 'errorCode "request.query_invalid" — `scopes` is absent or normalizes to an empty list. The refusal text also names where scope keys come from and repeats that an empty answer is not a clean store.' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '403': { description: 'errorCode "auth.operator_only" — origin marking and clearance are operator-only deployment actions.' }
+        '500':
+          description: 'errorCode "internal.memory_control_plane_corrupt" (meaning (1) only on this read face) or "internal.error" (unclassified, text not echoed).'
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '501': { description: 'errorCode "capability.memory_engine_required" — no memory engine whose backend owns the engine control plane; the clearance ledger and its write-ahead custody rows live in that plane.' }
+
+  /v1/memory/origin/clearances:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+    get:
+      tags: [memory]
+      operationId: memoryOriginClearances
+      x-status: live             # design/316 item ② (server >= 7.46.0). SDK memory.originClearances().
+      summary: The origin-clearance audit ledger (operator lane, explicit whitelist projection).
+      description: >
+        design/316 item ② — who un-marked what, when, why, and whether the clearance finished. Gate order and
+        capability bit are those of `GET /v1/memory/origin/external`.
+
+        Each row is an EXPLICIT WHITELIST PROJECTION of core's `OriginClearanceRow`, which is DELIBERATELY THE
+        OPPOSITE posture from the two pass-through accounts above — the test is the same one ("is a new key
+        silently reaching the wire dangerous?") and the answer flips, because this is a CUSTODY face rather than a
+        statement of fact.
+        🔴 `entryText` — the full text of the cleared entry — NEVER reaches the wire, but its presence is disclosed
+        honestly as `custodyBytes`. That field is the CRASH-RECOVERY SEAT: if the process dies between the
+        tombstone batch and the re-record batch, the row holds the only copy of that memory; the recovery is TO
+        CALL `POST /v1/memory/origin/entries/{entryId}/clear` AGAIN (the engine replays from the row), not to read
+        the bytes out and paste them back. Putting a whole memory's body on an audit LIST face would attach a full
+        text export to every "let me look at the clearance records". So it is stripped — and STRIPPING IS
+        DISCLOSED: a `pending` row with `custodyBytes > 0` means the recovery seat is still holding a memory and A
+        HUMAN MUST ACT.
+        🔴 THE WHITELIST IS DEEP: the nested `origin` is projected key by key too, because the ledger read returns
+        the RAW ON-DISK OBJECT (core validates it without rewriting it), so version skew, a future core key, or
+        core's own documented BY-HAND recovery path could otherwise ride an extra member straight through — one
+        `origin.entryText` would bypass the single most load-bearing exclusion on this face. Members outside the
+        documented three are never serialized; their KEY NAMES are disclosed under `originUnknownKeys` (names
+        only, never values).
+        🔴 Attribution on this ledger is SELF-DECLARED: `requestId` is filled in by the caller and recorded
+        verbatim, so any operator who can reach the clear valve can book an irreversible clearance under someone
+        else's name. The deployment-side counterpart is a server log line (`memory_origin_cleared`) carrying the
+        VERIFIED principal beside the CLAIMED requestId and the `clearanceId` to join on — DO NOT draw a compliance
+        conclusion from the ledger alone.
+      responses:
+        '200':
+          description: The clearance ledger (whitelist projection, newest-first not guaranteed).
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/MemoryOriginClearancesResult' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '403': { description: 'errorCode "auth.operator_only" — origin marking and clearance are operator-only deployment actions.' }
+        '500':
+          description: 'errorCode "internal.memory_control_plane_corrupt" (the ledger cannot be read soundly) or "internal.error".'
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '501': { description: 'errorCode "capability.memory_engine_required" — no memory engine whose backend owns the engine control plane.' }
+
+  /v1/memory/origin/entries/{entryId}/clear:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+      - in: path
+        name: entryId
+        required: true
+        schema: { type: string }
+        description: 'The memory entry id, percent-encoded. A malformed escape → 400 `request.id_invalid`.'
+    post:
+      tags: [memory]
+      operationId: memoryOriginClear
+      x-status: live             # design/316 item ② (server >= 7.46.0). SDK memory.originClear().
+      summary: The audited UN-MARK valve (operator lane).
+      description: >
+        design/316 item ② — this vouches AWAY the disclosure "this memory came from outside, verify before use",
+        ON BEHALF OF THE HOST. The signer must be the deployment's operator, never a tenant. Gate order and
+        capability bit are those of `GET /v1/memory/origin/external`.
+
+        The clear rides the backend immutability law's ONE legal exit: a write-ahead clearance row (custody = the
+        full entry text) → a COMMITTED tombstone (CAS on the judged rev) → a later-batch re-record of THE SAME ID
+        with the marker stripped. The same id is on purpose: links, usage accounts and the clearance join all keep
+        their key. Every failure leaves the custody row standing, and CALLING THE SAME ENDPOINT AGAIN IS THE
+        RESUME (idempotent).
+
+        🔴 `requestId` IS THE AUDIT ATTRIBUTION, NOT AN IDEMPOTENCY KEY — the opposite of the same-named field on
+        `POST /v1/memory/erase`. Here it answers "WHO cleared this", recorded verbatim on the row and on the
+        terminal event; passing a NEW id when resuming a pending row is legal and common (the later resumer is a
+        different person). No length cap (the body-size limit bounds it).
+        🔴 `reason` is shape-checked only (must be a string); WHETHER AN EMPTY REASON IS ACCEPTABLE IS THE ENGINE'S
+        JUDGMENT (422 `memory.origin_clear_invalid`) — restating a `min(1)` in the HTTP layer would be a second
+        source of truth and would permanently keep a code core deliberately minted off the wire.
+        🔴 THE 200 CARRIES NO "THIS WAS A RESUME" DISCRIMINATOR, and the resume leg DOES NOT LOOK AT YOUR `reason`:
+        the engine resumes the existing pending row, the ledger keeps the OPENER's reason and requestId, and only
+        the terminal EVENT carries yours. So operator B, who resent after a 409 `memory.origin_clear_pending` as
+        instructed and got a 200, may have completed operator A's row. ⇒ AFTER A 200, READ
+        `GET /v1/memory/origin/clearances` BACK and check `reason` / `requestId`; `clearanceId` is that row's key.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: '#/components/schemas/MemoryOriginClearRequest' }
+      responses:
+        '200':
+          description: The clearance receipt.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/MemoryOriginClearReceipt' }
+        '400':
+          description: >
+            "request.id_invalid" (the entry id could not be decoded) / "request.request_id_required" (`requestId`
+            missing / empty / non-string — mint a stable id and resend; unlike the erase face, a retry here MAY
+            carry a new one) / "request.body_shape" (the top-level JSON shape is wrong).
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '403': { description: 'errorCode "auth.operator_only" — origin marking and clearance are operator-only deployment actions.' }
+        '409':
+          description: >
+            Six core-minted codes, passed through verbatim; BRANCH ON `errorCode` — the six operator actions all
+            differ and folding them into one cell would make people guess.
+            "memory.origin_clear_unknown" — TWO MEANINGS: (1) no committed entry under this id (check the id);
+            (2) a RESUMED clearance row whose entry is gone while this clearance never recorded a tombstone, so
+            core refuses to resurrect a deletion it did not make and the custody bytes stay on the terminal row
+            for a human. Deliberately NOT 404: (2) is not "wrong address", and a generic retry arm would read it
+            as one.
+            "memory.origin_clear_not_marked" — the entry is there but was never marked; use
+            `GET /v1/memory/origin/external` to see who really is.
+            "memory.origin_clear_challenged" — the entry is challenged/latched. THE CLEAR VALVE IS NOT A CHALLENGE
+            EXIT: adjudicate the challenge first (laundering an exclusion through a weaker credential is exactly
+            what this refusal stops).
+            "memory.origin_clear_conflict" — the judgment basis moved since the row was opened (rev changed,
+            projection slug changed, unadopted on-disk changes, tombstone leg refused). Action: call again to
+            re-judge; BYTES ON BOTH SIDES ARE UNCHANGED.
+            "memory.origin_clear_failed" — STOPPED HALFWAY AND RESUMABLE (the re-record leg was refused, or the
+            custody bytes failed their self-check). The row stays `pending` with the bytes in it ⇒ deliberately NOT
+            a 500: the server did not break. Action: fix, then call the same endpoint again to recover. ⚠️ Do not
+            read it as "nothing happened" — the tombstone may ALREADY be committed, and that row's `custodyBytes`
+            on the clearances ledger is the notice.
+            "memory.origin_clear_pending" — there is ALREADY a pending row on this entry (core's words: the pending
+            row is a resume seat, not a queue). This is CONCURRENCY, not a fault ⇒ resend, and the next call walks
+            into the resume leg. ⚠️ See the 200's note: that resume completes SOMEONE ELSE'S row.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '422':
+          description: >
+            Two core-minted SEMANTIC refusals (the body is valid JSON and the shape is right; what cannot be
+            produced is MEANING). "memory.origin_clear_unattributed" — an empty `requestId` (core's words: refused,
+            never defaulted; a clearance is the host signing for a foreign memory and a signature needs a name).
+            ⚠️ Through this route it is UNREACHABLE today (the route's own shape gate answers 400
+            `request.request_id_required` first); it is documented because core owns the refusal, and the day that
+            gate is loosened it must land as a 422 rather than as "the server broke".
+            "memory.origin_clear_invalid" — an empty `reason`; THIS one really does reach the wire, because the
+            HTTP layer deliberately does not restate core's `min(1)`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '500':
+          description: 'errorCode "internal.memory_control_plane_corrupt" or "internal.error" (unclassified, text not echoed).'
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '501': { description: 'errorCode "capability.memory_engine_required" — no memory engine whose backend owns the engine control plane.' }
+
   /v1/outcomes:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -6257,6 +6610,30 @@ components:
           type: array
           items: { type: string }
           description: Tool names to withhold from this task's roster.
+        excludeAllTools:
+          type: boolean
+          enum: [true]
+          description: >
+            (server >= 7.90.0, contract G.9b / acceptance G-40) UNMOUNT THE WHOLE TOOL SURFACE for this run —
+            caller tools, scaffolding, hands (Bash/Edit/Write…), MCP, A2A and skills are all left off, the model
+            has nothing to call, and the outcome is necessarily plain text. On the wire: the tail's first
+            `wiring_manifest` has `tools.count === 0` with an empty `entries` (disclosed ONCE, one frame per leg),
+            and the stream carries zero `tool_start` / `tool_end` / `tool_disclosure` frames.
+            🔴 DELIBERATELY NOT FOLDED INTO `excludeTools`: `"*"` is a LEGAL caller tool name, so "unmount
+            everything" cannot be spelled `excludeTools:["*"]` without collapsing it with "unmount the one tool
+            called `*`". Both keys may ride together and each takes effect — no conflict, no 400.
+            🔴 `true` IS THE ONLY VALUE THAT MEANS ANYTHING: the server writes only a literal `true` onto the
+            engine's TaskSpec, because sending `false` merely restates a default the ENGINE owns (absent /
+            `false` ⇒ roster unchanged). A non-boolean is a 400 `request.field_invalid` on the synchronous submit
+            leg; the DURABLE resume leg does not reject it (replaying a stored body — a 4xx there would brick an
+            already-parked run) and degrades it to "key absent".
+            🔴 PROBED BY THE KEY CLOSED SET, NOT BY A CAPABILITY BIT: a server that has not wired it (<= 7.89.x)
+            treats it as an unknown top-level key — 400 `request.body_shape` naming it verbatim under
+            `unknownKeys`, so trial-by-400 IS the probe (one key, one probe path; a second one is deliberately
+            not grown).
+            ⚠️ SCOPE: the A2A inbound face (`message/send`) does NOT carry this key — that leg's submit body is
+            rebuilt server-side from the protocol message as a CLOSED four-field set, so putting the key in an
+            A2A message is INERT and does not error. An A2A peer that wants a zero-tool run routes by skill.
         deferTools:
           type: array
           items: { type: string }
@@ -8319,6 +8696,436 @@ components:
             updatedAtMs: { type: integer }
         pullTruncated: { type: boolean, enum: [true] }
 
+    MemoryTransferEvidence:
+      type: object
+      description: >
+        core `TransferEvidence` — one row of the public `transfers.jsonl` audit face, as an OPEN discriminated
+        form: the three base keys are the contract, everything else is variant payload.
+        🔴 CONSUMER OBLIGATION: tolerate unknown `channel` values (report / skip / display raw) — NEVER an
+        exhaustive `switch` that throws. The channel vocabulary is set by whichever binary wrote the chain, and a
+        chain written by a newer engine must still read here.
+      required: [ev, channel, at]
+      additionalProperties: true
+      properties:
+        ev: { type: string, description: 'Unique event id (the evidence chain''s append-idempotency key).' }
+        channel: { type: string, description: 'The event kind — OPEN ON PURPOSE (see the consumer obligation above).' }
+        at: { type: integer, description: 'ms epoch of the event.' }
+
+    MemoryCommittedBinding:
+      description: >
+        core `CommittedBinding` — the committed-account BINDING half of one ledger row, as ONE tagged definition
+        (never a look-alike copy: an untagged `{scope, slug}` beside `{state: "unbound"}` can be satisfied by a
+        single hybrid object under both readings). `"unbound"` is a LEGAL transitional state (a v1→v2 migration
+        row whose projection could not be derived), never a refusal.
+      oneOf:
+        - type: object
+          required: [state, scope, slug]
+          additionalProperties: true
+          properties:
+            state: { type: string, enum: [bound] }
+            scope: { type: string }
+            slug: { type: string }
+            at: { type: integer }
+            prev:
+              type: object
+              required: [scope, slug, at]
+              additionalProperties: true
+              properties:
+                scope: { type: string }
+                slug: { type: string }
+                at: { type: integer }
+        - type: object
+          required: [state]
+          additionalProperties: true
+          properties:
+            state: { type: string, enum: [unbound] }
+
+    MemoryProvenanceBinding:
+      description: >
+        `EntryProvenanceAccount.binding` — FOUR states without collapse: `bound` / `unbound` (the shared tagged
+        {@link MemoryCommittedBinding}), `absent` (the account has NO row for this id) and `unknown` (the backend
+        has no audit-snapshot capability).
+        🔴 `unknown` ("cannot judge") MUST NEVER be folded into `absent` ("does not exist") — the two lead to
+        opposite compliance conclusions.
+      oneOf:
+        - { $ref: '#/components/schemas/MemoryCommittedBinding' }
+        - type: object
+          required: [state]
+          additionalProperties: true
+          properties:
+            state: { type: string, enum: [absent] }
+        - type: object
+          required: [state, reason]
+          additionalProperties: true
+          properties:
+            state: { type: string, enum: [unknown] }
+            reason: { type: string, enum: [audit-snapshot-capability-absent] }
+
+    EntryProvenanceAccount:
+      type: object
+      description: >
+        200 body of GET /v1/memory/entries/{entryId}/provenance — core `EntryProvenanceAccount` ITSELF (the server
+        neither wraps, projects nor pads it). An ASSEMBLY, not a second account: every field is read from an
+        authority that already exists (lineage / challenges / pollution = the engine's control plane;
+        binding / content / custody = the backend's committed account + evidence chain).
+        🔴 OPEN on purpose, like every other 2xx body of this family — the enforcement is ASYMMETRIC: a REQUEST
+        body is policed by the server's own strict gate (declaring it closed is an honest description), while a
+        RESPONSE body has no enforcer at all, so a consumer that closes one only turns "the producer shipped
+        first" into "this legal response failed validation". Tolerate new keys here; never reject on them.
+        🔴 `v` is a version envelope: a consumer reading `v > 1` must REFUSE, never reinterpret.
+      required: [v, id, binding, contributors, contentState, custody]
+      additionalProperties: true
+      properties:
+        v: { type: integer, enum: [1] }
+        id: { type: string }
+        binding: { $ref: '#/components/schemas/MemoryProvenanceBinding' }
+        contributors:
+          type: array
+          description: >
+            The committed lineage BY-ENTRY projection, each row joined with its session's pollution record where
+            one exists. PENDING (unsettled) lineage rows are never contributions — they surface as the
+            `lineage_pending` exclusion instead.
+          items:
+            type: object
+            required: [sessionId, lastRev]
+            additionalProperties: true
+            properties:
+              sessionId: { type: string }
+              lastRev: { type: string }
+              lastAt: { type: integer }
+              polluted:
+                type: object
+                required: [at, reason]
+                additionalProperties: true
+                properties:
+                  at: { type: integer }
+                  reason: { type: string }
+        exclusion:
+          type: object
+          description: "The model-visible read faces' withholding state for this id, when any."
+          required: [code]
+          additionalProperties: true
+          properties:
+            code: { type: string, enum: [challenged, lineage_pending] }
+            generation: { type: integer }
+            at: { type: integer }
+        contentState:
+          type: string
+          enum: [present, unavailable, capability-absent, absent]
+          description: >
+            The content half, LINKED to `binding` by construction: `absent` ⇔ binding `absent`;
+            `capability-absent` ⇔ binding `unknown`; a row answers `present` (committed content servable — only
+            then may `ingest` ride) or `unavailable` ("cannot read it" stays distinct from "does not exist").
+        ingest:
+          type: object
+          description: "The typed repo-file ingest provenance carried by the committed content's frontmatter (with the un-whitewashable `trust` marker). Present only with `contentState: present`."
+          required: [kind, path, contentHash, ingestedAt]
+          additionalProperties: true
+          properties:
+            kind: { type: string, enum: [repo_file] }
+            path: { type: string }
+            contentHash: { type: string }
+            ingestedAt: { type: integer }
+            trust: { type: string, enum: [untrusted] }
+        custody:
+          type: object
+          description: >
+            The per-id evidence-chain read. `damaged` = the chain's integrity is impeached while a sound reading
+            still answers (torn tail / evidence loss / ev-identity contradiction; `reason` carries the detail when
+            one is known). `capability-absent` = the backend has no custody face — `events` is then empty and is
+            NEVER fabricated.
+          required: [state, events]
+          additionalProperties: true
+          properties:
+            state: { type: string, enum: [complete, damaged, capability-absent] }
+            events: { type: array, items: { $ref: '#/components/schemas/MemoryTransferEvidence' } }
+            reason: { type: string }
+
+    MemoryErasureRequest:
+      type: object
+      description: >
+        Request body of POST /v1/memory/erase.
+        🔴 `requestId` is THIS request's IDEMPOTENCY IDENTITY and neither the server nor the engine ever mints one
+        — a retry MUST carry the SAME id (a lost ack must not open a second real delete). Contrast
+        `MemoryOriginClearRequest.requestId`, which is an AUDIT ATTRIBUTION and may legitimately change on a resume.
+        🔴 `allowUnevidenced` is NEVER INJECTED by the server: the degraded lane is a human authorization statement.
+      required: [requestId, select]
+      additionalProperties: false
+      properties:
+        requestId: { type: string, minLength: 1 }
+        select:
+          type: object
+          description: >
+            The erasure selector. The documented forms are `{ids: string[]}` / `{scope: string}` /
+            `{sessionId: string}`, EXACTLY ONE of them. Declared OPEN on purpose: the rule's single owner is core
+            (`erasureRequestInvalid`) and the HTTP layer validates only the top-level structure — restating the
+            field table here would be a second source of truth, and would pre-reject a fourth form core may grow.
+            A form-right-meaning-wrong selector is answered 400 `config.memory_erasure_request` by the engine.
+          additionalProperties: true
+        allowUnevidenced:
+          type: boolean
+          description: "Opt-in to the evidence-capability-ABSENT degradation lane. Default = a loud refusal (409 `memory.erasure_evidence_unavailable`)."
+
+    MemoryErasedBinding:
+      description: "core `ErasedBinding` — one erased row's coordinates (the snapshot's tagged binding law, without the account-trace extras)."
+      oneOf:
+        - type: object
+          required: [state, scope, slug]
+          additionalProperties: true
+          properties:
+            state: { type: string, enum: [bound] }
+            scope: { type: string }
+            slug: { type: string }
+        - type: object
+          required: [state]
+          additionalProperties: true
+          properties:
+            state: { type: string, enum: [unbound] }
+
+    MemoryErasureAttestation:
+      type: object
+      description: >
+        200 body of POST /v1/memory/erase — core `MemoryErasureAttestation` ITSELF, the deliverable a compliance
+        caller archives. Every claim is black-box re-checkable.
+        🔴 READ `evidenceCapability` BEFORE DECIDING WHETHER A RETRY IS SAFE — the two legs have different
+        contracts (see the endpoint description). OPEN for the same reason as `EntryProvenanceAccount`.
+      required: [v, requestId, at, status, evidenceCapability, custodyState, select, selectHash, resolvedIds, erased, notFound, conflicts, residuals]
+      additionalProperties: true
+      properties:
+        v: { type: integer, enum: [1], description: 'Version envelope — a consumer reading `v > 1` must refuse, never reinterpret.' }
+        requestId: { type: string }
+        at: { type: integer }
+        status:
+          type: string
+          enum: [complete, partial]
+          description: '`complete` ⇔ conflicts empty ∧ every pinned id ∈ erased ∪ erasedPreviously ∪ (notFound with `custodyState === "complete"`). Everything else is `partial` (a replay converges it).'
+        evidenceCapability:
+          type: string
+          enum: [journal, none]
+          description: '`journal` = the File evidence path; `none` = the explicit `allowUnevidenced` degradation lane. ALWAYS PRESENT — a silent downgrade is the forbidden shape.'
+        custodyState:
+          type: string
+          enum: [complete, damaged, capability-absent]
+          description: "The evidence chain's integrity as read at assembly. `damaged` ⇒ every notFound row carries `historyUnknown` and `erasedPreviously` is never produced."
+        select: { type: object, additionalProperties: true, description: 'The selector, echoed verbatim (same open form as the request).' }
+        selectHash: { type: string, description: "sha256 hex of the selector's canonical JSON — equals the anchor row's." }
+        resolvedIds: { type: array, items: { type: string }, description: "The pinned id set (= the anchor row's ids; a replay reads it back, never re-resolves)." }
+        erased:
+          type: array
+          items:
+            type: object
+            required: [id, rev, binding, projectionsRemoved, sessions]
+            additionalProperties: true
+            properties:
+              id: { type: string }
+              rev: { type: string }
+              binding: { $ref: '#/components/schemas/MemoryErasedBinding' }
+              evidenceEv: { type: string, description: "The delete evidence row's `ev` — absent in `none` mode." }
+              projectionsRemoved: { type: integer, description: 'Distinct census-confirmed projection files this transaction physically deleted (the sweep arm can answer > 1).' }
+              sessions: { type: array, items: { type: string }, description: 'Contributing sessions (`none` mode answers []). A replay after a crash carries the chain''s set — an honest downgrade, never a fabricated rebuild.' }
+        notFound:
+          type: array
+          description: >
+            No row at judgment time and not claimable as erased under THIS request. Covers never-existed /
+            organically deleted / deleted by another request — the chain can distinguish them, the attestation does
+            not pretend to. `historyUnknown` ⇔ `custodyState !== "complete"`.
+          items:
+            type: object
+            required: [id]
+            additionalProperties: true
+            properties:
+              id: { type: string }
+              historyUnknown: { type: boolean, enum: [true] }
+        erasedPreviously:
+          type: array
+          description: 'Chain-read rows: an origin-ABSENT delete row carrying THIS requestId. Present only when non-empty; never produced in `none` mode or over a damaged chain.'
+          items:
+            type: object
+            required: [id, ev, at]
+            additionalProperties: true
+            properties:
+              id: { type: string }
+              ev: { type: string }
+              at: { type: integer }
+              from:
+                type: object
+                required: [scope, slug]
+                additionalProperties: true
+                properties:
+                  scope: { type: string }
+                  slug: { type: string }
+        conflicts:
+          type: array
+          description: 'Per-id PLANNING-stage faults (io/plan errors under the lock — there is no CAS loser inside a single lock span). Non-fatal; a replay converges them.'
+          items:
+            type: object
+            required: [id, reason]
+            additionalProperties: true
+            properties:
+              id: { type: string }
+              reason: { type: string }
+        residuals:
+          type: object
+          required: [quarantineHits, quarantineOpaque, propagation]
+          additionalProperties: true
+          properties:
+            quarantineHits: { type: array, items: { type: string }, description: 'Quarantine files whose frontmatter id is in the pinned set (PRESERVE-NOT-DELETE: the attestation enumerates, an explicit second action clears).' }
+            quarantineOpaque: { type: integer, description: 'Quarantine files that could not be attributed (fragments / non-entry shapes) — the honest BOUND of the enumeration.' }
+            indexUncleared: { type: array, items: { type: string }, description: 'Derived MEMORY.md index files that may STILL carry a line naming an erased entry (the erase-time sweep could not read or rewrite them). Present only when non-empty.' }
+            propagation:
+              type: string
+              enum: [local-store-only]
+              description: 'Propagation boundary, SELF-DECLARED ALWAYS: deletion is a THIS-STORE fact; remote-peer convergence is the sync deployment''s half to prove.'
+
+    MemoryEntryOriginMark:
+      type: object
+      description: >
+        core `MemoryEntryOrigin` — one entry's EXTERNAL-ORIGIN marker: the content came from material the model
+        READ, not from first-hand facts in the session. The marker means "verify before use", not "poisoned".
+        🔴 `cause` MAY BE ABSENT AND IS NEVER GUESSED: an entry marked before the cause vocabulary existed is
+        honestly without one.
+      required: [taint, at]
+      additionalProperties: true
+      properties:
+        taint: { type: string, enum: [external] }
+        cause: { type: string, enum: [observed, derived, static, unattributed] }
+        at: { type: integer }
+
+    MemoryOriginExternalEntry:
+      type: object
+      description: 'One row of GET /v1/memory/origin/external: the marker plus the FULL provenance account. Open (statement-of-fact posture).'
+      required: [id, slug, scope, origin, provenance]
+      additionalProperties: true
+      properties:
+        id: { type: string }
+        slug: { type: string }
+        scope: { type: string }
+        origin: { $ref: '#/components/schemas/MemoryEntryOriginMark' }
+        provenance:
+          allOf: [{ $ref: '#/components/schemas/EntryProvenanceAccount' }]
+          description: 'IS the `EntryProvenanceAccount` of GET /v1/memory/entries/{entryId}/provenance — same discriminated form, same pass-through discipline. A CHALLENGED marked entry is still listed; the exclusion rides in here.'
+
+    MemoryOriginExternalResult:
+      type: object
+      description: >
+        200 body of GET /v1/memory/origin/external.
+        🔴 THE ANSWER COVERS ONLY THE SCOPES YOU NAMED, AND AN EMPTY RESULT IS NEVER "THE STORE IS CLEAN" — this
+        server generation has no scope-enumeration read face, so incompleteness is SILENT. `scopes` echoes the set
+        ACTUALLY AUDITED (after trimming / dropping empty segments / de-duplicating in order) so the coverage is
+        observable rather than inferred.
+        ⚠️ `withheldOriginTagged` (an integer, minted only when > 0) rides the OPEN tail when the request did NOT
+        declare `originAware=1`: every row of this face is marked, so the fence withholds them all. A caller that
+        declares the flag (the SDK always does) never sees the key.
+      required: [scopes, entries]
+      additionalProperties: true
+      properties:
+        scopes: { type: array, items: { type: string } }
+        entries: { type: array, items: { $ref: '#/components/schemas/MemoryOriginExternalEntry' } }
+
+    MemoryOriginClearanceEvent:
+      type: object
+      description: 'One TERMINAL event of a clearance (who / when / to / detail is the whole of the concept "event"). `detail` absent ⇒ the KEY is absent — on an audit face "no detail written" and "the detail is empty" are not the same thing.'
+      required: [eventId, at, to, requestId]
+      additionalProperties: true
+      properties:
+        eventId: { type: string }
+        at: { type: integer }
+        to: { type: string, enum: [done, failed] }
+        requestId: { type: string, description: "THIS event's resolver (the opener on the normal path; a later resumer on a crash path)." }
+        detail: { type: string, description: 'Mechanical detail (landing slug, refusal reason) — engine-composed, bounded by the writer.' }
+
+    MemoryOriginClearanceRow:
+      type: object
+      description: >
+        One row of GET /v1/memory/origin/clearances — an EXPLICIT WHITELIST PROJECTION of core's
+        `OriginClearanceRow`, guarded on the server side by a compile-time set-difference gate.
+        🔴 core's `entryText` (the cleared entry's full body) is STRIPPED BY THE SERVER and its presence disclosed
+        as `custodyBytes`; the nested `origin` is projected KEY BY KEY, with any member outside the documented
+        three disclosed by NAME ONLY under `originUnknownKeys`.
+        ⚠️ THAT IS THE SERVER'S RESTRAINT, NOT A CLIENT-SIDE STRICTNESS — this schema stays OPEN like every 2xx
+        body of the family. The server decides WHAT TO SEND; a consumer schema decides WHAT TO TOLERATE, and
+        closing the latter only breaks on version skew. The whitelist is written down so a reader knows what the
+        server promises, and `entryText` is simply NOT DECLARED so nobody reads a promise that was never made.
+      required: [clearanceId, entryId, scope, slug, baseRev, origin, requestId, reason, at, status, events, custodyBytes]
+      additionalProperties: true
+      properties:
+        clearanceId: { type: string }
+        entryId: { type: string, description: 'The cleared entry. A clearance KEEPS THE SAME ID, so this key joins the clearance to the entry across its whole life.' }
+        scope: { type: string }
+        slug: { type: string }
+        baseRev: { type: string, description: "The committed rev the clearance was judged against (the tombstone's CAS anchor)." }
+        origin:
+          allOf: [{ $ref: '#/components/schemas/MemoryEntryOriginMark' }]
+          description: 'THE MARKER THAT WAS CLEARED, deep-projected to the documented three keys (audit: what exactly did the host vouch away).'
+        originUnknownKeys:
+          type: array
+          items: { type: string }
+          description: "Present only when the on-disk row's `origin` carried members outside the documented three — KEY NAMES ONLY, values never reach the wire. A normal row does not have this key."
+        requestId:
+          type: string
+          description: >
+            WHO cleared it — the mandatory audit attribution, never defaulted by core.
+            🔴 IT IS SELF-DECLARED, NOT VERIFIED: any operator who can reach the valve can book a clearance under
+            another name. The deployment-side counterpart is the server log line `memory_origin_cleared` (verified
+            principal + claimed requestId + clearanceId to join on).
+        reason: { type: string, description: "WHY — the host's stated ground, never defaulted (free text)." }
+        at: { type: integer, description: 'When the row was opened.' }
+        status: { type: string, enum: [pending, done, failed] }
+        tombstonedAt: { type: integer, description: "This clearance's tombstone commit moment (SENT ONLY WHEN PRESENT). A row without it refuses conservatively on the resume leg." }
+        events: { type: array, items: { $ref: '#/components/schemas/MemoryOriginClearanceEvent' } }
+        custodyBytes:
+          type: integer
+          description: >
+            The custody text's UTF-8 BYTE COUNT (not a JS string length — that counts UTF-16 code units and would
+            under-report a CJK entry by up to two thirds, and this number is the only evidence of how much the
+            recovery seat still holds). `0` = this row carries no bytes; `> 0` on a `pending` row = the crash
+            recovery seat still holds a memory's body AND A HUMAN MUST ACT (call the clear endpoint again).
+
+    MemoryOriginClearancesResult:
+      type: object
+      description: '200 body of GET /v1/memory/origin/clearances.'
+      required: [clearances]
+      additionalProperties: true
+      properties:
+        clearances: { type: array, items: { $ref: '#/components/schemas/MemoryOriginClearanceRow' } }
+
+    MemoryOriginClearRequest:
+      type: object
+      description: >
+        Request body of POST /v1/memory/origin/entries/{entryId}/clear.
+        🔴 `requestId` is the AUDIT ATTRIBUTION, not an idempotency key (the opposite of the same-named field on
+        POST /v1/memory/erase): passing a NEW id when resuming a pending row is legal and common. No length cap.
+        🔴 `reason` is shape-checked only; whether an EMPTY reason is acceptable is the ENGINE's judgment
+        (422 `memory.origin_clear_invalid`).
+      required: [requestId, reason]
+      additionalProperties: false
+      properties:
+        requestId: { type: string, minLength: 1 }
+        reason: { type: string }
+
+    MemoryOriginClearReceipt:
+      type: object
+      description: >
+        200 body of POST /v1/memory/origin/entries/{entryId}/clear.
+        🔴 `origin` IS FORWARDED VERBATIM AND MAY CARRY MEMBERS OUTSIDE THE DOCUMENTED THREE. On a freshly opened
+        row it is core's narrow rebuild (`committedOriginOf` mints exactly taint / cause? / at); on the RESUME leg
+        core answers with the ledger row's ORIGINAL object (`clearEntryOrigin` finds the pending row and returns
+        `origin: row.origin`), so version skew, a future core key, or core's own documented by-hand recovery can
+        ride along — on a clearance that ALREADY COMMITTED SUCCESSFULLY. Only the clearances LIST face
+        deep-projects it, which is why this receipt and that row are not the same shape.
+        🔴 THERE IS NO "THIS WAS A RESUME" DISCRIMINATOR HERE, and the resume leg ignores your `reason` — read
+        GET /v1/memory/origin/clearances back and check `reason` / `requestId` before treating a 200 as "my ground
+        was recorded". `clearanceId` is that row's key.
+      required: [entryId, clearanceId, origin, landedSlug]
+      additionalProperties: true
+      properties:
+        entryId: { type: string }
+        clearanceId: { type: string }
+        origin:
+          allOf: [{ $ref: '#/components/schemas/MemoryEntryOriginMark' }]
+          description: 'The marker that was just cleared, verbatim.'
+        landedSlug: { type: string, description: "The re-recorded entry's landing slug." }
+
     MetricsSummaryOps:
       type: object
       description: >
@@ -16707,9 +17514,9 @@ components:
           type: string
           enum: [darwin, linux]
           description: 'The v1 CLOSED SET. A third value (e.g. `win32`) ⇒ 400 request.field_invalid — never silently accepted.'
-        platformArch: { type: string }
-        displayName: { type: string, description: 'Echoed back by `GET /v1/devices` as `name`, and HONESTLY ABSENT there when empty.' }
-        workspaceRoot: { type: string, minLength: 1, description: 'The device-side root every instruction resolves against. Required and non-empty. Over its byte column ⇒ 400 (a silently truncated value is a DIFFERENT value).' }
+        platformArch: { type: string, maxLength: 32, description: 'At most 32 **UTF-8 bytes** (producer gates byte length; `maxLength` is the looser character bound, see the unit convention).' }
+        displayName: { type: string, maxLength: 255, description: 'Echoed back by `GET /v1/devices` as `name`, and HONESTLY ABSENT there when empty. At most 255 **UTF-8 bytes** (producer gates byte length; `maxLength` is the looser character bound).' }
+        workspaceRoot: { type: string, minLength: 1, maxLength: 1024, description: 'The device-side root every instruction resolves against. Required and non-empty. At most 1024 **UTF-8 bytes** (producer gates byte length; `maxLength` is the looser character bound) ⇒ over it 400 request.field_invalid (a silently truncated value is a DIFFERENT value).' }
 
     DeviceEnrollResult:
       type: object
@@ -16730,7 +17537,7 @@ components:
       description: 'The `POST /v1/devices/{deviceId}/revoke` body (closed shape; the only accepted key is `reason`). Absent body is folded to `{}` server-side.'
       additionalProperties: false
       properties:
-        reason: { type: string, maxLength: 512, description: 'At most 512 BYTES; over it ⇒ 400 request.field_invalid — a silently truncated audit reason is a DIFFERENT reason.' }
+        reason: { type: string, maxLength: 512, description: 'At most 512 **UTF-8 bytes** (the producer gates `Buffer.byteLength(reason, "utf8")`, NOT `.length` — this is the one family where the file''s unit convention''s explicit-UTF-8 carve-out applies); `maxLength: 512` is the deliberately LOOSER character bound (a multi-byte value can pass this schema and still get 400 request.field_invalid naming the field — loud, never a client-side false refusal). A silently truncated audit reason is a DIFFERENT reason.' }
 
     DeviceRevokeResult:
       type: object