@shardflux/sdk 0.11.1 → 0.13.0

package/dist/generated/app-api.d.ts

@@ -188,7 +188,7 @@ export interface paths {
         put?: never;
         /**
          * Consume an email verification token
-         * @description Single use. The emailed link is a frontend page (`/auth/verify-email#token=...`); GET never consumes. The first verification signs out every session, disables any MFA enrolled while unverified and invalidates the other open verification links. A link sent by a registration applies the password chosen in that same registration (`status: verified`; sign in again). A link from "resend" carries no password, so the stored one (set by an unverified registrant) is discarded: the response is `status: password_reset_required` with a single-use `reset_token` for POST /api/auth/password/reset/confirm, and no sign-in is possible until a password is set.
+         * @description Single use. The emailed link is a frontend page (`/auth/verify-email#token=...`); GET never consumes. The first verification signs out every session, disables any MFA enrolled while unverified and invalidates the other open verification links. A link sent by a registration applies the password chosen in that same registration (`status: verified`). A link from "resend" carries no password, so the stored one (set by an unverified registrant) is discarded: the response is `status: password_reset_required` with a single-use `reset_token` for POST /api/auth/password/reset/confirm, and no sign-in is possible until a password is set. Consumed in the browser whose registration sent the link (its __Host-sf_signup cookie), a `verified` link also signs that browser in: `signed_in: true` with the new session cookie and its `csrf_token`. Anywhere else `signed_in` is false: sign in.
          */
         post: operations["postApiAuthVerifyEmail"];
         delete?: never;
@@ -576,7 +576,7 @@ export interface paths {
         put?: never;
         /**
          * Consume an email verification token
-         * @description Single use. The emailed link is a frontend page (`/auth/verify-email#token=...`); GET never consumes. The first verification signs out every session, disables any MFA enrolled while unverified and invalidates the other open verification links. A link sent by a registration applies the password chosen in that same registration (`status: verified`; sign in again). A link from "resend" carries no password, so the stored one (set by an unverified registrant) is discarded: the response is `status: password_reset_required` with a single-use `reset_token` for POST /v1/auth/password/reset/confirm, and no sign-in is possible until a password is set.
+         * @description Single use. The emailed link is a frontend page (`/auth/verify-email#token=...`); GET never consumes. The first verification signs out every session, disables any MFA enrolled while unverified and invalidates the other open verification links. A link sent by a registration applies the password chosen in that same registration (`status: verified`). A link from "resend" carries no password, so the stored one (set by an unverified registrant) is discarded: the response is `status: password_reset_required` with a single-use `reset_token` for POST /v1/auth/password/reset/confirm, and no sign-in is possible until a password is set. Sign in afterwards.
          */
         post: operations["postV1AuthVerifyEmail"];
         delete?: never;
@@ -1366,7 +1366,7 @@ export interface paths {
         put?: never;
         /**
          * Open a workspace by key (create on first use, reconnect or resume afterwards)
-         * @description New keys resolve `template` to its latest published version; reopening never changes or resets the workspace (the response reports the template version actually used). 200 when the workspace is already running and ready (with `cell_endpoint` and a tool token); otherwise 202 with the operation to poll. A running workspace whose startup failed (`startup.state` failed, contracts §24.4) is not ready: the open is 202 with an `open` operation (input.startup_retry) that runs the failed step again. Concurrent opens of one key share one workspace and one operation. `secrets` (optional) binds secret names injected into every exec/PTY start: it sets the binding of a new key and replaces it on an existing key (omitted = unchanged); an unknown or unusable name is 422 details.reason secret_not_available with details.names (nothing is created or changed). The template version’s secret inputs (contracts §24.3) join the binding on create and whenever `secrets` is given; a required one this workspace may not use is 422 input_required (details.kind secret); a bound name equal to a template env key or text input is 422 env_collision (details.name). `inputs` (optional): the version’s text inputs {NAME: string}; stored on create (else the declared default) and replaced on an existing key (omitted = unchanged); 422 input_unknown, input_invalid or input_required (details.names). `lifetime` (contracts §19.11): omitted = the version’s default (else persistent); `session` workspaces are discarded when the session ends (close(), idle timeout), after which the key opens a NEW workspace; reopening a live key with another lifetime is 409 lifetime_mismatch. A new workspace is `layered` when its version supports it and layered opens are enabled (`disk_layout`). Errors: 404 template/key outside scope, 402 `entitlement_required`, 403 `quota_exceeded` (details.limit), 409 operation in progress, deleted key (workspace_deleted) or lifetime_mismatch, 422 reserved_key_prefix (keys starting with sf:). Supports Idempotency-Key. Held open (contracts §22.3): with `Prefer: wait=<seconds>` (at most 20) an open whose outcome is an operation is held until the operation is terminal or the wait elapses; success answers 200 with the running workspace, the succeeded operation and a tool token (`Preference-Applied: wait=<seconds>`), anything else 202 with the fresh operation. Without `Preference-Applied` the server did not wait: poll the operation. `mode` (contracts §29): omitted = processful for a new key and the stored mode for an existing one; `file_first` creates a workspace whose state is a versioned file tree with no VM between executions: it is ready at once (200 with a tool token, `observed_state` running, `tree_revision` 0, no operation), needs a layered template version (409 layout_unsupported otherwise) and is persistent (`lifetime: session` or `idle_policy` with it are 422 not_supported_for_mode); each open of a file-first key re-resolves the size of its execution VMs from `caps`, the template and the plan. 422 mode_not_available while the deployment does not offer file-first workspaces; reopening a key with another mode is 409 mode_mismatch.
+         * @description New keys resolve `template` to its latest published version; reopening never changes or resets the workspace (the response reports the template version actually used). 200 when the workspace is already running and ready (with `cell_endpoint` and a tool token); otherwise 202 with the operation to poll. A running workspace whose startup failed (`startup.state` failed, contracts §24.4) is not ready: the open is 202 with an `open` operation (input.startup_retry) that runs the failed step again. Concurrent opens of one key share one workspace and one operation. `secrets` (optional) binds secret names injected into every exec/PTY start: it sets the binding of a new key and replaces it on an existing key (omitted = unchanged); an unknown or unusable name is 422 details.reason secret_not_available with details.names (nothing is created or changed). The template version’s secret inputs (contracts §24.3) join the binding on create and whenever `secrets` is given; a required one this workspace may not use is 422 input_required (details.kind secret); a bound name equal to a template env key or text input is 422 env_collision (details.name). `inputs` (optional): the version’s text inputs {NAME: string}; stored on create (else the declared default) and replaced on an existing key (omitted = unchanged); 422 input_unknown, input_invalid or input_required (details.names). `lifetime` (contracts §19.11): omitted = the version’s default (else persistent); `session` workspaces are discarded when the session ends (close(), idle timeout), after which the key opens a NEW workspace; reopening a live key with another lifetime is 409 lifetime_mismatch. A new workspace is `layered` when its version supports it and layered opens are enabled (`disk_layout`). Errors: 404 template/key outside scope, 402 `entitlement_required`, 403 `quota_exceeded` (details.limit), 409 operation in progress, key whose deletion is still in progress (workspace_deleted) or lifetime_mismatch, 422 reserved_key_prefix (keys starting with sf:). Supports Idempotency-Key. Held open (contracts §22.3): with `Prefer: wait=<seconds>` (at most 20) an open whose outcome is an operation is held until the operation is terminal or the wait elapses; success answers 200 with the running workspace, the succeeded operation and a tool token (`Preference-Applied: wait=<seconds>`), anything else 202 with the fresh operation. Without `Preference-Applied` the server did not wait: poll the operation. `mode` (contracts §29): omitted = processful for a new key and the stored mode for an existing one; `file_first` creates a workspace whose state is a versioned file tree with no VM between executions: it is ready at once (200 with a tool token, `observed_state` running, `tree_revision` 0, no operation), needs a layered template version (409 layout_unsupported otherwise) and is persistent (`lifetime: session` or `idle_policy` with it are 422 not_supported_for_mode); each open of a file-first key re-resolves the size of its execution VMs from `caps`, the template and the plan. 422 mode_not_available while the deployment does not offer file-first workspaces; reopening a key with another mode is 409 mode_mismatch. Memory allocation (contracts §32): caps.allocation_mode elastic with caps.memory_mib_held; 422 validation_failed details.field caps.allocation_mode reason allocation_mode_not_available (the organization lacks elastic memory; nothing is created or changed), reason not_supported_for_mode (file_first); details.field caps.memory_mib_held reason requires_elastic (held without elastic) or exceeds_memory_mib (held above caps.memory_mib).
          */
         post: operations["postV1WorkspacesOpen"];
         delete?: never;
@@ -1428,7 +1428,7 @@ export interface paths {
         post?: never;
         /**
          * Delete a workspace (tombstone now, storage cleanup by the cell)
-         * @description Sets desired_state=deleted and deleted_at, revokes tool access immediately (workspace revocation watermark, agent sessions revoked) and creates a `delete` operation for the cell. A file-first workspace’s tree revisions are deleted with the tombstone and the cell deletes its stored files (contracts §29). Repeating returns the same operation. The key is never reused. Supports Idempotency-Key.
+         * @description Sets desired_state=deleted and deleted_at, revokes tool access immediately (workspace revocation watermark, agent sessions revoked) and creates a `delete` operation for the cell. A file-first workspace’s tree revisions are deleted with the tombstone and the cell deletes its stored files (contracts §29). Repeating returns the same operation. After deletion finishes (observed_state deleted), the key can open a new workspace ID; old IDs and tokens remain deleted. Supports Idempotency-Key.
          */
         delete: operations["deleteV1WorkspacesWorkspaceId"];
         options?: never;
@@ -1456,6 +1456,23 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/labels": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /** Replace workspace labels */
+        put: operations["putV1WorkspacesWorkspaceIdLabels"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/idle-policy": {
         parameters: {
             query?: never;
@@ -1507,7 +1524,7 @@ export interface paths {
         put?: never;
         /**
          * Resume a suspended workspace (admitted like a start)
-         * @description Creates a `resume` operation executed by the cell, or returns the active resume/open (concurrent wakes join one operation); 202 with it: poll GET /operations/{id}. Errors: 409 already_running or not_suspended, operation_in_progress (a suspend or another operation is active; details.active_operation_id), workspace_deleted, not_supported_for_mode (file-first, contracts §29); 402/403 as for open (admitted like a start). Supports Idempotency-Key. Held resume (contracts §22.6): with `Prefer: wait=<seconds>` (at most 20) the response is held until the operation is terminal or the wait elapses, exactly like a held open (§22.3); success answers 200 with the running workspace, the succeeded operation, `cell_endpoint` and a tool token for `agent_label`/`tools` (minted while the restore is in flight, at the new ownership epoch), `Preference-Applied: wait=<seconds>`; anything else is 202 with the fresh operation. With the preference a workspace that is already running answers 200 at once (operation null, a token) instead of 409 already_running. Without `Preference-Applied` the server did not wait: poll the operation. `tools` beyond the principal’s tool permissions are 403 (nothing is created); a token the API cannot issue otherwise is `tool_token: null`.
+         * @description Creates a `resume` operation for a suspended workspace, or an `open` recovery for a failed workspace (same ID and disk, no reset), or returns the active resume/open (concurrent wakes join one operation); 202 with it: poll GET /operations/{id}. Errors: 409 already_running or not_suspended, operation_in_progress (a suspend or another operation is active; details.active_operation_id), workspace_deleted, not_supported_for_mode (file-first, contracts §29); 402/403 as for open (admitted like a start). Supports Idempotency-Key. Held resume (contracts §22.6): with `Prefer: wait=<seconds>` (at most 20) the response is held until the operation is terminal or the wait elapses, exactly like a held open (§22.3); success answers 200 with the running workspace, the succeeded operation, `cell_endpoint` and a tool token for `agent_label`/`tools` (minted while the restore is in flight, at the new ownership epoch), `Preference-Applied: wait=<seconds>`; anything else is 202 with the fresh operation. With the preference a workspace that is already running answers 200 at once (operation null, a token) instead of 409 already_running. Without `Preference-Applied` the server did not wait: poll the operation. `tools` beyond the principal’s tool permissions are 403 (nothing is created); a token the API cannot issue otherwise is `tool_token: null`.
          */
         post: operations["postV1WorkspacesWorkspaceIdResume"];
         delete?: never;
@@ -1571,7 +1588,7 @@ export interface paths {
         put?: never;
         /**
          * Fork a workspace into a new key (independent copy of its committed state)
-         * @description Creates the target workspace (same template version and disk layout) and a `fork` operation on it, admitted like a start. Caps default to the source’s. `lifetime` is the fork’s own (default persistent): forking a session keeps its state. A file-first source (contracts §29) is 409 not_supported_for_mode. Supports Idempotency-Key.
+         * @description Creates the target workspace (same template version and disk layout) and a `fork` operation on it, admitted like a start. Caps default to the source’s. `lifetime` is the fork’s own (default persistent): forking a session keeps its state. A file-first source (contracts §29) is 409 not_supported_for_mode. Supports Idempotency-Key. Caps (and the memory allocation mode) default to the source’s. Held fork (contracts §22.7): with Prefer: wait=<seconds> (at most 20), holds through the terminal operation. Success returns 200 with the running target, succeeded operation and a final-epoch tool token for agent_label/tools. Otherwise returns 202 with the fresh operation. Preference-Applied confirms the wait; without it, poll as usual. A token that could not be issued is null; fetch it from the target tool-token route. Memory allocation (contracts §32): caps.allocation_mode elastic with caps.memory_mib_held; 422 validation_failed details.field caps.allocation_mode reason allocation_mode_not_available (the organization lacks elastic memory; nothing is created or changed), reason not_supported_for_mode (file_first); details.field caps.memory_mib_held reason requires_elastic (held without elastic) or exceeds_memory_mib (held above caps.memory_mib).
          */
         post: operations["postV1WorkspacesWorkspaceIdFork"];
         delete?: never;
@@ -1631,7 +1648,7 @@ export interface paths {
         put?: never;
         /**
          * Save a layered workspace as the next version of an organization template
-         * @description Everything in the workspace becomes template content (its whole filesystem, minus the sf-scrub.v1 list, the contents of /proc, /sys, /dev, /run and /tmp, and shared-volume contents), stored as one new org layer on the workspace’s template chain. A running workspace is captured briefly (`operation`, layer_snapshot); a suspended one uses its current checkpoint; `checkpoint_id` saves a committed checkpoint instead. 202 SaveAsTemplateResponse: poll the build. Owners/admins and API keys with a tool permission (403 otherwise). Errors: 409 legacy_disk_layout, workspace_not_running, operation_in_progress, not_supported_for_mode (file-first, contracts §29), template_archived, 422 platform_template_slug, invalid_defaults, update_policy_not_available, too_many_acknowledged_findings, invalid_path, 403 quota_exceeded (concurrent_template_builds). Supports Idempotency-Key.
+         * @description Everything in the workspace becomes template content (its whole filesystem, minus the sf-scrub.v1 list, the contents of /proc, /sys, /dev, /run and /tmp, and shared-volume contents), stored as one new org layer on the workspace’s template chain. A running workspace is captured briefly (`operation`, layer_snapshot); a suspended one uses its current checkpoint; `checkpoint_id` saves a committed checkpoint instead. 202 SaveAsTemplateResponse: poll the build. Owners/admins and API keys with a tool permission (403 otherwise). Immutable paths (contracts §34.1): the new version declares the target template’s open version’s immutable paths (else the workspace’s version’s); their content comes from that template’s newest published version, not from the workspace (a draft publish keeps the draft’s own content). Errors: 409 legacy_disk_layout, workspace_not_running, operation_in_progress, not_supported_for_mode (file-first, contracts §29), template_archived, 422 platform_template_slug, invalid_defaults, too_many_acknowledged_findings, invalid_path, immutable_paths_unsupported_base (the workspace’s base has no guest agent with immutable_paths.v1; details.base), 403 quota_exceeded (concurrent_template_builds). Supports Idempotency-Key.
          */
         post: operations["postV1WorkspacesWorkspaceIdSaveAsTemplate"];
         delete?: never;
@@ -1742,7 +1759,7 @@ export interface paths {
         put?: never;
         /**
          * Open a workspace by key (create on first use, reconnect or resume afterwards)
-         * @description New keys resolve `template` to its latest published version; reopening never changes or resets the workspace (the response reports the template version actually used). 200 when the workspace is already running and ready (with `cell_endpoint` and a tool token); otherwise 202 with the operation to poll. A running workspace whose startup failed (`startup.state` failed, contracts §24.4) is not ready: the open is 202 with an `open` operation (input.startup_retry) that runs the failed step again. Concurrent opens of one key share one workspace and one operation. `secrets` (optional) binds secret names injected into every exec/PTY start: it sets the binding of a new key and replaces it on an existing key (omitted = unchanged); an unknown or unusable name is 422 details.reason secret_not_available with details.names (nothing is created or changed). The template version’s secret inputs (contracts §24.3) join the binding on create and whenever `secrets` is given; a required one this workspace may not use is 422 input_required (details.kind secret); a bound name equal to a template env key or text input is 422 env_collision (details.name). `inputs` (optional): the version’s text inputs {NAME: string}; stored on create (else the declared default) and replaced on an existing key (omitted = unchanged); 422 input_unknown, input_invalid or input_required (details.names). `lifetime` (contracts §19.11): omitted = the version’s default (else persistent); `session` workspaces are discarded when the session ends (close(), idle timeout), after which the key opens a NEW workspace; reopening a live key with another lifetime is 409 lifetime_mismatch. A new workspace is `layered` when its version supports it and layered opens are enabled (`disk_layout`). Errors: 404 template/key outside scope, 402 `entitlement_required`, 403 `quota_exceeded` (details.limit), 409 operation in progress, deleted key (workspace_deleted) or lifetime_mismatch, 422 reserved_key_prefix (keys starting with sf:). Supports Idempotency-Key. Held open (contracts §22.3): with `Prefer: wait=<seconds>` (at most 20) an open whose outcome is an operation is held until the operation is terminal or the wait elapses; success answers 200 with the running workspace, the succeeded operation and a tool token (`Preference-Applied: wait=<seconds>`), anything else 202 with the fresh operation. Without `Preference-Applied` the server did not wait: poll the operation. `mode` (contracts §29): omitted = processful for a new key and the stored mode for an existing one; `file_first` creates a workspace whose state is a versioned file tree with no VM between executions: it is ready at once (200 with a tool token, `observed_state` running, `tree_revision` 0, no operation), needs a layered template version (409 layout_unsupported otherwise) and is persistent (`lifetime: session` or `idle_policy` with it are 422 not_supported_for_mode); each open of a file-first key re-resolves the size of its execution VMs from `caps`, the template and the plan. 422 mode_not_available while the deployment does not offer file-first workspaces; reopening a key with another mode is 409 mode_mismatch.
+         * @description New keys resolve `template` to its latest published version; reopening never changes or resets the workspace (the response reports the template version actually used). 200 when the workspace is already running and ready (with `cell_endpoint` and a tool token); otherwise 202 with the operation to poll. A running workspace whose startup failed (`startup.state` failed, contracts §24.4) is not ready: the open is 202 with an `open` operation (input.startup_retry) that runs the failed step again. Concurrent opens of one key share one workspace and one operation. `secrets` (optional) binds secret names injected into every exec/PTY start: it sets the binding of a new key and replaces it on an existing key (omitted = unchanged); an unknown or unusable name is 422 details.reason secret_not_available with details.names (nothing is created or changed). The template version’s secret inputs (contracts §24.3) join the binding on create and whenever `secrets` is given; a required one this workspace may not use is 422 input_required (details.kind secret); a bound name equal to a template env key or text input is 422 env_collision (details.name). `inputs` (optional): the version’s text inputs {NAME: string}; stored on create (else the declared default) and replaced on an existing key (omitted = unchanged); 422 input_unknown, input_invalid or input_required (details.names). `lifetime` (contracts §19.11): omitted = the version’s default (else persistent); `session` workspaces are discarded when the session ends (close(), idle timeout), after which the key opens a NEW workspace; reopening a live key with another lifetime is 409 lifetime_mismatch. A new workspace is `layered` when its version supports it and layered opens are enabled (`disk_layout`). Errors: 404 template/key outside scope, 402 `entitlement_required`, 403 `quota_exceeded` (details.limit), 409 operation in progress, key whose deletion is still in progress (workspace_deleted) or lifetime_mismatch, 422 reserved_key_prefix (keys starting with sf:). Supports Idempotency-Key. Held open (contracts §22.3): with `Prefer: wait=<seconds>` (at most 20) an open whose outcome is an operation is held until the operation is terminal or the wait elapses; success answers 200 with the running workspace, the succeeded operation and a tool token (`Preference-Applied: wait=<seconds>`), anything else 202 with the fresh operation. Without `Preference-Applied` the server did not wait: poll the operation. `mode` (contracts §29): omitted = processful for a new key and the stored mode for an existing one; `file_first` creates a workspace whose state is a versioned file tree with no VM between executions: it is ready at once (200 with a tool token, `observed_state` running, `tree_revision` 0, no operation), needs a layered template version (409 layout_unsupported otherwise) and is persistent (`lifetime: session` or `idle_policy` with it are 422 not_supported_for_mode); each open of a file-first key re-resolves the size of its execution VMs from `caps`, the template and the plan. 422 mode_not_available while the deployment does not offer file-first workspaces; reopening a key with another mode is 409 mode_mismatch. Memory allocation (contracts §32): caps.allocation_mode elastic with caps.memory_mib_held; 422 validation_failed details.field caps.allocation_mode reason allocation_mode_not_available (the organization lacks elastic memory; nothing is created or changed), reason not_supported_for_mode (file_first); details.field caps.memory_mib_held reason requires_elastic (held without elastic) or exceeds_memory_mib (held above caps.memory_mib).
          */
         post: operations["postApiV1WorkspacesOpen"];
         delete?: never;
@@ -1804,7 +1821,7 @@ export interface paths {
         post?: never;
         /**
          * Delete a workspace (tombstone now, storage cleanup by the cell)
-         * @description Sets desired_state=deleted and deleted_at, revokes tool access immediately (workspace revocation watermark, agent sessions revoked) and creates a `delete` operation for the cell. A file-first workspace’s tree revisions are deleted with the tombstone and the cell deletes its stored files (contracts §29). Repeating returns the same operation. The key is never reused. Supports Idempotency-Key.
+         * @description Sets desired_state=deleted and deleted_at, revokes tool access immediately (workspace revocation watermark, agent sessions revoked) and creates a `delete` operation for the cell. A file-first workspace’s tree revisions are deleted with the tombstone and the cell deletes its stored files (contracts §29). Repeating returns the same operation. After deletion finishes (observed_state deleted), the key can open a new workspace ID; old IDs and tokens remain deleted. Supports Idempotency-Key.
          */
         delete: operations["deleteApiV1WorkspacesWorkspaceId"];
         options?: never;
@@ -1832,6 +1849,23 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/workspaces/{workspace_id}/labels": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /** Replace workspace labels */
+        put: operations["putApiV1WorkspacesWorkspaceIdLabels"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/workspaces/{workspace_id}/idle-policy": {
         parameters: {
             query?: never;
@@ -1883,7 +1917,7 @@ export interface paths {
         put?: never;
         /**
          * Resume a suspended workspace (admitted like a start)
-         * @description Creates a `resume` operation executed by the cell, or returns the active resume/open (concurrent wakes join one operation); 202 with it: poll GET /operations/{id}. Errors: 409 already_running or not_suspended, operation_in_progress (a suspend or another operation is active; details.active_operation_id), workspace_deleted, not_supported_for_mode (file-first, contracts §29); 402/403 as for open (admitted like a start). Supports Idempotency-Key. Held resume (contracts §22.6): with `Prefer: wait=<seconds>` (at most 20) the response is held until the operation is terminal or the wait elapses, exactly like a held open (§22.3); success answers 200 with the running workspace, the succeeded operation, `cell_endpoint` and a tool token for `agent_label`/`tools` (minted while the restore is in flight, at the new ownership epoch), `Preference-Applied: wait=<seconds>`; anything else is 202 with the fresh operation. With the preference a workspace that is already running answers 200 at once (operation null, a token) instead of 409 already_running. Without `Preference-Applied` the server did not wait: poll the operation. `tools` beyond the principal’s tool permissions are 403 (nothing is created); a token the API cannot issue otherwise is `tool_token: null`.
+         * @description Creates a `resume` operation for a suspended workspace, or an `open` recovery for a failed workspace (same ID and disk, no reset), or returns the active resume/open (concurrent wakes join one operation); 202 with it: poll GET /operations/{id}. Errors: 409 already_running or not_suspended, operation_in_progress (a suspend or another operation is active; details.active_operation_id), workspace_deleted, not_supported_for_mode (file-first, contracts §29); 402/403 as for open (admitted like a start). Supports Idempotency-Key. Held resume (contracts §22.6): with `Prefer: wait=<seconds>` (at most 20) the response is held until the operation is terminal or the wait elapses, exactly like a held open (§22.3); success answers 200 with the running workspace, the succeeded operation, `cell_endpoint` and a tool token for `agent_label`/`tools` (minted while the restore is in flight, at the new ownership epoch), `Preference-Applied: wait=<seconds>`; anything else is 202 with the fresh operation. With the preference a workspace that is already running answers 200 at once (operation null, a token) instead of 409 already_running. Without `Preference-Applied` the server did not wait: poll the operation. `tools` beyond the principal’s tool permissions are 403 (nothing is created); a token the API cannot issue otherwise is `tool_token: null`.
          */
         post: operations["postApiV1WorkspacesWorkspaceIdResume"];
         delete?: never;
@@ -1947,7 +1981,7 @@ export interface paths {
         put?: never;
         /**
          * Fork a workspace into a new key (independent copy of its committed state)
-         * @description Creates the target workspace (same template version and disk layout) and a `fork` operation on it, admitted like a start. Caps default to the source’s. `lifetime` is the fork’s own (default persistent): forking a session keeps its state. A file-first source (contracts §29) is 409 not_supported_for_mode. Supports Idempotency-Key.
+         * @description Creates the target workspace (same template version and disk layout) and a `fork` operation on it, admitted like a start. Caps default to the source’s. `lifetime` is the fork’s own (default persistent): forking a session keeps its state. A file-first source (contracts §29) is 409 not_supported_for_mode. Supports Idempotency-Key. Caps (and the memory allocation mode) default to the source’s. Held fork (contracts §22.7): with Prefer: wait=<seconds> (at most 20), holds through the terminal operation. Success returns 200 with the running target, succeeded operation and a final-epoch tool token for agent_label/tools. Otherwise returns 202 with the fresh operation. Preference-Applied confirms the wait; without it, poll as usual. A token that could not be issued is null; fetch it from the target tool-token route. Memory allocation (contracts §32): caps.allocation_mode elastic with caps.memory_mib_held; 422 validation_failed details.field caps.allocation_mode reason allocation_mode_not_available (the organization lacks elastic memory; nothing is created or changed), reason not_supported_for_mode (file_first); details.field caps.memory_mib_held reason requires_elastic (held without elastic) or exceeds_memory_mib (held above caps.memory_mib).
          */
         post: operations["postApiV1WorkspacesWorkspaceIdFork"];
         delete?: never;
@@ -2007,7 +2041,7 @@ export interface paths {
         put?: never;
         /**
          * Save a layered workspace as the next version of an organization template
-         * @description Everything in the workspace becomes template content (its whole filesystem, minus the sf-scrub.v1 list, the contents of /proc, /sys, /dev, /run and /tmp, and shared-volume contents), stored as one new org layer on the workspace’s template chain. A running workspace is captured briefly (`operation`, layer_snapshot); a suspended one uses its current checkpoint; `checkpoint_id` saves a committed checkpoint instead. 202 SaveAsTemplateResponse: poll the build. Owners/admins and API keys with a tool permission (403 otherwise). Errors: 409 legacy_disk_layout, workspace_not_running, operation_in_progress, not_supported_for_mode (file-first, contracts §29), template_archived, 422 platform_template_slug, invalid_defaults, update_policy_not_available, too_many_acknowledged_findings, invalid_path, 403 quota_exceeded (concurrent_template_builds). Supports Idempotency-Key.
+         * @description Everything in the workspace becomes template content (its whole filesystem, minus the sf-scrub.v1 list, the contents of /proc, /sys, /dev, /run and /tmp, and shared-volume contents), stored as one new org layer on the workspace’s template chain. A running workspace is captured briefly (`operation`, layer_snapshot); a suspended one uses its current checkpoint; `checkpoint_id` saves a committed checkpoint instead. 202 SaveAsTemplateResponse: poll the build. Owners/admins and API keys with a tool permission (403 otherwise). Immutable paths (contracts §34.1): the new version declares the target template’s open version’s immutable paths (else the workspace’s version’s); their content comes from that template’s newest published version, not from the workspace (a draft publish keeps the draft’s own content). Errors: 409 legacy_disk_layout, workspace_not_running, operation_in_progress, not_supported_for_mode (file-first, contracts §29), template_archived, 422 platform_template_slug, invalid_defaults, too_many_acknowledged_findings, invalid_path, immutable_paths_unsupported_base (the workspace’s base has no guest agent with immutable_paths.v1; details.base), 403 quota_exceeded (concurrent_template_builds). Supports Idempotency-Key.
          */
         post: operations["postApiV1WorkspacesWorkspaceIdSaveAsTemplate"];
         delete?: never;
@@ -2419,7 +2453,7 @@ export interface paths {
         put?: never;
         /**
          * Request a custom template build (queued for the isolated builder)
-         * @description 202 with the queued build. Takes recipe v1 (a Dockerfile) or recipe v2 (contracts §24.1: validated against the base, compiled to the builder’s steps, uploads locked). Records the canonical recipe and its SHA-256 (provenance input), pins the base version, clamps resources to the plan and assigns `target_version`. The cell executes it (building -> testing -> publishing -> published) and the API then registers the version (published at once unless auto_publish=false); poll GET .../template-builds/{id} until `registration.state` is registered (or the build failed/was canceled). `builder_availability` says whether a builder is running. Errors: 422 when the recipe is outside the host builder Dockerfile dialect or the slug is not a builder slug (`details.reason`: multi_stage_not_supported, from_not_template_base, stage_names_not_supported, from_flags_not_supported, base_mismatch, run_flags_not_supported, heredoc_not_supported, instruction_not_supported, no_build_context, env_invalid, user_invalid, too_many_steps, recipe_too_large, slug_not_supported_by_builder, platform_template_slug, reserved_template_slug, base_not_found, base_not_published, base_archived, architecture_not_supported, ...; `line` for line errors; recipe v2: invalid_recipe (details.field, details.detail), base_not_layered, language_unavailable, language_conflict, invalid_package, too_many_files, platform_owned_path, invalid_path, upload_required, upload_missing, upload_digest_mismatch, upload_too_large, too_many_steps, recipe_too_large, allowlist_empty, allow_hosts_without_allowlist, extra_hosts_without_auto, too_many_hosts, invalid_host, ip_literal_not_allowed, host_not_allowed, invalid_settings, services_unsupported, too_many_acknowledged_findings), 503 dependency_unavailable (uploads_not_configured), 402 entitlement_required, 403 quota_exceeded (concurrent_template_builds), 409 template_archived. Supports Idempotency-Key.
+         * @description 202 with the queued build. Takes recipe v1 (a Dockerfile) or recipe v2 (contracts §24.1: validated against the base, compiled to the builder’s steps, uploads locked). Records the canonical recipe and its SHA-256 (provenance input), pins the base version, clamps resources to the plan and assigns `target_version`. The cell executes it (building -> testing -> publishing -> published) and the API then registers the version (published at once unless auto_publish=false); poll GET .../template-builds/{id} until `registration.state` is registered (or the build failed/was canceled). `builder_availability` says whether a builder is running. Errors: 422 when the recipe is outside the host builder Dockerfile dialect or the slug is not a builder slug (`details.reason`: multi_stage_not_supported, from_not_template_base, stage_names_not_supported, from_flags_not_supported, base_mismatch, run_flags_not_supported, heredoc_not_supported, instruction_not_supported, no_build_context, env_invalid, user_invalid, too_many_steps, recipe_too_large, slug_not_supported_by_builder, platform_template_slug, reserved_template_slug, base_not_found, base_not_published, base_archived, architecture_not_supported, ...; `line` for line errors; recipe v2: invalid_recipe (details.field, details.detail), base_not_layered, language_unavailable, language_conflict, invalid_package, too_many_files, platform_owned_path, invalid_path, upload_required, upload_missing, upload_digest_mismatch, upload_too_large, too_many_steps, recipe_too_large, allowlist_empty, allow_hosts_without_allowlist, extra_hosts_without_auto, too_many_hosts, invalid_host, ip_literal_not_allowed, host_not_allowed, invalid_settings, services_unsupported, too_many_acknowledged_findings; immutable paths (contracts §34.1): invalid_path (details.field recipe.immutable[<i>]), immutable_path_removed (the recipe drops a path of the template’s open version; details.removed), immutable_paths_unsupported_base (a non-empty list on a base whose guest agent lacks immutable_paths.v1, or a recipe v1 build of a template with immutable paths; details.base {name, version})), 503 dependency_unavailable (uploads_not_configured), 402 entitlement_required, 403 quota_exceeded (concurrent_template_builds), 409 template_archived. Supports Idempotency-Key.
          */
         post: operations["postV1OrganizationsOrganizationIdTemplateBuilds"];
         delete?: never;
@@ -2676,7 +2710,7 @@ export interface paths {
         put?: never;
         /**
          * Publish an organization template version
-         * @description Only a version produced by a registered `published` build (or a legacy `succeeded` one) whose scan and compatibility checks passed (409 `not_produced_by_succeeded_build` otherwise; 409 `version_archived`). New workspaces of the slug then use the latest published version; existing workspaces keep theirs. Idempotent. Owner/admin.
+         * @description Only a version produced by a registered `published` build (or a legacy `succeeded` one) whose scan and compatibility checks passed (409 `not_produced_by_succeeded_build` otherwise; 409 `version_archived`). New workspaces of the slug then use the latest published version; existing workspaces keep theirs, except their immutable paths (contracts §34), which show the latest published version from their next cold boot or resume. Idempotent. Owner/admin.
          */
         post: operations["postV1OrganizationsOrganizationIdTemplatesSlugVersionsVersionPublish"];
         delete?: never;
@@ -2696,7 +2730,7 @@ export interface paths {
         put?: never;
         /**
          * Archive an organization template version
-         * @description Hides the version and stops `open` from picking it for new workspaces; existing workspaces are never changed (versions are immutable). Idempotent. Owner/admin.
+         * @description Hides the version and stops `open` from picking it for new workspaces; existing workspaces keep their version (versions are immutable). Archiving the latest published version rolls immutable paths (contracts §34) back: workspaces show the previous published version there from their next cold boot or resume. Idempotent. Owner/admin.
          */
         post: operations["postV1OrganizationsOrganizationIdTemplatesSlugVersionsVersionArchive"];
         delete?: never;
@@ -2757,7 +2791,7 @@ export interface paths {
         put?: never;
         /**
          * Request a custom template build (queued for the isolated builder)
-         * @description 202 with the queued build. Takes recipe v1 (a Dockerfile) or recipe v2 (contracts §24.1: validated against the base, compiled to the builder’s steps, uploads locked). Records the canonical recipe and its SHA-256 (provenance input), pins the base version, clamps resources to the plan and assigns `target_version`. The cell executes it (building -> testing -> publishing -> published) and the API then registers the version (published at once unless auto_publish=false); poll GET .../template-builds/{id} until `registration.state` is registered (or the build failed/was canceled). `builder_availability` says whether a builder is running. Errors: 422 when the recipe is outside the host builder Dockerfile dialect or the slug is not a builder slug (`details.reason`: multi_stage_not_supported, from_not_template_base, stage_names_not_supported, from_flags_not_supported, base_mismatch, run_flags_not_supported, heredoc_not_supported, instruction_not_supported, no_build_context, env_invalid, user_invalid, too_many_steps, recipe_too_large, slug_not_supported_by_builder, platform_template_slug, reserved_template_slug, base_not_found, base_not_published, base_archived, architecture_not_supported, ...; `line` for line errors; recipe v2: invalid_recipe (details.field, details.detail), base_not_layered, language_unavailable, language_conflict, invalid_package, too_many_files, platform_owned_path, invalid_path, upload_required, upload_missing, upload_digest_mismatch, upload_too_large, too_many_steps, recipe_too_large, allowlist_empty, allow_hosts_without_allowlist, extra_hosts_without_auto, too_many_hosts, invalid_host, ip_literal_not_allowed, host_not_allowed, invalid_settings, services_unsupported, too_many_acknowledged_findings), 503 dependency_unavailable (uploads_not_configured), 402 entitlement_required, 403 quota_exceeded (concurrent_template_builds), 409 template_archived. Supports Idempotency-Key.
+         * @description 202 with the queued build. Takes recipe v1 (a Dockerfile) or recipe v2 (contracts §24.1: validated against the base, compiled to the builder’s steps, uploads locked). Records the canonical recipe and its SHA-256 (provenance input), pins the base version, clamps resources to the plan and assigns `target_version`. The cell executes it (building -> testing -> publishing -> published) and the API then registers the version (published at once unless auto_publish=false); poll GET .../template-builds/{id} until `registration.state` is registered (or the build failed/was canceled). `builder_availability` says whether a builder is running. Errors: 422 when the recipe is outside the host builder Dockerfile dialect or the slug is not a builder slug (`details.reason`: multi_stage_not_supported, from_not_template_base, stage_names_not_supported, from_flags_not_supported, base_mismatch, run_flags_not_supported, heredoc_not_supported, instruction_not_supported, no_build_context, env_invalid, user_invalid, too_many_steps, recipe_too_large, slug_not_supported_by_builder, platform_template_slug, reserved_template_slug, base_not_found, base_not_published, base_archived, architecture_not_supported, ...; `line` for line errors; recipe v2: invalid_recipe (details.field, details.detail), base_not_layered, language_unavailable, language_conflict, invalid_package, too_many_files, platform_owned_path, invalid_path, upload_required, upload_missing, upload_digest_mismatch, upload_too_large, too_many_steps, recipe_too_large, allowlist_empty, allow_hosts_without_allowlist, extra_hosts_without_auto, too_many_hosts, invalid_host, ip_literal_not_allowed, host_not_allowed, invalid_settings, services_unsupported, too_many_acknowledged_findings; immutable paths (contracts §34.1): invalid_path (details.field recipe.immutable[<i>]), immutable_path_removed (the recipe drops a path of the template’s open version; details.removed), immutable_paths_unsupported_base (a non-empty list on a base whose guest agent lacks immutable_paths.v1, or a recipe v1 build of a template with immutable paths; details.base {name, version})), 503 dependency_unavailable (uploads_not_configured), 402 entitlement_required, 403 quota_exceeded (concurrent_template_builds), 409 template_archived. Supports Idempotency-Key.
          */
         post: operations["postApiV1OrganizationsOrganizationIdTemplateBuilds"];
         delete?: never;
@@ -2934,7 +2968,7 @@ export interface paths {
         put?: never;
         /**
          * Publish an organization template version
-         * @description Only a version produced by a registered `published` build (or a legacy `succeeded` one) whose scan and compatibility checks passed (409 `not_produced_by_succeeded_build` otherwise; 409 `version_archived`). New workspaces of the slug then use the latest published version; existing workspaces keep theirs. Idempotent. Owner/admin.
+         * @description Only a version produced by a registered `published` build (or a legacy `succeeded` one) whose scan and compatibility checks passed (409 `not_produced_by_succeeded_build` otherwise; 409 `version_archived`). New workspaces of the slug then use the latest published version; existing workspaces keep theirs, except their immutable paths (contracts §34), which show the latest published version from their next cold boot or resume. Idempotent. Owner/admin.
          */
         post: operations["postApiV1OrganizationsOrganizationIdTemplatesSlugVersionsVersionPublish"];
         delete?: never;
@@ -2954,7 +2988,7 @@ export interface paths {
         put?: never;
         /**
          * Archive an organization template version
-         * @description Hides the version and stops `open` from picking it for new workspaces; existing workspaces are never changed (versions are immutable). Idempotent. Owner/admin.
+         * @description Hides the version and stops `open` from picking it for new workspaces; existing workspaces keep their version (versions are immutable). Archiving the latest published version rolls immutable paths (contracts §34) back: workspaces show the previous published version there from their next cold boot or resume. Idempotent. Owner/admin.
          */
         post: operations["postApiV1OrganizationsOrganizationIdTemplatesSlugVersionsVersionArchive"];
         delete?: never;
@@ -3120,7 +3154,7 @@ export interface paths {
         put?: never;
         /**
          * Publish the draft as the template’s next version (save-as-template from the draft)
-         * @description Builds one new org layer holding every change since the draft base, from `state_id` or the draft’s current state (a fresh capture when running). `settings` (TemplateSettingsInput, contracts §24.3): each given field replaces that field of the draft base’s settings, each absent one is carried forward (settings.defaults and defaults together: 422 invalid_settings). Refused with 409 draft_stale (details latest_version, draft_base_version) when the template has a version newer than the draft base that this draft did not produce, and 409 build_in_progress while a build from another source is unfinished. 202 SaveAsTemplateResponse. Supports Idempotency-Key.
+         * @description Builds one new org layer holding every change since the draft base, from `state_id` or the draft’s current state (a fresh capture when running). `settings` (TemplateSettingsInput, contracts §24.3): each given field replaces that field of the draft base’s settings, each absent one is carried forward (settings.defaults and defaults together: 422 invalid_settings). Refused with 409 draft_stale (details latest_version, draft_base_version) when the template has a version newer than the draft base that this draft did not produce, and 409 build_in_progress while a build from another source is unfinished. Immutable paths (contracts §34.1): the new version declares the template’s open version’s immutable paths (else the draft base’s) with the content the draft holds there; 422 immutable_paths_unsupported_base when the draft’s base has no guest agent with immutable_paths.v1 (details.base). 202 SaveAsTemplateResponse. Supports Idempotency-Key.
          */
         post: operations["postV1OrganizationsOrganizationIdTemplatesSlugDraftPublish"];
         delete?: never;
@@ -3140,7 +3174,7 @@ export interface paths {
         put?: never;
         /**
          * Publish the draft as the template’s next version (save-as-template from the draft)
-         * @description Builds one new org layer holding every change since the draft base, from `state_id` or the draft’s current state (a fresh capture when running). `settings` (TemplateSettingsInput, contracts §24.3): each given field replaces that field of the draft base’s settings, each absent one is carried forward (settings.defaults and defaults together: 422 invalid_settings). Refused with 409 draft_stale (details latest_version, draft_base_version) when the template has a version newer than the draft base that this draft did not produce, and 409 build_in_progress while a build from another source is unfinished. 202 SaveAsTemplateResponse. Supports Idempotency-Key.
+         * @description Builds one new org layer holding every change since the draft base, from `state_id` or the draft’s current state (a fresh capture when running). `settings` (TemplateSettingsInput, contracts §24.3): each given field replaces that field of the draft base’s settings, each absent one is carried forward (settings.defaults and defaults together: 422 invalid_settings). Refused with 409 draft_stale (details latest_version, draft_base_version) when the template has a version newer than the draft base that this draft did not produce, and 409 build_in_progress while a build from another source is unfinished. Immutable paths (contracts §34.1): the new version declares the template’s open version’s immutable paths (else the draft base’s) with the content the draft holds there; 422 immutable_paths_unsupported_base when the draft’s base has no guest agent with immutable_paths.v1 (details.base). 202 SaveAsTemplateResponse. Supports Idempotency-Key.
          */
         post: operations["postV1TemplatesSlugDraftPublish"];
         delete?: never;
@@ -3233,7 +3267,7 @@ export interface paths {
         put?: never;
         /**
          * Publish the draft as the template’s next version (save-as-template from the draft)
-         * @description Builds one new org layer holding every change since the draft base, from `state_id` or the draft’s current state (a fresh capture when running). `settings` (TemplateSettingsInput, contracts §24.3): each given field replaces that field of the draft base’s settings, each absent one is carried forward (settings.defaults and defaults together: 422 invalid_settings). Refused with 409 draft_stale (details latest_version, draft_base_version) when the template has a version newer than the draft base that this draft did not produce, and 409 build_in_progress while a build from another source is unfinished. 202 SaveAsTemplateResponse. Supports Idempotency-Key.
+         * @description Builds one new org layer holding every change since the draft base, from `state_id` or the draft’s current state (a fresh capture when running). `settings` (TemplateSettingsInput, contracts §24.3): each given field replaces that field of the draft base’s settings, each absent one is carried forward (settings.defaults and defaults together: 422 invalid_settings). Refused with 409 draft_stale (details latest_version, draft_base_version) when the template has a version newer than the draft base that this draft did not produce, and 409 build_in_progress while a build from another source is unfinished. Immutable paths (contracts §34.1): the new version declares the template’s open version’s immutable paths (else the draft base’s) with the content the draft holds there; 422 immutable_paths_unsupported_base when the draft’s base has no guest agent with immutable_paths.v1 (details.base). 202 SaveAsTemplateResponse. Supports Idempotency-Key.
          */
         post: operations["postApiV1OrganizationsOrganizationIdTemplatesSlugDraftPublish"];
         delete?: never;
@@ -5548,6 +5582,55 @@ export interface components {
                 [key: string]: unknown;
             };
             result?: {
+                /** @description suspend and fork: whether the capture is in durable storage. false while `durability.state` is pending (the suspend completed on its host) or lost; true once it committed. Absent on other kinds. */
+                durable?: boolean;
+                /** @description suspend: `local_commit` when the suspend completed on its host and the durable copy followed in the background. */
+                suspend_path?: string;
+                durability?: {
+                    /**
+                     * @description pending: sealed on its host, the durable copy is being written; durable: the copy committed; lost: the copy could not be made and the previous recovery point stays current.
+                     * @enum {string}
+                     */
+                    state: "pending" | "durable" | "lost";
+                    /** @description The checkpoint being made durable. */
+                    checkpoint_id?: string;
+                    /** @description Its generation on the host. */
+                    generation_id?: string;
+                    /** @description RFC 3339: when the suspend (or fork) completed on its host. */
+                    local_commit_at?: string;
+                    /** @description RFC 3339: when the durable copy is expected to have committed (local_commit_at + the deadline). */
+                    durable_by?: string;
+                    /** @description RFC 3339 (state durable): when the durable copy committed. */
+                    durable_at?: string;
+                    /** @description State durable: local_commit_at to durable_at, in milliseconds. */
+                    local_commit_to_durable_ms?: number;
+                    /** @description RFC 3339: set once durable_by passed while the copy was still pending; it keeps retrying. */
+                    overdue_at?: string;
+                    /** @description State lost: why, e.g. host_lost. */
+                    reason?: string;
+                    /** @description State lost: the error code of the failed copy. */
+                    code?: string;
+                    recovery_point_checkpoint_id?: string | null;
+                } & {
+                    [key: string]: unknown;
+                };
+                lost_suspend?: {
+                    /** @description The suspend checkpoint whose durable copy was lost. */
+                    checkpoint_id: string;
+                    /** @description Its generation on the host. */
+                    generation_id?: string;
+                    /** @description Why it was lost, e.g. host_lost. */
+                    reason?: string;
+                    /** @description RFC 3339: when that suspend captured the workspace. */
+                    suspended_at?: string;
+                    /** @description The earlier durable checkpoint this resume restored. */
+                    restored_checkpoint_id?: string;
+                    /** @description RFC 3339: when the restored checkpoint committed; the workspace state is as of then. */
+                    state_as_of?: string;
+                } & {
+                    [key: string]: unknown;
+                };
+            } & {
                 [key: string]: unknown;
             };
         };
@@ -5566,11 +5649,6 @@ export interface components {
          * @enum {string}
          */
         WorkspacePurpose: "standard" | "template_draft" | "template_test";
-        /**
-         * @description Reserved (T2). Always `pinned` in T1: a workspace stays on its template version; `auto` is refused with 422 update_policy_not_available.
-         * @enum {string}
-         */
-        UpdatePolicy: "pinned" | "auto";
         /** @description Where the workspace’s disk came from; null for a workspace opened from its template. */
         WorkspaceOrigin: {
             /** @enum {string} */
@@ -5621,7 +5699,6 @@ export interface components {
             } | null;
             egress: components["schemas"]["TemplateEgressDefault"] | null;
             agent_tools: null;
-            update_policy: null;
         };
         /** @description The template’s workspace network ceiling (contracts §24.3): the cell intersects it with the effective egress policy. */
         TemplateEgressDefault: {
@@ -5730,7 +5807,7 @@ export interface components {
                     ready_timeout_seconds?: number;
                 };
             };
-            /** @description Manifest defaults (§19.7, §24.3). agent_tools and update_policy stay reserved (null). */
+            /** @description Manifest defaults (§19.7, §24.3). agent_tools stays reserved (null). */
             defaults?: {
                 /** @enum {unknown} */
                 lifetime?: "persistent" | "session";
@@ -5748,7 +5825,6 @@ export interface components {
                     allow_hosts?: string[];
                 };
                 agent_tools?: null;
-                update_policy?: null;
             };
         };
         /** @description Recipe v1: a Dockerfile in the host builder’s dialect (no `schema` field). */
@@ -5781,7 +5857,7 @@ export interface components {
         };
         /**
          * Template recipe v2 (shardflux.template-recipe.v2)
-         * @description A template without a Dockerfile (docs/INTEGRATION_CONTRACTS.md §24.1): `build` changes the filesystem through the host builder's structured steps, `settings` goes into the manifest and applies when a workspace opens. This document is the body field `recipe` of POST …/template-builds, the `recipe` of GET …/templates/{slug}/versions/{v}/recipe (export), and the content of template.yaml (the same document in YAML; only clients parse YAML). In template.yaml a file entry may name a local path (`from`) instead of an upload; clients upload it and send `upload` (the API refuses `from`). Rules JSON Schema cannot express, enforced by the API with 422 validation_failed and details.reason (§24.1, §24.6): input names are unique across settings.env and settings.inputs; a secret input has no default; a required input has no default; start command names are unique; `to` is not platform-owned; build.network.allow_hosts only with build "allowlist" and extra_hosts only with "auto"; the sum of every run/command script is at most 262144 bytes; start timeout_seconds sum to at most 3600; languages are in the API's language table for the base; services need a base whose guest agent has services.v1.
+         * @description A template without a Dockerfile (docs/INTEGRATION_CONTRACTS.md §24.1): `build` changes the filesystem through the host builder's structured steps, `settings` goes into the manifest and applies when a workspace opens. This document is the body field `recipe` of POST …/template-builds, the `recipe` of GET …/templates/{slug}/versions/{v}/recipe (export), and the content of template.yaml (the same document in YAML; only clients parse YAML). In template.yaml a file entry may name a local path (`from`) instead of an upload; clients upload it and send `upload` (the API refuses `from`). Rules JSON Schema cannot express, enforced by the API with 422 validation_failed and details.reason (§24.1, §24.6): input names are unique across settings.env and settings.inputs; a secret input has no default; a required input has no default; start command names are unique; `to` is not platform-owned; build.network.allow_hosts only with build "allowlist" and extra_hosts only with "auto"; the sum of every run/command script is at most 262144 bytes; start timeout_seconds sum to at most 3600; languages are in the API's language table for the base; services need a base whose guest agent has services.v1; immutable paths are not platform-owned, do not contain a platform-owned path and do not nest (§34.1).
          */
         TemplateRecipeV2: {
             /** @enum {unknown} */
@@ -5895,7 +5971,7 @@ export interface components {
                         ready_timeout_seconds?: number;
                     };
                 };
-                /** @description Manifest defaults (§19.7, §24.3). agent_tools and update_policy stay reserved (null). */
+                /** @description Manifest defaults (§19.7, §24.3). agent_tools stays reserved (null). */
                 defaults?: {
                     /** @enum {unknown} */
                     lifetime?: "persistent" | "session";
@@ -5913,9 +5989,10 @@ export interface components {
                         allow_hosts?: string[];
                     };
                     agent_tools?: null;
-                    update_policy?: null;
                 };
             };
+            /** @description Directories every workspace of the template mounts read-only from the template's newest published version (§34.1): workspaces pick up a newer version when they cold-boot or resume. Not `/`, not equal to or under /proc, /sys, /dev, /run, /tmp, /lost+found or a platform-owned path, not containing a platform-owned path, none equal to or containing another (422 invalid_path). Omitted: the list of the template's newest published version. A version keeps every path of that list (422 immutable_path_removed) and a non-empty list needs a base whose guest agent has immutable_paths.v1 (422 immutable_paths_unsupported_base). Each path is a directory in the built filesystem. */
+            immutable?: string[];
             /** @description Builder VM bounds, exactly as recipe v1 `resources` (not part of recipe_sha256). */
             resources?: {
                 cpu_millis?: number;
@@ -6308,6 +6385,8 @@ export interface components {
                         kind: "file" | "tar";
                     }[];
                 };
+                /** @description The effective immutable paths (contracts §34.1: the recipe’s, else inherited), in byte order; empty for none. */
+                immutable: string[];
             };
             result: {
                 artifact_sha256: string | null;
@@ -6331,8 +6410,13 @@ export interface components {
                 } | null;
             };
             failure: {
+                /** @description build_error, timeout, resource_limit, scan_failed, compatibility_failed, base_unavailable, network_denied, internal_error, publish_failed, source_unavailable, immutable_path_missing (an immutable path is not a directory in the built filesystem: details.path), immutable_image_too_large (the immutable image exceeds 16 GiB). */
                 code: string;
                 message: string;
+                /** @description Code-specific details (immutable_path_missing: {path}). */
+                details?: {
+                    [key: string]: unknown;
+                };
             } | null;
             /** @description Build log: the tail inline, the full log through a short-lived signed URL (log-url). */
             log: {
@@ -6370,6 +6454,8 @@ export interface components {
             produced_layer_id: string | null;
             squashed: boolean | null;
             org_bytes: number | null;
+            /** @description The immutable paths the produced version declares (contracts §34.1), in byte order: the recipe’s `immutable`, else the list of the template’s open version (a save from a workspace: the target template’s open version’s list, else the workspace’s version’s). Empty for none. */
+            immutable_paths: string[];
         };
         /** @description A disk-only capture of the draft (contracts §19.9). */
         DraftState: {
@@ -6458,7 +6544,6 @@ export interface components {
                 } | null;
                 /** @description Reserved (T2). */
                 agent_tools?: null;
-                update_policy?: ("pinned" | "auto") | null;
             };
             settings?: components["schemas"]["TemplateSettingsInput"];
             /** @default true */
@@ -6489,7 +6574,6 @@ export interface components {
                 } | null;
                 /** @description Reserved (T2). */
                 agent_tools?: null;
-                update_policy?: ("pinned" | "auto") | null;
             };
             /**
              * Format: uuid
@@ -6668,12 +6752,16 @@ export interface components {
              */
             project_id: string;
             workspace_key: string;
+            /** @description Searchable workspace metadata; not secrets. At most 50 labels. */
+            labels: {
+                [key: string]: string;
+            };
             /**
              * Format: uuid
              * @description UUIDv7, lowercase canonical form.
              */
             template_version_id: string;
-            /** @description Immutable template version this workspace was created from. */
+            /** @description The template version this workspace was created from (immutable), and the version its immutable paths show. */
             template: {
                 /**
                  * Format: uuid
@@ -6687,6 +6775,7 @@ export interface components {
                 template_id: string;
                 slug: string;
                 version: number;
+                immutable_version: number | null;
             };
             /** @enum {string} */
             desired_state: "running" | "suspended" | "deleted";
@@ -6695,11 +6784,29 @@ export interface components {
             cell_id: string | null;
             cell_endpoint: string | null;
             ownership_epoch: number;
-            /** @description User caps for this workspace (null = no user restriction). */
+            /** @description User caps for this workspace (null = no user restriction) and its memory allocation mode. */
             caps: {
                 cpu_millis: number | null;
                 memory_mib: number | null;
                 disk_gib: number | null;
+                /**
+                 * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic holds memory_mib_held while idle and is grown up to memory_mib (the promise) when a command needs it. The mode the next VM start uses: an elastic request whose promise does not exceed the held floor by at least 512 MiB is fixed at the promise.
+                 * @enum {string}
+                 */
+                allocation_mode: "fixed" | "elastic";
+                /** @description Elastic only: the memory held while idle (MiB). */
+                memory_mib_held?: number;
+            };
+            /** @description Memory of the workspace (contracts §32.6). */
+            memory: {
+                /**
+                 * @description The layout of the running VM, else the one the next start uses.
+                 * @enum {string}
+                 */
+                allocation_mode: "fixed" | "elastic";
+                promised_mib: number | null;
+                held_mib: number | null;
+                plugged_mib: number | null;
             };
             ceilings: {
                 cpu_millis: number;
@@ -6752,7 +6859,6 @@ export interface components {
             origin: components["schemas"]["WorkspaceOrigin"] | null;
             ended_reason: ("closed" | "idle_timeout" | "draft_discarded") | null;
             dev_template_id: string | null;
-            update_policy: components["schemas"]["UpdatePolicy"];
             startup: components["schemas"]["WorkspaceStartup"] | null;
             mode: components["schemas"]["WorkspaceMode"];
             /** @description file_first: the latest revision of the file tree (0 = the empty tree the workspace starts with; each mutating file call or execution publishes the next one; cell file responses carry it as X-Tree-Revision). Always 0 for processful workspaces. */
@@ -7488,6 +7594,10 @@ export interface operations {
                         status: "verified" | "password_reset_required";
                         /** @description Present with password_reset_required: single-use token for POST /api/auth/password/reset/confirm. */
                         reset_token?: string;
+                        /** @description True when this response opened a session (the registering browser); false: sign in. */
+                        signed_in: boolean;
+                        /** @description Send as X-CSRF-Token on subsequent mutations. */
+                        csrf_token?: string;
                     };
                 };
             };
@@ -8487,7 +8597,7 @@ export interface operations {
                 content: {
                     "application/json": {
                         status: "verified" | "password_reset_required";
-                        /** @description Present with password_reset_required: single-use token for POST /api/auth/password/reset/confirm. */
+                        /** @description Present with password_reset_required: single-use token for POST /v1/auth/password/reset/confirm. */
                         reset_token?: string;
                     };
                 };
@@ -11495,13 +11605,25 @@ export interface operations {
                 "application/json": {
                     /** @description Stable workspace key, unique per organization (e.g. `${customerId}/${projectId}`). */
                     key: string;
+                    /** @description Searchable workspace metadata; not secrets. At most 50 labels. */
+                    labels?: {
+                        [key: string]: string;
+                    };
                     /** @description Template slug; new workspaces use its latest published version. */
                     template: string;
-                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. */
+                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction (allocation_mode: fixed). Given caps replace the stored ones. */
                     caps?: {
                         cpu_millis?: number;
                         memory_mib?: number;
                         disk_gib?: number;
+                        /**
+                         * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Takes effect at the next VM start.
+                         * @default fixed
+                         * @enum {string}
+                         */
+                        allocation_mode?: "fixed" | "elastic";
+                        /** @description Elastic only: memory held while idle (MiB, default 1024, at most memory_mib). */
+                        memory_mib_held?: number;
                     };
                     /**
                      * Format: uuid
@@ -11586,6 +11708,8 @@ export interface operations {
                 state?: "creating" | "starting" | "running" | "suspending" | "suspended" | "resuming" | "forking" | "stopping" | "failed" | "deleting" | "deleted";
                 desired_state?: "running" | "suspended" | "deleted";
                 key_prefix?: string;
+                /** @description JSON object of exact label matches; all pairs must match. */
+                labels?: string;
                 include_deleted?: boolean;
                 /** @description persistent (default), session or any. Key lookups pass any. */
                 lifetime?: "persistent" | "session" | "any";
@@ -11641,6 +11765,8 @@ export interface operations {
                 state?: "creating" | "starting" | "running" | "suspending" | "suspended" | "resuming" | "forking" | "stopping" | "failed" | "deleting" | "deleted";
                 desired_state?: "running" | "suspended" | "deleted";
                 key_prefix?: string;
+                /** @description JSON object of exact label matches; all pairs must match. */
+                labels?: string;
                 include_deleted?: boolean;
                 /** @description persistent (default), session or any. Key lookups pass any. */
                 lifetime?: "persistent" | "session" | "any";
@@ -11814,6 +11940,56 @@ export interface operations {
             };
         };
     };
+    putV1WorkspacesWorkspaceIdLabels: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Searchable workspace metadata; not secrets. At most 50 labels. */
+                    labels: {
+                        [key: string]: string;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Workspace"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     putV1WorkspacesWorkspaceIdIdlePolicy: {
         parameters: {
             query?: never;
@@ -12121,7 +12297,9 @@ export interface operations {
     postV1WorkspacesWorkspaceIdFork: {
         parameters: {
             query?: never;
-            header?: never;
+            header?: {
+                prefer?: string;
+            };
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
                 workspace_id: string;
@@ -12133,17 +12311,47 @@ export interface operations {
                 "application/json": {
                     /** @description Stable workspace key, unique per organization (e.g. `${customerId}/${projectId}`). */
                     key: string;
-                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. */
+                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction (allocation_mode: fixed). Given caps replace the stored ones. */
                     caps?: {
                         cpu_millis?: number;
                         memory_mib?: number;
                         disk_gib?: number;
+                        /**
+                         * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Takes effect at the next VM start.
+                         * @default fixed
+                         * @enum {string}
+                         */
+                        allocation_mode?: "fixed" | "elastic";
+                        /** @description Elastic only: memory held while idle (MiB, default 1024, at most memory_mib). */
+                        memory_mib_held?: number;
                     };
                     lifetime?: components["schemas"]["WorkspaceLifetime"];
+                    /** @description Attribution label; one agent session per (workspace, principal, label). */
+                    agent_label?: string;
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
                 };
             };
         };
         responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        operation: components["schemas"]["Operation"];
+                        workspace: components["schemas"]["Workspace"];
+                        /**
+                         * Format: uuid
+                         * @description UUIDv7, lowercase canonical form.
+                         */
+                        source_workspace_id: string;
+                        cell_endpoint: string | null;
+                        tool_token: components["schemas"]["ToolToken"] | null;
+                    };
+                };
+            };
             /** @description Default Response */
             202: {
                 headers: {
@@ -12623,13 +12831,25 @@ export interface operations {
                 "application/json": {
                     /** @description Stable workspace key, unique per organization (e.g. `${customerId}/${projectId}`). */
                     key: string;
+                    /** @description Searchable workspace metadata; not secrets. At most 50 labels. */
+                    labels?: {
+                        [key: string]: string;
+                    };
                     /** @description Template slug; new workspaces use its latest published version. */
                     template: string;
-                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. */
+                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction (allocation_mode: fixed). Given caps replace the stored ones. */
                     caps?: {
                         cpu_millis?: number;
                         memory_mib?: number;
                         disk_gib?: number;
+                        /**
+                         * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Takes effect at the next VM start.
+                         * @default fixed
+                         * @enum {string}
+                         */
+                        allocation_mode?: "fixed" | "elastic";
+                        /** @description Elastic only: memory held while idle (MiB, default 1024, at most memory_mib). */
+                        memory_mib_held?: number;
                     };
                     /**
                      * Format: uuid
@@ -12714,6 +12934,8 @@ export interface operations {
                 state?: "creating" | "starting" | "running" | "suspending" | "suspended" | "resuming" | "forking" | "stopping" | "failed" | "deleting" | "deleted";
                 desired_state?: "running" | "suspended" | "deleted";
                 key_prefix?: string;
+                /** @description JSON object of exact label matches; all pairs must match. */
+                labels?: string;
                 include_deleted?: boolean;
                 /** @description persistent (default), session or any. Key lookups pass any. */
                 lifetime?: "persistent" | "session" | "any";
@@ -12769,6 +12991,8 @@ export interface operations {
                 state?: "creating" | "starting" | "running" | "suspending" | "suspended" | "resuming" | "forking" | "stopping" | "failed" | "deleting" | "deleted";
                 desired_state?: "running" | "suspended" | "deleted";
                 key_prefix?: string;
+                /** @description JSON object of exact label matches; all pairs must match. */
+                labels?: string;
                 include_deleted?: boolean;
                 /** @description persistent (default), session or any. Key lookups pass any. */
                 lifetime?: "persistent" | "session" | "any";
@@ -12942,6 +13166,56 @@ export interface operations {
             };
         };
     };
+    putApiV1WorkspacesWorkspaceIdLabels: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Searchable workspace metadata; not secrets. At most 50 labels. */
+                    labels: {
+                        [key: string]: string;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Workspace"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     putApiV1WorkspacesWorkspaceIdIdlePolicy: {
         parameters: {
             query?: never;
@@ -13249,7 +13523,9 @@ export interface operations {
     postApiV1WorkspacesWorkspaceIdFork: {
         parameters: {
             query?: never;
-            header?: never;
+            header?: {
+                prefer?: string;
+            };
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
                 workspace_id: string;
@@ -13261,17 +13537,47 @@ export interface operations {
                 "application/json": {
                     /** @description Stable workspace key, unique per organization (e.g. `${customerId}/${projectId}`). */
                     key: string;
-                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. */
+                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction (allocation_mode: fixed). Given caps replace the stored ones. */
                     caps?: {
                         cpu_millis?: number;
                         memory_mib?: number;
                         disk_gib?: number;
+                        /**
+                         * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Takes effect at the next VM start.
+                         * @default fixed
+                         * @enum {string}
+                         */
+                        allocation_mode?: "fixed" | "elastic";
+                        /** @description Elastic only: memory held while idle (MiB, default 1024, at most memory_mib). */
+                        memory_mib_held?: number;
                     };
                     lifetime?: components["schemas"]["WorkspaceLifetime"];
+                    /** @description Attribution label; one agent session per (workspace, principal, label). */
+                    agent_label?: string;
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
                 };
             };
         };
         responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        operation: components["schemas"]["Operation"];
+                        workspace: components["schemas"]["Workspace"];
+                        /**
+                         * Format: uuid
+                         * @description UUIDv7, lowercase canonical form.
+                         */
+                        source_workspace_id: string;
+                        cell_endpoint: string | null;
+                        tool_token: components["schemas"]["ToolToken"] | null;
+                    };
+                };
+            };
             /** @description Default Response */
             202: {
                 headers: {
@@ -14778,6 +15084,12 @@ export interface operations {
                                 } | null;
                                 defaults: components["schemas"]["TemplateDefaults"];
                                 settings: components["schemas"]["TemplateSettings"];
+                                immutable: {
+                                    /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                    paths: string[];
+                                    /** @description Size of the version’s immutable image (counts toward template storage). */
+                                    bytes: number;
+                                } | null;
                                 files: components["schemas"]["TemplateFilesSummary"];
                                 rootfs_bytes: number | null;
                                 /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -14821,7 +15133,6 @@ export interface operations {
                                  */
                                 created_at: string;
                             } | null;
-                            update_policy: components["schemas"]["UpdatePolicy"];
                             category: ("os" | "stack") | null;
                         }[];
                         next_cursor: string | null;
@@ -14990,6 +15301,12 @@ export interface operations {
                             } | null;
                             defaults: components["schemas"]["TemplateDefaults"];
                             settings: components["schemas"]["TemplateSettings"];
+                            immutable: {
+                                /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                paths: string[];
+                                /** @description Size of the version’s immutable image (counts toward template storage). */
+                                bytes: number;
+                            } | null;
                             files: components["schemas"]["TemplateFilesSummary"];
                             rootfs_bytes: number | null;
                             /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -15033,7 +15350,6 @@ export interface operations {
                              */
                             created_at: string;
                         } | null;
-                        update_policy: components["schemas"]["UpdatePolicy"];
                         category: ("os" | "stack") | null;
                         plan: {
                             plan_key: string;
@@ -15149,6 +15465,12 @@ export interface operations {
                             } | null;
                             defaults: components["schemas"]["TemplateDefaults"];
                             settings: components["schemas"]["TemplateSettings"];
+                            immutable: {
+                                /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                paths: string[];
+                                /** @description Size of the version’s immutable image (counts toward template storage). */
+                                bytes: number;
+                            } | null;
                             files: components["schemas"]["TemplateFilesSummary"];
                             rootfs_bytes: number | null;
                             /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -15327,6 +15649,12 @@ export interface operations {
                                 } | null;
                                 defaults: components["schemas"]["TemplateDefaults"];
                                 settings: components["schemas"]["TemplateSettings"];
+                                immutable: {
+                                    /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                    paths: string[];
+                                    /** @description Size of the version’s immutable image (counts toward template storage). */
+                                    bytes: number;
+                                } | null;
                                 files: components["schemas"]["TemplateFilesSummary"];
                                 rootfs_bytes: number | null;
                                 /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -15370,7 +15698,6 @@ export interface operations {
                                  */
                                 created_at: string;
                             } | null;
-                            update_policy: components["schemas"]["UpdatePolicy"];
                             category: ("os" | "stack") | null;
                         }[];
                         next_cursor: string | null;
@@ -15537,6 +15864,12 @@ export interface operations {
                             } | null;
                             defaults: components["schemas"]["TemplateDefaults"];
                             settings: components["schemas"]["TemplateSettings"];
+                            immutable: {
+                                /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                paths: string[];
+                                /** @description Size of the version’s immutable image (counts toward template storage). */
+                                bytes: number;
+                            } | null;
                             files: components["schemas"]["TemplateFilesSummary"];
                             rootfs_bytes: number | null;
                             /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -15580,7 +15913,6 @@ export interface operations {
                              */
                             created_at: string;
                         } | null;
-                        update_policy: components["schemas"]["UpdatePolicy"];
                         category: ("os" | "stack") | null;
                         plan: {
                             plan_key: string;
@@ -15696,6 +16028,12 @@ export interface operations {
                             } | null;
                             defaults: components["schemas"]["TemplateDefaults"];
                             settings: components["schemas"]["TemplateSettings"];
+                            immutable: {
+                                /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                paths: string[];
+                                /** @description Size of the version’s immutable image (counts toward template storage). */
+                                bytes: number;
+                            } | null;
                             files: components["schemas"]["TemplateFilesSummary"];
                             rootfs_bytes: number | null;
                             /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -15960,6 +16298,8 @@ export interface operations {
                                         kind: "file" | "tar";
                                     }[];
                                 };
+                                /** @description The effective immutable paths (contracts §34.1: the recipe’s, else inherited), in byte order; empty for none. */
+                                immutable: string[];
                             };
                             result: {
                                 artifact_sha256: string | null;
@@ -15983,8 +16323,13 @@ export interface operations {
                                 } | null;
                             };
                             failure: {
+                                /** @description build_error, timeout, resource_limit, scan_failed, compatibility_failed, base_unavailable, network_denied, internal_error, publish_failed, source_unavailable, immutable_path_missing (an immutable path is not a directory in the built filesystem: details.path), immutable_image_too_large (the immutable image exceeds 16 GiB). */
                                 code: string;
                                 message: string;
+                                /** @description Code-specific details (immutable_path_missing: {path}). */
+                                details?: {
+                                    [key: string]: unknown;
+                                };
                             } | null;
                             /** @description Build log: the tail inline, the full log through a short-lived signed URL (log-url). */
                             log: {
@@ -16022,6 +16367,8 @@ export interface operations {
                             produced_layer_id: string | null;
                             squashed: boolean | null;
                             org_bytes: number | null;
+                            /** @description The immutable paths the produced version declares (contracts §34.1), in byte order: the recipe’s `immutable`, else the list of the template’s open version (a save from a workspace: the target template’s open version’s list, else the workspace’s version’s). Empty for none. */
+                            immutable_paths: string[];
                         }[];
                         next_cursor: string | null;
                     };
@@ -16286,6 +16633,8 @@ export interface operations {
                                     kind: "file" | "tar";
                                 }[];
                             };
+                            /** @description The effective immutable paths (contracts §34.1: the recipe’s, else inherited), in byte order; empty for none. */
+                            immutable: string[];
                         };
                         result: {
                             artifact_sha256: string | null;
@@ -16309,8 +16658,13 @@ export interface operations {
                             } | null;
                         };
                         failure: {
+                            /** @description build_error, timeout, resource_limit, scan_failed, compatibility_failed, base_unavailable, network_denied, internal_error, publish_failed, source_unavailable, immutable_path_missing (an immutable path is not a directory in the built filesystem: details.path), immutable_image_too_large (the immutable image exceeds 16 GiB). */
                             code: string;
                             message: string;
+                            /** @description Code-specific details (immutable_path_missing: {path}). */
+                            details?: {
+                                [key: string]: unknown;
+                            };
                         } | null;
                         /** @description Build log: the tail inline, the full log through a short-lived signed URL (log-url). */
                         log: {
@@ -16348,6 +16702,8 @@ export interface operations {
                         produced_layer_id: string | null;
                         squashed: boolean | null;
                         org_bytes: number | null;
+                        /** @description The immutable paths the produced version declares (contracts §34.1), in byte order: the recipe’s `immutable`, else the list of the template’s open version (a save from a workspace: the target template’s open version’s list, else the workspace’s version’s). Empty for none. */
+                        immutable_paths: string[];
                     };
                 };
             };
@@ -16595,6 +16951,8 @@ export interface operations {
                                     kind: "file" | "tar";
                                 }[];
                             };
+                            /** @description The effective immutable paths (contracts §34.1: the recipe’s, else inherited), in byte order; empty for none. */
+                            immutable: string[];
                         };
                         result: {
                             artifact_sha256: string | null;
@@ -16618,8 +16976,13 @@ export interface operations {
                             } | null;
                         };
                         failure: {
+                            /** @description build_error, timeout, resource_limit, scan_failed, compatibility_failed, base_unavailable, network_denied, internal_error, publish_failed, source_unavailable, immutable_path_missing (an immutable path is not a directory in the built filesystem: details.path), immutable_image_too_large (the immutable image exceeds 16 GiB). */
                             code: string;
                             message: string;
+                            /** @description Code-specific details (immutable_path_missing: {path}). */
+                            details?: {
+                                [key: string]: unknown;
+                            };
                         } | null;
                         /** @description Build log: the tail inline, the full log through a short-lived signed URL (log-url). */
                         log: {
@@ -16657,6 +17020,8 @@ export interface operations {
                         produced_layer_id: string | null;
                         squashed: boolean | null;
                         org_bytes: number | null;
+                        /** @description The immutable paths the produced version declares (contracts §34.1), in byte order: the recipe’s `immutable`, else the list of the template’s open version (a save from a workspace: the target template’s open version’s list, else the workspace’s version’s). Empty for none. */
+                        immutable_paths: string[];
                     };
                 };
             };
@@ -16901,6 +17266,8 @@ export interface operations {
                                     kind: "file" | "tar";
                                 }[];
                             };
+                            /** @description The effective immutable paths (contracts §34.1: the recipe’s, else inherited), in byte order; empty for none. */
+                            immutable: string[];
                         };
                         result: {
                             artifact_sha256: string | null;
@@ -16924,8 +17291,13 @@ export interface operations {
                             } | null;
                         };
                         failure: {
+                            /** @description build_error, timeout, resource_limit, scan_failed, compatibility_failed, base_unavailable, network_denied, internal_error, publish_failed, source_unavailable, immutable_path_missing (an immutable path is not a directory in the built filesystem: details.path), immutable_image_too_large (the immutable image exceeds 16 GiB). */
                             code: string;
                             message: string;
+                            /** @description Code-specific details (immutable_path_missing: {path}). */
+                            details?: {
+                                [key: string]: unknown;
+                            };
                         } | null;
                         /** @description Build log: the tail inline, the full log through a short-lived signed URL (log-url). */
                         log: {
@@ -16963,6 +17335,8 @@ export interface operations {
                         produced_layer_id: string | null;
                         squashed: boolean | null;
                         org_bytes: number | null;
+                        /** @description The immutable paths the produced version declares (contracts §34.1), in byte order: the recipe’s `immutable`, else the list of the template’s open version (a save from a workspace: the target template’s open version’s list, else the workspace’s version’s). Empty for none. */
+                        immutable_paths: string[];
                     };
                 };
             };
@@ -17173,6 +17547,8 @@ export interface operations {
                                     kind: "file" | "tar";
                                 }[];
                             };
+                            /** @description The effective immutable paths (contracts §34.1: the recipe’s, else inherited), in byte order; empty for none. */
+                            immutable: string[];
                         };
                         result: {
                             artifact_sha256: string | null;
@@ -17196,8 +17572,13 @@ export interface operations {
                             } | null;
                         };
                         failure: {
+                            /** @description build_error, timeout, resource_limit, scan_failed, compatibility_failed, base_unavailable, network_denied, internal_error, publish_failed, source_unavailable, immutable_path_missing (an immutable path is not a directory in the built filesystem: details.path), immutable_image_too_large (the immutable image exceeds 16 GiB). */
                             code: string;
                             message: string;
+                            /** @description Code-specific details (immutable_path_missing: {path}). */
+                            details?: {
+                                [key: string]: unknown;
+                            };
                         } | null;
                         /** @description Build log: the tail inline, the full log through a short-lived signed URL (log-url). */
                         log: {
@@ -17235,6 +17616,8 @@ export interface operations {
                         produced_layer_id: string | null;
                         squashed: boolean | null;
                         org_bytes: number | null;
+                        /** @description The immutable paths the produced version declares (contracts §34.1), in byte order: the recipe’s `immutable`, else the list of the template’s open version (a save from a workspace: the target template’s open version’s list, else the workspace’s version’s). Empty for none. */
+                        immutable_paths: string[];
                     };
                 };
             };
@@ -17866,6 +18249,12 @@ export interface operations {
                             } | null;
                             defaults: components["schemas"]["TemplateDefaults"];
                             settings: components["schemas"]["TemplateSettings"];
+                            immutable: {
+                                /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                paths: string[];
+                                /** @description Size of the version’s immutable image (counts toward template storage). */
+                                bytes: number;
+                            } | null;
                             files: components["schemas"]["TemplateFilesSummary"];
                             rootfs_bytes: number | null;
                             /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -17909,7 +18298,6 @@ export interface operations {
                              */
                             created_at: string;
                         } | null;
-                        update_policy: components["schemas"]["UpdatePolicy"];
                         category: ("os" | "stack") | null;
                         plan: {
                             plan_key: string;
@@ -18025,6 +18413,12 @@ export interface operations {
                             } | null;
                             defaults: components["schemas"]["TemplateDefaults"];
                             settings: components["schemas"]["TemplateSettings"];
+                            immutable: {
+                                /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                paths: string[];
+                                /** @description Size of the version’s immutable image (counts toward template storage). */
+                                bytes: number;
+                            } | null;
                             files: components["schemas"]["TemplateFilesSummary"];
                             rootfs_bytes: number | null;
                             /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -18201,6 +18595,12 @@ export interface operations {
                             } | null;
                             defaults: components["schemas"]["TemplateDefaults"];
                             settings: components["schemas"]["TemplateSettings"];
+                            immutable: {
+                                /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                paths: string[];
+                                /** @description Size of the version’s immutable image (counts toward template storage). */
+                                bytes: number;
+                            } | null;
                             files: components["schemas"]["TemplateFilesSummary"];
                             rootfs_bytes: number | null;
                             /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -18244,7 +18644,6 @@ export interface operations {
                              */
                             created_at: string;
                         } | null;
-                        update_policy: components["schemas"]["UpdatePolicy"];
                         category: ("os" | "stack") | null;
                         plan: {
                             plan_key: string;
@@ -18360,6 +18759,12 @@ export interface operations {
                             } | null;
                             defaults: components["schemas"]["TemplateDefaults"];
                             settings: components["schemas"]["TemplateSettings"];
+                            immutable: {
+                                /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                paths: string[];
+                                /** @description Size of the version’s immutable image (counts toward template storage). */
+                                bytes: number;
+                            } | null;
                             files: components["schemas"]["TemplateFilesSummary"];
                             rootfs_bytes: number | null;
                             /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -18541,6 +18946,12 @@ export interface operations {
                                 } | null;
                                 defaults: components["schemas"]["TemplateDefaults"];
                                 settings: components["schemas"]["TemplateSettings"];
+                                immutable: {
+                                    /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                    paths: string[];
+                                    /** @description Size of the version’s immutable image (counts toward template storage). */
+                                    bytes: number;
+                                } | null;
                                 files: components["schemas"]["TemplateFilesSummary"];
                                 rootfs_bytes: number | null;
                                 /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -18584,7 +18995,6 @@ export interface operations {
                                  */
                                 created_at: string;
                             } | null;
-                            update_policy: components["schemas"]["UpdatePolicy"];
                             category: ("os" | "stack") | null;
                         }[];
                         next_cursor: string | null;
@@ -18753,6 +19163,12 @@ export interface operations {
                             } | null;
                             defaults: components["schemas"]["TemplateDefaults"];
                             settings: components["schemas"]["TemplateSettings"];
+                            immutable: {
+                                /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                paths: string[];
+                                /** @description Size of the version’s immutable image (counts toward template storage). */
+                                bytes: number;
+                            } | null;
                             files: components["schemas"]["TemplateFilesSummary"];
                             rootfs_bytes: number | null;
                             /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -18796,7 +19212,6 @@ export interface operations {
                              */
                             created_at: string;
                         } | null;
-                        update_policy: components["schemas"]["UpdatePolicy"];
                         category: ("os" | "stack") | null;
                         plan: {
                             plan_key: string;
@@ -18912,6 +19327,12 @@ export interface operations {
                             } | null;
                             defaults: components["schemas"]["TemplateDefaults"];
                             settings: components["schemas"]["TemplateSettings"];
+                            immutable: {
+                                /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                paths: string[];
+                                /** @description Size of the version’s immutable image (counts toward template storage). */
+                                bytes: number;
+                            } | null;
                             files: components["schemas"]["TemplateFilesSummary"];
                             rootfs_bytes: number | null;
                             /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -19176,6 +19597,8 @@ export interface operations {
                                         kind: "file" | "tar";
                                     }[];
                                 };
+                                /** @description The effective immutable paths (contracts §34.1: the recipe’s, else inherited), in byte order; empty for none. */
+                                immutable: string[];
                             };
                             result: {
                                 artifact_sha256: string | null;
@@ -19199,8 +19622,13 @@ export interface operations {
                                 } | null;
                             };
                             failure: {
+                                /** @description build_error, timeout, resource_limit, scan_failed, compatibility_failed, base_unavailable, network_denied, internal_error, publish_failed, source_unavailable, immutable_path_missing (an immutable path is not a directory in the built filesystem: details.path), immutable_image_too_large (the immutable image exceeds 16 GiB). */
                                 code: string;
                                 message: string;
+                                /** @description Code-specific details (immutable_path_missing: {path}). */
+                                details?: {
+                                    [key: string]: unknown;
+                                };
                             } | null;
                             /** @description Build log: the tail inline, the full log through a short-lived signed URL (log-url). */
                             log: {
@@ -19238,6 +19666,8 @@ export interface operations {
                             produced_layer_id: string | null;
                             squashed: boolean | null;
                             org_bytes: number | null;
+                            /** @description The immutable paths the produced version declares (contracts §34.1), in byte order: the recipe’s `immutable`, else the list of the template’s open version (a save from a workspace: the target template’s open version’s list, else the workspace’s version’s). Empty for none. */
+                            immutable_paths: string[];
                         }[];
                         next_cursor: string | null;
                     };
@@ -19502,6 +19932,8 @@ export interface operations {
                                     kind: "file" | "tar";
                                 }[];
                             };
+                            /** @description The effective immutable paths (contracts §34.1: the recipe’s, else inherited), in byte order; empty for none. */
+                            immutable: string[];
                         };
                         result: {
                             artifact_sha256: string | null;
@@ -19525,8 +19957,13 @@ export interface operations {
                             } | null;
                         };
                         failure: {
+                            /** @description build_error, timeout, resource_limit, scan_failed, compatibility_failed, base_unavailable, network_denied, internal_error, publish_failed, source_unavailable, immutable_path_missing (an immutable path is not a directory in the built filesystem: details.path), immutable_image_too_large (the immutable image exceeds 16 GiB). */
                             code: string;
                             message: string;
+                            /** @description Code-specific details (immutable_path_missing: {path}). */
+                            details?: {
+                                [key: string]: unknown;
+                            };
                         } | null;
                         /** @description Build log: the tail inline, the full log through a short-lived signed URL (log-url). */
                         log: {
@@ -19564,6 +20001,8 @@ export interface operations {
                         produced_layer_id: string | null;
                         squashed: boolean | null;
                         org_bytes: number | null;
+                        /** @description The immutable paths the produced version declares (contracts §34.1), in byte order: the recipe’s `immutable`, else the list of the template’s open version (a save from a workspace: the target template’s open version’s list, else the workspace’s version’s). Empty for none. */
+                        immutable_paths: string[];
                     };
                 };
             };
@@ -19811,6 +20250,8 @@ export interface operations {
                                     kind: "file" | "tar";
                                 }[];
                             };
+                            /** @description The effective immutable paths (contracts §34.1: the recipe’s, else inherited), in byte order; empty for none. */
+                            immutable: string[];
                         };
                         result: {
                             artifact_sha256: string | null;
@@ -19834,8 +20275,13 @@ export interface operations {
                             } | null;
                         };
                         failure: {
+                            /** @description build_error, timeout, resource_limit, scan_failed, compatibility_failed, base_unavailable, network_denied, internal_error, publish_failed, source_unavailable, immutable_path_missing (an immutable path is not a directory in the built filesystem: details.path), immutable_image_too_large (the immutable image exceeds 16 GiB). */
                             code: string;
                             message: string;
+                            /** @description Code-specific details (immutable_path_missing: {path}). */
+                            details?: {
+                                [key: string]: unknown;
+                            };
                         } | null;
                         /** @description Build log: the tail inline, the full log through a short-lived signed URL (log-url). */
                         log: {
@@ -19873,6 +20319,8 @@ export interface operations {
                         produced_layer_id: string | null;
                         squashed: boolean | null;
                         org_bytes: number | null;
+                        /** @description The immutable paths the produced version declares (contracts §34.1), in byte order: the recipe’s `immutable`, else the list of the template’s open version (a save from a workspace: the target template’s open version’s list, else the workspace’s version’s). Empty for none. */
+                        immutable_paths: string[];
                     };
                 };
             };
@@ -20117,6 +20565,8 @@ export interface operations {
                                     kind: "file" | "tar";
                                 }[];
                             };
+                            /** @description The effective immutable paths (contracts §34.1: the recipe’s, else inherited), in byte order; empty for none. */
+                            immutable: string[];
                         };
                         result: {
                             artifact_sha256: string | null;
@@ -20140,8 +20590,13 @@ export interface operations {
                             } | null;
                         };
                         failure: {
+                            /** @description build_error, timeout, resource_limit, scan_failed, compatibility_failed, base_unavailable, network_denied, internal_error, publish_failed, source_unavailable, immutable_path_missing (an immutable path is not a directory in the built filesystem: details.path), immutable_image_too_large (the immutable image exceeds 16 GiB). */
                             code: string;
                             message: string;
+                            /** @description Code-specific details (immutable_path_missing: {path}). */
+                            details?: {
+                                [key: string]: unknown;
+                            };
                         } | null;
                         /** @description Build log: the tail inline, the full log through a short-lived signed URL (log-url). */
                         log: {
@@ -20179,6 +20634,8 @@ export interface operations {
                         produced_layer_id: string | null;
                         squashed: boolean | null;
                         org_bytes: number | null;
+                        /** @description The immutable paths the produced version declares (contracts §34.1), in byte order: the recipe’s `immutable`, else the list of the template’s open version (a save from a workspace: the target template’s open version’s list, else the workspace’s version’s). Empty for none. */
+                        immutable_paths: string[];
                     };
                 };
             };
@@ -20389,6 +20846,8 @@ export interface operations {
                                     kind: "file" | "tar";
                                 }[];
                             };
+                            /** @description The effective immutable paths (contracts §34.1: the recipe’s, else inherited), in byte order; empty for none. */
+                            immutable: string[];
                         };
                         result: {
                             artifact_sha256: string | null;
@@ -20412,8 +20871,13 @@ export interface operations {
                             } | null;
                         };
                         failure: {
+                            /** @description build_error, timeout, resource_limit, scan_failed, compatibility_failed, base_unavailable, network_denied, internal_error, publish_failed, source_unavailable, immutable_path_missing (an immutable path is not a directory in the built filesystem: details.path), immutable_image_too_large (the immutable image exceeds 16 GiB). */
                             code: string;
                             message: string;
+                            /** @description Code-specific details (immutable_path_missing: {path}). */
+                            details?: {
+                                [key: string]: unknown;
+                            };
                         } | null;
                         /** @description Build log: the tail inline, the full log through a short-lived signed URL (log-url). */
                         log: {
@@ -20451,6 +20915,8 @@ export interface operations {
                         produced_layer_id: string | null;
                         squashed: boolean | null;
                         org_bytes: number | null;
+                        /** @description The immutable paths the produced version declares (contracts §34.1), in byte order: the recipe’s `immutable`, else the list of the template’s open version (a save from a workspace: the target template’s open version’s list, else the workspace’s version’s). Empty for none. */
+                        immutable_paths: string[];
                     };
                 };
             };
@@ -20902,6 +21368,12 @@ export interface operations {
                             } | null;
                             defaults: components["schemas"]["TemplateDefaults"];
                             settings: components["schemas"]["TemplateSettings"];
+                            immutable: {
+                                /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                paths: string[];
+                                /** @description Size of the version’s immutable image (counts toward template storage). */
+                                bytes: number;
+                            } | null;
                             files: components["schemas"]["TemplateFilesSummary"];
                             rootfs_bytes: number | null;
                             /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -20945,7 +21417,6 @@ export interface operations {
                              */
                             created_at: string;
                         } | null;
-                        update_policy: components["schemas"]["UpdatePolicy"];
                         category: ("os" | "stack") | null;
                         plan: {
                             plan_key: string;
@@ -21061,6 +21532,12 @@ export interface operations {
                             } | null;
                             defaults: components["schemas"]["TemplateDefaults"];
                             settings: components["schemas"]["TemplateSettings"];
+                            immutable: {
+                                /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                paths: string[];
+                                /** @description Size of the version’s immutable image (counts toward template storage). */
+                                bytes: number;
+                            } | null;
                             files: components["schemas"]["TemplateFilesSummary"];
                             rootfs_bytes: number | null;
                             /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -21237,6 +21714,12 @@ export interface operations {
                             } | null;
                             defaults: components["schemas"]["TemplateDefaults"];
                             settings: components["schemas"]["TemplateSettings"];
+                            immutable: {
+                                /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                paths: string[];
+                                /** @description Size of the version’s immutable image (counts toward template storage). */
+                                bytes: number;
+                            } | null;
                             files: components["schemas"]["TemplateFilesSummary"];
                             rootfs_bytes: number | null;
                             /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -21280,7 +21763,6 @@ export interface operations {
                              */
                             created_at: string;
                         } | null;
-                        update_policy: components["schemas"]["UpdatePolicy"];
                         category: ("os" | "stack") | null;
                         plan: {
                             plan_key: string;
@@ -21396,6 +21878,12 @@ export interface operations {
                             } | null;
                             defaults: components["schemas"]["TemplateDefaults"];
                             settings: components["schemas"]["TemplateSettings"];
+                            immutable: {
+                                /** @description The directories every workspace of the template mounts read-only from its newest published version, in byte order. */
+                                paths: string[];
+                                /** @description Size of the version’s immutable image (counts toward template storage). */
+                                bytes: number;
+                            } | null;
                             files: components["schemas"]["TemplateFilesSummary"];
                             rootfs_bytes: number | null;
                             /** @description The org layers of this version’s chain, bottom to top (empty for images). */
@@ -33652,6 +34140,10 @@ export interface operations {
                             controller_leases: {
                                 total: number;
                                 expired: number;
+                                /** @description Leases whose loop_state is late. */
+                                late: number;
+                                /** @description Leases whose loop_state is stalled (what Status alerts on). */
+                                stalled: number;
                                 leases: {
                                     name: string;
                                     holder: string;
@@ -33673,6 +34165,13 @@ export interface operations {
                                     expires_at: string;
                                     expired: boolean;
                                     renewed_age_seconds: number;
+                                    /**
+                                     * @description Against the loop's cell-loop-stalled CloudWatch alarm threshold: running (held), handover (no holder for at most one interval + 60 s, e.g. a deploy's release), late (no holder for longer, not stalled yet), stalled (no renewal for longer than the threshold).
+                                     * @enum {string}
+                                     */
+                                    loop_state: "running" | "handover" | "late" | "stalled";
+                                    /** @description The loop's alarm threshold: stalled past this many seconds without a renewal. */
+                                    stall_after_seconds: number;
                                 }[];
                             };
                             stale_after_seconds: number;