diff --git a/dotnet/src/Generated/Rpc.cs b/dotnet/src/Generated/Rpc.cs
index 8471e9e4e1..7e3c233c4d 100644
--- a/dotnet/src/Generated/Rpc.cs
+++ b/dotnet/src/Generated/Rpc.cs
@@ -670,6 +670,10 @@ public sealed class CopilotUserResponseEndpoints
 /// <summary>RPC data type for CopilotUserResponseOrganizationListItem operations.</summary>
 public sealed class CopilotUserResponseOrganizationListItem
 {
+    /// <summary>Numeric database ID of the organization.</summary>
+    [JsonPropertyName("id")]
+    public double? Id { get; set; }
+
     /// <summary>GitHub login of the organization.</summary>
     [JsonPropertyName("login")]
     public string? Login { get; set; }
@@ -931,7 +935,7 @@ public sealed class CopilotUserResponse
     [JsonPropertyName("monthly_quotas")]
     public IDictionary<string, double>? MonthlyQuotas { get; set; }
 
-    /// <summary>Organizations the user belongs to, each with an optional login and display name.</summary>
+    /// <summary>Organizations the user belongs to, each with an optional ID, login, and display name.</summary>
     [JsonPropertyName("organization_list")]
     public IList<CopilotUserResponseOrganizationListItem?>? OrganizationList { get; set; }
 
@@ -1885,9 +1889,9 @@ public partial class McpPlanInstallResultNegotiationRefused : McpPlanInstallResu
     [JsonPropertyName("runtimeProtocolVersion")]
     public required long RuntimeProtocolVersion { get; set; }
 
-    /// <summary>Every wire feature this runtime understands, so the caller can retry within that contract. This list does not imply that every deployment has enabled every operation.</summary>
+    /// <summary>Capabilities this runtime can safely advertise to this caller. The complete five-capability protocol-3 legacy set is always present; every capability added after that baseline appears only when the caller required it, so an older closed-enum decoder can still consume a refusal. This list does not imply that every deployment has enabled every operation.</summary>
     [JsonPropertyName("supportedCapabilities")]
-    public required IList<CatalogCapability> SupportedCapabilities { get; set; }
+    public required IList<string> SupportedCapabilities { get; set; }
 
     /// <summary>The subset of the caller's bounded extensible capability identifiers this runtime cannot honour.</summary>
     [JsonPropertyName("unsupportedCapabilities")]
@@ -2521,6 +2525,201 @@ public partial class CatalogCandidateSourceEmbedded : CatalogCandidateSource
     public override string Kind => "embedded";
 }
 
+/// <summary>A versioned, bounded trust observation carried unchanged with a catalog candidate and its private handle context. Current observations require a recognised T1/T2 tier; every non-current state structurally forbids a tier. Eligibility remains `unknown` while Agent Finder supplies no exposure decision, and states absent from its current wire are never inferred from age, relevance, popularity, or a tier transition.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>status</c>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "status",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(CatalogTrustSnapshotCurrent), "current")]
+[JsonDerivedType(typeof(CatalogTrustSnapshotAbsent), "absent")]
+[JsonDerivedType(typeof(CatalogTrustSnapshotStale), "stale")]
+[JsonDerivedType(typeof(CatalogTrustSnapshotDowngraded), "downgraded")]
+[JsonDerivedType(typeof(CatalogTrustSnapshotRevoked), "revoked")]
+[JsonDerivedType(typeof(CatalogTrustSnapshotUnsupported), "unsupported")]
+[JsonDerivedType(typeof(CatalogTrustSnapshotMalformed), "malformed")]
+public partial class CatalogTrustSnapshot
+{
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("status")]
+    public virtual string Status { get; set; } = string.Empty;
+}
+
+
+/// <summary>Where and when the runtime observed the trust metadata. Observation time is not the authority's evaluation time and must not be used to infer staleness.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class CatalogTrustProvenance
+{
+    /// <summary>ISO 8601 timestamp with a timezone offset at which the runtime observed the search result carrying this trust field.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(20)]
+    [MaxLength(64)]
+    [JsonPropertyName("observedAt")]
+    public DateTimeOffset ObservedAt { get; set; }
+
+    /// <summary>Bounded authority that supplied the trust field.</summary>
+    [JsonPropertyName("source")]
+    public CatalogTrustSource Source { get; set; }
+}
+
+/// <summary>A recognised current Agent Finder T1 or T2 trust tier.</summary>
+/// <remarks>The <c>current</c> variant of <see cref="CatalogTrustSnapshot"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class CatalogTrustSnapshotCurrent : CatalogTrustSnapshot
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Status => "current";
+
+    /// <summary>Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field.</summary>
+    [JsonPropertyName("eligibility")]
+    public required CatalogTrustEligibility Eligibility { get; set; }
+
+    /// <summary>Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust.</summary>
+    [JsonPropertyName("provenance")]
+    public required CatalogTrustProvenance Provenance { get; set; }
+
+    /// <summary>Schema version of this runtime-owned snapshot envelope.</summary>
+    [JsonPropertyName("schemaVersion")]
+    public required CatalogTrustSnapshotSchemaVersion SchemaVersion { get; set; }
+
+    /// <summary>Service-computed T1 or T2 trust tier.</summary>
+    [JsonPropertyName("tier")]
+    public required CatalogTrustTier Tier { get; set; }
+}
+
+/// <summary>Discriminator: the authority omitted trust metadata.</summary>
+/// <remarks>The <c>absent</c> variant of <see cref="CatalogTrustSnapshot"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class CatalogTrustSnapshotAbsent : CatalogTrustSnapshot
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Status => "absent";
+
+    /// <summary>Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field.</summary>
+    [JsonPropertyName("eligibility")]
+    public required CatalogTrustEligibility Eligibility { get; set; }
+
+    /// <summary>Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust.</summary>
+    [JsonPropertyName("provenance")]
+    public required CatalogTrustProvenance Provenance { get; set; }
+
+    /// <summary>Schema version of this runtime-owned snapshot envelope.</summary>
+    [JsonPropertyName("schemaVersion")]
+    public required CatalogTrustSnapshotSchemaVersion SchemaVersion { get; set; }
+}
+
+/// <summary>Discriminator: the authority explicitly marked the assessment stale.</summary>
+/// <remarks>The <c>stale</c> variant of <see cref="CatalogTrustSnapshot"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class CatalogTrustSnapshotStale : CatalogTrustSnapshot
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Status => "stale";
+
+    /// <summary>Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field.</summary>
+    [JsonPropertyName("eligibility")]
+    public required CatalogTrustEligibility Eligibility { get; set; }
+
+    /// <summary>Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust.</summary>
+    [JsonPropertyName("provenance")]
+    public required CatalogTrustProvenance Provenance { get; set; }
+
+    /// <summary>Schema version of this runtime-owned snapshot envelope.</summary>
+    [JsonPropertyName("schemaVersion")]
+    public required CatalogTrustSnapshotSchemaVersion SchemaVersion { get; set; }
+}
+
+/// <summary>Discriminator: the authority explicitly reported a downgraded assessment.</summary>
+/// <remarks>The <c>downgraded</c> variant of <see cref="CatalogTrustSnapshot"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class CatalogTrustSnapshotDowngraded : CatalogTrustSnapshot
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Status => "downgraded";
+
+    /// <summary>Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field.</summary>
+    [JsonPropertyName("eligibility")]
+    public required CatalogTrustEligibility Eligibility { get; set; }
+
+    /// <summary>Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust.</summary>
+    [JsonPropertyName("provenance")]
+    public required CatalogTrustProvenance Provenance { get; set; }
+
+    /// <summary>Schema version of this runtime-owned snapshot envelope.</summary>
+    [JsonPropertyName("schemaVersion")]
+    public required CatalogTrustSnapshotSchemaVersion SchemaVersion { get; set; }
+}
+
+/// <summary>Discriminator: the authority explicitly revoked the assessment.</summary>
+/// <remarks>The <c>revoked</c> variant of <see cref="CatalogTrustSnapshot"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class CatalogTrustSnapshotRevoked : CatalogTrustSnapshot
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Status => "revoked";
+
+    /// <summary>Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field.</summary>
+    [JsonPropertyName("eligibility")]
+    public required CatalogTrustEligibility Eligibility { get; set; }
+
+    /// <summary>Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust.</summary>
+    [JsonPropertyName("provenance")]
+    public required CatalogTrustProvenance Provenance { get; set; }
+
+    /// <summary>Schema version of this runtime-owned snapshot envelope.</summary>
+    [JsonPropertyName("schemaVersion")]
+    public required CatalogTrustSnapshotSchemaVersion SchemaVersion { get; set; }
+}
+
+/// <summary>Discriminator: the authority supplied a bounded trust value this runtime does not understand.</summary>
+/// <remarks>The <c>unsupported</c> variant of <see cref="CatalogTrustSnapshot"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class CatalogTrustSnapshotUnsupported : CatalogTrustSnapshot
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Status => "unsupported";
+
+    /// <summary>Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field.</summary>
+    [JsonPropertyName("eligibility")]
+    public required CatalogTrustEligibility Eligibility { get; set; }
+
+    /// <summary>Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust.</summary>
+    [JsonPropertyName("provenance")]
+    public required CatalogTrustProvenance Provenance { get; set; }
+
+    /// <summary>Schema version of this runtime-owned snapshot envelope.</summary>
+    [JsonPropertyName("schemaVersion")]
+    public required CatalogTrustSnapshotSchemaVersion SchemaVersion { get; set; }
+}
+
+/// <summary>Discriminator: the trust field was empty, unbounded, or had the wrong JSON type.</summary>
+/// <remarks>The <c>malformed</c> variant of <see cref="CatalogTrustSnapshot"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class CatalogTrustSnapshotMalformed : CatalogTrustSnapshot
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Status => "malformed";
+
+    /// <summary>Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field.</summary>
+    [JsonPropertyName("eligibility")]
+    public required CatalogTrustEligibility Eligibility { get; set; }
+
+    /// <summary>Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust.</summary>
+    [JsonPropertyName("provenance")]
+    public required CatalogTrustProvenance Provenance { get; set; }
+
+    /// <summary>Schema version of this runtime-owned snapshot envelope.</summary>
+    [JsonPropertyName("schemaVersion")]
+    public required CatalogTrustSnapshotSchemaVersion SchemaVersion { get; set; }
+}
+
 /// <summary>An inert MCP server catalog result. Every free-text field is untrusted external data and must never be treated as an instruction, and the handle is the only way to refer to the candidate in a later operation.</summary>
 /// <remarks>The <c>mcp-server</c> variant of <see cref="CatalogCandidate"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
@@ -2575,6 +2774,11 @@ public partial class CatalogCandidateMcpServer : CatalogCandidate
     /// <summary>Where the card came from: exactly one of a URL or embedded data, encoded as a tagged union so neither both nor neither can be represented.</summary>
     [JsonPropertyName("source")]
     public required CatalogCandidateSource Source { get; set; }
+
+    /// <summary>Versioned trust metadata observed from the catalog authority. Optional for protocol-3 compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits an explicit snapshot even when the authority omitted or malformed its trust field.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("trust")]
+    public CatalogTrustSnapshot? Trust { get; set; }
 }
 
 /// <summary>Where and when an AI skill catalog reference was observed. Discovery provenance deliberately carries no content digest because search does not establish the exact validated content a later plan will bind.</summary>
@@ -2650,6 +2854,11 @@ public partial class CatalogCandidateAiSkill : CatalogCandidate
     /// <summary>Where the card came from: exactly one of a URL or embedded data, encoded as a tagged union so neither both nor neither can be represented.</summary>
     [JsonPropertyName("source")]
     public required CatalogCandidateSource Source { get; set; }
+
+    /// <summary>Versioned trust metadata observed from the catalog authority. Optional for protocol-3 compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits an explicit snapshot even when the authority omitted or malformed its trust field.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("trust")]
+    public CatalogTrustSnapshot? Trust { get; set; }
 }
 
 /// <summary>A completed catalog search: inert candidate summaries, each carrying a single-use handle.</summary>
@@ -2708,9 +2917,9 @@ public partial class CatalogSearchResultNegotiationRefused : CatalogSearchResult
     [JsonPropertyName("runtimeProtocolVersion")]
     public required long RuntimeProtocolVersion { get; set; }
 
-    /// <summary>Every wire feature this runtime understands, so the caller can retry within that contract. This list does not imply that every deployment has enabled every operation.</summary>
+    /// <summary>Capabilities this runtime can safely advertise to this caller. The complete five-capability protocol-3 legacy set is always present; every capability added after that baseline appears only when the caller required it, so an older closed-enum decoder can still consume a refusal. This list does not imply that every deployment has enabled every operation.</summary>
     [JsonPropertyName("supportedCapabilities")]
-    public required IList<CatalogCapability> SupportedCapabilities { get; set; }
+    public required IList<string> SupportedCapabilities { get; set; }
 
     /// <summary>The subset of the caller's bounded extensible capability identifiers this runtime cannot honour.</summary>
     [JsonPropertyName("unsupportedCapabilities")]
@@ -4527,7 +4736,7 @@ public sealed class EventsReadResult
     [JsonPropertyName("cursor")]
     public string Cursor { get; set; } = string.Empty;
 
-    /// <summary>Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history. For a forward read the fallback starts from the beginning of the remaining history; for a backward read it falls back to the tail (the newest window). Because the fallback page is a fresh boundary snapshot rather than a continuation of the requested cursor, it may overlap events the consumer has already rendered — a backward fallback to the tail in particular can repeat the newest window. On 'expired', consumers should reset or rebase their local pagination state (or deduplicate by event id) before continuing from the returned cursor rather than blindly appending/prepending the fallback page.</summary>
+    /// <summary>Cursor status: 'ok' means the cursor was applied successfully. For session.eventLog.read, 'expired' means the cursor referred to an event that no longer exists in active history and the read fell back to a boundary of the remaining history: the beginning for a forward read or the newest window for a backward read. That fallback may overlap already rendered events, so active-session consumers should reset, rebase, or deduplicate before continuing. sessions.readPersistedEvents has stricter snapshot semantics: 'expired' returns an empty terminal page and never switches to a replacement journal generation. Other persisted-read I/O failures are RPC errors with diagnostics, not cursor expiry.</summary>
     [JsonPropertyName("cursorStatus")]
     public EventsCursorStatus CursorStatus { get; set; }
 
@@ -4535,7 +4744,7 @@ public sealed class EventsReadResult
     [JsonPropertyName("events")]
     public IList<SessionEvent> Events { get => field ??= []; set; }
 
-    /// <summary>True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window.</summary>
+    /// <summary>True when more events are available in the read's direction. For a backward read, true means older persisted events remain before the returned window. A persisted-event page may contain fewer than `max` events because of its byte budget while still reporting hasMore true; continue according to this flag rather than the event count.</summary>
     [JsonPropertyName("hasMore")]
     public bool HasMore { get; set; }
 }
@@ -4544,15 +4753,15 @@ public sealed class EventsReadResult
 [Experimental(Diagnostics.Experimental)]
 internal sealed class SessionsReadPersistedEventsRequest
 {
-    /// <summary>Opaque cursor returned by a previous persisted-event read. Omit on the first call.</summary>
+    /// <summary>Opaque, process-local, single-use cursor returned by the previous persisted-event read. Omit on the first call and issue continuations sequentially; reusing the same cursor returns an expired terminal page.</summary>
     [JsonPropertyName("cursor")]
     public string? Cursor { get; set; }
 
-    /// <summary>Direction to page through persisted history. Forward starts at the beginning; backward starts with the newest events. Events in each page remain chronological.</summary>
+    /// <summary>Direction to page through persisted history. Forward starts at the beginning; backward starts with the newest events. Events in each page remain chronological. This selects the initial read only; a continuation always uses the direction bound into its cursor.</summary>
     [JsonPropertyName("direction")]
     public EventsReadDirection? Direction { get; set; }
 
-    /// <summary>Maximum number of events to return in this batch (1–1000, default 200).</summary>
+    /// <summary>Maximum number of events to return in this batch (1–1000, default 200). Pages may contain fewer events to keep the serialized event array within a soft 1 MiB budget including resolved binary assets; one oversized event is returned alone to guarantee progress.</summary>
     [JsonPropertyName("max")]
     public long? Max { get; set; }
 
@@ -8063,6 +8272,10 @@ internal sealed class ModelApplyStartupOverlayRequest
     [JsonPropertyName("policyHelperModel")]
     public string? PolicyHelperModel { get; set; }
 
+    /// <summary>Auto routing preference selected by repository settings, when configured. Applied only when the overlay selects the Auto model; beside a concrete model it stays dormant.</summary>
+    [JsonPropertyName("repoAutoTier")]
+    public string? RepoAutoTier { get; set; }
+
     /// <summary>Context tier selected by repository settings, when configured.</summary>
     [JsonPropertyName("repoContextTier")]
     public string? RepoContextTier { get; set; }
@@ -8225,6 +8438,10 @@ public sealed class ModeSetResult
     [JsonPropertyName("message")]
     public string? Message { get; set; }
 
+    /// <summary>Whether the requested mode was applied to the session. False only when an 'expectedMode' precondition did not hold, in which case any model change reported alongside it was still applied.</summary>
+    [JsonPropertyName("modeApplied")]
+    public bool? ModeApplied { get; set; }
+
     /// <summary>Whether applying the mode changed the active model.</summary>
     [JsonPropertyName("modelChanged")]
     public bool ModelChanged { get; set; }
@@ -8246,6 +8463,10 @@ internal sealed class ModeSetRequest
     [JsonPropertyName("compactionDecision")]
     public string? CompactionDecision { get; set; }
 
+    /// <summary>Mode the session must currently be in for the change to apply. When set and the session is in a different mode the request is a no-op and reports status 'unchanged'.</summary>
+    [JsonPropertyName("expectedMode")]
+    public SessionMode? ExpectedMode { get; set; }
+
     /// <summary>Session whose plan-mode base state should be inherited.</summary>
     [JsonPropertyName("inheritPlanBaseFromSessionId")]
     public string? InheritPlanBaseFromSessionId { get; set; }
@@ -9121,10 +9342,19 @@ public sealed class FleetStartResult
     public bool Started { get; set; }
 }
 
-/// <summary>Optional user prompt to combine with the fleet orchestration instructions.</summary>
+/// <summary>Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.</summary>
 [Experimental(Diagnostics.Experimental)]
 internal sealed class FleetStartRequest
 {
+    /// <summary>Optional attachments (files, directories, selections, blobs, GitHub references) to include with the fleet request.</summary>
+    [JsonPropertyName("attachments")]
+    public IList<Attachment>? Attachments { get; set; }
+
+    /// <summary>If false, this request will not trigger a Premium Request Unit charge. User requests default to billable.</summary>
+    [JsonInclude]
+    [JsonPropertyName("billable")]
+    internal bool? Billable { get; set; }
+
     /// <summary>Optional user prompt to combine with fleet instructions.</summary>
     [JsonPropertyName("prompt")]
     public string? Prompt { get; set; }
@@ -9132,6 +9362,10 @@ internal sealed class FleetStartRequest
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>If true, await completion of the agentic loop for this fleet request before returning. Defaults to false.</summary>
+    [JsonPropertyName("wait")]
+    public bool? Wait { get; set; }
 }
 
 /// <summary>Agents available to the session.</summary>
@@ -20655,6 +20889,9 @@ public CatalogCapability(string value)
     /// <summary>Understands plans that enumerate every eligible transport rather than a single preferred one.</summary>
     public static CatalogCapability MultipleTransportChoice { get; } = new("multiple-transport-choice");
 
+    /// <summary>Understands versioned candidate trust snapshots. Protocol-3 callers must require this capability before the runtime adds the optional snapshot field.</summary>
+    public static CatalogCapability TrustSnapshot { get; } = new("trust-snapshot");
+
     /// <summary>Returns a value indicating whether two <see cref="CatalogCapability"/> instances are equivalent.</summary>
     public static bool operator ==(CatalogCapability left, CatalogCapability right) => left.Equals(right);
 
@@ -22504,6 +22741,258 @@ public override void Write(Utf8JsonWriter writer, CatalogMcpServerInstallability
 }
 
 
+/// <summary>Authority-computed exposure eligibility, kept separate from tier. The current tier-only Agent Finder response maps to `unknown`, never to a locally inferred eligibility.</summary>
+[Experimental(Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogTrustEligibility : IEquatable<CatalogTrustEligibility>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="CatalogTrustEligibility"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogTrustEligibility"/>.</param>
+    [JsonConstructor]
+    public CatalogTrustEligibility(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="CatalogTrustEligibility"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>Eligible for default catalogue exposure.</summary>
+    public static CatalogTrustEligibility Default { get; } = new("default");
+
+    /// <summary>Eligible only when expanded or community results are requested.</summary>
+    public static CatalogTrustEligibility Expanded { get; } = new("expanded");
+
+    /// <summary>Not eligible for normal catalogue exposure.</summary>
+    public static CatalogTrustEligibility Hidden { get; } = new("hidden");
+
+    /// <summary>The authority did not supply an eligibility decision.</summary>
+    public static CatalogTrustEligibility Unknown { get; } = new("unknown");
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogTrustEligibility"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogTrustEligibility left, CatalogTrustEligibility right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogTrustEligibility"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogTrustEligibility left, CatalogTrustEligibility right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogTrustEligibility other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(CatalogTrustEligibility other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{CatalogTrustEligibility}"/> for serializing <see cref="CatalogTrustEligibility"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogTrustEligibility>
+    {
+        /// <inheritdoc />
+        public override CatalogTrustEligibility Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogTrustEligibility value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogTrustEligibility));
+        }
+    }
+}
+
+
+/// <summary>Bounded authority that supplied a catalogue trust observation.</summary>
+[Experimental(Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogTrustSource : IEquatable<CatalogTrustSource>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="CatalogTrustSource"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogTrustSource"/>.</param>
+    [JsonConstructor]
+    public CatalogTrustSource(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="CatalogTrustSource"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>GitHub Agent Finder supplied the trust field on its search result.</summary>
+    public static CatalogTrustSource AgentFinder { get; } = new("agent-finder");
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogTrustSource"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogTrustSource left, CatalogTrustSource right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogTrustSource"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogTrustSource left, CatalogTrustSource right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogTrustSource other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(CatalogTrustSource other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{CatalogTrustSource}"/> for serializing <see cref="CatalogTrustSource"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogTrustSource>
+    {
+        /// <inheritdoc />
+        public override CatalogTrustSource Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogTrustSource value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogTrustSource));
+        }
+    }
+}
+
+
+/// <summary>Schema version of the catalogue trust snapshot envelope.</summary>
+[Experimental(Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogTrustSnapshotSchemaVersion : IEquatable<CatalogTrustSnapshotSchemaVersion>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="CatalogTrustSnapshotSchemaVersion"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogTrustSnapshotSchemaVersion"/>.</param>
+    [JsonConstructor]
+    public CatalogTrustSnapshotSchemaVersion(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="CatalogTrustSnapshotSchemaVersion"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>Initial envelope carrying one bounded service tier or one explicit unavailable state.</summary>
+    public static CatalogTrustSnapshotSchemaVersion V1 { get; } = new("v1");
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogTrustSnapshotSchemaVersion"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogTrustSnapshotSchemaVersion left, CatalogTrustSnapshotSchemaVersion right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogTrustSnapshotSchemaVersion"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogTrustSnapshotSchemaVersion left, CatalogTrustSnapshotSchemaVersion right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogTrustSnapshotSchemaVersion other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(CatalogTrustSnapshotSchemaVersion other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{CatalogTrustSnapshotSchemaVersion}"/> for serializing <see cref="CatalogTrustSnapshotSchemaVersion"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogTrustSnapshotSchemaVersion>
+    {
+        /// <inheritdoc />
+        public override CatalogTrustSnapshotSchemaVersion Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogTrustSnapshotSchemaVersion value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogTrustSnapshotSchemaVersion));
+        }
+    }
+}
+
+
+/// <summary>Service-computed trust tier currently emitted by Agent Finder. It is independent of search score, popularity, and client-side ranking.</summary>
+[Experimental(Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogTrustTier : IEquatable<CatalogTrustTier>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="CatalogTrustTier"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogTrustTier"/>.</param>
+    [JsonConstructor]
+    public CatalogTrustTier(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="CatalogTrustTier"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>Tier one as assigned by the catalogue authority.</summary>
+    public static CatalogTrustTier T1 { get; } = new("T1");
+
+    /// <summary>Tier two as assigned by the catalogue authority.</summary>
+    public static CatalogTrustTier T2 { get; } = new("T2");
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogTrustTier"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogTrustTier left, CatalogTrustTier right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogTrustTier"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogTrustTier left, CatalogTrustTier right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogTrustTier other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(CatalogTrustTier other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{CatalogTrustTier}"/> for serializing <see cref="CatalogTrustTier"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogTrustTier>
+    {
+        /// <inheritdoc />
+        public override CatalogTrustTier Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogTrustTier value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogTrustTier));
+        }
+    }
+}
+
+
 /// <summary>What kind of resource a catalog candidate describes.</summary>
 [Experimental(Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
@@ -23839,7 +24328,7 @@ public override void Write(Utf8JsonWriter writer, SessionSource value, JsonSeria
 }
 
 
-/// <summary>Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history (the beginning for a forward read, the tail for a backward read). The fallback page is a fresh boundary snapshot, not a continuation of the requested cursor, so it may overlap already-rendered events; on 'expired' a consumer should reset/rebase its pagination state (or deduplicate by event id) before continuing from the returned cursor.</summary>
+/// <summary>Cursor status: 'ok' means the read succeeded against the requested history; 'expired' means the requested continuation is unavailable. Recovery is endpoint-specific: session.eventLog.read returns a boundary window of remaining active history that may overlap prior pages, while sessions.readPersistedEvents returns an empty terminal page and never switches journal generations. An expired persisted read is not successful completion; a complete persisted snapshot requires cursorStatus 'ok' and hasMore false.</summary>
 [Experimental(Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
@@ -23859,10 +24348,10 @@ public EventsCursorStatus(string value)
     /// <summary>Gets the value associated with this <see cref="EventsCursorStatus"/>.</summary>
     public string Value => _value ?? string.Empty;
 
-    /// <summary>The cursor was applied successfully.</summary>
+    /// <summary>The read succeeded against the requested history.</summary>
     public static EventsCursorStatus Ok { get; } = new("ok");
 
-    /// <summary>The cursor referred to history that is no longer available.</summary>
+    /// <summary>The requested continuation is unavailable; see the endpoint's recovery semantics.</summary>
     public static EventsCursorStatus Expired { get; } = new("expired");
 
     /// <summary>Returns a value indicating whether two <see cref="EventsCursorStatus"/> instances are equivalent.</summary>
@@ -24838,75 +25327,6 @@ public override void Write(Utf8JsonWriter writer, PermissionResponseCapability v
 }
 
 
-/// <summary>Controlled reason or actor responsible for a permission response.</summary>
-[Experimental(Diagnostics.Experimental)]
-[JsonConverter(typeof(Converter))]
-[DebuggerDisplay("{Value,nq}")]
-public readonly struct PermissionDecisionSource : IEquatable<PermissionDecisionSource>
-{
-    private readonly string? _value;
-
-    /// <summary>Initializes a new instance of the <see cref="PermissionDecisionSource"/> struct.</summary>
-    /// <param name="value">The value to associate with this <see cref="PermissionDecisionSource"/>.</param>
-    [JsonConstructor]
-    public PermissionDecisionSource(string value)
-    {
-        ArgumentException.ThrowIfNullOrWhiteSpace(value);
-        _value = value;
-    }
-
-    /// <summary>Gets the value associated with this <see cref="PermissionDecisionSource"/>.</summary>
-    public string Value => _value ?? string.Empty;
-
-    /// <summary>The response followed the assisted-approval judge recommendation.</summary>
-    public static PermissionDecisionSource AssistedApproval { get; } = new("assisted_approval");
-
-    /// <summary>A human supplied the response through an interactive prompt.</summary>
-    public static PermissionDecisionSource HumanResponse { get; } = new("human_response");
-
-    /// <summary>The host applied a standing policy or override rather than a judge recommendation or human decision.</summary>
-    public static PermissionDecisionSource HostPolicy { get; } = new("host_policy");
-
-    /// <summary>The host denied the request because no interactive user response was available.</summary>
-    public static PermissionDecisionSource UnattendedFallback { get; } = new("unattended_fallback");
-
-    /// <summary>Returns a value indicating whether two <see cref="PermissionDecisionSource"/> instances are equivalent.</summary>
-    public static bool operator ==(PermissionDecisionSource left, PermissionDecisionSource right) => left.Equals(right);
-
-    /// <summary>Returns a value indicating whether two <see cref="PermissionDecisionSource"/> instances are not equivalent.</summary>
-    public static bool operator !=(PermissionDecisionSource left, PermissionDecisionSource right) => !(left == right);
-
-    /// <inheritdoc />
-    public override bool Equals(object? obj) => obj is PermissionDecisionSource other && Equals(other);
-
-    /// <inheritdoc />
-    public bool Equals(PermissionDecisionSource other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
-
-    /// <inheritdoc />
-    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
-
-    /// <inheritdoc />
-    public override string ToString() => Value;
-
-    /// <summary>Provides a <see cref="JsonConverter{PermissionDecisionSource}"/> for serializing <see cref="PermissionDecisionSource"/> instances.</summary>
-    [EditorBrowsable(EditorBrowsableState.Never)]
-    public sealed class Converter : JsonConverter<PermissionDecisionSource>
-    {
-        /// <inheritdoc />
-        public override PermissionDecisionSource Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
-        {
-            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
-        }
-
-        /// <inheritdoc />
-        public override void Write(Utf8JsonWriter writer, PermissionDecisionSource value, JsonSerializerOptions options)
-        {
-            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(PermissionDecisionSource));
-        }
-    }
-}
-
-
 /// <summary>Client surface that submitted a permission response.</summary>
 [Experimental(Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
@@ -32888,11 +33308,11 @@ public async Task<IList<SessionsClientMetadataEntry>> GetClientMetadataAsync(ILi
         return await CopilotClient.InvokeRpcAsync<IList<SessionsClientMetadataEntry>>(_rpc, "sessions.getClientMetadata", [request], cancellationToken);
     }
 
-    /// <summary>Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The initial backward read uses a bounded tail scan for fast first paint; cursor continuations preserve the session event-log paging semantics. Persisted events may omit payloads that are reconstructed only for an active session.</summary>
+    /// <summary>Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The first read pins the currently opened journal generation and its byte-length boundary; opaque cursor continuations remain on that generation across runtime-owned compaction, truncation, and rewrite operations, which replace the live path atomically, and events appended after the boundary are excluded. For cold hydration, await the first successful page before activation and establish lossless live-event buffering before resume; merge subsequent live events by ID, preserving persisted order and letting live payloads win. Continuations are process-local, single-use capabilities bound to the originating session and storage context and must be paged sequentially; concurrent or repeated use of the same cursor expires that duplicate read rather than reading the generation twice. A complete snapshot has cursorStatus 'ok' and hasMore false. Snapshots expire after five idle minutes, with at most eight retained per process and idle-only eviction under pressure; completion and cancelled-worker exit release their handles. No transcript copy is created, but retained handles may keep replaced files' disk blocks alive until release. Pages have a soft 1 MiB serialized event-array budget including resolved binary assets; one oversized event is returned alone to guarantee progress. Working memory also includes a record/lookahead and asset resolution; resolving the first binary reference may scan the full pinned generation to build a bounded offset index. If the snapshot expires, is evicted, is cancelled before a continuation is established, or becomes unreadable after an observable unsupported in-place shortening, the continuation returns cursorStatus 'expired' with an empty terminal page and never falls back to a different generation. A missing or initially unreadable journal is an RPC error. Persisted history excludes ephemeral events and may omit payloads that are reconstructed only for an active session; use the active session event stream for post-resume live events.</summary>
     /// <param name="sessionId">Session ID whose persisted event journal should be read.</param>
-    /// <param name="cursor">Opaque cursor returned by a previous persisted-event read. Omit on the first call.</param>
-    /// <param name="max">Maximum number of events to return in this batch (1–1000, default 200).</param>
-    /// <param name="direction">Direction to page through persisted history. Forward starts at the beginning; backward starts with the newest events. Events in each page remain chronological.</param>
+    /// <param name="cursor">Opaque, process-local, single-use cursor returned by the previous persisted-event read. Omit on the first call and issue continuations sequentially; reusing the same cursor returns an expired terminal page.</param>
+    /// <param name="max">Maximum number of events to return in this batch (1–1000, default 200). Pages may contain fewer events to keep the serialized event array within a soft 1 MiB budget including resolved binary assets; one oversized event is returned alone to guarantee progress.</param>
+    /// <param name="direction">Direction to page through persisted history. Forward starts at the beginning; backward starts with the newest events. Events in each page remain chronological. This selects the initial read only; a continuation always uses the direction bound into its cursor.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>Batch of session events returned by a read, with cursor and continuation metadata.</returns>
     public async Task<EventsReadResult> ReadPersistedEventsAsync(string sessionId, string? cursor = null, long? max = null, EventsReadDirection? direction = null, CancellationToken cancellationToken = default)
@@ -34306,15 +34726,16 @@ public async Task<ModelSwitchAutoTierResult> SwitchAutoTierAsync(AutoTier? autoT
     /// <param name="repoModel">Model selected by repository settings, when configured.</param>
     /// <param name="repoReasoningEffort">Reasoning effort selected by repository settings, when configured.</param>
     /// <param name="repoContextTier">Context tier selected by repository settings, when configured.</param>
+    /// <param name="repoAutoTier">Auto routing preference selected by repository settings, when configured. Applied only when the overlay selects the Auto model; beside a concrete model it stays dormant.</param>
     /// <param name="cliModel">Model explicitly selected by the CLI, when provided.</param>
     /// <param name="deferredResume">Whether the overlay is being applied while resuming a deferred session.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>The model identifier active on the session after the switch.</returns>
-    internal async Task<ModelSwitchToResult> ApplyStartupOverlayAsync(string? deviceManagedModel = null, string? serverManagedModel = null, string? policyHelperModel = null, string? repoModel = null, string? repoReasoningEffort = null, string? repoContextTier = null, string? cliModel = null, bool? deferredResume = null, CancellationToken cancellationToken = default)
+    internal async Task<ModelSwitchToResult> ApplyStartupOverlayAsync(string? deviceManagedModel = null, string? serverManagedModel = null, string? policyHelperModel = null, string? repoModel = null, string? repoReasoningEffort = null, string? repoContextTier = null, string? repoAutoTier = null, string? cliModel = null, bool? deferredResume = null, CancellationToken cancellationToken = default)
     {
         _session.ThrowIfDisposed();
 
-        var request = new ModelApplyStartupOverlayRequest { SessionId = _session.SessionId, DeviceManagedModel = deviceManagedModel, ServerManagedModel = serverManagedModel, PolicyHelperModel = policyHelperModel, RepoModel = repoModel, RepoReasoningEffort = repoReasoningEffort, RepoContextTier = repoContextTier, CliModel = cliModel, DeferredResume = deferredResume };
+        var request = new ModelApplyStartupOverlayRequest { SessionId = _session.SessionId, DeviceManagedModel = deviceManagedModel, ServerManagedModel = serverManagedModel, PolicyHelperModel = policyHelperModel, RepoModel = repoModel, RepoReasoningEffort = repoReasoningEffort, RepoContextTier = repoContextTier, RepoAutoTier = repoAutoTier, CliModel = cliModel, DeferredResume = deferredResume };
         return await CopilotClient.InvokeRpcAsync<ModelSwitchToResult>(_session.Rpc, "session.model.applyStartupOverlay", [request], cancellationToken);
     }
 
@@ -34380,6 +34801,7 @@ public async Task<SessionMode> GetAsync(CancellationToken cancellationToken = de
 
     /// <summary>Sets the current agent interaction mode.</summary>
     /// <param name="mode">The session mode the agent is operating in.</param>
+    /// <param name="expectedMode">Mode the session must currently be in for the change to apply. When set and the session is in a different mode the request is a no-op and reports status 'unchanged'.</param>
     /// <param name="inheritPlanBaseFromSessionId">Session whose plan-mode base state should be inherited.</param>
     /// <param name="planModelConfigured">Whether a dedicated plan model is configured.</param>
     /// <param name="planModel">Dedicated model to use in plan mode, when configured.</param>
@@ -34392,11 +34814,11 @@ public async Task<SessionMode> GetAsync(CancellationToken cancellationToken = de
     /// <param name="planExitAction">Action to perform when leaving plan mode.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>Outcome of a session mode change, including any model switch it triggered and follow-up the host must perform.</returns>
-    public async Task<ModeSetResult> SetAsync(SessionMode mode, string? inheritPlanBaseFromSessionId = null, bool? planModelConfigured = null, string? planModel = null, string? planReasoningEffort = null, string? planContextTier = null, string? compactionDecision = null, bool? restorePlanModel = null, bool? persistPlanSelection = null, ModelPickerSettingsContext? pickerSettingsContext = null, string? planExitAction = null, CancellationToken cancellationToken = default)
+    public async Task<ModeSetResult> SetAsync(SessionMode mode, SessionMode? expectedMode = null, string? inheritPlanBaseFromSessionId = null, bool? planModelConfigured = null, string? planModel = null, string? planReasoningEffort = null, string? planContextTier = null, string? compactionDecision = null, bool? restorePlanModel = null, bool? persistPlanSelection = null, ModelPickerSettingsContext? pickerSettingsContext = null, string? planExitAction = null, CancellationToken cancellationToken = default)
     {
         _session.ThrowIfDisposed();
 
-        var request = new ModeSetRequest { SessionId = _session.SessionId, Mode = mode, InheritPlanBaseFromSessionId = inheritPlanBaseFromSessionId, PlanModelConfigured = planModelConfigured, PlanModel = planModel, PlanReasoningEffort = planReasoningEffort, PlanContextTier = planContextTier, CompactionDecision = compactionDecision, RestorePlanModel = restorePlanModel, PersistPlanSelection = persistPlanSelection, PickerSettingsContext = pickerSettingsContext, PlanExitAction = planExitAction };
+        var request = new ModeSetRequest { SessionId = _session.SessionId, Mode = mode, ExpectedMode = expectedMode, InheritPlanBaseFromSessionId = inheritPlanBaseFromSessionId, PlanModelConfigured = planModelConfigured, PlanModel = planModel, PlanReasoningEffort = planReasoningEffort, PlanContextTier = planContextTier, CompactionDecision = compactionDecision, RestorePlanModel = restorePlanModel, PersistPlanSelection = persistPlanSelection, PickerSettingsContext = pickerSettingsContext, PlanExitAction = planExitAction };
         return await CopilotClient.InvokeRpcAsync<ModeSetResult>(_session.Rpc, "session.mode.set", [request], cancellationToken);
     }
 }
@@ -34820,13 +35242,16 @@ internal FleetApi(CopilotSession session)
 
     /// <summary>Starts fleet mode by submitting the fleet orchestration prompt to the session.</summary>
     /// <param name="prompt">Optional user prompt to combine with fleet instructions.</param>
+    /// <param name="attachments">Optional attachments (files, directories, selections, blobs, GitHub references) to include with the fleet request.</param>
+    /// <param name="billable">If false, this request will not trigger a Premium Request Unit charge. User requests default to billable.</param>
+    /// <param name="wait">If true, await completion of the agentic loop for this fleet request before returning. Defaults to false.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>Indicates whether fleet mode was successfully activated.</returns>
-    public async Task<FleetStartResult> StartAsync(string? prompt = null, CancellationToken cancellationToken = default)
+    public async Task<FleetStartResult> StartAsync(string? prompt = null, IList<Attachment>? attachments = null, bool? billable = null, bool? wait = null, CancellationToken cancellationToken = default)
     {
         _session.ThrowIfDisposed();
 
-        var request = new FleetStartRequest { SessionId = _session.SessionId, Prompt = prompt };
+        var request = new FleetStartRequest { SessionId = _session.SessionId, Prompt = prompt, Attachments = attachments, Billable = billable, Wait = wait };
         return await CopilotClient.InvokeRpcAsync<FleetStartResult>(_session.Rpc, "session.fleet.start", [request], cancellationToken);
     }
 }
@@ -38310,8 +38735,18 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(GitHub.Copilot.PendingMessagesModifiedData), TypeInfoPropertyName = "SessionEventsPendingMessagesModifiedData")]
 [JsonSerializable(typeof(GitHub.Copilot.PendingMessagesModifiedEvent), TypeInfoPropertyName = "SessionEventsPendingMessagesModifiedEvent")]
 [JsonSerializable(typeof(GitHub.Copilot.PermissionAssistedApproval), TypeInfoPropertyName = "SessionEventsPermissionAssistedApproval")]
+[JsonSerializable(typeof(GitHub.Copilot.PermissionCarriedForwardData), TypeInfoPropertyName = "SessionEventsPermissionCarriedForwardData")]
+[JsonSerializable(typeof(GitHub.Copilot.PermissionCarriedForwardEvent), TypeInfoPropertyName = "SessionEventsPermissionCarriedForwardEvent")]
 [JsonSerializable(typeof(GitHub.Copilot.PermissionCompletedData), TypeInfoPropertyName = "SessionEventsPermissionCompletedData")]
 [JsonSerializable(typeof(GitHub.Copilot.PermissionCompletedEvent), TypeInfoPropertyName = "SessionEventsPermissionCompletedEvent")]
+[JsonSerializable(typeof(GitHub.Copilot.PermissionDecisionSource), TypeInfoPropertyName = "SessionEventsPermissionDecisionSource")]
+[JsonSerializable(typeof(GitHub.Copilot.PermissionMessageAuthorizationData), TypeInfoPropertyName = "SessionEventsPermissionMessageAuthorizationData")]
+[JsonSerializable(typeof(GitHub.Copilot.PermissionMessageAuthorizationDegradedData), TypeInfoPropertyName = "SessionEventsPermissionMessageAuthorizationDegradedData")]
+[JsonSerializable(typeof(GitHub.Copilot.PermissionMessageAuthorizationDegradedEvent), TypeInfoPropertyName = "SessionEventsPermissionMessageAuthorizationDegradedEvent")]
+[JsonSerializable(typeof(GitHub.Copilot.PermissionMessageAuthorizationEvent), TypeInfoPropertyName = "SessionEventsPermissionMessageAuthorizationEvent")]
+[JsonSerializable(typeof(GitHub.Copilot.PermissionMessageAuthorizationPolarity), TypeInfoPropertyName = "SessionEventsPermissionMessageAuthorizationPolarity")]
+[JsonSerializable(typeof(GitHub.Copilot.PermissionMessageAuthorizationReadData), TypeInfoPropertyName = "SessionEventsPermissionMessageAuthorizationReadData")]
+[JsonSerializable(typeof(GitHub.Copilot.PermissionMessageAuthorizationReadEvent), TypeInfoPropertyName = "SessionEventsPermissionMessageAuthorizationReadEvent")]
 [JsonSerializable(typeof(GitHub.Copilot.PermissionMode), TypeInfoPropertyName = "SessionEventsPermissionMode")]
 [JsonSerializable(typeof(GitHub.Copilot.PermissionPromptRequest), TypeInfoPropertyName = "SessionEventsPermissionPromptRequest")]
 [JsonSerializable(typeof(GitHub.Copilot.PermissionPromptRequestCommands), TypeInfoPropertyName = "SessionEventsPermissionPromptRequestCommands")]
@@ -38553,6 +38988,8 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(CatalogNegotiatedContract))]
 [JsonSerializable(typeof(CatalogSearchRequest))]
 [JsonSerializable(typeof(CatalogSearchResult))]
+[JsonSerializable(typeof(CatalogTrustProvenance))]
+[JsonSerializable(typeof(CatalogTrustSnapshot))]
 [JsonSerializable(typeof(ClientTaskCancelRequest))]
 [JsonSerializable(typeof(ClientTaskCancelResult))]
 [JsonSerializable(typeof(CommandList))]
diff --git a/dotnet/src/Generated/SessionEvents.cs b/dotnet/src/Generated/SessionEvents.cs
index 2a81531d45..a58dae10ec 100644
--- a/dotnet/src/Generated/SessionEvents.cs
+++ b/dotnet/src/Generated/SessionEvents.cs
@@ -75,7 +75,11 @@ namespace GitHub.Copilot;
 [JsonDerivedType(typeof(ModelCallFinishedEvent), "model.call_finished")]
 [JsonDerivedType(typeof(ModelCallStartEvent), "model.call_start")]
 [JsonDerivedType(typeof(PendingMessagesModifiedEvent), "pending_messages.modified")]
+[JsonDerivedType(typeof(PermissionCarriedForwardEvent), "permission.carriedForward")]
 [JsonDerivedType(typeof(PermissionCompletedEvent), "permission.completed")]
+[JsonDerivedType(typeof(PermissionMessageAuthorizationEvent), "permission.messageAuthorization")]
+[JsonDerivedType(typeof(PermissionMessageAuthorizationDegradedEvent), "permission.messageAuthorizationDegraded")]
+[JsonDerivedType(typeof(PermissionMessageAuthorizationReadEvent), "permission.messageAuthorizationRead")]
 [JsonDerivedType(typeof(PermissionRequestedEvent), "permission.requested")]
 [JsonDerivedType(typeof(PromptCacheBreakEvent), "prompt_cache_break")]
 [JsonDerivedType(typeof(SamplingCompletedEvent), "sampling.completed")]
@@ -1333,6 +1337,62 @@ public sealed partial class PermissionCompletedEvent : SessionEvent
     public required PermissionCompletedData Data { get; set; }
 }
 
+/// <summary>Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left.</summary>
+/// <remarks>Represents the <c>permission.carriedForward</c> event.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public sealed partial class PermissionCarriedForwardEvent : SessionEvent
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "permission.carriedForward";
+
+    /// <summary>The <c>permission.carriedForward</c> event payload.</summary>
+    [JsonPropertyName("data")]
+    public required PermissionCarriedForwardData Data { get; set; }
+}
+
+/// <summary>Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume.</summary>
+/// <remarks>Represents the <c>permission.messageAuthorization</c> event.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public sealed partial class PermissionMessageAuthorizationEvent : SessionEvent
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "permission.messageAuthorization";
+
+    /// <summary>The <c>permission.messageAuthorization</c> event payload.</summary>
+    [JsonPropertyName("data")]
+    public required PermissionMessageAuthorizationData Data { get; set; }
+}
+
+/// <summary>Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism.</summary>
+/// <remarks>Represents the <c>permission.messageAuthorizationRead</c> event.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public sealed partial class PermissionMessageAuthorizationReadEvent : SessionEvent
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "permission.messageAuthorizationRead";
+
+    /// <summary>The <c>permission.messageAuthorizationRead</c> event payload.</summary>
+    [JsonPropertyName("data")]
+    public required PermissionMessageAuthorizationReadData Data { get; set; }
+}
+
+/// <summary>Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt.</summary>
+/// <remarks>Represents the <c>permission.messageAuthorizationDegraded</c> event.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public sealed partial class PermissionMessageAuthorizationDegradedEvent : SessionEvent
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "permission.messageAuthorizationDegraded";
+
+    /// <summary>The <c>permission.messageAuthorizationDegraded</c> event payload.</summary>
+    [JsonPropertyName("data")]
+    public required PermissionMessageAuthorizationDegradedData Data { get; set; }
+}
+
 /// <summary>User input request notification with question and optional predefined choices.</summary>
 /// <remarks>Represents the <c>user_input.requested</c> event.</remarks>
 public sealed partial class UserInputRequestedEvent : SessionEvent
@@ -4548,6 +4608,11 @@ public sealed partial class ToolExecutionStartData
     [JsonPropertyName("mcpToolName")]
     public string? McpToolName { get; set; }
 
+    /// <summary>Transport the MCP server hosting this tool is connected over, when the tool is an MCP tool and the server is configured.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("mcpTransport")]
+    public McpServerTransport? McpTransport { get; set; }
+
     /// <summary>Model identifier that generated this tool call.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("model")]
@@ -5195,6 +5260,12 @@ public sealed partial class PermissionRequestedData
 /// <summary>Permission request completion notification signaling UI dismissal.</summary>
 public sealed partial class PermissionCompletedData
 {
+    /// <summary>Who decided this permission request. Absent on completions recorded before this field existed, which consumers must treat as "not a human decision" rather than assuming one. Authorization records are minted only for `human_response`; an assisted-approval verdict, a host policy, an unattended fallback, and a hook resolution all produce the same `result` a person does, so this is the only field that distinguishes them.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("decisionSource")]
+    public PermissionDecisionSource? DecisionSource { get; set; }
+
     /// <summary>Request ID of the resolved permission request; clients should dismiss any UI for this request.</summary>
     [JsonPropertyName("requestId")]
     public required string RequestId { get; set; }
@@ -5209,6 +5280,104 @@ public sealed partial class PermissionCompletedData
     public string? ToolCallId { get; set; }
 }
 
+/// <summary>Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed partial class PermissionCarriedForwardData
+{
+    /// <summary>Always `authorization_carry_forward`. Stated explicitly so a consumer reading this event cannot mistake it for a human, host-policy, or assisted-approval decision.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("decisionSource")]
+    public required PermissionDecisionSource DecisionSource { get; set; }
+
+    /// <summary>Identity of the prior authorization record that contained the proposal.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("recordId")]
+    public required string RecordId { get; set; }
+
+    /// <summary>Authorization edge minted for this admission. Not a prompt id: no prompt was raised, so no client should expect a request with this id.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("requestId")]
+    public required string RequestId { get; set; }
+
+    /// <summary>Tool call this admission authorizes. Its execution receipts the prior grant, which is how a single-effect approval is spent rather than carried forward again.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("toolCallId")]
+    public required string ToolCallId { get; set; }
+}
+
+/// <summary>Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed partial class PermissionMessageAuthorizationData
+{
+    /// <summary>The kind of effect authorized, as an action-class identifier.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("actionClass")]
+    public required string ActionClass { get; set; }
+
+    /// <summary>Whether the claim granted or denied authority.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("polarity")]
+    public required PermissionMessageAuthorizationPolarity Polarity { get; set; }
+
+    /// <summary>Deterministic identity of the record, derived from the turn and span offsets so re-extracting the same span mints nothing new.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("recordId")]
+    public required string RecordId { get; set; }
+
+    /// <summary>End byte offset of the authorizing span within the turn.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("spanEnd")]
+    public required long SpanEnd { get; set; }
+
+    /// <summary>Start byte offset of the authorizing span within the turn.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("spanStart")]
+    public required long SpanStart { get; set; }
+
+    /// <summary>Concrete named targets that appear verbatim inside the span.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("targetMembers")]
+    public string[]? TargetMembers { get; set; }
+
+    /// <summary>The task the permission is scoped to, when the human named one.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("task")]
+    public string? Task { get; set; }
+
+    /// <summary>The human turn the quoted span was read from.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("turnIndex")]
+    public required long TurnIndex { get; set; }
+
+    /// <summary>The trusted version discriminator, when one exists. Exact shell-command grants carry the byte-identical commands grounded in the human span; world-derived classes carry a file object, remote tip, or runner only when that state was captured safely. An opaque object mirroring the runtime's adjacently-tagged resolution.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("world")]
+    public JsonElement? World { get; set; }
+}
+
+/// <summary>Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed partial class PermissionMessageAuthorizationReadData
+{
+    /// <summary>The human turn that was read by the proposer.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("turnIndex")]
+    public required long TurnIndex { get; set; }
+}
+
+/// <summary>Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed partial class PermissionMessageAuthorizationDegradedData
+{
+    /// <summary>The human turn that could not be represented safely.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("turnIndex")]
+    public required long TurnIndex { get; set; }
+}
+
 /// <summary>User input request notification with question and optional predefined choices.</summary>
 public sealed partial class UserInputRequestedData
 {
@@ -8975,6 +9144,18 @@ public override bool? ManagedApprovalRequired
     [JsonPropertyName("requestSandboxPermissive")]
     public bool? RequestSandboxPermissive { get; set; }
 
+    /// <summary>Runtime-resolved canonical object each possiblePaths entry names, keyed by the requested spelling, used for authorization identity checks. Internal and experimental; clients should continue to display possiblePaths.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("resolvedPaths")]
+    public IDictionary<string, string>? ResolvedPaths { get; set; }
+
+    /// <summary>Runtime-resolved canonical working directory the command runs in, used for authorization identity checks. Internal and experimental; clients should not display it.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("resolvedWorkingDirectory")]
+    public string? ResolvedWorkingDirectory { get; set; }
+
     /// <summary>Tool call ID that triggered this permission request.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("toolCallId")]
@@ -9034,6 +9215,12 @@ public override bool? ManagedApprovalRequired
     [JsonPropertyName("requestSandboxBypassReason")]
     public string? RequestSandboxBypassReason { get; set; }
 
+    /// <summary>Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display fileName.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("resolvedPath")]
+    public string? ResolvedPath { get; set; }
+
     /// <summary>Tool call ID that triggered this permission request.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("toolCallId")]
@@ -9075,6 +9262,12 @@ public override bool? ManagedApprovalRequired
     [JsonPropertyName("requestSandboxBypassReason")]
     public string? RequestSandboxBypassReason { get; set; }
 
+    /// <summary>Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display path.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("resolvedPath")]
+    public string? ResolvedPath { get; set; }
+
     /// <summary>Tool call ID that triggered this permission request.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("toolCallId")]
@@ -9602,6 +9795,12 @@ public sealed partial class PermissionPromptRequestWrite : PermissionPromptReque
     [JsonPropertyName("newFileContents")]
     public string? NewFileContents { get; set; }
 
+    /// <summary>Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display fileName.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("resolvedPath")]
+    public string? ResolvedPath { get; set; }
+
     /// <summary>Tool call ID that triggered this permission request.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("toolCallId")]
@@ -9635,6 +9834,12 @@ public sealed partial class PermissionPromptRequestRead : PermissionPromptReques
     [JsonPropertyName("path")]
     public required string Path { get; set; }
 
+    /// <summary>Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display path.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("resolvedPath")]
+    public string? ResolvedPath { get; set; }
+
     /// <summary>Tool call ID that triggered this permission request.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("toolCallId")]
@@ -13864,6 +14069,73 @@ public override void Write(Utf8JsonWriter writer, AbortReason value, JsonSeriali
     }
 }
 
+/// <summary>Transport mechanism: stdio, http, sse (deprecated), or memory (in-process MCP server).</summary>
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct McpServerTransport : IEquatable<McpServerTransport>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="McpServerTransport"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="McpServerTransport"/>.</param>
+    [JsonConstructor]
+    public McpServerTransport(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="McpServerTransport"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>Server communicates over stdio with a local child process.</summary>
+    public static McpServerTransport Stdio { get; } = new("stdio");
+
+    /// <summary>Server communicates over streamable HTTP.</summary>
+    public static McpServerTransport Http { get; } = new("http");
+
+    /// <summary>Server communicates over Server-Sent Events (deprecated).</summary>
+    public static McpServerTransport Sse { get; } = new("sse");
+
+    /// <summary>Server is backed by an in-memory runtime implementation.</summary>
+    public static McpServerTransport Memory { get; } = new("memory");
+
+    /// <summary>Returns a value indicating whether two <see cref="McpServerTransport"/> instances are equivalent.</summary>
+    public static bool operator ==(McpServerTransport left, McpServerTransport right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="McpServerTransport"/> instances are not equivalent.</summary>
+    public static bool operator !=(McpServerTransport left, McpServerTransport right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is McpServerTransport other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(McpServerTransport other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{McpServerTransport}"/> for serializing <see cref="McpServerTransport"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<McpServerTransport>
+    {
+        /// <inheritdoc />
+        public override McpServerTransport Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, McpServerTransport value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(McpServerTransport));
+        }
+    }
+}
+
 /// <summary>Allowed values for the `ToolExecutionStartToolDescriptionMetaUIVisibility` enumeration.</summary>
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
@@ -15196,6 +15468,138 @@ public override void Write(Utf8JsonWriter writer, PermissionPromptRequestPathAcc
     }
 }
 
+/// <summary>Controlled reason or actor responsible for a permission response.</summary>
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct PermissionDecisionSource : IEquatable<PermissionDecisionSource>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="PermissionDecisionSource"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="PermissionDecisionSource"/>.</param>
+    [JsonConstructor]
+    public PermissionDecisionSource(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="PermissionDecisionSource"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>The response followed the assisted-approval judge recommendation.</summary>
+    public static PermissionDecisionSource AssistedApproval { get; } = new("assisted_approval");
+
+    /// <summary>A human supplied the response through an interactive prompt.</summary>
+    public static PermissionDecisionSource HumanResponse { get; } = new("human_response");
+
+    /// <summary>The host applied a standing policy or override rather than a judge recommendation or human decision.</summary>
+    public static PermissionDecisionSource HostPolicy { get; } = new("host_policy");
+
+    /// <summary>The host denied the request because no interactive user response was available.</summary>
+    public static PermissionDecisionSource UnattendedFallback { get; } = new("unattended_fallback");
+
+    /// <summary>A live authorization record from an earlier human decision in this session contained the proposal, so it ran without another prompt. This is not a new human decision and never mints authority of its own.</summary>
+    public static PermissionDecisionSource AuthorizationCarryForward { get; } = new("authorization_carry_forward");
+
+    /// <summary>Returns a value indicating whether two <see cref="PermissionDecisionSource"/> instances are equivalent.</summary>
+    public static bool operator ==(PermissionDecisionSource left, PermissionDecisionSource right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="PermissionDecisionSource"/> instances are not equivalent.</summary>
+    public static bool operator !=(PermissionDecisionSource left, PermissionDecisionSource right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is PermissionDecisionSource other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(PermissionDecisionSource other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{PermissionDecisionSource}"/> for serializing <see cref="PermissionDecisionSource"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<PermissionDecisionSource>
+    {
+        /// <inheritdoc />
+        public override PermissionDecisionSource Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, PermissionDecisionSource value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(PermissionDecisionSource));
+        }
+    }
+}
+
+/// <summary>Which direction a message-backed authorization claim moves authority in.</summary>
+[Experimental(Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct PermissionMessageAuthorizationPolarity : IEquatable<PermissionMessageAuthorizationPolarity>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="PermissionMessageAuthorizationPolarity"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="PermissionMessageAuthorizationPolarity"/>.</param>
+    [JsonConstructor]
+    public PermissionMessageAuthorizationPolarity(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="PermissionMessageAuthorizationPolarity"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>The human's words authorized an effect.</summary>
+    public static PermissionMessageAuthorizationPolarity Grant { get; } = new("grant");
+
+    /// <summary>The human's words refused an effect.</summary>
+    public static PermissionMessageAuthorizationPolarity Denial { get; } = new("denial");
+
+    /// <summary>Returns a value indicating whether two <see cref="PermissionMessageAuthorizationPolarity"/> instances are equivalent.</summary>
+    public static bool operator ==(PermissionMessageAuthorizationPolarity left, PermissionMessageAuthorizationPolarity right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="PermissionMessageAuthorizationPolarity"/> instances are not equivalent.</summary>
+    public static bool operator !=(PermissionMessageAuthorizationPolarity left, PermissionMessageAuthorizationPolarity right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is PermissionMessageAuthorizationPolarity other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(PermissionMessageAuthorizationPolarity other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{PermissionMessageAuthorizationPolarity}"/> for serializing <see cref="PermissionMessageAuthorizationPolarity"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<PermissionMessageAuthorizationPolarity>
+    {
+        /// <inheritdoc />
+        public override PermissionMessageAuthorizationPolarity Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, PermissionMessageAuthorizationPolarity value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(PermissionMessageAuthorizationPolarity));
+        }
+    }
+}
+
 /// <summary>Elicitation mode; "form" for structured input, "url" for browser-based. Defaults to "form" when absent.</summary>
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
@@ -16467,73 +16871,6 @@ public override void Write(Utf8JsonWriter writer, McpServerStatus value, JsonSer
     }
 }
 
-/// <summary>Transport mechanism: stdio, http, sse (deprecated), or memory (in-process MCP server).</summary>
-[JsonConverter(typeof(Converter))]
-[DebuggerDisplay("{Value,nq}")]
-public readonly struct McpServerTransport : IEquatable<McpServerTransport>
-{
-    private readonly string? _value;
-
-    /// <summary>Initializes a new instance of the <see cref="McpServerTransport"/> struct.</summary>
-    /// <param name="value">The value to associate with this <see cref="McpServerTransport"/>.</param>
-    [JsonConstructor]
-    public McpServerTransport(string value)
-    {
-        ArgumentException.ThrowIfNullOrWhiteSpace(value);
-        _value = value;
-    }
-
-    /// <summary>Gets the value associated with this <see cref="McpServerTransport"/>.</summary>
-    public string Value => _value ?? string.Empty;
-
-    /// <summary>Server communicates over stdio with a local child process.</summary>
-    public static McpServerTransport Stdio { get; } = new("stdio");
-
-    /// <summary>Server communicates over streamable HTTP.</summary>
-    public static McpServerTransport Http { get; } = new("http");
-
-    /// <summary>Server communicates over Server-Sent Events (deprecated).</summary>
-    public static McpServerTransport Sse { get; } = new("sse");
-
-    /// <summary>Server is backed by an in-memory runtime implementation.</summary>
-    public static McpServerTransport Memory { get; } = new("memory");
-
-    /// <summary>Returns a value indicating whether two <see cref="McpServerTransport"/> instances are equivalent.</summary>
-    public static bool operator ==(McpServerTransport left, McpServerTransport right) => left.Equals(right);
-
-    /// <summary>Returns a value indicating whether two <see cref="McpServerTransport"/> instances are not equivalent.</summary>
-    public static bool operator !=(McpServerTransport left, McpServerTransport right) => !(left == right);
-
-    /// <inheritdoc />
-    public override bool Equals(object? obj) => obj is McpServerTransport other && Equals(other);
-
-    /// <inheritdoc />
-    public bool Equals(McpServerTransport other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
-
-    /// <inheritdoc />
-    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
-
-    /// <inheritdoc />
-    public override string ToString() => Value;
-
-    /// <summary>Provides a <see cref="JsonConverter{McpServerTransport}"/> for serializing <see cref="McpServerTransport"/> instances.</summary>
-    [EditorBrowsable(EditorBrowsableState.Never)]
-    public sealed class Converter : JsonConverter<McpServerTransport>
-    {
-        /// <inheritdoc />
-        public override McpServerTransport Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
-        {
-            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
-        }
-
-        /// <inheritdoc />
-        public override void Write(Utf8JsonWriter writer, McpServerTransport value, JsonSerializerOptions options)
-        {
-            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(McpServerTransport));
-        }
-    }
-}
-
 /// <summary>Discovery source.</summary>
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
@@ -16851,8 +17188,16 @@ public override void Write(Utf8JsonWriter writer, ExtensionsLoadedExtensionStatu
 [JsonSerializable(typeof(PendingMessagesModifiedData))]
 [JsonSerializable(typeof(PendingMessagesModifiedEvent))]
 [JsonSerializable(typeof(PermissionAssistedApproval))]
+[JsonSerializable(typeof(PermissionCarriedForwardData))]
+[JsonSerializable(typeof(PermissionCarriedForwardEvent))]
 [JsonSerializable(typeof(PermissionCompletedData))]
 [JsonSerializable(typeof(PermissionCompletedEvent))]
+[JsonSerializable(typeof(PermissionMessageAuthorizationData))]
+[JsonSerializable(typeof(PermissionMessageAuthorizationDegradedData))]
+[JsonSerializable(typeof(PermissionMessageAuthorizationDegradedEvent))]
+[JsonSerializable(typeof(PermissionMessageAuthorizationEvent))]
+[JsonSerializable(typeof(PermissionMessageAuthorizationReadData))]
+[JsonSerializable(typeof(PermissionMessageAuthorizationReadEvent))]
 [JsonSerializable(typeof(PermissionPromptRequest))]
 [JsonSerializable(typeof(PermissionPromptRequestCommands))]
 [JsonSerializable(typeof(PermissionPromptRequestCustomTool))]
diff --git a/go/rpc/zrpc.go b/go/rpc/zrpc.go
index fcdd3875de..fe6665e4e1 100644
--- a/go/rpc/zrpc.go
+++ b/go/rpc/zrpc.go
@@ -1504,6 +1504,10 @@ type CatalogAiSkillCandidate struct {
 	// Where the card came from: exactly one of a URL or embedded data, encoded as a tagged
 	// union so neither both nor neither can be represented.
 	Source CatalogCandidateSource `json:"source"`
+	// Versioned trust metadata observed from the catalog authority. Optional for protocol-3
+	// compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits
+	// an explicit snapshot even when the authority omitted or malformed its trust field.
+	Trust CatalogTrustSnapshot `json:"trust,omitempty"`
 }
 
 func (CatalogAiSkillCandidate) catalogCandidate() {}
@@ -1538,6 +1542,10 @@ type CatalogMCPServerCandidate struct {
 	// Where the card came from: exactly one of a URL or embedded data, encoded as a tagged
 	// union so neither both nor neither can be represented.
 	Source CatalogCandidateSource `json:"source"`
+	// Versioned trust metadata observed from the catalog authority. Optional for protocol-3
+	// compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits
+	// an explicit snapshot even when the authority omitted or malformed its trust field.
+	Trust CatalogTrustSnapshot `json:"trust,omitempty"`
 }
 
 func (CatalogMCPServerCandidate) catalogCandidate() {}
@@ -1769,9 +1777,12 @@ type CatalogNegotiationRefusedError struct {
 	Reason CatalogNegotiationRefusedReason `json:"reason"`
 	// Protocol version of the runtime that refused the request.
 	RuntimeProtocolVersion int64 `json:"runtimeProtocolVersion"`
-	// Every wire feature this runtime understands, so the caller can retry within that
-	// contract. This list does not imply that every deployment has enabled every operation.
-	SupportedCapabilities []CatalogCapability `json:"supportedCapabilities"`
+	// Capabilities this runtime can safely advertise to this caller. The complete
+	// five-capability protocol-3 legacy set is always present; every capability added after
+	// that baseline appears only when the caller required it, so an older closed-enum decoder
+	// can still consume a refusal. This list does not imply that every deployment has enabled
+	// every operation.
+	SupportedCapabilities []string `json:"supportedCapabilities"`
 	// The subset of the caller's bounded extensible capability identifiers this runtime cannot
 	// honour.
 	UnsupportedCapabilities []string `json:"unsupportedCapabilities"`
@@ -1899,6 +1910,177 @@ func (CatalogUnsupportedKindError) Kind() CatalogSearchResultKind {
 	return CatalogSearchResultKindUnsupportedKind
 }
 
+// Where and when the runtime observed the trust metadata. Observation time is not the
+// authority's evaluation time and must not be used to infer staleness.
+// Experimental: CatalogTrustProvenance is part of an experimental API and may change or be
+// removed.
+type CatalogTrustProvenance struct {
+	// ISO 8601 timestamp with a timezone offset at which the runtime observed the search result
+	// carrying this trust field.
+	ObservedAt time.Time `json:"observedAt"`
+	// Bounded authority that supplied the trust field.
+	Source CatalogTrustSource `json:"source"`
+}
+
+// A versioned, bounded trust observation carried unchanged with a catalog candidate and its
+// private handle context. Current observations require a recognised T1/T2 tier; every
+// non-current state structurally forbids a tier. Eligibility remains `unknown` while Agent
+// Finder supplies no exposure decision, and states absent from its current wire are never
+// inferred from age, relevance, popularity, or a tier transition.
+// Experimental: CatalogTrustSnapshot is part of an experimental API and may change or be
+// removed.
+type CatalogTrustSnapshot interface {
+	catalogTrustSnapshot()
+	SchemaVersion() CatalogTrustSnapshotSchemaVersion
+}
+
+type RawCatalogTrustSnapshotData struct {
+	Discriminator CatalogTrustSnapshotSchemaVersion
+	Raw           json.RawMessage
+}
+
+func (RawCatalogTrustSnapshotData) catalogTrustSnapshot() {}
+func (r RawCatalogTrustSnapshotData) SchemaVersion() CatalogTrustSnapshotSchemaVersion {
+	return r.Discriminator
+}
+
+// Discriminator: the authority omitted trust metadata.
+// Experimental: CatalogTrustSnapshotAbsent is part of an experimental API and may change or
+// be removed.
+type CatalogTrustSnapshotAbsent struct {
+	// Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+	// no explicit eligibility field.
+	Eligibility CatalogTrustEligibility `json:"eligibility"`
+	// Bounded source and observation time for this snapshot. This is distinct from evidence
+	// used by the authority to calculate trust.
+	Provenance CatalogTrustProvenance `json:"provenance"`
+	// Discriminator: the authority omitted trust metadata.
+	Status CatalogTrustSnapshotAbsentStatus `json:"status"`
+}
+
+func (CatalogTrustSnapshotAbsent) catalogTrustSnapshot() {}
+func (CatalogTrustSnapshotAbsent) SchemaVersion() CatalogTrustSnapshotSchemaVersion {
+	return CatalogTrustSnapshotSchemaVersionV1
+}
+
+// A recognised current Agent Finder T1 or T2 trust tier.
+// Experimental: CatalogTrustSnapshotCurrent is part of an experimental API and may change
+// or be removed.
+type CatalogTrustSnapshotCurrent struct {
+	// Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+	// no explicit eligibility field.
+	Eligibility CatalogTrustEligibility `json:"eligibility"`
+	// Bounded source and observation time for this snapshot. This is distinct from evidence
+	// used by the authority to calculate trust.
+	Provenance CatalogTrustProvenance `json:"provenance"`
+	// Discriminator: a recognised current trust tier was observed.
+	Status CatalogTrustSnapshotCurrentStatus `json:"status"`
+	// Service-computed T1 or T2 trust tier.
+	Tier CatalogTrustTier `json:"tier"`
+}
+
+func (CatalogTrustSnapshotCurrent) catalogTrustSnapshot() {}
+func (CatalogTrustSnapshotCurrent) SchemaVersion() CatalogTrustSnapshotSchemaVersion {
+	return CatalogTrustSnapshotSchemaVersionV1
+}
+
+// Discriminator: the authority explicitly reported a downgraded assessment.
+// Experimental: CatalogTrustSnapshotDowngraded is part of an experimental API and may
+// change or be removed.
+type CatalogTrustSnapshotDowngraded struct {
+	// Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+	// no explicit eligibility field.
+	Eligibility CatalogTrustEligibility `json:"eligibility"`
+	// Bounded source and observation time for this snapshot. This is distinct from evidence
+	// used by the authority to calculate trust.
+	Provenance CatalogTrustProvenance `json:"provenance"`
+	// Discriminator: the authority explicitly reported a downgraded assessment.
+	Status CatalogTrustSnapshotDowngradedStatus `json:"status"`
+}
+
+func (CatalogTrustSnapshotDowngraded) catalogTrustSnapshot() {}
+func (CatalogTrustSnapshotDowngraded) SchemaVersion() CatalogTrustSnapshotSchemaVersion {
+	return CatalogTrustSnapshotSchemaVersionV1
+}
+
+// Discriminator: the trust field was empty, unbounded, or had the wrong JSON type.
+// Experimental: CatalogTrustSnapshotMalformed is part of an experimental API and may change
+// or be removed.
+type CatalogTrustSnapshotMalformed struct {
+	// Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+	// no explicit eligibility field.
+	Eligibility CatalogTrustEligibility `json:"eligibility"`
+	// Bounded source and observation time for this snapshot. This is distinct from evidence
+	// used by the authority to calculate trust.
+	Provenance CatalogTrustProvenance `json:"provenance"`
+	// Discriminator: the trust field was empty, unbounded, or had the wrong JSON type.
+	Status CatalogTrustSnapshotMalformedStatus `json:"status"`
+}
+
+func (CatalogTrustSnapshotMalformed) catalogTrustSnapshot() {}
+func (CatalogTrustSnapshotMalformed) SchemaVersion() CatalogTrustSnapshotSchemaVersion {
+	return CatalogTrustSnapshotSchemaVersionV1
+}
+
+// Discriminator: the authority explicitly revoked the assessment.
+// Experimental: CatalogTrustSnapshotRevoked is part of an experimental API and may change
+// or be removed.
+type CatalogTrustSnapshotRevoked struct {
+	// Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+	// no explicit eligibility field.
+	Eligibility CatalogTrustEligibility `json:"eligibility"`
+	// Bounded source and observation time for this snapshot. This is distinct from evidence
+	// used by the authority to calculate trust.
+	Provenance CatalogTrustProvenance `json:"provenance"`
+	// Discriminator: the authority explicitly revoked the assessment.
+	Status CatalogTrustSnapshotRevokedStatus `json:"status"`
+}
+
+func (CatalogTrustSnapshotRevoked) catalogTrustSnapshot() {}
+func (CatalogTrustSnapshotRevoked) SchemaVersion() CatalogTrustSnapshotSchemaVersion {
+	return CatalogTrustSnapshotSchemaVersionV1
+}
+
+// Discriminator: the authority explicitly marked the assessment stale.
+// Experimental: CatalogTrustSnapshotStale is part of an experimental API and may change or
+// be removed.
+type CatalogTrustSnapshotStale struct {
+	// Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+	// no explicit eligibility field.
+	Eligibility CatalogTrustEligibility `json:"eligibility"`
+	// Bounded source and observation time for this snapshot. This is distinct from evidence
+	// used by the authority to calculate trust.
+	Provenance CatalogTrustProvenance `json:"provenance"`
+	// Discriminator: the authority explicitly marked the assessment stale.
+	Status CatalogTrustSnapshotStaleStatus `json:"status"`
+}
+
+func (CatalogTrustSnapshotStale) catalogTrustSnapshot() {}
+func (CatalogTrustSnapshotStale) SchemaVersion() CatalogTrustSnapshotSchemaVersion {
+	return CatalogTrustSnapshotSchemaVersionV1
+}
+
+// Discriminator: the authority supplied a bounded trust value this runtime does not
+// understand.
+// Experimental: CatalogTrustSnapshotUnsupported is part of an experimental API and may
+// change or be removed.
+type CatalogTrustSnapshotUnsupported struct {
+	// Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+	// no explicit eligibility field.
+	Eligibility CatalogTrustEligibility `json:"eligibility"`
+	// Bounded source and observation time for this snapshot. This is distinct from evidence
+	// used by the authority to calculate trust.
+	Provenance CatalogTrustProvenance `json:"provenance"`
+	// Discriminator: the authority supplied a bounded trust value this runtime does not
+	// understand.
+	Status CatalogTrustSnapshotUnsupportedStatus `json:"status"`
+}
+
+func (CatalogTrustSnapshotUnsupported) catalogTrustSnapshot() {}
+func (CatalogTrustSnapshotUnsupported) SchemaVersion() CatalogTrustSnapshotSchemaVersion {
+	return CatalogTrustSnapshotSchemaVersionV1
+}
+
 // Client-owned, case-sensitive string metadata persisted with a local session. Clients
 // should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys
 // under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8
@@ -2264,7 +2446,7 @@ type CopilotUserResponse struct {
 	Login *string `json:"login,omitempty"`
 	// Per-category monthly quota allotments, keyed by quota category.
 	MonthlyQuotas map[string]float64 `json:"monthly_quotas,omitzero"`
-	// Organizations the user belongs to, each with an optional login and display name.
+	// Organizations the user belongs to, each with an optional ID, login, and display name.
 	OrganizationList []CopilotUserResponseOrganizationListItem `json:"organization_list,omitzero"`
 	// Logins of the organizations the user belongs to.
 	OrganizationLoginList []string `json:"organization_login_list,omitzero"`
@@ -2303,6 +2485,8 @@ type CopilotUserResponseEndpoints struct {
 }
 
 type CopilotUserResponseOrganizationListItem struct {
+	// Numeric database ID of the organization.
+	ID *float64 `json:"id,omitempty"`
 	// GitHub login of the organization.
 	Login *string `json:"login,omitempty"`
 	// Display name of the organization.
@@ -2841,16 +3025,14 @@ type EventsReadResult struct {
 	// backward read this cursor pages toward OLDER events; keep passing `direction: backward`
 	// with it (the cursor is also self-describing, so backward paging continues correctly).
 	Cursor string `json:"cursor"`
-	// Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor
-	// referred to an event that no longer exists in history (e.g. truncated or compacted away)
-	// and the read fell back to a boundary of the remaining history. For a forward read the
-	// fallback starts from the beginning of the remaining history; for a backward read it falls
-	// back to the tail (the newest window). Because the fallback page is a fresh boundary
-	// snapshot rather than a continuation of the requested cursor, it may overlap events the
-	// consumer has already rendered — a backward fallback to the tail in particular can repeat
-	// the newest window. On 'expired', consumers should reset or rebase their local pagination
-	// state (or deduplicate by event id) before continuing from the returned cursor rather than
-	// blindly appending/prepending the fallback page.
+	// Cursor status: 'ok' means the cursor was applied successfully. For session.eventLog.read,
+	// 'expired' means the cursor referred to an event that no longer exists in active history
+	// and the read fell back to a boundary of the remaining history: the beginning for a
+	// forward read or the newest window for a backward read. That fallback may overlap already
+	// rendered events, so active-session consumers should reset, rebase, or deduplicate before
+	// continuing. sessions.readPersistedEvents has stricter snapshot semantics: 'expired'
+	// returns an empty terminal page and never switches to a replacement journal generation.
+	// Other persisted-read I/O failures are RPC errors with diagnostics, not cursor expiry.
 	CursorStatus EventsCursorStatus `json:"cursorStatus"`
 	// Session events for this batch, merged into a single stream in creation order: durable
 	// (persisted) events and ephemeral events interleave exactly as they were emitted. Set
@@ -2859,9 +3041,10 @@ type EventsReadResult struct {
 	// reading with a non-zero `waitMs`. For a backward (tail-first) read, the returned window
 	// contains persisted events only, still in chronological (oldest-to-newest) append order.
 	Events []SessionEvent `json:"events"`
-	// True when more events are available in the read's direction. For a forward read, true
-	// means the batch returned `max` events and more are available immediately. For a backward
-	// read, true means older persisted events remain before the returned window.
+	// True when more events are available in the read's direction. For a backward read, true
+	// means older persisted events remain before the returned window. A persisted-event page
+	// may contain fewer than `max` events because of its byte budget while still reporting
+	// hasMore true; continue according to this flag rather than the event count.
 	HasMore bool `json:"hasMore"`
 }
 
@@ -3965,12 +4148,24 @@ type FilterMappingEnumMap map[string]ContentFilterMode
 
 func (FilterMappingEnumMap) filterMapping() {}
 
-// Optional user prompt to combine with the fleet orchestration instructions.
+// Parameters for starting fleet orchestration: an optional user prompt combined with the
+// fleet instructions, plus the send options forwarded to the resulting turn.
 // Experimental: FleetStartRequest is part of an experimental API and may change or be
 // removed.
 type FleetStartRequest struct {
+	// Optional attachments (files, directories, selections, blobs, GitHub references) to
+	// include with the fleet request
+	Attachments []Attachment `json:"attachments,omitzero"`
+	// If false, this request will not trigger a Premium Request Unit charge. User requests
+	// default to billable.
+	// Internal: Billable is part of the SDK's internal API surface and is not intended for
+	// external use.
+	Billable *bool `json:"billable,omitempty"`
 	// Optional user prompt to combine with fleet instructions
 	Prompt *string `json:"prompt,omitempty"`
+	// If true, await completion of the agentic loop for this fleet request before returning.
+	// Defaults to false.
+	Wait *bool `json:"wait,omitempty"`
 }
 
 // Indicates whether fleet mode was successfully activated.
@@ -7226,6 +7421,9 @@ type ModelApplyStartupOverlayRequest struct {
 	// managed sources: it applies only when neither device nor server policy names a model, and
 	// an explicit user selection still wins.
 	PolicyHelperModel *string `json:"policyHelperModel,omitempty"`
+	// Auto routing preference selected by repository settings, when configured. Applied only
+	// when the overlay selects the Auto model; beside a concrete model it stays dormant.
+	RepoAutoTier *string `json:"repoAutoTier,omitempty"`
 	// Context tier selected by repository settings, when configured.
 	RepoContextTier *string `json:"repoContextTier,omitempty"`
 	// Model selected by repository settings, when configured.
@@ -7681,6 +7879,9 @@ type ModelWarningText struct {
 type ModeSetRequest struct {
 	// Explicit response to a model-switch compaction preflight.
 	CompactionDecision *string `json:"compactionDecision,omitempty"`
+	// Mode the session must currently be in for the change to apply. When set and the session
+	// is in a different mode the request is a no-op and reports status 'unchanged'.
+	ExpectedMode *SessionMode `json:"expectedMode,omitempty"`
 	// Session whose plan-mode base state should be inherited.
 	InheritPlanBaseFromSessionID *string `json:"inheritPlanBaseFromSessionId,omitempty"`
 	// The session mode the agent is operating in
@@ -7717,6 +7918,10 @@ type ModeSetResult struct {
 	DeprecationWarnings []string `json:"deprecationWarnings,omitzero"`
 	// User-facing outcome message for the model switch triggered by the mode change.
 	Message *string `json:"message,omitempty"`
+	// Whether the requested mode was applied to the session. False only when an 'expectedMode'
+	// precondition did not hold, in which case any model change reported alongside it was still
+	// applied.
+	ModeApplied *bool `json:"modeApplied,omitempty"`
 	// Whether applying the mode changed the active model.
 	ModelChanged bool `json:"modelChanged"`
 	// Lifecycle status of the requested mode change.
@@ -12539,6 +12744,9 @@ type SessionOpenOptions struct {
 	ReasoningEffort *string `json:"reasoningEffort,omitempty"`
 	// Initial reasoning summary mode for supported model clients.
 	ReasoningSummary *SessionOpenOptionsReasoningSummary `json:"reasoningSummary,omitempty"`
+	// Whether to invalidate cached custom-instruction discovery before constructing the
+	// session. Use when instruction files may have changed earlier in the same runtime process.
+	RefreshCustomInstructions *bool `json:"refreshCustomInstructions,omitempty"`
 	// Telemetry-only remote-defaulted flag.
 	RemoteDefaultedOn *bool `json:"remoteDefaultedOn,omitempty"`
 	// Telemetry-only remote exporting flag.
@@ -13483,12 +13691,17 @@ type SessionsPruneOldRequest struct {
 // Experimental: SessionsReadPersistedEventsRequest is part of an experimental API and may
 // change or be removed.
 type SessionsReadPersistedEventsRequest struct {
-	// Opaque cursor returned by a previous persisted-event read. Omit on the first call.
+	// Opaque, process-local, single-use cursor returned by the previous persisted-event read.
+	// Omit on the first call and issue continuations sequentially; reusing the same cursor
+	// returns an expired terminal page.
 	Cursor *string `json:"cursor,omitempty"`
 	// Direction to page through persisted history. Forward starts at the beginning; backward
-	// starts with the newest events. Events in each page remain chronological.
+	// starts with the newest events. Events in each page remain chronological. This selects the
+	// initial read only; a continuation always uses the direction bound into its cursor.
 	Direction *EventsReadDirection `json:"direction,omitempty"`
-	// Maximum number of events to return in this batch (1–1000, default 200).
+	// Maximum number of events to return in this batch (1–1000, default 200). Pages may contain
+	// fewer events to keep the serialized event array within a soft 1 MiB budget including
+	// resolved binary assets; one oversized event is returned alone to guarantee progress.
 	Max *int64 `json:"max,omitempty"`
 	// Session ID whose persisted event journal should be read.
 	SessionID string `json:"sessionId"`
@@ -16942,6 +17155,9 @@ const (
 	// Understands plans that enumerate every eligible transport rather than a single preferred
 	// one.
 	CatalogCapabilityMultipleTransportChoice CatalogCapability = "multiple-transport-choice"
+	// Understands versioned candidate trust snapshots. Protocol-3 callers must require this
+	// capability before the runtime adds the optional snapshot field.
+	CatalogCapabilityTrustSnapshot CatalogCapability = "trust-snapshot"
 )
 
 // Which wire-contract rule an upstream response broke
@@ -17128,6 +17344,125 @@ const (
 	CatalogSearchResultKindUnsupportedKind        CatalogSearchResultKind = "unsupported-kind"
 )
 
+// Authority-computed exposure eligibility, kept separate from tier. The current tier-only
+// Agent Finder response maps to `unknown`, never to a locally inferred eligibility.
+// Experimental: CatalogTrustEligibility is part of an experimental API and may change or be
+// removed.
+type CatalogTrustEligibility string
+
+const (
+	// Eligible for default catalogue exposure.
+	CatalogTrustEligibilityDefault CatalogTrustEligibility = "default"
+	// Eligible only when expanded or community results are requested.
+	CatalogTrustEligibilityExpanded CatalogTrustEligibility = "expanded"
+	// Not eligible for normal catalogue exposure.
+	CatalogTrustEligibilityHidden CatalogTrustEligibility = "hidden"
+	// The authority did not supply an eligibility decision.
+	CatalogTrustEligibilityUnknown CatalogTrustEligibility = "unknown"
+)
+
+// The authority omitted trust metadata.
+// Experimental: CatalogTrustSnapshotAbsentStatus is part of an experimental API and may
+// change or be removed.
+type CatalogTrustSnapshotAbsentStatus string
+
+const (
+	// The authority omitted trust metadata.
+	CatalogTrustSnapshotAbsentStatusAbsent CatalogTrustSnapshotAbsentStatus = "absent"
+)
+
+// A recognised T1 or T2 service tier was observed.
+// Experimental: CatalogTrustSnapshotCurrentStatus is part of an experimental API and may
+// change or be removed.
+type CatalogTrustSnapshotCurrentStatus string
+
+const (
+	// A recognised T1 or T2 service tier was observed.
+	CatalogTrustSnapshotCurrentStatusCurrent CatalogTrustSnapshotCurrentStatus = "current"
+)
+
+// The authority explicitly reported a downgraded assessment.
+// Experimental: CatalogTrustSnapshotDowngradedStatus is part of an experimental API and may
+// change or be removed.
+type CatalogTrustSnapshotDowngradedStatus string
+
+const (
+	// The authority explicitly reported a downgraded assessment.
+	CatalogTrustSnapshotDowngradedStatusDowngraded CatalogTrustSnapshotDowngradedStatus = "downgraded"
+)
+
+// The trust field was empty, unbounded, or had the wrong JSON type.
+// Experimental: CatalogTrustSnapshotMalformedStatus is part of an experimental API and may
+// change or be removed.
+type CatalogTrustSnapshotMalformedStatus string
+
+const (
+	// The trust field was empty, unbounded, or had the wrong JSON type.
+	CatalogTrustSnapshotMalformedStatusMalformed CatalogTrustSnapshotMalformedStatus = "malformed"
+)
+
+// The authority explicitly revoked its assessment.
+// Experimental: CatalogTrustSnapshotRevokedStatus is part of an experimental API and may
+// change or be removed.
+type CatalogTrustSnapshotRevokedStatus string
+
+const (
+	// The authority explicitly revoked its assessment.
+	CatalogTrustSnapshotRevokedStatusRevoked CatalogTrustSnapshotRevokedStatus = "revoked"
+)
+
+// SchemaVersion discriminator for CatalogTrustSnapshot.
+// Experimental: CatalogTrustSnapshotSchemaVersion is part of an experimental API and may
+// change or be removed.
+type CatalogTrustSnapshotSchemaVersion string
+
+const (
+	CatalogTrustSnapshotSchemaVersionV1 CatalogTrustSnapshotSchemaVersion = "v1"
+)
+
+// The authority explicitly marked its assessment stale.
+// Experimental: CatalogTrustSnapshotStaleStatus is part of an experimental API and may
+// change or be removed.
+type CatalogTrustSnapshotStaleStatus string
+
+const (
+	// The authority explicitly marked its assessment stale.
+	CatalogTrustSnapshotStaleStatusStale CatalogTrustSnapshotStaleStatus = "stale"
+)
+
+// The authority supplied a bounded trust value this runtime does not understand.
+// Experimental: CatalogTrustSnapshotUnsupportedStatus is part of an experimental API and
+// may change or be removed.
+type CatalogTrustSnapshotUnsupportedStatus string
+
+const (
+	// The authority supplied a bounded trust value this runtime does not understand.
+	CatalogTrustSnapshotUnsupportedStatusUnsupported CatalogTrustSnapshotUnsupportedStatus = "unsupported"
+)
+
+// Bounded authority that supplied a catalogue trust observation
+// Experimental: CatalogTrustSource is part of an experimental API and may change or be
+// removed.
+type CatalogTrustSource string
+
+const (
+	// GitHub Agent Finder supplied the trust field on its search result.
+	CatalogTrustSourceAgentFinder CatalogTrustSource = "agent-finder"
+)
+
+// Service-computed trust tier currently emitted by Agent Finder. It is independent of
+// search score, popularity, and client-side ranking.
+// Experimental: CatalogTrustTier is part of an experimental API and may change or be
+// removed.
+type CatalogTrustTier string
+
+const (
+	// Tier one as assigned by the catalogue authority.
+	CatalogTrustTierT1 CatalogTrustTier = "T1"
+	// Tier two as assigned by the catalogue authority.
+	CatalogTrustTierT2 CatalogTrustTier = "T2"
+)
+
 // Why a catalog operation is not available on this runtime
 // Experimental: CatalogUnavailableReason is part of an experimental API and may change or
 // be removed.
@@ -17381,21 +17716,20 @@ const (
 	EventsAgentScopePrimary EventsAgentScope = "primary"
 )
 
-// Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor
-// referred to an event that no longer exists in history (e.g. truncated or compacted away)
-// and the read fell back to a boundary of the remaining history (the beginning for a
-// forward read, the tail for a backward read). The fallback page is a fresh boundary
-// snapshot, not a continuation of the requested cursor, so it may overlap already-rendered
-// events; on 'expired' a consumer should reset/rebase its pagination state (or deduplicate
-// by event id) before continuing from the returned cursor.
+// Cursor status: 'ok' means the read succeeded against the requested history; 'expired'
+// means the requested continuation is unavailable. Recovery is endpoint-specific:
+// session.eventLog.read returns a boundary window of remaining active history that may
+// overlap prior pages, while sessions.readPersistedEvents returns an empty terminal page
+// and never switches journal generations. An expired persisted read is not successful
+// completion; a complete persisted snapshot requires cursorStatus 'ok' and hasMore false.
 // Experimental: EventsCursorStatus is part of an experimental API and may change or be
 // removed.
 type EventsCursorStatus string
 
 const (
-	// The cursor referred to history that is no longer available.
+	// The requested continuation is unavailable; see the endpoint's recovery semantics.
 	EventsCursorStatusExpired EventsCursorStatus = "expired"
-	// The cursor was applied successfully.
+	// The read succeeded against the requested history.
 	EventsCursorStatusOk EventsCursorStatus = "ok"
 )
 
@@ -18764,6 +19098,10 @@ type PermissionDecisionSource string
 const (
 	// The response followed the assisted-approval judge recommendation.
 	PermissionDecisionSourceAssistedApproval PermissionDecisionSource = "assisted_approval"
+	// A live authorization record from an earlier human decision in this session contained the
+	// proposal, so it ran without another prompt. This is not a new human decision and never
+	// mints authority of its own.
+	PermissionDecisionSourceAuthorizationCarryForward PermissionDecisionSource = "authorization_carry_forward"
 	// The host applied a standing policy or override rather than a judge recommendation or
 	// human decision.
 	PermissionDecisionSourceHostPolicy PermissionDecisionSource = "host_policy"
@@ -21546,10 +21884,30 @@ func (a *ServerSessionsAPI) PruneOld(ctx context.Context, params *SessionsPruneO
 }
 
 // ReadPersistedEvents reads a page of durable events directly from a local session's
-// persisted journal without creating, resuming, or activating the session. The initial
-// backward read uses a bounded tail scan for fast first paint; cursor continuations
-// preserve the session event-log paging semantics. Persisted events may omit payloads that
-// are reconstructed only for an active session.
+// persisted journal without creating, resuming, or activating the session. The first read
+// pins the currently opened journal generation and its byte-length boundary; opaque cursor
+// continuations remain on that generation across runtime-owned compaction, truncation, and
+// rewrite operations, which replace the live path atomically, and events appended after the
+// boundary are excluded. For cold hydration, await the first successful page before
+// activation and establish lossless live-event buffering before resume; merge subsequent
+// live events by ID, preserving persisted order and letting live payloads win.
+// Continuations are process-local, single-use capabilities bound to the originating session
+// and storage context and must be paged sequentially; concurrent or repeated use of the
+// same cursor expires that duplicate read rather than reading the generation twice. A
+// complete snapshot has cursorStatus 'ok' and hasMore false. Snapshots expire after five
+// idle minutes, with at most eight retained per process and idle-only eviction under
+// pressure; completion and cancelled-worker exit release their handles. No transcript copy
+// is created, but retained handles may keep replaced files' disk blocks alive until
+// release. Pages have a soft 1 MiB serialized event-array budget including resolved binary
+// assets; one oversized event is returned alone to guarantee progress. Working memory also
+// includes a record/lookahead and asset resolution; resolving the first binary reference
+// may scan the full pinned generation to build a bounded offset index. If the snapshot
+// expires, is evicted, is cancelled before a continuation is established, or becomes
+// unreadable after an observable unsupported in-place shortening, the continuation returns
+// cursorStatus 'expired' with an empty terminal page and never falls back to a different
+// generation. A missing or initially unreadable journal is an RPC error. Persisted history
+// excludes ephemeral events and may omit payloads that are reconstructed only for an active
+// session; use the active session event stream for post-resume live events.
 //
 // RPC method: sessions.readPersistedEvents.
 //
@@ -23410,15 +23768,25 @@ type FleetAPI sessionAPI
 //
 // RPC method: session.fleet.start.
 //
-// Parameters: Optional user prompt to combine with the fleet orchestration instructions.
+// Parameters: Parameters for starting fleet orchestration: an optional user prompt combined
+// with the fleet instructions, plus the send options forwarded to the resulting turn.
 //
 // Returns: Indicates whether fleet mode was successfully activated.
 func (a *FleetAPI) Start(ctx context.Context, params *FleetStartRequest) (*FleetStartResult, error) {
 	req := map[string]any{"sessionId": a.sessionID}
 	if params != nil {
+		if params.Attachments != nil {
+			req["attachments"] = params.Attachments
+		}
+		if params.Billable != nil {
+			req["billable"] = *params.Billable
+		}
 		if params.Prompt != nil {
 			req["prompt"] = *params.Prompt
 		}
+		if params.Wait != nil {
+			req["wait"] = *params.Wait
+		}
 	}
 	raw, err := a.client.Request(ctx, "session.fleet.start", req)
 	if err != nil {
@@ -24897,6 +25265,9 @@ func (a *ModeAPI) Set(ctx context.Context, params *ModeSetRequest) (*ModeSetResu
 		if params.CompactionDecision != nil {
 			req["compactionDecision"] = *params.CompactionDecision
 		}
+		if params.ExpectedMode != nil {
+			req["expectedMode"] = *params.ExpectedMode
+		}
 		if params.InheritPlanBaseFromSessionID != nil {
 			req["inheritPlanBaseFromSessionId"] = *params.InheritPlanBaseFromSessionID
 		}
@@ -29039,6 +29410,9 @@ func (a *InternalModelAPI) ApplyStartupOverlay(ctx context.Context, params *Mode
 		if params.PolicyHelperModel != nil {
 			req["policyHelperModel"] = *params.PolicyHelperModel
 		}
+		if params.RepoAutoTier != nil {
+			req["repoAutoTier"] = *params.RepoAutoTier
+		}
 		if params.RepoContextTier != nil {
 			req["repoContextTier"] = *params.RepoContextTier
 		}
diff --git a/go/rpc/zrpc_encoding.go b/go/rpc/zrpc_encoding.go
index 0b95171d79..0c731c63fe 100644
--- a/go/rpc/zrpc_encoding.go
+++ b/go/rpc/zrpc_encoding.go
@@ -775,6 +775,336 @@ func (r CatalogCandidateSourceURL) MarshalJSON() ([]byte, error) {
 	})
 }
 
+func matchesCatalogTrustSnapshotAbsent(data []byte) bool {
+	var rawGroup0 struct {
+		Status json.RawMessage `json:"status"`
+		Tier   json.RawMessage `json:"tier"`
+	}
+	if err := json.Unmarshal(data, &rawGroup0); err != nil {
+		return false
+	}
+	if rawGroup0.Status == nil {
+		return false
+	}
+	var rawGroup0String string
+	if err := json.Unmarshal(rawGroup0.Status, &rawGroup0String); err != nil {
+		return false
+	}
+	switch rawGroup0String {
+	case "absent":
+	default:
+		return false
+	}
+	return rawGroup0.Tier == nil
+}
+
+func matchesCatalogTrustSnapshotCurrent(data []byte) bool {
+	var rawGroup0 struct {
+		Status json.RawMessage `json:"status"`
+		Tier   json.RawMessage `json:"tier"`
+	}
+	if err := json.Unmarshal(data, &rawGroup0); err != nil {
+		return false
+	}
+	if rawGroup0.Status == nil {
+		return false
+	}
+	var rawGroup0String string
+	if err := json.Unmarshal(rawGroup0.Status, &rawGroup0String); err != nil {
+		return false
+	}
+	switch rawGroup0String {
+	case "current":
+	default:
+		return false
+	}
+	if rawGroup0.Tier == nil {
+		return false
+	}
+	var rawGroup0String string
+	if err := json.Unmarshal(rawGroup0.Tier, &rawGroup0String); err != nil {
+		return false
+	}
+	switch rawGroup0String {
+	case "T1", "T2":
+	default:
+		return false
+	}
+	return true
+}
+
+func matchesCatalogTrustSnapshotDowngraded(data []byte) bool {
+	var rawGroup0 struct {
+		Status json.RawMessage `json:"status"`
+		Tier   json.RawMessage `json:"tier"`
+	}
+	if err := json.Unmarshal(data, &rawGroup0); err != nil {
+		return false
+	}
+	if rawGroup0.Status == nil {
+		return false
+	}
+	var rawGroup0String string
+	if err := json.Unmarshal(rawGroup0.Status, &rawGroup0String); err != nil {
+		return false
+	}
+	switch rawGroup0String {
+	case "downgraded":
+	default:
+		return false
+	}
+	return rawGroup0.Tier == nil
+}
+
+func matchesCatalogTrustSnapshotMalformed(data []byte) bool {
+	var rawGroup0 struct {
+		Status json.RawMessage `json:"status"`
+		Tier   json.RawMessage `json:"tier"`
+	}
+	if err := json.Unmarshal(data, &rawGroup0); err != nil {
+		return false
+	}
+	if rawGroup0.Status == nil {
+		return false
+	}
+	var rawGroup0String string
+	if err := json.Unmarshal(rawGroup0.Status, &rawGroup0String); err != nil {
+		return false
+	}
+	switch rawGroup0String {
+	case "malformed":
+	default:
+		return false
+	}
+	return rawGroup0.Tier == nil
+}
+
+func matchesCatalogTrustSnapshotRevoked(data []byte) bool {
+	var rawGroup0 struct {
+		Status json.RawMessage `json:"status"`
+		Tier   json.RawMessage `json:"tier"`
+	}
+	if err := json.Unmarshal(data, &rawGroup0); err != nil {
+		return false
+	}
+	if rawGroup0.Status == nil {
+		return false
+	}
+	var rawGroup0String string
+	if err := json.Unmarshal(rawGroup0.Status, &rawGroup0String); err != nil {
+		return false
+	}
+	switch rawGroup0String {
+	case "revoked":
+	default:
+		return false
+	}
+	return rawGroup0.Tier == nil
+}
+
+func matchesCatalogTrustSnapshotStale(data []byte) bool {
+	var rawGroup0 struct {
+		Status json.RawMessage `json:"status"`
+		Tier   json.RawMessage `json:"tier"`
+	}
+	if err := json.Unmarshal(data, &rawGroup0); err != nil {
+		return false
+	}
+	if rawGroup0.Status == nil {
+		return false
+	}
+	var rawGroup0String string
+	if err := json.Unmarshal(rawGroup0.Status, &rawGroup0String); err != nil {
+		return false
+	}
+	switch rawGroup0String {
+	case "stale":
+	default:
+		return false
+	}
+	return rawGroup0.Tier == nil
+}
+
+func matchesCatalogTrustSnapshotUnsupported(data []byte) bool {
+	var rawGroup0 struct {
+		Status json.RawMessage `json:"status"`
+		Tier   json.RawMessage `json:"tier"`
+	}
+	if err := json.Unmarshal(data, &rawGroup0); err != nil {
+		return false
+	}
+	if rawGroup0.Status == nil {
+		return false
+	}
+	var rawGroup0String string
+	if err := json.Unmarshal(rawGroup0.Status, &rawGroup0String); err != nil {
+		return false
+	}
+	switch rawGroup0String {
+	case "unsupported":
+	default:
+		return false
+	}
+	return rawGroup0.Tier == nil
+}
+
+func unmarshalCatalogTrustSnapshot(data []byte) (CatalogTrustSnapshot, error) {
+	if string(data) == "null" {
+		return nil, nil
+	}
+	type rawUnion struct {
+		SchemaVersion CatalogTrustSnapshotSchemaVersion `json:"schemaVersion"`
+	}
+	var raw rawUnion
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return nil, err
+	}
+
+	switch raw.SchemaVersion {
+	case CatalogTrustSnapshotSchemaVersionV1:
+		if matchesCatalogTrustSnapshotAbsent(data) {
+			var d CatalogTrustSnapshotAbsent
+			if err := json.Unmarshal(data, &d); err != nil {
+				return nil, err
+			}
+			return &d, nil
+		}
+		if matchesCatalogTrustSnapshotCurrent(data) {
+			var d CatalogTrustSnapshotCurrent
+			if err := json.Unmarshal(data, &d); err != nil {
+				return nil, err
+			}
+			return &d, nil
+		}
+		if matchesCatalogTrustSnapshotDowngraded(data) {
+			var d CatalogTrustSnapshotDowngraded
+			if err := json.Unmarshal(data, &d); err != nil {
+				return nil, err
+			}
+			return &d, nil
+		}
+		if matchesCatalogTrustSnapshotMalformed(data) {
+			var d CatalogTrustSnapshotMalformed
+			if err := json.Unmarshal(data, &d); err != nil {
+				return nil, err
+			}
+			return &d, nil
+		}
+		if matchesCatalogTrustSnapshotRevoked(data) {
+			var d CatalogTrustSnapshotRevoked
+			if err := json.Unmarshal(data, &d); err != nil {
+				return nil, err
+			}
+			return &d, nil
+		}
+		if matchesCatalogTrustSnapshotStale(data) {
+			var d CatalogTrustSnapshotStale
+			if err := json.Unmarshal(data, &d); err != nil {
+				return nil, err
+			}
+			return &d, nil
+		}
+		if matchesCatalogTrustSnapshotUnsupported(data) {
+			var d CatalogTrustSnapshotUnsupported
+			if err := json.Unmarshal(data, &d); err != nil {
+				return nil, err
+			}
+			return &d, nil
+		}
+		return &RawCatalogTrustSnapshotData{Discriminator: raw.SchemaVersion, Raw: data}, nil
+	default:
+		return &RawCatalogTrustSnapshotData{Discriminator: raw.SchemaVersion, Raw: data}, nil
+	}
+}
+
+func (r RawCatalogTrustSnapshotData) MarshalJSON() ([]byte, error) {
+	if r.Raw != nil {
+		return r.Raw, nil
+	}
+	return json.Marshal(struct {
+		SchemaVersion CatalogTrustSnapshotSchemaVersion `json:"schemaVersion"`
+	}{
+		SchemaVersion: r.Discriminator,
+	})
+}
+
+func (r CatalogTrustSnapshotAbsent) MarshalJSON() ([]byte, error) {
+	type alias CatalogTrustSnapshotAbsent
+	return json.Marshal(struct {
+		SchemaVersion CatalogTrustSnapshotSchemaVersion `json:"schemaVersion"`
+		alias
+	}{
+		SchemaVersion: r.SchemaVersion(),
+		alias:         alias(r),
+	})
+}
+
+func (r CatalogTrustSnapshotCurrent) MarshalJSON() ([]byte, error) {
+	type alias CatalogTrustSnapshotCurrent
+	return json.Marshal(struct {
+		SchemaVersion CatalogTrustSnapshotSchemaVersion `json:"schemaVersion"`
+		alias
+	}{
+		SchemaVersion: r.SchemaVersion(),
+		alias:         alias(r),
+	})
+}
+
+func (r CatalogTrustSnapshotDowngraded) MarshalJSON() ([]byte, error) {
+	type alias CatalogTrustSnapshotDowngraded
+	return json.Marshal(struct {
+		SchemaVersion CatalogTrustSnapshotSchemaVersion `json:"schemaVersion"`
+		alias
+	}{
+		SchemaVersion: r.SchemaVersion(),
+		alias:         alias(r),
+	})
+}
+
+func (r CatalogTrustSnapshotMalformed) MarshalJSON() ([]byte, error) {
+	type alias CatalogTrustSnapshotMalformed
+	return json.Marshal(struct {
+		SchemaVersion CatalogTrustSnapshotSchemaVersion `json:"schemaVersion"`
+		alias
+	}{
+		SchemaVersion: r.SchemaVersion(),
+		alias:         alias(r),
+	})
+}
+
+func (r CatalogTrustSnapshotRevoked) MarshalJSON() ([]byte, error) {
+	type alias CatalogTrustSnapshotRevoked
+	return json.Marshal(struct {
+		SchemaVersion CatalogTrustSnapshotSchemaVersion `json:"schemaVersion"`
+		alias
+	}{
+		SchemaVersion: r.SchemaVersion(),
+		alias:         alias(r),
+	})
+}
+
+func (r CatalogTrustSnapshotStale) MarshalJSON() ([]byte, error) {
+	type alias CatalogTrustSnapshotStale
+	return json.Marshal(struct {
+		SchemaVersion CatalogTrustSnapshotSchemaVersion `json:"schemaVersion"`
+		alias
+	}{
+		SchemaVersion: r.SchemaVersion(),
+		alias:         alias(r),
+	})
+}
+
+func (r CatalogTrustSnapshotUnsupported) MarshalJSON() ([]byte, error) {
+	type alias CatalogTrustSnapshotUnsupported
+	return json.Marshal(struct {
+		SchemaVersion CatalogTrustSnapshotSchemaVersion `json:"schemaVersion"`
+		alias
+	}{
+		SchemaVersion: r.SchemaVersion(),
+		alias:         alias(r),
+	})
+}
+
 func (r *CatalogAiSkillCandidate) UnmarshalJSON(data []byte) error {
 	type rawCatalogAiSkillCandidate struct {
 		Description     *string                               `json:"description,omitempty"`
@@ -786,6 +1116,7 @@ func (r *CatalogAiSkillCandidate) UnmarshalJSON(data []byte) error {
 		Provenance      CatalogAiSkillCandidateProvenance     `json:"provenance"`
 		Publisher       *string                               `json:"publisher,omitempty"`
 		Source          json.RawMessage                       `json:"source"`
+		Trust           json.RawMessage                       `json:"trust,omitempty"`
 	}
 	var raw rawCatalogAiSkillCandidate
 	if err := json.Unmarshal(data, &raw); err != nil {
@@ -806,6 +1137,13 @@ func (r *CatalogAiSkillCandidate) UnmarshalJSON(data []byte) error {
 		}
 		r.Source = value
 	}
+	if raw.Trust != nil {
+		value, err := unmarshalCatalogTrustSnapshot(raw.Trust)
+		if err != nil {
+			return err
+		}
+		r.Trust = value
+	}
 	return nil
 }
 
@@ -831,6 +1169,7 @@ func (r *CatalogMCPServerCandidate) UnmarshalJSON(data []byte) error {
 		Provenance      CatalogMCPServerCandidateProvenance `json:"provenance"`
 		Publisher       *string                             `json:"publisher,omitempty"`
 		Source          json.RawMessage                     `json:"source"`
+		Trust           json.RawMessage                     `json:"trust,omitempty"`
 	}
 	var raw rawCatalogMCPServerCandidate
 	if err := json.Unmarshal(data, &raw); err != nil {
@@ -851,6 +1190,13 @@ func (r *CatalogMCPServerCandidate) UnmarshalJSON(data []byte) error {
 		}
 		r.Source = value
 	}
+	if raw.Trust != nil {
+		value, err := unmarshalCatalogTrustSnapshot(raw.Trust)
+		if err != nil {
+			return err
+		}
+		r.Trust = value
+	}
 	return nil
 }
 
@@ -1843,6 +2189,33 @@ func unmarshalFilterMapping(data []byte) (FilterMapping, error) {
 	return nil, errors.New("data did not match any union variant for FilterMapping")
 }
 
+func (r *FleetStartRequest) UnmarshalJSON(data []byte) error {
+	type rawFleetStartRequest struct {
+		Attachments []json.RawMessage `json:"attachments,omitzero"`
+		Billable    *bool             `json:"billable,omitempty"`
+		Prompt      *string           `json:"prompt,omitempty"`
+		Wait        *bool             `json:"wait,omitempty"`
+	}
+	var raw rawFleetStartRequest
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+	if raw.Attachments != nil {
+		r.Attachments = make([]Attachment, 0, len(raw.Attachments))
+		for _, rawItem := range raw.Attachments {
+			value, err := unmarshalAttachment(rawItem)
+			if err != nil {
+				return err
+			}
+			r.Attachments = append(r.Attachments, value)
+		}
+	}
+	r.Billable = raw.Billable
+	r.Prompt = raw.Prompt
+	r.Wait = raw.Wait
+	return nil
+}
+
 func unmarshalGitHubTokenAcquireResult(data []byte) (GitHubTokenAcquireResult, error) {
 	if string(data) == "null" {
 		return nil, nil
@@ -5509,6 +5882,7 @@ func (r *SessionOpenOptions) UnmarshalJSON(data []byte) error {
 		Providers                              []NamedProviderConfig                                `json:"providers,omitzero"`
 		ReasoningEffort                        *string                                              `json:"reasoningEffort,omitempty"`
 		ReasoningSummary                       *SessionOpenOptionsReasoningSummary                  `json:"reasoningSummary,omitempty"`
+		RefreshCustomInstructions              *bool                                                `json:"refreshCustomInstructions,omitempty"`
 		RemoteDefaultedOn                      *bool                                                `json:"remoteDefaultedOn,omitempty"`
 		RemoteExporting                        *bool                                                `json:"remoteExporting,omitempty"`
 		RemoteSteerable                        *bool                                                `json:"remoteSteerable,omitempty"`
@@ -5592,6 +5966,7 @@ func (r *SessionOpenOptions) UnmarshalJSON(data []byte) error {
 	r.Providers = raw.Providers
 	r.ReasoningEffort = raw.ReasoningEffort
 	r.ReasoningSummary = raw.ReasoningSummary
+	r.RefreshCustomInstructions = raw.RefreshCustomInstructions
 	r.RemoteDefaultedOn = raw.RemoteDefaultedOn
 	r.RemoteExporting = raw.RemoteExporting
 	r.RemoteSteerable = raw.RemoteSteerable
diff --git a/go/rpc/zsession_encoding.go b/go/rpc/zsession_encoding.go
index db4db7f740..b3e2f607b4 100644
--- a/go/rpc/zsession_encoding.go
+++ b/go/rpc/zsession_encoding.go
@@ -341,12 +341,36 @@ func (e *SessionEvent) UnmarshalJSON(data []byte) error {
 			return err
 		}
 		e.Data = &d
+	case SessionEventTypePermissionCarriedForward:
+		var d PermissionCarriedForwardData
+		if err := json.Unmarshal(raw.Data, &d); err != nil {
+			return err
+		}
+		e.Data = &d
 	case SessionEventTypePermissionCompleted:
 		var d PermissionCompletedData
 		if err := json.Unmarshal(raw.Data, &d); err != nil {
 			return err
 		}
 		e.Data = &d
+	case SessionEventTypePermissionMessageAuthorization:
+		var d PermissionMessageAuthorizationData
+		if err := json.Unmarshal(raw.Data, &d); err != nil {
+			return err
+		}
+		e.Data = &d
+	case SessionEventTypePermissionMessageAuthorizationDegraded:
+		var d PermissionMessageAuthorizationDegradedData
+		if err := json.Unmarshal(raw.Data, &d); err != nil {
+			return err
+		}
+		e.Data = &d
+	case SessionEventTypePermissionMessageAuthorizationRead:
+		var d PermissionMessageAuthorizationReadData
+		if err := json.Unmarshal(raw.Data, &d); err != nil {
+			return err
+		}
+		e.Data = &d
 	case SessionEventTypePermissionRequested:
 		var d PermissionRequestedData
 		if err := json.Unmarshal(raw.Data, &d); err != nil {
@@ -2498,14 +2522,16 @@ func (r PermissionDeniedNoApprovalRuleAndCouldNotRequestFromUser) MarshalJSON()
 
 func (r *PermissionCompletedData) UnmarshalJSON(data []byte) error {
 	type rawPermissionCompletedData struct {
-		RequestID  string          `json:"requestId"`
-		Result     json.RawMessage `json:"result"`
-		ToolCallID *string         `json:"toolCallId,omitempty"`
+		DecisionSource *PermissionDecisionSource `json:"decisionSource,omitempty"`
+		RequestID      string                    `json:"requestId"`
+		Result         json.RawMessage           `json:"result"`
+		ToolCallID     *string                   `json:"toolCallId,omitempty"`
 	}
 	var raw rawPermissionCompletedData
 	if err := json.Unmarshal(data, &raw); err != nil {
 		return err
 	}
+	r.DecisionSource = raw.DecisionSource
 	r.RequestID = raw.RequestID
 	if raw.Result != nil {
 		value, err := unmarshalPermissionResult(raw.Result)
diff --git a/go/rpc/zsession_events.go b/go/rpc/zsession_events.go
index f355637137..a4ccde9aaf 100644
--- a/go/rpc/zsession_events.go
+++ b/go/rpc/zsession_events.go
@@ -118,12 +118,24 @@ const (
 	SessionEventTypeModelCallFinished          SessionEventType = "model.call_finished"
 	SessionEventTypeModelCallStart             SessionEventType = "model.call_start"
 	SessionEventTypePendingMessagesModified    SessionEventType = "pending_messages.modified"
-	SessionEventTypePermissionCompleted        SessionEventType = "permission.completed"
-	SessionEventTypePermissionRequested        SessionEventType = "permission.requested"
-	SessionEventTypePromptCacheBreak           SessionEventType = "prompt_cache_break"
-	SessionEventTypeSamplingCompleted          SessionEventType = "sampling.completed"
-	SessionEventTypeSamplingRequested          SessionEventType = "sampling.requested"
-	SessionEventTypeSandboxDecision            SessionEventType = "sandbox.decision"
+	// Experimental: SessionEventTypePermissionCarriedForward identifies an experimental event
+	// that may change or be removed.
+	SessionEventTypePermissionCarriedForward SessionEventType = "permission.carriedForward"
+	SessionEventTypePermissionCompleted      SessionEventType = "permission.completed"
+	// Experimental: SessionEventTypePermissionMessageAuthorization identifies an experimental
+	// event that may change or be removed.
+	SessionEventTypePermissionMessageAuthorization SessionEventType = "permission.messageAuthorization"
+	// Experimental: SessionEventTypePermissionMessageAuthorizationDegraded identifies an
+	// experimental event that may change or be removed.
+	SessionEventTypePermissionMessageAuthorizationDegraded SessionEventType = "permission.messageAuthorizationDegraded"
+	// Experimental: SessionEventTypePermissionMessageAuthorizationRead identifies an
+	// experimental event that may change or be removed.
+	SessionEventTypePermissionMessageAuthorizationRead SessionEventType = "permission.messageAuthorizationRead"
+	SessionEventTypePermissionRequested                SessionEventType = "permission.requested"
+	SessionEventTypePromptCacheBreak                   SessionEventType = "prompt_cache_break"
+	SessionEventTypeSamplingCompleted                  SessionEventType = "sampling.completed"
+	SessionEventTypeSamplingRequested                  SessionEventType = "sampling.requested"
+	SessionEventTypeSandboxDecision                    SessionEventType = "sandbox.decision"
 	// Experimental: SessionEventTypeSessionAutoModeResolved identifies an experimental event
 	// that may change or be removed.
 	SessionEventTypeSessionAutoModeResolved          SessionEventType = "session.auto_mode_resolved"
@@ -1325,6 +1337,43 @@ type ModelCallFinishedData struct {
 func (*ModelCallFinishedData) sessionEventData()      {}
 func (*ModelCallFinishedData) Type() SessionEventType { return SessionEventTypeModelCallFinished }
 
+// Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume.
+// Experimental: PermissionMessageAuthorizationData is part of an experimental API and may change or be removed.
+type PermissionMessageAuthorizationData struct {
+	// The kind of effect authorized, as an action-class identifier.
+	// Experimental: ActionClass is part of an experimental API and may change or be removed.
+	ActionClass string `json:"actionClass"`
+	// Whether the claim granted or denied authority.
+	// Experimental: Polarity is part of an experimental API and may change or be removed.
+	Polarity PermissionMessageAuthorizationPolarity `json:"polarity"`
+	// Deterministic identity of the record, derived from the turn and span offsets so re-extracting the same span mints nothing new.
+	// Experimental: RecordID is part of an experimental API and may change or be removed.
+	RecordID string `json:"recordId"`
+	// End byte offset of the authorizing span within the turn.
+	// Experimental: SpanEnd is part of an experimental API and may change or be removed.
+	SpanEnd int64 `json:"spanEnd"`
+	// Start byte offset of the authorizing span within the turn.
+	// Experimental: SpanStart is part of an experimental API and may change or be removed.
+	SpanStart int64 `json:"spanStart"`
+	// Concrete named targets that appear verbatim inside the span.
+	// Experimental: TargetMembers is part of an experimental API and may change or be removed.
+	TargetMembers []string `json:"targetMembers,omitzero"`
+	// The task the permission is scoped to, when the human named one.
+	// Experimental: Task is part of an experimental API and may change or be removed.
+	Task *string `json:"task,omitempty"`
+	// The human turn the quoted span was read from.
+	// Experimental: TurnIndex is part of an experimental API and may change or be removed.
+	TurnIndex int64 `json:"turnIndex"`
+	// The trusted version discriminator, when one exists. Exact shell-command grants carry the byte-identical commands grounded in the human span; world-derived classes carry a file object, remote tip, or runner only when that state was captured safely. An opaque object mirroring the runtime's adjacently-tagged resolution.
+	// Experimental: World is part of an experimental API and may change or be removed.
+	World any `json:"world,omitempty"`
+}
+
+func (*PermissionMessageAuthorizationData) sessionEventData() {}
+func (*PermissionMessageAuthorizationData) Type() SessionEventType {
+	return SessionEventTypePermissionMessageAuthorization
+}
+
 // Hook invocation completion details including output, success status, and error information
 type HookEndData struct {
 	// Error details when the hook failed
@@ -1965,6 +2014,9 @@ func (*UserMessageData) Type() SessionEventType { return SessionEventTypeUserMes
 
 // Permission request completion notification signaling UI dismissal
 type PermissionCompletedData struct {
+	// Who decided this permission request. Absent on completions recorded before this field existed, which consumers must treat as "not a human decision" rather than assuming one. Authorization records are minted only for `human_response`; an assisted-approval verdict, a host policy, an unattended fallback, and a hook resolution all produce the same `result` a person does, so this is the only field that distinguishes them.
+	// Experimental: DecisionSource is part of an experimental API and may change or be removed.
+	DecisionSource *PermissionDecisionSource `json:"decisionSource,omitempty"`
 	// Request ID of the resolved permission request; clients should dismiss any UI for this request
 	RequestID string `json:"requestId"`
 	// The result of the permission request
@@ -2094,6 +2146,28 @@ type CommandQueuedData struct {
 func (*CommandQueuedData) sessionEventData()      {}
 func (*CommandQueuedData) Type() SessionEventType { return SessionEventTypeCommandQueued }
 
+// Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left.
+// Experimental: PermissionCarriedForwardData is part of an experimental API and may change or be removed.
+type PermissionCarriedForwardData struct {
+	// Always `authorization_carry_forward`. Stated explicitly so a consumer reading this event cannot mistake it for a human, host-policy, or assisted-approval decision.
+	// Experimental: DecisionSource is part of an experimental API and may change or be removed.
+	DecisionSource PermissionDecisionSource `json:"decisionSource"`
+	// Identity of the prior authorization record that contained the proposal.
+	// Experimental: RecordID is part of an experimental API and may change or be removed.
+	RecordID string `json:"recordId"`
+	// Authorization edge minted for this admission. Not a prompt id: no prompt was raised, so no client should expect a request with this id.
+	// Experimental: RequestID is part of an experimental API and may change or be removed.
+	RequestID string `json:"requestId"`
+	// Tool call this admission authorizes. Its execution receipts the prior grant, which is how a single-effect approval is spent rather than carried forward again.
+	// Experimental: ToolCallID is part of an experimental API and may change or be removed.
+	ToolCallID string `json:"toolCallId"`
+}
+
+func (*PermissionCarriedForwardData) sessionEventData() {}
+func (*PermissionCarriedForwardData) Type() SessionEventType {
+	return SessionEventTypePermissionCarriedForward
+}
+
 // Records that a mode transition notice reached the model so cache-stable mode tools can remain offered across resume.
 type SessionModeNoticeDeliveredData struct {
 	// Model-visible transition notice persisted for a mid-turn delivery
@@ -2107,6 +2181,32 @@ func (*SessionModeNoticeDeliveredData) Type() SessionEventType {
 	return SessionEventTypeSessionModeNoticeDelivered
 }
 
+// Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt.
+// Experimental: PermissionMessageAuthorizationDegradedData is part of an experimental API and may change or be removed.
+type PermissionMessageAuthorizationDegradedData struct {
+	// The human turn that could not be represented safely.
+	// Experimental: TurnIndex is part of an experimental API and may change or be removed.
+	TurnIndex int64 `json:"turnIndex"`
+}
+
+func (*PermissionMessageAuthorizationDegradedData) sessionEventData() {}
+func (*PermissionMessageAuthorizationDegradedData) Type() SessionEventType {
+	return SessionEventTypePermissionMessageAuthorizationDegraded
+}
+
+// Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism.
+// Experimental: PermissionMessageAuthorizationReadData is part of an experimental API and may change or be removed.
+type PermissionMessageAuthorizationReadData struct {
+	// The human turn that was read by the proposer.
+	// Experimental: TurnIndex is part of an experimental API and may change or be removed.
+	TurnIndex int64 `json:"turnIndex"`
+}
+
+func (*PermissionMessageAuthorizationReadData) sessionEventData() {}
+func (*PermissionMessageAuthorizationReadData) Type() SessionEventType {
+	return SessionEventTypePermissionMessageAuthorizationRead
+}
+
 // Registered command dispatch request routed to the owning client
 type CommandExecuteData struct {
 	// Raw argument string after the command name
@@ -2776,6 +2876,8 @@ type ToolExecutionStartData struct {
 	MCPServerName *string `json:"mcpServerName,omitempty"`
 	// Original tool name on the MCP server, when the tool is an MCP tool
 	MCPToolName *string `json:"mcpToolName,omitempty"`
+	// Transport the MCP server hosting this tool is connected over, when the tool is an MCP tool and the server is configured
+	MCPTransport *MCPServerTransport `json:"mcpTransport,omitempty"`
 	// Model identifier that generated this tool call
 	Model *string `json:"model,omitempty"`
 	// Tool call ID of the parent tool invocation when this event originates from a sub-agent
@@ -3854,6 +3956,9 @@ type PermissionPromptRequestRead struct {
 	ManagedApprovalRequired *bool `json:"managedApprovalRequired,omitempty"`
 	// Path of the file or directory being read
 	Path string `json:"path"`
+	// Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display path.
+	// Experimental: ResolvedPath is part of an experimental API and may change or be removed.
+	ResolvedPath *string `json:"resolvedPath,omitempty"`
 	// Tool call ID that triggered this permission request
 	ToolCallID *string `json:"toolCallId,omitempty"`
 }
@@ -3906,6 +4011,9 @@ type PermissionPromptRequestWrite struct {
 	ManagedApprovalRequired *bool `json:"managedApprovalRequired,omitempty"`
 	// Complete new file contents for newly created files
 	NewFileContents *string `json:"newFileContents,omitempty"`
+	// Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display fileName.
+	// Experimental: ResolvedPath is part of an experimental API and may change or be removed.
+	ResolvedPath *string `json:"resolvedPath,omitempty"`
 	// Tool call ID that triggered this permission request
 	ToolCallID *string `json:"toolCallId,omitempty"`
 }
@@ -4134,6 +4242,9 @@ type PermissionRequestRead struct {
 	RequestSandboxBypass *bool `json:"requestSandboxBypass,omitempty"`
 	// What the tool tells the user about the bypass on offer: which policy rule blocked the call, or why it cannot be sandboxed. Only meaningful when requestSandboxBypass is true.
 	RequestSandboxBypassReason *string `json:"requestSandboxBypassReason,omitempty"`
+	// Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display path.
+	// Experimental: ResolvedPath is part of an experimental API and may change or be removed.
+	ResolvedPath *string `json:"resolvedPath,omitempty"`
 	// Tool call ID that triggered this permission request
 	ToolCallID *string `json:"toolCallId,omitempty"`
 }
@@ -4169,6 +4280,12 @@ type PermissionRequestShell struct {
 	RequestSandboxBypassReason *string `json:"requestSandboxBypassReason,omitempty"`
 	// True when the requested escalation is a permissive retry rather than a full bypass: the command re-runs inside the sandbox with its file and process restrictions recording instead of blocking, while the network policy stays enforced. Always accompanied by requestSandboxBypass, so hosts that do not recognize this field still treat the request as the escalation it is. Hosts that do recognize it must not describe the command as running outside the sandbox, which would overstate the privilege being granted.
 	RequestSandboxPermissive *bool `json:"requestSandboxPermissive,omitempty"`
+	// Runtime-resolved canonical object each possiblePaths entry names, keyed by the requested spelling, used for authorization identity checks. Internal and experimental; clients should continue to display possiblePaths.
+	// Experimental: ResolvedPaths is part of an experimental API and may change or be removed.
+	ResolvedPaths map[string]string `json:"resolvedPaths,omitzero"`
+	// Runtime-resolved canonical working directory the command runs in, used for authorization identity checks. Internal and experimental; clients should not display it.
+	// Experimental: ResolvedWorkingDirectory is part of an experimental API and may change or be removed.
+	ResolvedWorkingDirectory *string `json:"resolvedWorkingDirectory,omitempty"`
 	// Tool call ID that triggered this permission request
 	ToolCallID *string `json:"toolCallId,omitempty"`
 	// Optional warning message about risks of running this command
@@ -4221,6 +4338,9 @@ type PermissionRequestWrite struct {
 	RequestSandboxBypass *bool `json:"requestSandboxBypass,omitempty"`
 	// Justification for the sandbox-bypass request. Only meaningful when requestSandboxBypass is true.
 	RequestSandboxBypassReason *string `json:"requestSandboxBypassReason,omitempty"`
+	// Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display fileName.
+	// Experimental: ResolvedPath is part of an experimental API and may change or be removed.
+	ResolvedPath *string `json:"resolvedPath,omitempty"`
 	// Tool call ID that triggered this permission request
 	ToolCallID *string `json:"toolCallId,omitempty"`
 }
@@ -5743,6 +5863,17 @@ const (
 	OmittedBinaryTypeResource OmittedBinaryType = "resource"
 )
 
+// Which direction a message-backed authorization claim moves authority in.
+// Experimental: PermissionMessageAuthorizationPolarity is part of an experimental API and may change or be removed.
+type PermissionMessageAuthorizationPolarity string
+
+const (
+	// The human's words refused an effect.
+	PermissionMessageAuthorizationPolarityDenial PermissionMessageAuthorizationPolarity = "denial"
+	// The human's words authorized an effect.
+	PermissionMessageAuthorizationPolarityGrant PermissionMessageAuthorizationPolarity = "grant"
+)
+
 // Kind discriminator for PermissionPromptRequest.
 type PermissionPromptRequestKind string
 
diff --git a/go/zsession_events.go b/go/zsession_events.go
index 25d7ef5460..5dac5f535c 100644
--- a/go/zsession_events.go
+++ b/go/zsession_events.go
@@ -194,12 +194,17 @@ type (
 	PermissionApprovedForSession                                   = rpc.PermissionApprovedForSession
 	PermissionAssistedApproval                                     = rpc.PermissionAssistedApproval
 	PermissionCancelled                                            = rpc.PermissionCancelled
+	PermissionCarriedForwardData                                   = rpc.PermissionCarriedForwardData
 	PermissionCompletedData                                        = rpc.PermissionCompletedData
 	PermissionDeniedByContentExclusionPolicy                       = rpc.PermissionDeniedByContentExclusionPolicy
 	PermissionDeniedByPermissionRequestHook                        = rpc.PermissionDeniedByPermissionRequestHook
 	PermissionDeniedByRules                                        = rpc.PermissionDeniedByRules
 	PermissionDeniedInteractivelyByUser                            = rpc.PermissionDeniedInteractivelyByUser
 	PermissionDeniedNoApprovalRuleAndCouldNotRequestFromUser       = rpc.PermissionDeniedNoApprovalRuleAndCouldNotRequestFromUser
+	PermissionMessageAuthorizationData                             = rpc.PermissionMessageAuthorizationData
+	PermissionMessageAuthorizationDegradedData                     = rpc.PermissionMessageAuthorizationDegradedData
+	PermissionMessageAuthorizationPolarity                         = rpc.PermissionMessageAuthorizationPolarity
+	PermissionMessageAuthorizationReadData                         = rpc.PermissionMessageAuthorizationReadData
 	PermissionMode                                                 = rpc.PermissionMode
 	PermissionPromptRequest                                        = rpc.PermissionPromptRequest
 	PermissionPromptRequestCommands                                = rpc.PermissionPromptRequestCommands
@@ -653,6 +658,9 @@ const (
 	OmittedBinaryOmittedReasonTooLarge                                 = rpc.OmittedBinaryOmittedReasonTooLarge
 	OmittedBinaryTypeImage                                             = rpc.OmittedBinaryTypeImage
 	OmittedBinaryTypeResource                                          = rpc.OmittedBinaryTypeResource
+	PermissionDecisionSourceAuthorizationCarryForward                  = rpc.PermissionDecisionSourceAuthorizationCarryForward
+	PermissionMessageAuthorizationPolarityDenial                       = rpc.PermissionMessageAuthorizationPolarityDenial
+	PermissionMessageAuthorizationPolarityGrant                        = rpc.PermissionMessageAuthorizationPolarityGrant
 	PermissionModeAllowAll                                             = rpc.PermissionModeAllowAll
 	PermissionModeAssisted                                             = rpc.PermissionModeAssisted
 	PermissionModeManual                                               = rpc.PermissionModeManual
@@ -771,7 +779,11 @@ const (
 	SessionEventTypeModelCallFinished                                  = rpc.SessionEventTypeModelCallFinished
 	SessionEventTypeModelCallStart                                     = rpc.SessionEventTypeModelCallStart
 	SessionEventTypePendingMessagesModified                            = rpc.SessionEventTypePendingMessagesModified
+	SessionEventTypePermissionCarriedForward                           = rpc.SessionEventTypePermissionCarriedForward
 	SessionEventTypePermissionCompleted                                = rpc.SessionEventTypePermissionCompleted
+	SessionEventTypePermissionMessageAuthorization                     = rpc.SessionEventTypePermissionMessageAuthorization
+	SessionEventTypePermissionMessageAuthorizationDegraded             = rpc.SessionEventTypePermissionMessageAuthorizationDegraded
+	SessionEventTypePermissionMessageAuthorizationRead                 = rpc.SessionEventTypePermissionMessageAuthorizationRead
 	SessionEventTypePermissionRequested                                = rpc.SessionEventTypePermissionRequested
 	SessionEventTypePromptCacheBreak                                   = rpc.SessionEventTypePromptCacheBreak
 	SessionEventTypeSamplingCompleted                                  = rpc.SessionEventTypeSamplingCompleted
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/PermissionCarriedForwardEvent.java b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionCarriedForwardEvent.java
new file mode 100644
index 0000000000..27a5d0df91
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionCarriedForwardEvent.java
@@ -0,0 +1,47 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: session-events.schema.json
+
+package com.github.copilot.generated;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Session event "permission.carriedForward". Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left.
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class PermissionCarriedForwardEvent extends SessionEvent {
+
+    @Override
+    public String getType() { return "permission.carriedForward"; }
+
+    @JsonProperty("data")
+    private PermissionCarriedForwardEventData data;
+
+    public PermissionCarriedForwardEventData getData() { return data; }
+    public void setData(PermissionCarriedForwardEventData data) { this.data = data; }
+
+    /** Data payload for {@link PermissionCarriedForwardEvent}. */
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public record PermissionCarriedForwardEventData(
+        /** Authorization edge minted for this admission. Not a prompt id: no prompt was raised, so no client should expect a request with this id. */
+        @JsonProperty("requestId") String requestId,
+        /** Tool call this admission authorizes. Its execution receipts the prior grant, which is how a single-effect approval is spent rather than carried forward again. */
+        @JsonProperty("toolCallId") String toolCallId,
+        /** Identity of the prior authorization record that contained the proposal. */
+        @JsonProperty("recordId") String recordId,
+        /** Always `authorization_carry_forward`. Stated explicitly so a consumer reading this event cannot mistake it for a human, host-policy, or assisted-approval decision. */
+        @JsonProperty("decisionSource") PermissionDecisionSource decisionSource
+    ) {
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/PermissionCompletedEvent.java b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionCompletedEvent.java
index a21c25e8db..51e19ad373 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/PermissionCompletedEvent.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionCompletedEvent.java
@@ -39,7 +39,9 @@ public record PermissionCompletedEventData(
         /** Optional tool call ID associated with this permission prompt; clients may use it to correlate UI created from tool-scoped prompts */
         @JsonProperty("toolCallId") String toolCallId,
         /** The result of the permission request */
-        @JsonProperty("result") Object result
+        @JsonProperty("result") Object result,
+        /** Who decided this permission request. Absent on completions recorded before this field existed, which consumers must treat as "not a human decision" rather than assuming one. Authorization records are minted only for `human_response`; an assisted-approval verdict, a host policy, an unattended fallback, and a hook resolution all produce the same `result` a person does, so this is the only field that distinguishes them. */
+        @JsonProperty("decisionSource") PermissionDecisionSource decisionSource
     ) {
     }
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/PermissionDecisionSource.java b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionDecisionSource.java
new file mode 100644
index 0000000000..a8a8d73ed4
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionDecisionSource.java
@@ -0,0 +1,41 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: session-events.schema.json
+
+package com.github.copilot.generated;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Controlled reason or actor responsible for a permission response.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum PermissionDecisionSource {
+    /** The {@code assisted_approval} variant. */
+    ASSISTED_APPROVAL("assisted_approval"),
+    /** The {@code human_response} variant. */
+    HUMAN_RESPONSE("human_response"),
+    /** The {@code host_policy} variant. */
+    HOST_POLICY("host_policy"),
+    /** The {@code unattended_fallback} variant. */
+    UNATTENDED_FALLBACK("unattended_fallback"),
+    /** The {@code authorization_carry_forward} variant. */
+    AUTHORIZATION_CARRY_FORWARD("authorization_carry_forward");
+
+    private final String value;
+    PermissionDecisionSource(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static PermissionDecisionSource fromValue(String value) {
+        for (PermissionDecisionSource v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown PermissionDecisionSource value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationDegradedEvent.java b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationDegradedEvent.java
new file mode 100644
index 0000000000..dc37375dcf
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationDegradedEvent.java
@@ -0,0 +1,41 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: session-events.schema.json
+
+package com.github.copilot.generated;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Session event "permission.messageAuthorizationDegraded". Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt.
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class PermissionMessageAuthorizationDegradedEvent extends SessionEvent {
+
+    @Override
+    public String getType() { return "permission.messageAuthorizationDegraded"; }
+
+    @JsonProperty("data")
+    private PermissionMessageAuthorizationDegradedEventData data;
+
+    public PermissionMessageAuthorizationDegradedEventData getData() { return data; }
+    public void setData(PermissionMessageAuthorizationDegradedEventData data) { this.data = data; }
+
+    /** Data payload for {@link PermissionMessageAuthorizationDegradedEvent}. */
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public record PermissionMessageAuthorizationDegradedEventData(
+        /** The human turn that could not be represented safely. */
+        @JsonProperty("turnIndex") Long turnIndex
+    ) {
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationEvent.java b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationEvent.java
new file mode 100644
index 0000000000..c87dce05cb
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationEvent.java
@@ -0,0 +1,58 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: session-events.schema.json
+
+package com.github.copilot.generated;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import java.util.List;
+import javax.annotation.processing.Generated;
+
+/**
+ * Session event "permission.messageAuthorization". Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume.
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class PermissionMessageAuthorizationEvent extends SessionEvent {
+
+    @Override
+    public String getType() { return "permission.messageAuthorization"; }
+
+    @JsonProperty("data")
+    private PermissionMessageAuthorizationEventData data;
+
+    public PermissionMessageAuthorizationEventData getData() { return data; }
+    public void setData(PermissionMessageAuthorizationEventData data) { this.data = data; }
+
+    /** Data payload for {@link PermissionMessageAuthorizationEvent}. */
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public record PermissionMessageAuthorizationEventData(
+        /** Deterministic identity of the record, derived from the turn and span offsets so re-extracting the same span mints nothing new. */
+        @JsonProperty("recordId") String recordId,
+        /** The human turn the quoted span was read from. */
+        @JsonProperty("turnIndex") Long turnIndex,
+        /** Whether the claim granted or denied authority. */
+        @JsonProperty("polarity") PermissionMessageAuthorizationPolarity polarity,
+        /** The kind of effect authorized, as an action-class identifier. */
+        @JsonProperty("actionClass") String actionClass,
+        /** Start byte offset of the authorizing span within the turn. */
+        @JsonProperty("spanStart") Long spanStart,
+        /** End byte offset of the authorizing span within the turn. */
+        @JsonProperty("spanEnd") Long spanEnd,
+        /** Concrete named targets that appear verbatim inside the span. */
+        @JsonProperty("targetMembers") List<String> targetMembers,
+        /** The task the permission is scoped to, when the human named one. */
+        @JsonProperty("task") String task,
+        /** The trusted version discriminator, when one exists. Exact shell-command grants carry the byte-identical commands grounded in the human span; world-derived classes carry a file object, remote tip, or runner only when that state was captured safely. An opaque object mirroring the runtime's adjacently-tagged resolution. */
+        @JsonProperty("world") Object world
+    ) {
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationPolarity.java b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationPolarity.java
new file mode 100644
index 0000000000..14bc8e2895
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationPolarity.java
@@ -0,0 +1,35 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: session-events.schema.json
+
+package com.github.copilot.generated;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Which direction a message-backed authorization claim moves authority in.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum PermissionMessageAuthorizationPolarity {
+    /** The {@code grant} variant. */
+    GRANT("grant"),
+    /** The {@code denial} variant. */
+    DENIAL("denial");
+
+    private final String value;
+    PermissionMessageAuthorizationPolarity(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static PermissionMessageAuthorizationPolarity fromValue(String value) {
+        for (PermissionMessageAuthorizationPolarity v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown PermissionMessageAuthorizationPolarity value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationReadEvent.java b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationReadEvent.java
new file mode 100644
index 0000000000..b05b7fc0bc
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationReadEvent.java
@@ -0,0 +1,41 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: session-events.schema.json
+
+package com.github.copilot.generated;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Session event "permission.messageAuthorizationRead". Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism.
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class PermissionMessageAuthorizationReadEvent extends SessionEvent {
+
+    @Override
+    public String getType() { return "permission.messageAuthorizationRead"; }
+
+    @JsonProperty("data")
+    private PermissionMessageAuthorizationReadEventData data;
+
+    public PermissionMessageAuthorizationReadEventData getData() { return data; }
+    public void setData(PermissionMessageAuthorizationReadEventData data) { this.data = data; }
+
+    /** Data payload for {@link PermissionMessageAuthorizationReadEvent}. */
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public record PermissionMessageAuthorizationReadEventData(
+        /** The human turn that was read by the proposer. */
+        @JsonProperty("turnIndex") Long turnIndex
+    ) {
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/SessionEvent.java b/java/sdk/src/generated/java/com/github/copilot/generated/SessionEvent.java
index a04aefe9f3..f41a34923b 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/SessionEvent.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/SessionEvent.java
@@ -111,6 +111,10 @@
     @JsonSubTypes.Type(value = SystemNotificationEvent.class, name = "system.notification"),
     @JsonSubTypes.Type(value = PermissionRequestedEvent.class, name = "permission.requested"),
     @JsonSubTypes.Type(value = PermissionCompletedEvent.class, name = "permission.completed"),
+    @JsonSubTypes.Type(value = PermissionCarriedForwardEvent.class, name = "permission.carriedForward"),
+    @JsonSubTypes.Type(value = PermissionMessageAuthorizationEvent.class, name = "permission.messageAuthorization"),
+    @JsonSubTypes.Type(value = PermissionMessageAuthorizationReadEvent.class, name = "permission.messageAuthorizationRead"),
+    @JsonSubTypes.Type(value = PermissionMessageAuthorizationDegradedEvent.class, name = "permission.messageAuthorizationDegraded"),
     @JsonSubTypes.Type(value = UserInputRequestedEvent.class, name = "user_input.requested"),
     @JsonSubTypes.Type(value = UserInputCompletedEvent.class, name = "user_input.completed"),
     @JsonSubTypes.Type(value = ElicitationRequestedEvent.class, name = "elicitation.requested"),
@@ -251,6 +255,10 @@ public abstract sealed class SessionEvent permits
         SystemNotificationEvent,
         PermissionRequestedEvent,
         PermissionCompletedEvent,
+        PermissionCarriedForwardEvent,
+        PermissionMessageAuthorizationEvent,
+        PermissionMessageAuthorizationReadEvent,
+        PermissionMessageAuthorizationDegradedEvent,
         UserInputRequestedEvent,
         UserInputCompletedEvent,
         ElicitationRequestedEvent,
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/ToolExecutionStartEvent.java b/java/sdk/src/generated/java/com/github/copilot/generated/ToolExecutionStartEvent.java
index 36691ca41e..24d0cad2a5 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/ToolExecutionStartEvent.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/ToolExecutionStartEvent.java
@@ -50,6 +50,8 @@ public record ToolExecutionStartEventData(
         @JsonProperty("mcpServerName") String mcpServerName,
         /** Original tool name on the MCP server, when the tool is an MCP tool */
         @JsonProperty("mcpToolName") String mcpToolName,
+        /** Transport the MCP server hosting this tool is connected over, when the tool is an MCP tool and the server is configured */
+        @JsonProperty("mcpTransport") McpServerTransport mcpTransport,
         /** Identifier for the agent loop turn this tool was invoked in, matching the corresponding assistant.turn_start event */
         @JsonProperty("turnId") String turnId,
         /** When true, the tool output should be displayed expanded (verbatim) in the CLI timeline */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogAiSkillCandidate.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogAiSkillCandidate.java
index 59e70f4935..5cbcafcc73 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogAiSkillCandidate.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogAiSkillCandidate.java
@@ -64,6 +64,10 @@ public final class CatalogAiSkillCandidate extends CatalogCandidate {
     @JsonProperty("provenance")
     private CatalogAiSkillCandidateProvenance provenance;
 
+    /** Versioned trust metadata observed from the catalog authority. Optional for protocol-3 compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits an explicit snapshot even when the authority omitted or malformed its trust field. */
+    @JsonProperty("trust")
+    private CatalogTrustSnapshot trust;
+
     public String getHandle() { return handle; }
     public void setHandle(String handle) { this.handle = handle; }
 
@@ -90,4 +94,7 @@ public final class CatalogAiSkillCandidate extends CatalogCandidate {
 
     public CatalogAiSkillCandidateProvenance getProvenance() { return provenance; }
     public void setProvenance(CatalogAiSkillCandidateProvenance provenance) { this.provenance = provenance; }
+
+    public CatalogTrustSnapshot getTrust() { return trust; }
+    public void setTrust(CatalogTrustSnapshot trust) { this.trust = trust; }
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogCapability.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogCapability.java
index bb1662ba27..8a94f40819 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogCapability.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogCapability.java
@@ -25,7 +25,9 @@ public enum CatalogCapability {
     /** The {@code mcp-install-planning} variant. */
     MCP_INSTALL_PLANNING("mcp-install-planning"),
     /** The {@code multiple-transport-choice} variant. */
-    MULTIPLE_TRANSPORT_CHOICE("multiple-transport-choice");
+    MULTIPLE_TRANSPORT_CHOICE("multiple-transport-choice"),
+    /** The {@code trust-snapshot} variant. */
+    TRUST_SNAPSHOT("trust-snapshot");
 
     private final String value;
     CatalogCapability(String value) { this.value = value; }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogMcpServerCandidate.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogMcpServerCandidate.java
index 8183ca422a..a58c19f729 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogMcpServerCandidate.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogMcpServerCandidate.java
@@ -64,6 +64,10 @@ public final class CatalogMcpServerCandidate extends CatalogCandidate {
     @JsonProperty("provenance")
     private CatalogMcpServerCandidateProvenance provenance;
 
+    /** Versioned trust metadata observed from the catalog authority. Optional for protocol-3 compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits an explicit snapshot even when the authority omitted or malformed its trust field. */
+    @JsonProperty("trust")
+    private CatalogTrustSnapshot trust;
+
     public String getHandle() { return handle; }
     public void setHandle(String handle) { this.handle = handle; }
 
@@ -90,4 +94,7 @@ public final class CatalogMcpServerCandidate extends CatalogCandidate {
 
     public CatalogMcpServerCandidateProvenance getProvenance() { return provenance; }
     public void setProvenance(CatalogMcpServerCandidateProvenance provenance) { this.provenance = provenance; }
+
+    public CatalogTrustSnapshot getTrust() { return trust; }
+    public void setTrust(CatalogTrustSnapshot trust) { this.trust = trust; }
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNegotiationRefusedError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNegotiationRefusedError.java
index 56e20d3b4e..5432396324 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNegotiationRefusedError.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNegotiationRefusedError.java
@@ -41,9 +41,9 @@ public final class CatalogNegotiationRefusedError extends CatalogSearchResult {
     @JsonProperty("minimumSupportedProtocolVersion")
     private Long minimumSupportedProtocolVersion;
 
-    /** Every wire feature this runtime understands, so the caller can retry within that contract. This list does not imply that every deployment has enabled every operation. */
+    /** Capabilities this runtime can safely advertise to this caller. The complete five-capability protocol-3 legacy set is always present; every capability added after that baseline appears only when the caller required it, so an older closed-enum decoder can still consume a refusal. This list does not imply that every deployment has enabled every operation. */
     @JsonProperty("supportedCapabilities")
-    private List<CatalogCapability> supportedCapabilities;
+    private List<String> supportedCapabilities;
 
     /** The subset of the caller's bounded extensible capability identifiers this runtime cannot honour. */
     @JsonProperty("unsupportedCapabilities")
@@ -62,8 +62,8 @@ public final class CatalogNegotiationRefusedError extends CatalogSearchResult {
     public Long getMinimumSupportedProtocolVersion() { return minimumSupportedProtocolVersion; }
     public void setMinimumSupportedProtocolVersion(Long minimumSupportedProtocolVersion) { this.minimumSupportedProtocolVersion = minimumSupportedProtocolVersion; }
 
-    public List<CatalogCapability> getSupportedCapabilities() { return supportedCapabilities; }
-    public void setSupportedCapabilities(List<CatalogCapability> supportedCapabilities) { this.supportedCapabilities = supportedCapabilities; }
+    public List<String> getSupportedCapabilities() { return supportedCapabilities; }
+    public void setSupportedCapabilities(List<String> supportedCapabilities) { this.supportedCapabilities = supportedCapabilities; }
 
     public List<String> getUnsupportedCapabilities() { return unsupportedCapabilities; }
     public void setUnsupportedCapabilities(List<String> unsupportedCapabilities) { this.unsupportedCapabilities = unsupportedCapabilities; }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustEligibility.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustEligibility.java
new file mode 100644
index 0000000000..91b9f8847e
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustEligibility.java
@@ -0,0 +1,39 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Authority-computed exposure eligibility, kept separate from tier. The current tier-only Agent Finder response maps to `unknown`, never to a locally inferred eligibility.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogTrustEligibility {
+    /** The {@code default} variant. */
+    DEFAULT("default"),
+    /** The {@code expanded} variant. */
+    EXPANDED("expanded"),
+    /** The {@code hidden} variant. */
+    HIDDEN("hidden"),
+    /** The {@code unknown} variant. */
+    UNKNOWN("unknown");
+
+    private final String value;
+    CatalogTrustEligibility(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogTrustEligibility fromValue(String value) {
+        for (CatalogTrustEligibility v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogTrustEligibility value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustProvenance.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustProvenance.java
new file mode 100644
index 0000000000..2f4c5718d4
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustProvenance.java
@@ -0,0 +1,30 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import java.time.OffsetDateTime;
+import javax.annotation.processing.Generated;
+
+/**
+ * Where and when the runtime observed the trust metadata. Observation time is not the authority's evaluation time and must not be used to infer staleness.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record CatalogTrustProvenance(
+    /** Bounded authority that supplied the trust field. */
+    @JsonProperty("source") CatalogTrustSource source,
+    /** ISO 8601 timestamp with a timezone offset at which the runtime observed the search result carrying this trust field. */
+    @JsonProperty("observedAt") OffsetDateTime observedAt
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshot.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshot.java
new file mode 100644
index 0000000000..be90c08f41
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshot.java
@@ -0,0 +1,40 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import javax.annotation.processing.Generated;
+
+/**
+ * A versioned, bounded trust observation carried unchanged with a catalog candidate and its private handle context. Current observations require a recognised T1/T2 tier; every non-current state structurally forbids a tier. Eligibility remains `unknown` while Agent Finder supplies no exposure decision, and states absent from its current wire are never inferred from age, relevance, popularity, or a tier transition.
+ *
+ * @since 1.0.0
+ */
+@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, include = JsonTypeInfo.As.EXISTING_PROPERTY, property = "status", visible = true)
+@JsonSubTypes({
+    @JsonSubTypes.Type(value = CatalogTrustSnapshotCurrent.class, name = "current"),
+    @JsonSubTypes.Type(value = CatalogTrustSnapshotAbsent.class, name = "absent"),
+    @JsonSubTypes.Type(value = CatalogTrustSnapshotStale.class, name = "stale"),
+    @JsonSubTypes.Type(value = CatalogTrustSnapshotDowngraded.class, name = "downgraded"),
+    @JsonSubTypes.Type(value = CatalogTrustSnapshotRevoked.class, name = "revoked"),
+    @JsonSubTypes.Type(value = CatalogTrustSnapshotUnsupported.class, name = "unsupported"),
+    @JsonSubTypes.Type(value = CatalogTrustSnapshotMalformed.class, name = "malformed")
+})
+@JsonIgnoreProperties(ignoreUnknown = true)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public abstract class CatalogTrustSnapshot {
+
+    /**
+     * Returns the discriminator value for this variant.
+     *
+     * @return the status discriminator
+     */
+    public abstract String getStatus();
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotAbsent.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotAbsent.java
new file mode 100644
index 0000000000..2bba3db626
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotAbsent.java
@@ -0,0 +1,51 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Discriminator: the authority omitted trust metadata.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogTrustSnapshotAbsent extends CatalogTrustSnapshot {
+
+    @JsonProperty("status")
+    private final String status = "absent";
+
+    @Override
+    public String getStatus() { return status; }
+
+    /** Schema version of this runtime-owned snapshot envelope. */
+    @JsonProperty("schemaVersion")
+    private CatalogTrustSnapshotSchemaVersion schemaVersion;
+
+    /** Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field. */
+    @JsonProperty("eligibility")
+    private CatalogTrustEligibility eligibility;
+
+    /** Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust. */
+    @JsonProperty("provenance")
+    private CatalogTrustProvenance provenance;
+
+    public CatalogTrustSnapshotSchemaVersion getSchemaVersion() { return schemaVersion; }
+    public void setSchemaVersion(CatalogTrustSnapshotSchemaVersion schemaVersion) { this.schemaVersion = schemaVersion; }
+
+    public CatalogTrustEligibility getEligibility() { return eligibility; }
+    public void setEligibility(CatalogTrustEligibility eligibility) { this.eligibility = eligibility; }
+
+    public CatalogTrustProvenance getProvenance() { return provenance; }
+    public void setProvenance(CatalogTrustProvenance provenance) { this.provenance = provenance; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotCurrent.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotCurrent.java
new file mode 100644
index 0000000000..42b4c40621
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotCurrent.java
@@ -0,0 +1,58 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * A recognised current Agent Finder T1 or T2 trust tier.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogTrustSnapshotCurrent extends CatalogTrustSnapshot {
+
+    @JsonProperty("status")
+    private final String status = "current";
+
+    @Override
+    public String getStatus() { return status; }
+
+    /** Schema version of this runtime-owned snapshot envelope. */
+    @JsonProperty("schemaVersion")
+    private CatalogTrustSnapshotSchemaVersion schemaVersion;
+
+    /** Service-computed T1 or T2 trust tier. */
+    @JsonProperty("tier")
+    private CatalogTrustTier tier;
+
+    /** Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field. */
+    @JsonProperty("eligibility")
+    private CatalogTrustEligibility eligibility;
+
+    /** Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust. */
+    @JsonProperty("provenance")
+    private CatalogTrustProvenance provenance;
+
+    public CatalogTrustSnapshotSchemaVersion getSchemaVersion() { return schemaVersion; }
+    public void setSchemaVersion(CatalogTrustSnapshotSchemaVersion schemaVersion) { this.schemaVersion = schemaVersion; }
+
+    public CatalogTrustTier getTier() { return tier; }
+    public void setTier(CatalogTrustTier tier) { this.tier = tier; }
+
+    public CatalogTrustEligibility getEligibility() { return eligibility; }
+    public void setEligibility(CatalogTrustEligibility eligibility) { this.eligibility = eligibility; }
+
+    public CatalogTrustProvenance getProvenance() { return provenance; }
+    public void setProvenance(CatalogTrustProvenance provenance) { this.provenance = provenance; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotDowngraded.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotDowngraded.java
new file mode 100644
index 0000000000..552c759eca
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotDowngraded.java
@@ -0,0 +1,51 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Discriminator: the authority explicitly reported a downgraded assessment.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogTrustSnapshotDowngraded extends CatalogTrustSnapshot {
+
+    @JsonProperty("status")
+    private final String status = "downgraded";
+
+    @Override
+    public String getStatus() { return status; }
+
+    /** Schema version of this runtime-owned snapshot envelope. */
+    @JsonProperty("schemaVersion")
+    private CatalogTrustSnapshotSchemaVersion schemaVersion;
+
+    /** Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field. */
+    @JsonProperty("eligibility")
+    private CatalogTrustEligibility eligibility;
+
+    /** Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust. */
+    @JsonProperty("provenance")
+    private CatalogTrustProvenance provenance;
+
+    public CatalogTrustSnapshotSchemaVersion getSchemaVersion() { return schemaVersion; }
+    public void setSchemaVersion(CatalogTrustSnapshotSchemaVersion schemaVersion) { this.schemaVersion = schemaVersion; }
+
+    public CatalogTrustEligibility getEligibility() { return eligibility; }
+    public void setEligibility(CatalogTrustEligibility eligibility) { this.eligibility = eligibility; }
+
+    public CatalogTrustProvenance getProvenance() { return provenance; }
+    public void setProvenance(CatalogTrustProvenance provenance) { this.provenance = provenance; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotMalformed.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotMalformed.java
new file mode 100644
index 0000000000..26fa0f0414
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotMalformed.java
@@ -0,0 +1,51 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Discriminator: the trust field was empty, unbounded, or had the wrong JSON type.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogTrustSnapshotMalformed extends CatalogTrustSnapshot {
+
+    @JsonProperty("status")
+    private final String status = "malformed";
+
+    @Override
+    public String getStatus() { return status; }
+
+    /** Schema version of this runtime-owned snapshot envelope. */
+    @JsonProperty("schemaVersion")
+    private CatalogTrustSnapshotSchemaVersion schemaVersion;
+
+    /** Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field. */
+    @JsonProperty("eligibility")
+    private CatalogTrustEligibility eligibility;
+
+    /** Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust. */
+    @JsonProperty("provenance")
+    private CatalogTrustProvenance provenance;
+
+    public CatalogTrustSnapshotSchemaVersion getSchemaVersion() { return schemaVersion; }
+    public void setSchemaVersion(CatalogTrustSnapshotSchemaVersion schemaVersion) { this.schemaVersion = schemaVersion; }
+
+    public CatalogTrustEligibility getEligibility() { return eligibility; }
+    public void setEligibility(CatalogTrustEligibility eligibility) { this.eligibility = eligibility; }
+
+    public CatalogTrustProvenance getProvenance() { return provenance; }
+    public void setProvenance(CatalogTrustProvenance provenance) { this.provenance = provenance; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotRevoked.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotRevoked.java
new file mode 100644
index 0000000000..d3163bba4a
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotRevoked.java
@@ -0,0 +1,51 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Discriminator: the authority explicitly revoked the assessment.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogTrustSnapshotRevoked extends CatalogTrustSnapshot {
+
+    @JsonProperty("status")
+    private final String status = "revoked";
+
+    @Override
+    public String getStatus() { return status; }
+
+    /** Schema version of this runtime-owned snapshot envelope. */
+    @JsonProperty("schemaVersion")
+    private CatalogTrustSnapshotSchemaVersion schemaVersion;
+
+    /** Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field. */
+    @JsonProperty("eligibility")
+    private CatalogTrustEligibility eligibility;
+
+    /** Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust. */
+    @JsonProperty("provenance")
+    private CatalogTrustProvenance provenance;
+
+    public CatalogTrustSnapshotSchemaVersion getSchemaVersion() { return schemaVersion; }
+    public void setSchemaVersion(CatalogTrustSnapshotSchemaVersion schemaVersion) { this.schemaVersion = schemaVersion; }
+
+    public CatalogTrustEligibility getEligibility() { return eligibility; }
+    public void setEligibility(CatalogTrustEligibility eligibility) { this.eligibility = eligibility; }
+
+    public CatalogTrustProvenance getProvenance() { return provenance; }
+    public void setProvenance(CatalogTrustProvenance provenance) { this.provenance = provenance; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotSchemaVersion.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotSchemaVersion.java
new file mode 100644
index 0000000000..5d06990881
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotSchemaVersion.java
@@ -0,0 +1,33 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Schema version of the catalogue trust snapshot envelope
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogTrustSnapshotSchemaVersion {
+    /** The {@code v1} variant. */
+    V1("v1");
+
+    private final String value;
+    CatalogTrustSnapshotSchemaVersion(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogTrustSnapshotSchemaVersion fromValue(String value) {
+        for (CatalogTrustSnapshotSchemaVersion v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogTrustSnapshotSchemaVersion value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotStale.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotStale.java
new file mode 100644
index 0000000000..c9b64e4096
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotStale.java
@@ -0,0 +1,51 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Discriminator: the authority explicitly marked the assessment stale.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogTrustSnapshotStale extends CatalogTrustSnapshot {
+
+    @JsonProperty("status")
+    private final String status = "stale";
+
+    @Override
+    public String getStatus() { return status; }
+
+    /** Schema version of this runtime-owned snapshot envelope. */
+    @JsonProperty("schemaVersion")
+    private CatalogTrustSnapshotSchemaVersion schemaVersion;
+
+    /** Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field. */
+    @JsonProperty("eligibility")
+    private CatalogTrustEligibility eligibility;
+
+    /** Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust. */
+    @JsonProperty("provenance")
+    private CatalogTrustProvenance provenance;
+
+    public CatalogTrustSnapshotSchemaVersion getSchemaVersion() { return schemaVersion; }
+    public void setSchemaVersion(CatalogTrustSnapshotSchemaVersion schemaVersion) { this.schemaVersion = schemaVersion; }
+
+    public CatalogTrustEligibility getEligibility() { return eligibility; }
+    public void setEligibility(CatalogTrustEligibility eligibility) { this.eligibility = eligibility; }
+
+    public CatalogTrustProvenance getProvenance() { return provenance; }
+    public void setProvenance(CatalogTrustProvenance provenance) { this.provenance = provenance; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotUnsupported.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotUnsupported.java
new file mode 100644
index 0000000000..eacd3fbf92
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSnapshotUnsupported.java
@@ -0,0 +1,51 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Discriminator: the authority supplied a bounded trust value this runtime does not understand.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogTrustSnapshotUnsupported extends CatalogTrustSnapshot {
+
+    @JsonProperty("status")
+    private final String status = "unsupported";
+
+    @Override
+    public String getStatus() { return status; }
+
+    /** Schema version of this runtime-owned snapshot envelope. */
+    @JsonProperty("schemaVersion")
+    private CatalogTrustSnapshotSchemaVersion schemaVersion;
+
+    /** Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field. */
+    @JsonProperty("eligibility")
+    private CatalogTrustEligibility eligibility;
+
+    /** Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust. */
+    @JsonProperty("provenance")
+    private CatalogTrustProvenance provenance;
+
+    public CatalogTrustSnapshotSchemaVersion getSchemaVersion() { return schemaVersion; }
+    public void setSchemaVersion(CatalogTrustSnapshotSchemaVersion schemaVersion) { this.schemaVersion = schemaVersion; }
+
+    public CatalogTrustEligibility getEligibility() { return eligibility; }
+    public void setEligibility(CatalogTrustEligibility eligibility) { this.eligibility = eligibility; }
+
+    public CatalogTrustProvenance getProvenance() { return provenance; }
+    public void setProvenance(CatalogTrustProvenance provenance) { this.provenance = provenance; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSource.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSource.java
new file mode 100644
index 0000000000..c4180a11e5
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustSource.java
@@ -0,0 +1,33 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Bounded authority that supplied a catalogue trust observation
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogTrustSource {
+    /** The {@code agent-finder} variant. */
+    AGENT_FINDER("agent-finder");
+
+    private final String value;
+    CatalogTrustSource(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogTrustSource fromValue(String value) {
+        for (CatalogTrustSource v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogTrustSource value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustTier.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustTier.java
new file mode 100644
index 0000000000..466c6a571c
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogTrustTier.java
@@ -0,0 +1,35 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Service-computed trust tier currently emitted by Agent Finder. It is independent of search score, popularity, and client-side ranking.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogTrustTier {
+    /** The {@code T1} variant. */
+    T1("T1"),
+    /** The {@code T2} variant. */
+    T2("T2");
+
+    private final String value;
+    CatalogTrustTier(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogTrustTier fromValue(String value) {
+        for (CatalogTrustTier v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogTrustTier value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CopilotUserResponse.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CopilotUserResponse.java
index cd6d5c83bd..ad501eac0d 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CopilotUserResponse.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CopilotUserResponse.java
@@ -43,7 +43,7 @@ public record CopilotUserResponse(
     @JsonProperty("endpoints") CopilotUserResponseEndpoints endpoints,
     /** Logins of the organizations the user belongs to. */
     @JsonProperty("organization_login_list") List<String> organizationLoginList,
-    /** Organizations the user belongs to, each with an optional login and display name. */
+    /** Organizations the user belongs to, each with an optional ID, login, and display name. */
     @JsonProperty("organization_list") Object organizationList,
     /** Whether the Codex agent is enabled for the user. */
     @JsonProperty("codex_agent_enabled") Boolean codexAgentEnabled,
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/EventsCursorStatus.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/EventsCursorStatus.java
index 20f37bdfa4..32600aa4df 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/EventsCursorStatus.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/EventsCursorStatus.java
@@ -10,7 +10,7 @@
 import javax.annotation.processing.Generated;
 
 /**
- * Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history (the beginning for a forward read, the tail for a backward read). The fallback page is a fresh boundary snapshot, not a continuation of the requested cursor, so it may overlap already-rendered events; on 'expired' a consumer should reset/rebase its pagination state (or deduplicate by event id) before continuing from the returned cursor.
+ * Cursor status: 'ok' means the read succeeded against the requested history; 'expired' means the requested continuation is unavailable. Recovery is endpoint-specific: session.eventLog.read returns a boundary window of remaining active history that may overlap prior pages, while sessions.readPersistedEvents returns an empty terminal page and never switches journal generations. An expired persisted read is not successful completion; a complete persisted snapshot requires cursorStatus 'ok' and hasMore false.
  *
  * @since 1.0.0
  */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionDecisionSource.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionDecisionSource.java
index 56f5793c5e..66313b8070 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionDecisionSource.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionDecisionSource.java
@@ -23,7 +23,9 @@ public enum PermissionDecisionSource {
     /** The {@code host_policy} variant. */
     HOST_POLICY("host_policy"),
     /** The {@code unattended_fallback} variant. */
-    UNATTENDED_FALLBACK("unattended_fallback");
+    UNATTENDED_FALLBACK("unattended_fallback"),
+    /** The {@code authorization_carry_forward} variant. */
+    AUTHORIZATION_CARRY_FORWARD("authorization_carry_forward");
 
     private final String value;
     PermissionDecisionSource(String value) { this.value = value; }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionEventLogReadResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionEventLogReadResult.java
index 857578d0fb..cda7ea4d25 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionEventLogReadResult.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionEventLogReadResult.java
@@ -30,9 +30,9 @@ public record SessionEventLogReadResult(
     @JsonProperty("events") List<SessionEvent> events,
     /** Opaque cursor for the next read. Pass back unchanged in the next read.cursor to continue from where this read left off. Always present, even when no events were returned. For a backward read this cursor pages toward OLDER events; keep passing `direction: backward` with it (the cursor is also self-describing, so backward paging continues correctly). */
     @JsonProperty("cursor") String cursor,
-    /** True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window. */
+    /** True when more events are available in the read's direction. For a backward read, true means older persisted events remain before the returned window. A persisted-event page may contain fewer than `max` events because of its byte budget while still reporting hasMore true; continue according to this flag rather than the event count. */
     @JsonProperty("hasMore") Boolean hasMore,
-    /** Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history. For a forward read the fallback starts from the beginning of the remaining history; for a backward read it falls back to the tail (the newest window). Because the fallback page is a fresh boundary snapshot rather than a continuation of the requested cursor, it may overlap events the consumer has already rendered — a backward fallback to the tail in particular can repeat the newest window. On 'expired', consumers should reset or rebase their local pagination state (or deduplicate by event id) before continuing from the returned cursor rather than blindly appending/prepending the fallback page. */
+    /** Cursor status: 'ok' means the cursor was applied successfully. For session.eventLog.read, 'expired' means the cursor referred to an event that no longer exists in active history and the read fell back to a boundary of the remaining history: the beginning for a forward read or the newest window for a backward read. That fallback may overlap already rendered events, so active-session consumers should reset, rebase, or deduplicate before continuing. sessions.readPersistedEvents has stricter snapshot semantics: 'expired' returns an empty terminal page and never switches to a replacement journal generation. Other persisted-read I/O failures are RPC errors with diagnostics, not cursor expiry. */
     @JsonProperty("cursorStatus") EventsCursorStatus cursorStatus
 ) {
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFleetApi.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFleetApi.java
index 183117612e..ca855b70a9 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFleetApi.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFleetApi.java
@@ -31,7 +31,7 @@ public final class SessionFleetApi {
     }
 
     /**
-     * Optional user prompt to combine with the fleet orchestration instructions.
+     * Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.
      * <p>
      * Note: the {@code sessionId} field in the params record is overridden
      * by the session-scoped wrapper; any value provided is ignored.
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFleetStartParams.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFleetStartParams.java
index c2f0471cdc..e69e7a93d0 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFleetStartParams.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFleetStartParams.java
@@ -11,10 +11,11 @@
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.github.copilot.CopilotExperimental;
+import java.util.List;
 import javax.annotation.processing.Generated;
 
 /**
- * Optional user prompt to combine with the fleet orchestration instructions.
+ * Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.
  *
  * @apiNote This method is experimental and may change in a future version.
  * @since 1.0.0
@@ -27,6 +28,12 @@ public record SessionFleetStartParams(
     /** Target session identifier */
     @JsonProperty("sessionId") String sessionId,
     /** Optional user prompt to combine with fleet instructions */
-    @JsonProperty("prompt") String prompt
+    @JsonProperty("prompt") String prompt,
+    /** Optional attachments (files, directories, selections, blobs, GitHub references) to include with the fleet request */
+    @JsonProperty("attachments") List<Object> attachments,
+    /** If false, this request will not trigger a Premium Request Unit charge. User requests default to billable. */
+    @JsonProperty("billable") Boolean billable,
+    /** If true, await completion of the agentic loop for this fleet request before returning. Defaults to false. */
+    @JsonProperty("wait") Boolean wait_
 ) {
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionModeSetParams.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionModeSetParams.java
index 4c01d16d03..9a20862a13 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionModeSetParams.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionModeSetParams.java
@@ -28,6 +28,8 @@ public record SessionModeSetParams(
     @JsonProperty("sessionId") String sessionId,
     /** The session mode the agent is operating in */
     @JsonProperty("mode") SessionMode mode,
+    /** Mode the session must currently be in for the change to apply. When set and the session is in a different mode the request is a no-op and reports status 'unchanged'. */
+    @JsonProperty("expectedMode") SessionMode expectedMode,
     /** Session whose plan-mode base state should be inherited. */
     @JsonProperty("inheritPlanBaseFromSessionId") String inheritPlanBaseFromSessionId,
     /** Whether a dedicated plan model is configured. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionModeSetResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionModeSetResult.java
index e3af446682..9221e4608b 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionModeSetResult.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionModeSetResult.java
@@ -29,6 +29,8 @@ public record SessionModeSetResult(
     @JsonProperty("status") String status,
     /** Whether applying the mode changed the active model. */
     @JsonProperty("modelChanged") Boolean modelChanged,
+    /** Whether the requested mode was applied to the session. False only when an 'expectedMode' precondition did not hold, in which case any model change reported alongside it was still applied. */
+    @JsonProperty("modeApplied") Boolean modeApplied,
     /** Compaction confirmation required before the mode change can complete. */
     @JsonProperty("confirmation") ModelSwitchConfirmation confirmation,
     /** User-facing warning produced while applying the mode change. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionModelApplyStartupOverlayParams.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionModelApplyStartupOverlayParams.java
index dfb593fd21..4a83b7b43b 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionModelApplyStartupOverlayParams.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionModelApplyStartupOverlayParams.java
@@ -38,6 +38,8 @@ public record SessionModelApplyStartupOverlayParams(
     @JsonProperty("repoReasoningEffort") String repoReasoningEffort,
     /** Context tier selected by repository settings, when configured. */
     @JsonProperty("repoContextTier") String repoContextTier,
+    /** Auto routing preference selected by repository settings, when configured. Applied only when the overlay selects the Auto model; beside a concrete model it stays dormant. */
+    @JsonProperty("repoAutoTier") String repoAutoTier,
     /** Model explicitly selected by the CLI, when provided. */
     @JsonProperty("cliModel") String cliModel,
     /** Whether the overlay is being applied while resuming a deferred session. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionOpenOptions.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionOpenOptions.java
index a1c234903e..52577dd16a 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionOpenOptions.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionOpenOptions.java
@@ -127,6 +127,8 @@ public record SessionOpenOptions(
     @JsonProperty("customAgentsLocalOnly") Boolean customAgentsLocalOnly,
     /** Whether to skip custom instruction sources. */
     @JsonProperty("skipCustomInstructions") Boolean skipCustomInstructions,
+    /** Whether to invalidate cached custom-instruction discovery before constructing the session. Use when instruction files may have changed earlier in the same runtime process. */
+    @JsonProperty("refreshCustomInstructions") Boolean refreshCustomInstructions,
     /** Instruction source IDs disabled for this session. */
     @JsonProperty("disabledInstructionSources") List<String> disabledInstructionSources,
     /** Whether commit-message coauthor trailers are enabled. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionsReadPersistedEventsParams.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionsReadPersistedEventsParams.java
index 4da93409be..4c7bce7276 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionsReadPersistedEventsParams.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionsReadPersistedEventsParams.java
@@ -26,11 +26,11 @@
 public record SessionsReadPersistedEventsParams(
     /** Session ID whose persisted event journal should be read. */
     @JsonProperty("sessionId") String sessionId,
-    /** Opaque cursor returned by a previous persisted-event read. Omit on the first call. */
+    /** Opaque, process-local, single-use cursor returned by the previous persisted-event read. Omit on the first call and issue continuations sequentially; reusing the same cursor returns an expired terminal page. */
     @JsonProperty("cursor") String cursor,
-    /** Maximum number of events to return in this batch (1–1000, default 200). */
+    /** Maximum number of events to return in this batch (1–1000, default 200). Pages may contain fewer events to keep the serialized event array within a soft 1 MiB budget including resolved binary assets; one oversized event is returned alone to guarantee progress. */
     @JsonProperty("max") Long max,
-    /** Direction to page through persisted history. Forward starts at the beginning; backward starts with the newest events. Events in each page remain chronological. */
+    /** Direction to page through persisted history. Forward starts at the beginning; backward starts with the newest events. Events in each page remain chronological. This selects the initial read only; a continuation always uses the direction bound into its cursor. */
     @JsonProperty("direction") EventsReadDirection direction
 ) {
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionsReadPersistedEventsResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionsReadPersistedEventsResult.java
index f022df5ae2..49af36f635 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionsReadPersistedEventsResult.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionsReadPersistedEventsResult.java
@@ -30,9 +30,9 @@ public record SessionsReadPersistedEventsResult(
     @JsonProperty("events") List<SessionEvent> events,
     /** Opaque cursor for the next read. Pass back unchanged in the next read.cursor to continue from where this read left off. Always present, even when no events were returned. For a backward read this cursor pages toward OLDER events; keep passing `direction: backward` with it (the cursor is also self-describing, so backward paging continues correctly). */
     @JsonProperty("cursor") String cursor,
-    /** True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window. */
+    /** True when more events are available in the read's direction. For a backward read, true means older persisted events remain before the returned window. A persisted-event page may contain fewer than `max` events because of its byte budget while still reporting hasMore true; continue according to this flag rather than the event count. */
     @JsonProperty("hasMore") Boolean hasMore,
-    /** Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history. For a forward read the fallback starts from the beginning of the remaining history; for a backward read it falls back to the tail (the newest window). Because the fallback page is a fresh boundary snapshot rather than a continuation of the requested cursor, it may overlap events the consumer has already rendered — a backward fallback to the tail in particular can repeat the newest window. On 'expired', consumers should reset or rebase their local pagination state (or deduplicate by event id) before continuing from the returned cursor rather than blindly appending/prepending the fallback page. */
+    /** Cursor status: 'ok' means the cursor was applied successfully. For session.eventLog.read, 'expired' means the cursor referred to an event that no longer exists in active history and the read fell back to a boundary of the remaining history: the beginning for a forward read or the newest window for a backward read. That fallback may overlap already rendered events, so active-session consumers should reset, rebase, or deduplicate before continuing. sessions.readPersistedEvents has stricter snapshot semantics: 'expired' returns an empty terminal page and never switches to a replacement journal generation. Other persisted-read I/O failures are RPC errors with diagnostics, not cursor expiry. */
     @JsonProperty("cursorStatus") EventsCursorStatus cursorStatus
 ) {
 }
diff --git a/nodejs/package.json b/nodejs/package.json
index 4918bc7274..8805d0d4d8 100644
--- a/nodejs/package.json
+++ b/nodejs/package.json
@@ -5,7 +5,7 @@
         "url": "https://github.com/github/copilot-sdk.git"
     },
     "version": "0.0.0-dev",
-    "copilotCliVersion": "1.0.84-4",
+    "copilotCliVersion": "1.0.84-5",
     "description": "TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC",
     "main": "./dist/cjs/index.js",
     "types": "./dist/index.d.ts",
diff --git a/nodejs/src/cliVersion.ts b/nodejs/src/cliVersion.ts
index dbe63efcd5..fc4c85afce 100644
--- a/nodejs/src/cliVersion.ts
+++ b/nodejs/src/cliVersion.ts
@@ -1,3 +1,3 @@
-export const COPILOT_CLI_VERSION = "1.0.84-4";
+export const COPILOT_CLI_VERSION = "1.0.84-5";
 
 export const COPILOT_CLI_USE_NPM_PACKAGE = false;
diff --git a/nodejs/src/generated/rpc.ts b/nodejs/src/generated/rpc.ts
index b2ce8c05e9..09bfc8ffa7 100644
--- a/nodejs/src/generated/rpc.ts
+++ b/nodejs/src/generated/rpc.ts
@@ -5,7 +5,7 @@
 
 import type { MessageConnection } from "vscode-jsonrpc/node.js";
 
-import type { AbortReason, AgentModelPolicy, Attachment, AutoTier, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerMetadata, McpServerSource, McpServerStatus, ModelChangeSource, PermissionMode, PermissionPromptRequest, PermissionRule, ReasoningSummary, RemediationAction, SessionEvent, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompleteData, TaskCompletionOutcome, UserToolSessionApproval, Verbosity } from "./session-events.js";
+import type { AbortReason, AgentModelPolicy, Attachment, AutoTier, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerMetadata, McpServerSource, McpServerStatus, ModelChangeSource, PermissionDecisionSource, PermissionMode, PermissionPromptRequest, PermissionRule, ReasoningSummary, RemediationAction, SessionEvent, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompleteData, TaskCompletionOutcome, UserToolSessionApproval, Verbosity } from "./session-events.js";
 
 /** A value that can be represented losslessly on the SDK JSON wire. */
 export type JsonValue = null | boolean | number | string | JsonValue[] | { [key: string]: JsonValue };
@@ -354,6 +354,131 @@ export type CardDigestValue = string;
  */
 /** @experimental */
 export type CatalogCandidateSource = CatalogCandidateSourceUrl | CatalogCandidateSourceEmbedded;
+/**
+ * A versioned, bounded trust observation carried unchanged with a catalog candidate and its private handle context. Current observations require a recognised T1/T2 tier; every non-current state structurally forbids a tier. Eligibility remains `unknown` while Agent Finder supplies no exposure decision, and states absent from its current wire are never inferred from age, relevance, popularity, or a tier transition.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshot".
+ */
+/** @experimental */
+export type CatalogTrustSnapshot =
+  | CatalogTrustSnapshotCurrent
+  | CatalogTrustSnapshotAbsent
+  | CatalogTrustSnapshotStale
+  | CatalogTrustSnapshotDowngraded
+  | CatalogTrustSnapshotRevoked
+  | CatalogTrustSnapshotUnsupported
+  | CatalogTrustSnapshotMalformed;
+/**
+ * Schema version of the catalogue trust snapshot envelope
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotSchemaVersion".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotSchemaVersion =
+  /** Initial envelope carrying one bounded service tier or one explicit unavailable state. */
+  "v1";
+/**
+ * A recognised T1 or T2 service tier was observed.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotCurrentStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotCurrentStatus = /** A recognised T1 or T2 service tier was observed. */ "current";
+/**
+ * Service-computed trust tier currently emitted by Agent Finder. It is independent of search score, popularity, and client-side ranking.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustTier".
+ */
+/** @experimental */
+export type CatalogTrustTier =
+  /** Tier one as assigned by the catalogue authority. */
+  | "T1"
+  /** Tier two as assigned by the catalogue authority. */
+  | "T2";
+/**
+ * Authority-computed exposure eligibility, kept separate from tier. The current tier-only Agent Finder response maps to `unknown`, never to a locally inferred eligibility.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustEligibility".
+ */
+/** @experimental */
+export type CatalogTrustEligibility =
+  /** Eligible for default catalogue exposure. */
+  | "default"
+  /** Eligible only when expanded or community results are requested. */
+  | "expanded"
+  /** Not eligible for normal catalogue exposure. */
+  | "hidden"
+  /** The authority did not supply an eligibility decision. */
+  | "unknown";
+/**
+ * Bounded authority that supplied a catalogue trust observation
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSource".
+ */
+/** @experimental */
+export type CatalogTrustSource =
+  /** GitHub Agent Finder supplied the trust field on its search result. */
+  "agent-finder";
+/**
+ * The authority omitted trust metadata.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotAbsentStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotAbsentStatus = /** The authority omitted trust metadata. */ "absent";
+/**
+ * The authority explicitly marked its assessment stale.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotStaleStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotStaleStatus = /** The authority explicitly marked its assessment stale. */ "stale";
+/**
+ * The authority explicitly reported a downgraded assessment.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotDowngradedStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotDowngradedStatus =
+  /** The authority explicitly reported a downgraded assessment. */
+  "downgraded";
+/**
+ * The authority explicitly revoked its assessment.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotRevokedStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotRevokedStatus = /** The authority explicitly revoked its assessment. */ "revoked";
+/**
+ * The authority supplied a bounded trust value this runtime does not understand.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotUnsupportedStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotUnsupportedStatus =
+  /** The authority supplied a bounded trust value this runtime does not understand. */
+  "unsupported";
+/**
+ * The trust field was empty, unbounded, or had the wrong JSON type.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotMalformedStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotMalformedStatus =
+  /** The trust field was empty, unbounded, or had the wrong JSON type. */
+  "malformed";
 /**
  * Why the catalog authority did not accept the caller's identity
  *
@@ -429,7 +554,9 @@ export type CatalogCapability =
   /** Understands side-effect-free MCP install-plan requests, results, and plan handles; `planning-unavailable` separately reports that planning is not enabled. */
   | "mcp-install-planning"
   /** Understands plans that enumerate every eligible transport rather than a single preferred one. */
-  | "multiple-transport-choice";
+  | "multiple-transport-choice"
+  /** Understands versioned candidate trust snapshots. Protocol-3 callers must require this capability before the runtime adds the optional snapshot field. */
+  | "trust-snapshot";
 /**
  * Bounded extensible wire-feature identifier. Known values are described by `CatalogCapability`; newer callers may send future identifiers so an older runtime can return a typed negotiation refusal instead of failing schema validation. Capability negotiation establishes contract understanding, while each operation's result separately reports runtime availability.
  *
@@ -1016,16 +1143,16 @@ export type EventsReadDirection =
   /** Tail-first: return the newest events and page toward older events. */
   | "backward";
 /**
- * Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history (the beginning for a forward read, the tail for a backward read). The fallback page is a fresh boundary snapshot, not a continuation of the requested cursor, so it may overlap already-rendered events; on 'expired' a consumer should reset/rebase its pagination state (or deduplicate by event id) before continuing from the returned cursor.
+ * Cursor status: 'ok' means the read succeeded against the requested history; 'expired' means the requested continuation is unavailable. Recovery is endpoint-specific: session.eventLog.read returns a boundary window of remaining active history that may overlap prior pages, while sessions.readPersistedEvents returns an empty terminal page and never switches journal generations. An expired persisted read is not successful completion; a complete persisted snapshot requires cursorStatus 'ok' and hasMore false.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "EventsCursorStatus".
  */
 /** @experimental */
 export type EventsCursorStatus =
-  /** The cursor was applied successfully. */
+  /** The read succeeded against the requested history. */
   | "ok"
-  /** The cursor referred to history that is no longer available. */
+  /** The requested continuation is unavailable; see the endpoint's recovery semantics. */
   | "expired";
 /**
  * Discovery source: project (.github/extensions/), user (~/.copilot/extensions/), plugin (installed plugin), or session (session-state/<id>/extensions/)
@@ -2643,22 +2770,6 @@ export type PermissionDecisionOutcome =
   | "autopilot_denied"
   /** The response came from an interactive user prompt. */
   | "prompted_user";
-/**
- * Controlled reason or actor responsible for a permission response.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "PermissionDecisionSource".
- */
-/** @experimental */
-export type PermissionDecisionSource =
-  /** The response followed the assisted-approval judge recommendation. */
-  | "assisted_approval"
-  /** A human supplied the response through an interactive prompt. */
-  | "human_response"
-  /** The host applied a standing policy or override rather than a judge recommendation or human decision. */
-  | "host_policy"
-  /** The host denied the request because no interactive user response was available. */
-  | "unattended_fallback";
 /**
  * Client surface that submitted a permission response.
  *
@@ -4256,7 +4367,7 @@ export interface CopilotUserResponse {
    */
   organization_login_list?: string[];
   /**
-   * Organizations the user belongs to, each with an optional login and display name.
+   * Organizations the user belongs to, each with an optional ID, login, and display name.
    */
   organization_list?:
     | (
@@ -4264,6 +4375,10 @@ export interface CopilotUserResponse {
             [k: string]: unknown | undefined;
           }
         | ({
+            /**
+             * Numeric database ID of the organization.
+             */
+            id?: number;
             /**
              * GitHub login of the organization.
              */
@@ -5981,6 +6096,7 @@ export interface CatalogAiSkillCandidate {
   publisher?: string;
   source: CatalogCandidateSource;
   provenance: CatalogAiSkillCandidateProvenance;
+  trust?: CatalogTrustSnapshot;
 }
 /**
  * Candidate whose card is retrieved from a URL through the runtime's hardened fetch boundary.
@@ -6033,6 +6149,112 @@ export interface CatalogAiSkillCandidateProvenance {
    */
   mediaType: "application/ai-skill";
 }
+/**
+ * A recognised current Agent Finder T1 or T2 trust tier.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotCurrent".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotCurrent {
+  schemaVersion: CatalogTrustSnapshotSchemaVersion;
+  status: CatalogTrustSnapshotCurrentStatus;
+  tier: CatalogTrustTier;
+  eligibility: CatalogTrustEligibility;
+  provenance: CatalogTrustProvenance;
+}
+/**
+ * Where and when the runtime observed the trust metadata. Observation time is not the authority's evaluation time and must not be used to infer staleness.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustProvenance".
+ */
+/** @experimental */
+export interface CatalogTrustProvenance {
+  source: CatalogTrustSource;
+  /**
+   * ISO 8601 timestamp with a timezone offset at which the runtime observed the search result carrying this trust field.
+   */
+  observedAt: string;
+}
+/**
+ * Discriminator: the authority omitted trust metadata.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotAbsent".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotAbsent {
+  schemaVersion: CatalogTrustSnapshotSchemaVersion;
+  status: CatalogTrustSnapshotAbsentStatus;
+  eligibility: CatalogTrustEligibility;
+  provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the authority explicitly marked the assessment stale.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotStale".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotStale {
+  schemaVersion: CatalogTrustSnapshotSchemaVersion;
+  status: CatalogTrustSnapshotStaleStatus;
+  eligibility: CatalogTrustEligibility;
+  provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the authority explicitly reported a downgraded assessment.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotDowngraded".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotDowngraded {
+  schemaVersion: CatalogTrustSnapshotSchemaVersion;
+  status: CatalogTrustSnapshotDowngradedStatus;
+  eligibility: CatalogTrustEligibility;
+  provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the authority explicitly revoked the assessment.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotRevoked".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotRevoked {
+  schemaVersion: CatalogTrustSnapshotSchemaVersion;
+  status: CatalogTrustSnapshotRevokedStatus;
+  eligibility: CatalogTrustEligibility;
+  provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the authority supplied a bounded trust value this runtime does not understand.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotUnsupported".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotUnsupported {
+  schemaVersion: CatalogTrustSnapshotSchemaVersion;
+  status: CatalogTrustSnapshotUnsupportedStatus;
+  eligibility: CatalogTrustEligibility;
+  provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the trust field was empty, unbounded, or had the wrong JSON type.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotMalformed".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotMalformed {
+  schemaVersion: CatalogTrustSnapshotSchemaVersion;
+  status: CatalogTrustSnapshotMalformedStatus;
+  eligibility: CatalogTrustEligibility;
+  provenance: CatalogTrustProvenance;
+}
 /**
  * An optional catalog authentication exchange did not establish the caller's identity. Anonymous search remains supported; this refusal is reserved for an operation that cannot continue after the attempted exchange. It is distinct from `policy-rejected` and from a network failure, and the reason identifies the recovery action.
  *
@@ -6087,6 +6309,7 @@ export interface CatalogMcpServerCandidate {
   publisher?: string;
   source: CatalogCandidateSource;
   provenance: CatalogMcpServerCandidateProvenance;
+  trust?: CatalogTrustSnapshot;
 }
 /**
  * Where and when an MCP server catalog reference was observed. Discovery provenance deliberately carries no content digest because search does not establish the exact validated content a later plan will bind.
@@ -6238,9 +6461,11 @@ export interface CatalogNegotiationRefusedError {
    */
   minimumSupportedProtocolVersion: number;
   /**
-   * Every wire feature this runtime understands, so the caller can retry within that contract. This list does not imply that every deployment has enabled every operation.
+   * Capabilities this runtime can safely advertise to this caller. The complete five-capability protocol-3 legacy set is always present; every capability added after that baseline appears only when the caller required it, so an older closed-enum decoder can still consume a refusal. This list does not imply that every deployment has enabled every operation.
+   *
+   * @maxItems 32
    */
-  supportedCapabilities: CatalogCapability[];
+  supportedCapabilities: CatalogCapabilityId[];
   /**
    * The subset of the caller's bounded extensible capability identifiers this runtime cannot honour.
    *
@@ -7553,7 +7778,7 @@ export interface EventsReadResult {
    */
   cursor: string;
   /**
-   * True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window.
+   * True when more events are available in the read's direction. For a backward read, true means older persisted events remain before the returned window. A persisted-event page may contain fewer than `max` events because of its byte budget while still reporting hasMore true; continue according to this flag rather than the event count.
    */
   hasMore: boolean;
   cursorStatus: EventsCursorStatus;
@@ -9016,7 +9241,7 @@ export interface FactoryToolRunRequest {
   toolCallId?: string;
 }
 /**
- * Optional user prompt to combine with the fleet orchestration instructions.
+ * Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "FleetStartRequest".
@@ -9027,6 +9252,20 @@ export interface FleetStartRequest {
    * Optional user prompt to combine with fleet instructions
    */
   prompt?: string;
+  /**
+   * Optional attachments (files, directories, selections, blobs, GitHub references) to include with the fleet request
+   */
+  attachments?: Attachment[];
+  /**
+   * If false, this request will not trigger a Premium Request Unit charge. User requests default to billable.
+   *
+   * @internal
+   */
+  billable?: boolean;
+  /**
+   * If true, await completion of the agentic loop for this fleet request before returning. Defaults to false.
+   */
+  wait?: boolean;
 }
 /**
  * Indicates whether fleet mode was successfully activated.
@@ -13159,6 +13398,10 @@ export interface ModelApplyStartupOverlayRequest {
    * Context tier selected by repository settings, when configured.
    */
   repoContextTier?: string;
+  /**
+   * Auto routing preference selected by repository settings, when configured. Applied only when the overlay selects the Auto model; beside a concrete model it stays dormant.
+   */
+  repoAutoTier?: string;
   /**
    * Model explicitly selected by the CLI, when provided.
    */
@@ -13515,6 +13758,7 @@ export interface ModelSwitchToResult {
 /** @experimental */
 export interface ModeSetRequest {
   mode: SessionMode;
+  expectedMode?: SessionMode;
   /**
    * Session whose plan-mode base state should be inherited.
    */
@@ -13569,6 +13813,10 @@ export interface ModeSetResult {
    * Whether applying the mode changed the active model.
    */
   modelChanged: boolean;
+  /**
+   * Whether the requested mode was applied to the session. False only when an 'expectedMode' precondition did not hold, in which case any model change reported alongside it was still applied.
+   */
+  modeApplied?: boolean;
   confirmation?: ModelSwitchConfirmation;
   /**
    * User-facing warning produced while applying the mode change.
@@ -19228,6 +19476,10 @@ export interface SessionOpenOptions {
    * Whether to skip custom instruction sources.
    */
   skipCustomInstructions?: boolean;
+  /**
+   * Whether to invalidate cached custom-instruction discovery before constructing the session. Use when instruction files may have changed earlier in the same runtime process.
+   */
+  refreshCustomInstructions?: boolean;
   /**
    * Instruction source IDs disabled for this session.
    */
@@ -20405,11 +20657,11 @@ export interface SessionsReadPersistedEventsRequest {
    */
   sessionId: string;
   /**
-   * Opaque cursor returned by a previous persisted-event read. Omit on the first call.
+   * Opaque, process-local, single-use cursor returned by the previous persisted-event read. Omit on the first call and issue continuations sequentially; reusing the same cursor returns an expired terminal page.
    */
   cursor?: string;
   /**
-   * Maximum number of events to return in this batch (1–1000, default 200).
+   * Maximum number of events to return in this batch (1–1000, default 200). Pages may contain fewer events to keep the serialized event array within a soft 1 MiB budget including resolved binary assets; one oversized event is returned alone to guarantee progress.
    */
   max?: number;
   direction?: EventsReadDirection;
@@ -24662,7 +24914,7 @@ export function createServerRpc(connection: MessageConnection) {
             getClientMetadata: async (params: SessionsGetClientMetadataRequest): Promise<SessionsGetClientMetadataResult> =>
                 connection.sendRequest("sessions.getClientMetadata", params),
             /**
-             * Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The initial backward read uses a bounded tail scan for fast first paint; cursor continuations preserve the session event-log paging semantics. Persisted events may omit payloads that are reconstructed only for an active session.
+             * Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The first read pins the currently opened journal generation and its byte-length boundary; opaque cursor continuations remain on that generation across runtime-owned compaction, truncation, and rewrite operations, which replace the live path atomically, and events appended after the boundary are excluded. For cold hydration, await the first successful page before activation and establish lossless live-event buffering before resume; merge subsequent live events by ID, preserving persisted order and letting live payloads win. Continuations are process-local, single-use capabilities bound to the originating session and storage context and must be paged sequentially; concurrent or repeated use of the same cursor expires that duplicate read rather than reading the generation twice. A complete snapshot has cursorStatus 'ok' and hasMore false. Snapshots expire after five idle minutes, with at most eight retained per process and idle-only eviction under pressure; completion and cancelled-worker exit release their handles. No transcript copy is created, but retained handles may keep replaced files' disk blocks alive until release. Pages have a soft 1 MiB serialized event-array budget including resolved binary assets; one oversized event is returned alone to guarantee progress. Working memory also includes a record/lookahead and asset resolution; resolving the first binary reference may scan the full pinned generation to build a bounded offset index. If the snapshot expires, is evicted, is cancelled before a continuation is established, or becomes unreadable after an observable unsupported in-place shortening, the continuation returns cursorStatus 'expired' with an empty terminal page and never falls back to a different generation. A missing or initially unreadable journal is an RPC error. Persisted history excludes ephemeral events and may omit payloads that are reconstructed only for an active session; use the active session event stream for post-resume live events.
              *
              * @param params Pagination options for reading an inactive or active local session's persisted event journal.
              *
@@ -25539,7 +25791,7 @@ export function createSessionRpc(connection: MessageConnection, sessionId: strin
             /**
              * Starts fleet mode by submitting the fleet orchestration prompt to the session.
              *
-             * @param params Optional user prompt to combine with the fleet orchestration instructions.
+             * @param params Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.
              *
              * @returns Indicates whether fleet mode was successfully activated.
              */
diff --git a/nodejs/src/generated/session-events.ts b/nodejs/src/generated/session-events.ts
index b33830dc7d..5bd67b8042 100644
--- a/nodejs/src/generated/session-events.ts
+++ b/nodejs/src/generated/session-events.ts
@@ -91,6 +91,10 @@ export type SessionEvent =
   | SystemNotificationEvent
   | PermissionRequestedEvent
   | PermissionCompletedEvent
+  | PermissionCarriedForwardEvent
+  | PermissionMessageAuthorizationEvent
+  | PermissionMessageAuthorizationReadEvent
+  | PermissionMessageAuthorizationDegradedEvent
   | UserInputRequestedEvent
   | UserInputCompletedEvent
   | ElicitationRequestedEvent
@@ -641,6 +645,18 @@ export type AbortReason =
   | "user_abort"
   /** Autopilot stopped the run because the active objective reached its user-set --max-ai-credits limit. */
   | "autopilot_credit_limit";
+/**
+ * Transport mechanism: stdio, http, sse (deprecated), or memory (in-process MCP server)
+ */
+export type McpServerTransport =
+  /** Server communicates over stdio with a local child process. */
+  | "stdio"
+  /** Server communicates over streamable HTTP. */
+  | "http"
+  /** Server communicates over Server-Sent Events (deprecated). */
+  | "sse"
+  /** Server is backed by an in-memory runtime implementation. */
+  | "memory";
 /**
  * Allowed values for the `ToolExecutionStartToolDescriptionMetaUIVisibility` enumeration.
  */
@@ -929,6 +945,20 @@ export type PermissionPromptRequestPathAccessKind =
   | "shell"
   /** Write access to a filesystem path. */
   | "write";
+/**
+ * Controlled reason or actor responsible for a permission response.
+ */
+export type PermissionDecisionSource =
+  /** The response followed the assisted-approval judge recommendation. */
+  | "assisted_approval"
+  /** A human supplied the response through an interactive prompt. */
+  | "human_response"
+  /** The host applied a standing policy or override rather than a judge recommendation or human decision. */
+  | "host_policy"
+  /** The host denied the request because no interactive user response was available. */
+  | "unattended_fallback"
+  /** A live authorization record from an earlier human decision in this session contained the proposal, so it ran without another prompt. This is not a new human decision and never mints authority of its own. */
+  | "authorization_carry_forward";
 /**
  * The result of the permission request
  */
@@ -956,6 +986,15 @@ export type UserToolSessionApproval =
   | UserToolSessionApprovalFactory
   | UserToolSessionApprovalExtensionPermissionAccess
   | UserToolSessionApprovalExtensionEnvAccess;
+/**
+ * Which direction a message-backed authorization claim moves authority in.
+ */
+/** @experimental */
+export type PermissionMessageAuthorizationPolarity =
+  /** The human's words authorized an effect. */
+  | "grant"
+  /** The human's words refused an effect. */
+  | "denial";
 /**
  * Elicitation mode; "form" for structured input, "url" for browser-based. Defaults to "form" when absent.
  */
@@ -1191,18 +1230,6 @@ export type McpServerStatus =
   | "stopped"
   /** The server is not configured for this session. */
   | "not_configured";
-/**
- * Transport mechanism: stdio, http, sse (deprecated), or memory (in-process MCP server)
- */
-export type McpServerTransport =
-  /** Server communicates over stdio with a local child process. */
-  | "stdio"
-  /** Server communicates over streamable HTTP. */
-  | "http"
-  /** Server communicates over Server-Sent Events (deprecated). */
-  | "sse"
-  /** Server is backed by an in-memory runtime implementation. */
-  | "memory";
 /**
  * Discovery source
  */
@@ -6214,6 +6241,7 @@ export interface ToolExecutionStartData {
    * Original tool name on the MCP server, when the tool is an MCP tool
    */
   mcpToolName?: string;
+  mcpTransport?: McpServerTransport;
   /**
    * Model identifier that generated this tool call
    */
@@ -8109,6 +8137,20 @@ export interface PermissionRequestShell {
    * True when the requested escalation is a permissive retry rather than a full bypass: the command re-runs inside the sandbox with its file and process restrictions recording instead of blocking, while the network policy stays enforced. Always accompanied by requestSandboxBypass, so hosts that do not recognize this field still treat the request as the escalation it is. Hosts that do recognize it must not describe the command as running outside the sandbox, which would overstate the privilege being granted.
    */
   requestSandboxPermissive?: boolean;
+  /**
+   * Runtime-resolved canonical object each possiblePaths entry names, keyed by the requested spelling, used for authorization identity checks. Internal and experimental; clients should continue to display possiblePaths.
+   *
+   * @experimental
+   */
+  resolvedPaths?: {
+    [k: string]: string | undefined;
+  };
+  /**
+   * Runtime-resolved canonical working directory the command runs in, used for authorization identity checks. Internal and experimental; clients should not display it.
+   *
+   * @experimental
+   */
+  resolvedWorkingDirectory?: string;
   /**
    * Tool call ID that triggered this permission request
    */
@@ -8193,6 +8235,12 @@ export interface PermissionRequestWrite {
    * Justification for the sandbox-bypass request. Only meaningful when requestSandboxBypass is true.
    */
   requestSandboxBypassReason?: string;
+  /**
+   * Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display fileName.
+   *
+   * @experimental
+   */
+  resolvedPath?: string;
   /**
    * Tool call ID that triggered this permission request
    */
@@ -8226,6 +8274,12 @@ export interface PermissionRequestRead {
    * What the tool tells the user about the bypass on offer: which policy rule blocked the call, or why it cannot be sandboxed. Only meaningful when requestSandboxBypass is true.
    */
   requestSandboxBypassReason?: string;
+  /**
+   * Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display path.
+   *
+   * @experimental
+   */
+  resolvedPath?: string;
   /**
    * Tool call ID that triggered this permission request
    */
@@ -8656,6 +8710,12 @@ export interface PermissionPromptRequestWrite {
    * Complete new file contents for newly created files
    */
   newFileContents?: string;
+  /**
+   * Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display fileName.
+   *
+   * @experimental
+   */
+  resolvedPath?: string;
   /**
    * Tool call ID that triggered this permission request
    */
@@ -8687,6 +8747,12 @@ export interface PermissionPromptRequestRead {
    * Path of the file or directory being read
    */
   path: string;
+  /**
+   * Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display path.
+   *
+   * @experimental
+   */
+  resolvedPath?: string;
   /**
    * Tool call ID that triggered this permission request
    */
@@ -9096,6 +9162,12 @@ export interface PermissionCompletedEvent {
  * Permission request completion notification signaling UI dismissal
  */
 export interface PermissionCompletedData {
+  /**
+   * Who decided this permission request. Absent on completions recorded before this field existed, which consumers must treat as "not a human decision" rather than assuming one. Authorization records are minted only for `human_response`; an assisted-approval verdict, a host policy, an unattended fallback, and a hook resolution all produce the same `result` a person does, so this is the only field that distinguishes them.
+   *
+   * @experimental
+   */
+  decisionSource?: PermissionDecisionSource;
   /**
    * Request ID of the resolved permission request; clients should dismiss any UI for this request
    */
@@ -9378,6 +9450,244 @@ export interface PermissionDeniedByPermissionRequestHook {
    */
   message?: string;
 }
+/**
+ * Session event "permission.carriedForward". Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left.
+ */
+/** @experimental */
+export interface PermissionCarriedForwardEvent {
+  /**
+   * Sub-agent instance identifier. Absent for events from the root/main agent and session-level events.
+   */
+  agentId?: string;
+  data: PermissionCarriedForwardData;
+  /**
+   * When true, the event is transient and not persisted to the session event log on disk
+   */
+  ephemeral?: boolean;
+  /**
+   * Unique event identifier (UUID v4), generated when the event is emitted
+   */
+  id: string;
+  /**
+   * ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event.
+   */
+  parentId: string | null;
+  /**
+   * ISO 8601 timestamp when the event was created
+   */
+  timestamp: string;
+  /**
+   * Type discriminator. Always "permission.carriedForward".
+   */
+  type: "permission.carriedForward";
+}
+/**
+ * Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left.
+ */
+/** @experimental */
+export interface PermissionCarriedForwardData {
+  /**
+   * Always `authorization_carry_forward`. Stated explicitly so a consumer reading this event cannot mistake it for a human, host-policy, or assisted-approval decision.
+   *
+   * @experimental
+   */
+  decisionSource: PermissionDecisionSource;
+  /**
+   * Identity of the prior authorization record that contained the proposal.
+   *
+   * @experimental
+   */
+  recordId: string;
+  /**
+   * Authorization edge minted for this admission. Not a prompt id: no prompt was raised, so no client should expect a request with this id.
+   *
+   * @experimental
+   */
+  requestId: string;
+  /**
+   * Tool call this admission authorizes. Its execution receipts the prior grant, which is how a single-effect approval is spent rather than carried forward again.
+   *
+   * @experimental
+   */
+  toolCallId: string;
+}
+/**
+ * Session event "permission.messageAuthorization". Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume.
+ */
+/** @experimental */
+export interface PermissionMessageAuthorizationEvent {
+  /**
+   * Sub-agent instance identifier. Absent for events from the root/main agent and session-level events.
+   */
+  agentId?: string;
+  data: PermissionMessageAuthorizationData;
+  /**
+   * When true, the event is transient and not persisted to the session event log on disk
+   */
+  ephemeral?: boolean;
+  /**
+   * Unique event identifier (UUID v4), generated when the event is emitted
+   */
+  id: string;
+  /**
+   * ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event.
+   */
+  parentId: string | null;
+  /**
+   * ISO 8601 timestamp when the event was created
+   */
+  timestamp: string;
+  /**
+   * Type discriminator. Always "permission.messageAuthorization".
+   */
+  type: "permission.messageAuthorization";
+}
+/**
+ * Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume.
+ */
+/** @experimental */
+export interface PermissionMessageAuthorizationData {
+  /**
+   * The kind of effect authorized, as an action-class identifier.
+   *
+   * @experimental
+   */
+  actionClass: string;
+  /**
+   * Whether the claim granted or denied authority.
+   *
+   * @experimental
+   */
+  polarity: PermissionMessageAuthorizationPolarity;
+  /**
+   * Deterministic identity of the record, derived from the turn and span offsets so re-extracting the same span mints nothing new.
+   *
+   * @experimental
+   */
+  recordId: string;
+  /**
+   * End byte offset of the authorizing span within the turn.
+   *
+   * @experimental
+   */
+  spanEnd: number;
+  /**
+   * Start byte offset of the authorizing span within the turn.
+   *
+   * @experimental
+   */
+  spanStart: number;
+  /**
+   * Concrete named targets that appear verbatim inside the span.
+   *
+   * @experimental
+   */
+  targetMembers?: string[];
+  /**
+   * The task the permission is scoped to, when the human named one.
+   *
+   * @experimental
+   */
+  task?: string;
+  /**
+   * The human turn the quoted span was read from.
+   *
+   * @experimental
+   */
+  turnIndex: number;
+  /**
+   * The trusted version discriminator, when one exists. Exact shell-command grants carry the byte-identical commands grounded in the human span; world-derived classes carry a file object, remote tip, or runner only when that state was captured safely. An opaque object mirroring the runtime's adjacently-tagged resolution.
+   *
+   * @experimental
+   */
+  world?: JsonValue;
+}
+/**
+ * Session event "permission.messageAuthorizationRead". Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism.
+ */
+/** @experimental */
+export interface PermissionMessageAuthorizationReadEvent {
+  /**
+   * Sub-agent instance identifier. Absent for events from the root/main agent and session-level events.
+   */
+  agentId?: string;
+  data: PermissionMessageAuthorizationReadData;
+  /**
+   * When true, the event is transient and not persisted to the session event log on disk
+   */
+  ephemeral?: boolean;
+  /**
+   * Unique event identifier (UUID v4), generated when the event is emitted
+   */
+  id: string;
+  /**
+   * ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event.
+   */
+  parentId: string | null;
+  /**
+   * ISO 8601 timestamp when the event was created
+   */
+  timestamp: string;
+  /**
+   * Type discriminator. Always "permission.messageAuthorizationRead".
+   */
+  type: "permission.messageAuthorizationRead";
+}
+/**
+ * Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism.
+ */
+/** @experimental */
+export interface PermissionMessageAuthorizationReadData {
+  /**
+   * The human turn that was read by the proposer.
+   *
+   * @experimental
+   */
+  turnIndex: number;
+}
+/**
+ * Session event "permission.messageAuthorizationDegraded". Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt.
+ */
+/** @experimental */
+export interface PermissionMessageAuthorizationDegradedEvent {
+  /**
+   * Sub-agent instance identifier. Absent for events from the root/main agent and session-level events.
+   */
+  agentId?: string;
+  data: PermissionMessageAuthorizationDegradedData;
+  /**
+   * When true, the event is transient and not persisted to the session event log on disk
+   */
+  ephemeral?: boolean;
+  /**
+   * Unique event identifier (UUID v4), generated when the event is emitted
+   */
+  id: string;
+  /**
+   * ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event.
+   */
+  parentId: string | null;
+  /**
+   * ISO 8601 timestamp when the event was created
+   */
+  timestamp: string;
+  /**
+   * Type discriminator. Always "permission.messageAuthorizationDegraded".
+   */
+  type: "permission.messageAuthorizationDegraded";
+}
+/**
+ * Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt.
+ */
+/** @experimental */
+export interface PermissionMessageAuthorizationDegradedData {
+  /**
+   * The human turn that could not be represented safely.
+   *
+   * @experimental
+   */
+  turnIndex: number;
+}
 /**
  * Session event "user_input.requested". User input request notification with question and optional predefined choices
  */
diff --git a/python/copilot/generated/rpc.py b/python/copilot/generated/rpc.py
index 6a25a8018f..237ec09620 100644
--- a/python/copilot/generated/rpc.py
+++ b/python/copilot/generated/rpc.py
@@ -6,7 +6,7 @@
 
 from typing import ClassVar, TYPE_CHECKING
 
-from .session_events import AbortReason, AgentModelPolicy, Attachment, AutoTier, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerMetadata, McpServerSource, McpServerStatus, ModelChangeSource, PermissionMode, PermissionPromptRequest, PermissionRule, ReasoningSummary, RemediationAction, SessionEvent, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompletionOutcome, UserToolSessionApproval, Verbosity
+from .session_events import AbortReason, AgentModelPolicy, Attachment, AutoTier, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerMetadata, McpServerSource, McpServerStatus, ModelChangeSource, PermissionDecisionSource, PermissionMode, PermissionPromptRequest, PermissionRule, ReasoningSummary, RemediationAction, SessionEvent, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompletionOutcome, UserToolSessionApproval, Verbosity
 
 if TYPE_CHECKING:
     from .._jsonrpc import JsonRpcClient
@@ -1148,6 +1148,68 @@ class CatalogCandidateSourceKind(Enum):
     EMBEDDED = "embedded"
     URL = "url"
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogTrustEligibility(Enum):
+    """Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+    no explicit eligibility field.
+
+    Authority-computed exposure eligibility, kept separate from tier. The current tier-only
+    Agent Finder response maps to `unknown`, never to a locally inferred eligibility.
+    """
+    DEFAULT = "default"
+    EXPANDED = "expanded"
+    HIDDEN = "hidden"
+    UNKNOWN = "unknown"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogTrustSource(Enum):
+    """Bounded authority that supplied the trust field.
+
+    Bounded authority that supplied a catalogue trust observation
+    """
+    AGENT_FINDER = "agent-finder"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogTrustSnapshotSchemaVersion(Enum):
+    """Schema version of this runtime-owned snapshot envelope.
+
+    Schema version of the catalogue trust snapshot envelope
+    """
+    V1 = "v1"
+
+class CatalogTrustSnapshotStatus(Enum):
+    """A recognised T1 or T2 service tier was observed.
+
+    The authority omitted trust metadata.
+
+    The authority explicitly marked its assessment stale.
+
+    The authority explicitly reported a downgraded assessment.
+
+    The authority explicitly revoked its assessment.
+
+    The authority supplied a bounded trust value this runtime does not understand.
+
+    The trust field was empty, unbounded, or had the wrong JSON type.
+    """
+    ABSENT = "absent"
+    CURRENT = "current"
+    DOWNGRADED = "downgraded"
+    MALFORMED = "malformed"
+    REVOKED = "revoked"
+    STALE = "stale"
+    UNSUPPORTED = "unsupported"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogTrustTier(Enum):
+    """Service-computed T1 or T2 trust tier.
+
+    Service-computed trust tier currently emitted by Agent Finder. It is independent of
+    search score, popularity, and client-side ranking.
+    """
+    T1 = "T1"
+    T2 = "T2"
+
 class CatalogAuthenticationRequiredErrorKind(Enum):
     AUTHENTICATION_REQUIRED = "authentication-required"
 
@@ -1221,6 +1283,7 @@ class CatalogCapability(Enum):
     MCP_INSTALL_PLANNING = "mcp-install-planning"
     MCP_SERVER_CARD = "mcp-server-card"
     MULTIPLE_TRANSPORT_CHOICE = "multiple-transport-choice"
+    TRUST_SNAPSHOT = "trust-snapshot"
 
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
@@ -1496,6 +1559,48 @@ class CatalogSearchResultReason(Enum):
 class CatalogSearchSucceededKind(Enum):
     SUCCEEDED = "succeeded"
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogTrustSnapshotAbsentStatus(Enum):
+    """The authority omitted trust metadata."""
+
+    ABSENT = "absent"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogTrustSnapshotCurrentStatus(Enum):
+    """A recognised T1 or T2 service tier was observed."""
+
+    CURRENT = "current"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogTrustSnapshotDowngradedStatus(Enum):
+    """The authority explicitly reported a downgraded assessment."""
+
+    DOWNGRADED = "downgraded"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogTrustSnapshotMalformedStatus(Enum):
+    """The trust field was empty, unbounded, or had the wrong JSON type."""
+
+    MALFORMED = "malformed"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogTrustSnapshotRevokedStatus(Enum):
+    """The authority explicitly revoked its assessment."""
+
+    REVOKED = "revoked"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogTrustSnapshotStaleStatus(Enum):
+    """The authority explicitly marked its assessment stale."""
+
+    STALE = "stale"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogTrustSnapshotUnsupportedStatus(Enum):
+    """The authority supplied a bounded trust value this runtime does not understand."""
+
+    UNSUPPORTED = "unsupported"
+
 class CatalogUnavailableErrorKind(Enum):
     UNAVAILABLE = "unavailable"
 
@@ -2728,7 +2833,8 @@ class EventsReadDirection(Enum):
     (oldest-to-newest), even for a backward read.
 
     Direction to page through persisted history. Forward starts at the beginning; backward
-    starts with the newest events. Events in each page remain chronological.
+    starts with the newest events. Events in each page remain chronological. This selects the
+    initial read only; a continuation always uses the direction bound into its cursor.
     """
     BACKWARD = "backward"
     FORWARD = "forward"
@@ -2782,30 +2888,6 @@ def to_dict(self) -> dict:
         result["cursor"] = from_str(self.cursor)
         return result
 
-# Experimental: this type is part of an experimental API and may change or be removed.
-class EventsCursorStatus(Enum):
-    """Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor
-    referred to an event that no longer exists in history (e.g. truncated or compacted away)
-    and the read fell back to a boundary of the remaining history (the beginning for a
-    forward read, the tail for a backward read). The fallback page is a fresh boundary
-    snapshot, not a continuation of the requested cursor, so it may overlap already-rendered
-    events; on 'expired' a consumer should reset/rebase its pagination state (or deduplicate
-    by event id) before continuing from the returned cursor.
-
-    Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor
-    referred to an event that no longer exists in history (e.g. truncated or compacted away)
-    and the read fell back to a boundary of the remaining history. For a forward read the
-    fallback starts from the beginning of the remaining history; for a backward read it falls
-    back to the tail (the newest window). Because the fallback page is a fresh boundary
-    snapshot rather than a continuation of the requested cursor, it may overlap events the
-    consumer has already rendered — a backward fallback to the tail in particular can repeat
-    the newest window. On 'expired', consumers should reset or rebase their local pagination
-    state (or deduplicate by event id) before continuing from the returned cursor rather than
-    blindly appending/prepending the fallback page.
-    """
-    EXPIRED = "expired"
-    OK = "ok"
-
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class ExecuteCommandParams:
@@ -3646,21 +3728,45 @@ def to_dict(self) -> dict:
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class FleetStartRequest:
-    """Optional user prompt to combine with the fleet orchestration instructions."""
-
+    """Parameters for starting fleet orchestration: an optional user prompt combined with the
+    fleet instructions, plus the send options forwarded to the resulting turn.
+    """
+    attachments: list[Attachment] | None = None
+    """Optional attachments (files, directories, selections, blobs, GitHub references) to
+    include with the fleet request
+    """
+    # Internal: this field is an internal SDK API and is not part of the public surface.
+    billable: bool | None = None
+    """If false, this request will not trigger a Premium Request Unit charge. User requests
+    default to billable.
+    """
     prompt: str | None = None
     """Optional user prompt to combine with fleet instructions"""
 
+    wait: bool | None = None
+    """If true, await completion of the agentic loop for this fleet request before returning.
+    Defaults to false.
+    """
+
     @staticmethod
     def from_dict(obj: Any) -> 'FleetStartRequest':
         assert isinstance(obj, dict)
+        attachments = from_union([lambda x: from_list(Attachment.from_dict, x), from_none], obj.get("attachments"))
+        billable = from_union([from_bool, from_none], obj.get("billable"))
         prompt = from_union([from_str, from_none], obj.get("prompt"))
-        return FleetStartRequest(prompt)
+        wait = from_union([from_bool, from_none], obj.get("wait"))
+        return FleetStartRequest(attachments, billable, prompt, wait)
 
     def to_dict(self) -> dict:
         result: dict = {}
+        if self.attachments is not None:
+            result["attachments"] = from_union([lambda x: from_list(lambda x: to_class(Attachment, x), x), from_none], self.attachments)
+        if self.billable is not None:
+            result["billable"] = from_union([from_bool, from_none], self.billable)
         if self.prompt is not None:
             result["prompt"] = from_union([from_str, from_none], self.prompt)
+        if self.wait is not None:
+            result["wait"] = from_union([from_bool, from_none], self.wait)
         return result
 
 # Experimental: this type is part of an experimental API and may change or be removed.
@@ -7603,17 +7709,6 @@ class PermissionResponseCapability(Enum):
     INTERACTIVE = "interactive"
     NONE = "none"
 
-# Experimental: this type is part of an experimental API and may change or be removed.
-class PermissionDecisionSource(Enum):
-    """Controlled reason or actor responsible for the response.
-
-    Controlled reason or actor responsible for a permission response.
-    """
-    ASSISTED_APPROVAL = "assisted_approval"
-    HOST_POLICY = "host_policy"
-    HUMAN_RESPONSE = "human_response"
-    UNATTENDED_FALLBACK = "unattended_fallback"
-
 # Experimental: this type is part of an experimental API and may change or be removed.
 class PermissionDecisionSurface(Enum):
     """Client surface that submitted the response.
@@ -15590,6 +15685,35 @@ def to_dict(self) -> dict:
         result["value"] = from_str(self.value)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogTrustProvenance:
+    """Bounded source and observation time for this snapshot. This is distinct from evidence
+    used by the authority to calculate trust.
+
+    Where and when the runtime observed the trust metadata. Observation time is not the
+    authority's evaluation time and must not be used to infer staleness.
+    """
+    observed_at: datetime
+    """ISO 8601 timestamp with a timezone offset at which the runtime observed the search result
+    carrying this trust field.
+    """
+    source: CatalogTrustSource
+    """Bounded authority that supplied the trust field."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogTrustProvenance':
+        assert isinstance(obj, dict)
+        observed_at = from_datetime(obj.get("observedAt"))
+        source = CatalogTrustSource(obj.get("source"))
+        return CatalogTrustProvenance(observed_at, source)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["observedAt"] = self.observed_at.isoformat()
+        result["source"] = to_enum(CatalogTrustSource, self.source)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class CatalogAuthenticationRequiredError:
@@ -16038,9 +16162,12 @@ class CatalogNegotiationRefusedError:
     runtime_protocol_version: int
     """Protocol version of the runtime that refused the request."""
 
-    supported_capabilities: list[CatalogCapability]
-    """Every wire feature this runtime understands, so the caller can retry within that
-    contract. This list does not imply that every deployment has enabled every operation.
+    supported_capabilities: list[str]
+    """Capabilities this runtime can safely advertise to this caller. The complete
+    five-capability protocol-3 legacy set is always present; every capability added after
+    that baseline appears only when the caller required it, so an older closed-enum decoder
+    can still consume a refusal. This list does not imply that every deployment has enabled
+    every operation.
     """
     unsupported_capabilities: list[str]
     """The subset of the caller's bounded extensible capability identifiers this runtime cannot
@@ -16054,7 +16181,7 @@ def from_dict(obj: Any) -> 'CatalogNegotiationRefusedError':
         minimum_supported_protocol_version = from_int(obj.get("minimumSupportedProtocolVersion"))
         reason = CatalogNegotiationRefusedReason(obj.get("reason"))
         runtime_protocol_version = from_int(obj.get("runtimeProtocolVersion"))
-        supported_capabilities = from_list(CatalogCapability, obj.get("supportedCapabilities"))
+        supported_capabilities = from_list(from_str, obj.get("supportedCapabilities"))
         unsupported_capabilities = from_list(from_str, obj.get("unsupportedCapabilities"))
         return CatalogNegotiationRefusedError(message, minimum_supported_protocol_version, reason, runtime_protocol_version, supported_capabilities, unsupported_capabilities)
 
@@ -16065,7 +16192,7 @@ def to_dict(self) -> dict:
         result["minimumSupportedProtocolVersion"] = from_int(self.minimum_supported_protocol_version)
         result["reason"] = to_enum(CatalogNegotiationRefusedReason, self.reason)
         result["runtimeProtocolVersion"] = from_int(self.runtime_protocol_version)
-        result["supportedCapabilities"] = from_list(lambda x: to_enum(CatalogCapability, x), self.supported_capabilities)
+        result["supportedCapabilities"] = from_list(from_str, self.supported_capabilities)
         result["unsupportedCapabilities"] = from_list(from_str, self.unsupported_capabilities)
         return result
 
@@ -17194,14 +17321,20 @@ class SessionsReadPersistedEventsRequest:
     """Session ID whose persisted event journal should be read."""
 
     cursor: str | None = None
-    """Opaque cursor returned by a previous persisted-event read. Omit on the first call."""
-
+    """Opaque, process-local, single-use cursor returned by the previous persisted-event read.
+    Omit on the first call and issue continuations sequentially; reusing the same cursor
+    returns an expired terminal page.
+    """
     direction: EventsReadDirection | None = None
     """Direction to page through persisted history. Forward starts at the beginning; backward
-    starts with the newest events. Events in each page remain chronological.
+    starts with the newest events. Events in each page remain chronological. This selects the
+    initial read only; a continuation always uses the direction bound into its cursor.
     """
     max: int | None = None
-    """Maximum number of events to return in this batch (1–1000, default 200)."""
+    """Maximum number of events to return in this batch (1–1000, default 200). Pages may contain
+    fewer events to keep the serialized event array within a soft 1 MiB budget including
+    resolved binary assets; one oversized event is returned alone to guarantee progress.
+    """
 
     @staticmethod
     def from_dict(obj: Any) -> 'SessionsReadPersistedEventsRequest':
@@ -17314,60 +17447,6 @@ def to_dict(self) -> dict:
             result["waitMs"] = from_union([from_int, from_none], self.wait_ms)
         return result
 
-# Experimental: this type is part of an experimental API and may change or be removed.
-@dataclass
-class EventsReadResult:
-    """Batch of session events returned by a read, with cursor and continuation metadata."""
-
-    cursor: str
-    """Opaque cursor for the next read. Pass back unchanged in the next read.cursor to continue
-    from where this read left off. Always present, even when no events were returned. For a
-    backward read this cursor pages toward OLDER events; keep passing `direction: backward`
-    with it (the cursor is also self-describing, so backward paging continues correctly).
-    """
-    cursor_status: EventsCursorStatus
-    """Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor
-    referred to an event that no longer exists in history (e.g. truncated or compacted away)
-    and the read fell back to a boundary of the remaining history. For a forward read the
-    fallback starts from the beginning of the remaining history; for a backward read it falls
-    back to the tail (the newest window). Because the fallback page is a fresh boundary
-    snapshot rather than a continuation of the requested cursor, it may overlap events the
-    consumer has already rendered — a backward fallback to the tail in particular can repeat
-    the newest window. On 'expired', consumers should reset or rebase their local pagination
-    state (or deduplicate by event id) before continuing from the returned cursor rather than
-    blindly appending/prepending the fallback page.
-    """
-    events: list[SessionEvent]
-    """Session events for this batch, merged into a single stream in creation order: durable
-    (persisted) events and ephemeral events interleave exactly as they were emitted. Set
-    `includeEphemeral: false` to receive only durable events. Ephemeral events are never
-    replayable once pruned from the in-memory ring, so a consumer that needs them should keep
-    reading with a non-zero `waitMs`. For a backward (tail-first) read, the returned window
-    contains persisted events only, still in chronological (oldest-to-newest) append order.
-    """
-    has_more: bool
-    """True when more events are available in the read's direction. For a forward read, true
-    means the batch returned `max` events and more are available immediately. For a backward
-    read, true means older persisted events remain before the returned window.
-    """
-
-    @staticmethod
-    def from_dict(obj: Any) -> 'EventsReadResult':
-        assert isinstance(obj, dict)
-        cursor = from_str(obj.get("cursor"))
-        cursor_status = EventsCursorStatus(obj.get("cursorStatus"))
-        events = from_list(SessionEvent.from_dict, obj.get("events"))
-        has_more = from_bool(obj.get("hasMore"))
-        return EventsReadResult(cursor, cursor_status, events, has_more)
-
-    def to_dict(self) -> dict:
-        result: dict = {}
-        result["cursor"] = from_str(self.cursor)
-        result["cursorStatus"] = to_enum(EventsCursorStatus, self.cursor_status)
-        result["events"] = from_list(lambda x: to_class(SessionEvent, x), self.events)
-        result["hasMore"] = from_bool(self.has_more)
-        return result
-
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class ExtensionLaunchProviderResolveRequest:
@@ -20461,6 +20540,10 @@ class ModeSetRequest:
     compaction_decision: str | None = None
     """Explicit response to a model-switch compaction preflight."""
 
+    expected_mode: SessionMode | None = None
+    """Mode the session must currently be in for the change to apply. When set and the session
+    is in a different mode the request is a no-op and reports status 'unchanged'.
+    """
     inherit_plan_base_from_session_id: str | None = None
     """Session whose plan-mode base state should be inherited."""
 
@@ -20493,6 +20576,7 @@ def from_dict(obj: Any) -> 'ModeSetRequest':
         assert isinstance(obj, dict)
         mode = SessionMode(obj.get("mode"))
         compaction_decision = from_union([from_str, from_none], obj.get("compactionDecision"))
+        expected_mode = from_union([SessionMode, from_none], obj.get("expectedMode"))
         inherit_plan_base_from_session_id = from_union([from_str, from_none], obj.get("inheritPlanBaseFromSessionId"))
         persist_plan_selection = from_union([from_bool, from_none], obj.get("persistPlanSelection"))
         picker_settings_context = from_union([ModelPickerSettingsContext.from_dict, from_none], obj.get("pickerSettingsContext"))
@@ -20502,13 +20586,15 @@ def from_dict(obj: Any) -> 'ModeSetRequest':
         plan_model_configured = from_union([from_bool, from_none], obj.get("planModelConfigured"))
         plan_reasoning_effort = from_union([from_str, from_none], obj.get("planReasoningEffort"))
         restore_plan_model = from_union([from_bool, from_none], obj.get("restorePlanModel"))
-        return ModeSetRequest(mode, compaction_decision, inherit_plan_base_from_session_id, persist_plan_selection, picker_settings_context, plan_context_tier, plan_exit_action, plan_model, plan_model_configured, plan_reasoning_effort, restore_plan_model)
+        return ModeSetRequest(mode, compaction_decision, expected_mode, inherit_plan_base_from_session_id, persist_plan_selection, picker_settings_context, plan_context_tier, plan_exit_action, plan_model, plan_model_configured, plan_reasoning_effort, restore_plan_model)
 
     def to_dict(self) -> dict:
         result: dict = {}
         result["mode"] = to_enum(SessionMode, self.mode)
         if self.compaction_decision is not None:
             result["compactionDecision"] = from_union([from_str, from_none], self.compaction_decision)
+        if self.expected_mode is not None:
+            result["expectedMode"] = from_union([lambda x: to_enum(SessionMode, x), from_none], self.expected_mode)
         if self.inherit_plan_base_from_session_id is not None:
             result["inheritPlanBaseFromSessionId"] = from_union([from_str, from_none], self.inherit_plan_base_from_session_id)
         if self.persist_plan_selection is not None:
@@ -20587,6 +20673,11 @@ class ModeSetResult:
     message: str | None = None
     """User-facing outcome message for the model switch triggered by the mode change."""
 
+    mode_applied: bool | None = None
+    """Whether the requested mode was applied to the session. False only when an 'expectedMode'
+    precondition did not hold, in which case any model change reported alongside it was still
+    applied.
+    """
     warning: str | None = None
     """User-facing warning produced while applying the mode change."""
 
@@ -20600,8 +20691,9 @@ def from_dict(obj: Any) -> 'ModeSetResult':
         defer_implementation = from_union([from_bool, from_none], obj.get("deferImplementation"))
         deprecation_warnings = from_union([lambda x: from_list(from_str, x), from_none], obj.get("deprecationWarnings"))
         message = from_union([from_str, from_none], obj.get("message"))
+        mode_applied = from_union([from_bool, from_none], obj.get("modeApplied"))
         warning = from_union([from_str, from_none], obj.get("warning"))
-        return ModeSetResult(model_changed, status, arm_interactive_continuation, confirmation, defer_implementation, deprecation_warnings, message, warning)
+        return ModeSetResult(model_changed, status, arm_interactive_continuation, confirmation, defer_implementation, deprecation_warnings, message, mode_applied, warning)
 
     def to_dict(self) -> dict:
         result: dict = {}
@@ -20617,6 +20709,8 @@ def to_dict(self) -> dict:
             result["deprecationWarnings"] = from_union([lambda x: from_list(from_str, x), from_none], self.deprecation_warnings)
         if self.message is not None:
             result["message"] = from_union([from_str, from_none], self.message)
+        if self.mode_applied is not None:
+            result["modeApplied"] = from_union([from_bool, from_none], self.mode_applied)
         if self.warning is not None:
             result["warning"] = from_union([from_str, from_none], self.warning)
         return result
@@ -26609,6 +26703,259 @@ def to_dict(self) -> dict:
         result["validatedAt"] = from_str(self.validated_at)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogTrustSnapshotAbsent:
+    """Discriminator: the authority omitted trust metadata."""
+
+    eligibility: CatalogTrustEligibility
+    """Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+    no explicit eligibility field.
+    """
+    provenance: CatalogTrustProvenance
+    """Bounded source and observation time for this snapshot. This is distinct from evidence
+    used by the authority to calculate trust.
+    """
+    schema_version: CatalogTrustSnapshotSchemaVersion
+    """Schema version of this runtime-owned snapshot envelope."""
+
+    status: ClassVar[str] = "absent"
+    """Discriminator: the authority omitted trust metadata."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogTrustSnapshotAbsent':
+        assert isinstance(obj, dict)
+        eligibility = CatalogTrustEligibility(obj.get("eligibility"))
+        provenance = CatalogTrustProvenance.from_dict(obj.get("provenance"))
+        schema_version = CatalogTrustSnapshotSchemaVersion(obj.get("schemaVersion"))
+        return CatalogTrustSnapshotAbsent(eligibility, provenance, schema_version)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["eligibility"] = to_enum(CatalogTrustEligibility, self.eligibility)
+        result["provenance"] = to_class(CatalogTrustProvenance, self.provenance)
+        result["schemaVersion"] = to_enum(CatalogTrustSnapshotSchemaVersion, self.schema_version)
+        result["status"] = self.status
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogTrustSnapshotCurrent:
+    """A recognised current Agent Finder T1 or T2 trust tier."""
+
+    eligibility: CatalogTrustEligibility
+    """Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+    no explicit eligibility field.
+    """
+    provenance: CatalogTrustProvenance
+    """Bounded source and observation time for this snapshot. This is distinct from evidence
+    used by the authority to calculate trust.
+    """
+    schema_version: CatalogTrustSnapshotSchemaVersion
+    """Schema version of this runtime-owned snapshot envelope."""
+
+    status: ClassVar[str] = "current"
+    """Discriminator: a recognised current trust tier was observed."""
+
+    tier: CatalogTrustTier
+    """Service-computed T1 or T2 trust tier."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogTrustSnapshotCurrent':
+        assert isinstance(obj, dict)
+        eligibility = CatalogTrustEligibility(obj.get("eligibility"))
+        provenance = CatalogTrustProvenance.from_dict(obj.get("provenance"))
+        schema_version = CatalogTrustSnapshotSchemaVersion(obj.get("schemaVersion"))
+        tier = CatalogTrustTier(obj.get("tier"))
+        return CatalogTrustSnapshotCurrent(eligibility, provenance, schema_version, tier)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["eligibility"] = to_enum(CatalogTrustEligibility, self.eligibility)
+        result["provenance"] = to_class(CatalogTrustProvenance, self.provenance)
+        result["schemaVersion"] = to_enum(CatalogTrustSnapshotSchemaVersion, self.schema_version)
+        result["status"] = self.status
+        result["tier"] = to_enum(CatalogTrustTier, self.tier)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogTrustSnapshotDowngraded:
+    """Discriminator: the authority explicitly reported a downgraded assessment."""
+
+    eligibility: CatalogTrustEligibility
+    """Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+    no explicit eligibility field.
+    """
+    provenance: CatalogTrustProvenance
+    """Bounded source and observation time for this snapshot. This is distinct from evidence
+    used by the authority to calculate trust.
+    """
+    schema_version: CatalogTrustSnapshotSchemaVersion
+    """Schema version of this runtime-owned snapshot envelope."""
+
+    status: ClassVar[str] = "downgraded"
+    """Discriminator: the authority explicitly reported a downgraded assessment."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogTrustSnapshotDowngraded':
+        assert isinstance(obj, dict)
+        eligibility = CatalogTrustEligibility(obj.get("eligibility"))
+        provenance = CatalogTrustProvenance.from_dict(obj.get("provenance"))
+        schema_version = CatalogTrustSnapshotSchemaVersion(obj.get("schemaVersion"))
+        return CatalogTrustSnapshotDowngraded(eligibility, provenance, schema_version)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["eligibility"] = to_enum(CatalogTrustEligibility, self.eligibility)
+        result["provenance"] = to_class(CatalogTrustProvenance, self.provenance)
+        result["schemaVersion"] = to_enum(CatalogTrustSnapshotSchemaVersion, self.schema_version)
+        result["status"] = self.status
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogTrustSnapshotMalformed:
+    """Discriminator: the trust field was empty, unbounded, or had the wrong JSON type."""
+
+    eligibility: CatalogTrustEligibility
+    """Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+    no explicit eligibility field.
+    """
+    provenance: CatalogTrustProvenance
+    """Bounded source and observation time for this snapshot. This is distinct from evidence
+    used by the authority to calculate trust.
+    """
+    schema_version: CatalogTrustSnapshotSchemaVersion
+    """Schema version of this runtime-owned snapshot envelope."""
+
+    status: ClassVar[str] = "malformed"
+    """Discriminator: the trust field was empty, unbounded, or had the wrong JSON type."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogTrustSnapshotMalformed':
+        assert isinstance(obj, dict)
+        eligibility = CatalogTrustEligibility(obj.get("eligibility"))
+        provenance = CatalogTrustProvenance.from_dict(obj.get("provenance"))
+        schema_version = CatalogTrustSnapshotSchemaVersion(obj.get("schemaVersion"))
+        return CatalogTrustSnapshotMalformed(eligibility, provenance, schema_version)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["eligibility"] = to_enum(CatalogTrustEligibility, self.eligibility)
+        result["provenance"] = to_class(CatalogTrustProvenance, self.provenance)
+        result["schemaVersion"] = to_enum(CatalogTrustSnapshotSchemaVersion, self.schema_version)
+        result["status"] = self.status
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogTrustSnapshotRevoked:
+    """Discriminator: the authority explicitly revoked the assessment."""
+
+    eligibility: CatalogTrustEligibility
+    """Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+    no explicit eligibility field.
+    """
+    provenance: CatalogTrustProvenance
+    """Bounded source and observation time for this snapshot. This is distinct from evidence
+    used by the authority to calculate trust.
+    """
+    schema_version: CatalogTrustSnapshotSchemaVersion
+    """Schema version of this runtime-owned snapshot envelope."""
+
+    status: ClassVar[str] = "revoked"
+    """Discriminator: the authority explicitly revoked the assessment."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogTrustSnapshotRevoked':
+        assert isinstance(obj, dict)
+        eligibility = CatalogTrustEligibility(obj.get("eligibility"))
+        provenance = CatalogTrustProvenance.from_dict(obj.get("provenance"))
+        schema_version = CatalogTrustSnapshotSchemaVersion(obj.get("schemaVersion"))
+        return CatalogTrustSnapshotRevoked(eligibility, provenance, schema_version)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["eligibility"] = to_enum(CatalogTrustEligibility, self.eligibility)
+        result["provenance"] = to_class(CatalogTrustProvenance, self.provenance)
+        result["schemaVersion"] = to_enum(CatalogTrustSnapshotSchemaVersion, self.schema_version)
+        result["status"] = self.status
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogTrustSnapshotStale:
+    """Discriminator: the authority explicitly marked the assessment stale."""
+
+    eligibility: CatalogTrustEligibility
+    """Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+    no explicit eligibility field.
+    """
+    provenance: CatalogTrustProvenance
+    """Bounded source and observation time for this snapshot. This is distinct from evidence
+    used by the authority to calculate trust.
+    """
+    schema_version: CatalogTrustSnapshotSchemaVersion
+    """Schema version of this runtime-owned snapshot envelope."""
+
+    status: ClassVar[str] = "stale"
+    """Discriminator: the authority explicitly marked the assessment stale."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogTrustSnapshotStale':
+        assert isinstance(obj, dict)
+        eligibility = CatalogTrustEligibility(obj.get("eligibility"))
+        provenance = CatalogTrustProvenance.from_dict(obj.get("provenance"))
+        schema_version = CatalogTrustSnapshotSchemaVersion(obj.get("schemaVersion"))
+        return CatalogTrustSnapshotStale(eligibility, provenance, schema_version)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["eligibility"] = to_enum(CatalogTrustEligibility, self.eligibility)
+        result["provenance"] = to_class(CatalogTrustProvenance, self.provenance)
+        result["schemaVersion"] = to_enum(CatalogTrustSnapshotSchemaVersion, self.schema_version)
+        result["status"] = self.status
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogTrustSnapshotUnsupported:
+    """Discriminator: the authority supplied a bounded trust value this runtime does not
+    understand.
+    """
+    eligibility: CatalogTrustEligibility
+    """Service-computed exposure eligibility. `unknown` is required while Agent Finder returns
+    no explicit eligibility field.
+    """
+    provenance: CatalogTrustProvenance
+    """Bounded source and observation time for this snapshot. This is distinct from evidence
+    used by the authority to calculate trust.
+    """
+    schema_version: CatalogTrustSnapshotSchemaVersion
+    """Schema version of this runtime-owned snapshot envelope."""
+
+    status: ClassVar[str] = "unsupported"
+    """Discriminator: the authority supplied a bounded trust value this runtime does not
+    understand.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogTrustSnapshotUnsupported':
+        assert isinstance(obj, dict)
+        eligibility = CatalogTrustEligibility(obj.get("eligibility"))
+        provenance = CatalogTrustProvenance.from_dict(obj.get("provenance"))
+        schema_version = CatalogTrustSnapshotSchemaVersion(obj.get("schemaVersion"))
+        return CatalogTrustSnapshotUnsupported(eligibility, provenance, schema_version)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["eligibility"] = to_enum(CatalogTrustEligibility, self.eligibility)
+        result["provenance"] = to_class(CatalogTrustProvenance, self.provenance)
+        result["schemaVersion"] = to_enum(CatalogTrustSnapshotSchemaVersion, self.schema_version)
+        result["status"] = self.status
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class SlashCommandInfo:
@@ -26793,6 +27140,12 @@ class CatalogAISkillCandidate:
     publisher: str | None = None
     """Publisher taken verbatim from the card. Inert untrusted text."""
 
+    trust: CatalogTrustSnapshot | None = None
+    """Versioned trust metadata observed from the catalog authority. Optional for protocol-3
+    compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits
+    an explicit snapshot even when the authority omitted or malformed its trust field.
+    """
+
     @staticmethod
     def from_dict(obj: Any) -> 'CatalogAISkillCandidate':
         assert isinstance(obj, dict)
@@ -26806,7 +27159,8 @@ def from_dict(obj: Any) -> 'CatalogAISkillCandidate':
         source = _load_CatalogCandidateSource(obj.get("source"))
         description = from_union([from_str, from_none], obj.get("description"))
         publisher = from_union([from_str, from_none], obj.get("publisher"))
-        return CatalogAISkillCandidate(display_name, handle, handle_expires_at, installability, kind, media_type, provenance, source, description, publisher)
+        trust = from_union([_load_CatalogTrustSnapshot, from_none], obj.get("trust"))
+        return CatalogAISkillCandidate(display_name, handle, handle_expires_at, installability, kind, media_type, provenance, source, description, publisher, trust)
 
     def to_dict(self) -> dict:
         result: dict = {}
@@ -26822,6 +27176,8 @@ def to_dict(self) -> dict:
             result["description"] = from_union([from_str, from_none], self.description)
         if self.publisher is not None:
             result["publisher"] = from_union([from_str, from_none], self.publisher)
+        if self.trust is not None:
+            result["trust"] = from_union([lambda x: (x).to_dict(), from_none], self.trust)
         return result
 
 # Experimental: this type is part of an experimental API and may change or be removed.
@@ -26876,6 +27232,12 @@ class CatalogCandidate:
     publisher: str | None = None
     """Publisher taken verbatim from the card. Inert untrusted text."""
 
+    trust: CatalogTrustSnapshot | None = None
+    """Versioned trust metadata observed from the catalog authority. Optional for protocol-3
+    compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits
+    an explicit snapshot even when the authority omitted or malformed its trust field.
+    """
+
     @staticmethod
     def from_dict(obj: Any) -> 'CatalogCandidate':
         assert isinstance(obj, dict)
@@ -26889,7 +27251,8 @@ def from_dict(obj: Any) -> 'CatalogCandidate':
         source = _load_CatalogCandidateSource(obj.get("source"))
         description = from_union([from_str, from_none], obj.get("description"))
         publisher = from_union([from_str, from_none], obj.get("publisher"))
-        return CatalogCandidate(display_name, handle, handle_expires_at, installability, kind, media_type, provenance, source, description, publisher)
+        trust = from_union([_load_CatalogTrustSnapshot, from_none], obj.get("trust"))
+        return CatalogCandidate(display_name, handle, handle_expires_at, installability, kind, media_type, provenance, source, description, publisher, trust)
 
     def to_dict(self) -> dict:
         result: dict = {}
@@ -26905,6 +27268,8 @@ def to_dict(self) -> dict:
             result["description"] = from_union([from_str, from_none], self.description)
         if self.publisher is not None:
             result["publisher"] = from_union([from_str, from_none], self.publisher)
+        if self.trust is not None:
+            result["trust"] = from_union([lambda x: (x).to_dict(), from_none], self.trust)
         return result
 
 # Experimental: this type is part of an experimental API and may change or be removed.
@@ -26947,6 +27312,12 @@ class CatalogMCPServerCandidate:
     publisher: str | None = None
     """Publisher taken verbatim from the card. Inert untrusted text."""
 
+    trust: CatalogTrustSnapshot | None = None
+    """Versioned trust metadata observed from the catalog authority. Optional for protocol-3
+    compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits
+    an explicit snapshot even when the authority omitted or malformed its trust field.
+    """
+
     @staticmethod
     def from_dict(obj: Any) -> 'CatalogMCPServerCandidate':
         assert isinstance(obj, dict)
@@ -26960,7 +27331,8 @@ def from_dict(obj: Any) -> 'CatalogMCPServerCandidate':
         source = _load_CatalogCandidateSource(obj.get("source"))
         description = from_union([from_str, from_none], obj.get("description"))
         publisher = from_union([from_str, from_none], obj.get("publisher"))
-        return CatalogMCPServerCandidate(display_name, handle, handle_expires_at, installability, kind, media_type, provenance, source, description, publisher)
+        trust = from_union([_load_CatalogTrustSnapshot, from_none], obj.get("trust"))
+        return CatalogMCPServerCandidate(display_name, handle, handle_expires_at, installability, kind, media_type, provenance, source, description, publisher, trust)
 
     def to_dict(self) -> dict:
         result: dict = {}
@@ -26976,6 +27348,8 @@ def to_dict(self) -> dict:
             result["description"] = from_union([from_str, from_none], self.description)
         if self.publisher is not None:
             result["publisher"] = from_union([from_str, from_none], self.publisher)
+        if self.trust is not None:
+            result["trust"] = from_union([lambda x: (x).to_dict(), from_none], self.trust)
         return result
 
 # Experimental: this type is part of an experimental API and may change or be removed.
@@ -32954,6 +33328,10 @@ class SessionOpenOptions:
     reasoning_summary: ReasoningSummary | None = None
     """Initial reasoning summary mode for supported model clients."""
 
+    refresh_custom_instructions: bool | None = None
+    """Whether to invalidate cached custom-instruction discovery before constructing the
+    session. Use when instruction files may have changed earlier in the same runtime process.
+    """
     remote_defaulted_on: bool | None = None
     """Telemetry-only remote-defaulted flag."""
 
@@ -33067,6 +33445,7 @@ def from_dict(obj: Any) -> 'SessionOpenOptions':
         providers = from_union([lambda x: from_list(NamedProviderConfig.from_dict, x), from_none], obj.get("providers"))
         reasoning_effort = from_union([from_str, from_none], obj.get("reasoningEffort"))
         reasoning_summary = from_union([ReasoningSummary, from_none], obj.get("reasoningSummary"))
+        refresh_custom_instructions = from_union([from_bool, from_none], obj.get("refreshCustomInstructions"))
         remote_defaulted_on = from_union([from_bool, from_none], obj.get("remoteDefaultedOn"))
         remote_exporting = from_union([from_bool, from_none], obj.get("remoteExporting"))
         remote_steerable = from_union([from_bool, from_none], obj.get("remoteSteerable"))
@@ -33085,7 +33464,7 @@ def from_dict(obj: Any) -> 'SessionOpenOptions':
         verbosity = from_union([Verbosity, from_none], obj.get("verbosity"))
         working_directory = from_union([from_str, from_none], obj.get("workingDirectory"))
         working_directory_context = from_union([SessionContext.from_dict, from_none], obj.get("workingDirectoryContext"))
-        return SessionOpenOptions(additional_content_exclusion_policies, additional_directories, agent_context, allow_all_mcp_server_instructions, ask_user_disabled, auth_client_id_metadata_url, auth_info, available_tools, capi, client_kind, client_name, coauthor_enabled, config_dir, continue_on_auto_mode, copilot_url, custom_agents_local_only, detached_from_spawning_parent_engagement_id, detached_from_spawning_parent_session_id, disabled_instruction_sources, disabled_mcp_servers, disabled_skills, enable_citations, enable_file_change_tracking, enable_managed_settings, enable_on_demand_instruction_discovery, enable_script_safety, enable_skills, enable_streaming, env_value_mode, events_log_directory, events_log_includes_subagents, excluded_builtin_agents, excluded_tools, exp_assignments, feature_flags, has_skill_provider, included_builtin_agents, included_builtin_skills, installed_plugins, integration_id, is_experimental_mode, log_interactive_shells, lsp_client_name, managed_settings, max_inline_binary_bytes, memory, model, model_capabilities_overrides, models, name, provider, providers, reasoning_effort, reasoning_summary, remote_defaulted_on, remote_exporting, remote_steerable, running_in_interactive_mode, sandbox_config, sandbox_config_source, session_capabilities, session_id, session_limits, shell, shell_init_profile, shell_process_flags, skill_directories, skip_custom_instructions, trajectory_file, verbosity, working_directory, working_directory_context)
+        return SessionOpenOptions(additional_content_exclusion_policies, additional_directories, agent_context, allow_all_mcp_server_instructions, ask_user_disabled, auth_client_id_metadata_url, auth_info, available_tools, capi, client_kind, client_name, coauthor_enabled, config_dir, continue_on_auto_mode, copilot_url, custom_agents_local_only, detached_from_spawning_parent_engagement_id, detached_from_spawning_parent_session_id, disabled_instruction_sources, disabled_mcp_servers, disabled_skills, enable_citations, enable_file_change_tracking, enable_managed_settings, enable_on_demand_instruction_discovery, enable_script_safety, enable_skills, enable_streaming, env_value_mode, events_log_directory, events_log_includes_subagents, excluded_builtin_agents, excluded_tools, exp_assignments, feature_flags, has_skill_provider, included_builtin_agents, included_builtin_skills, installed_plugins, integration_id, is_experimental_mode, log_interactive_shells, lsp_client_name, managed_settings, max_inline_binary_bytes, memory, model, model_capabilities_overrides, models, name, provider, providers, reasoning_effort, reasoning_summary, refresh_custom_instructions, remote_defaulted_on, remote_exporting, remote_steerable, running_in_interactive_mode, sandbox_config, sandbox_config_source, session_capabilities, session_id, session_limits, shell, shell_init_profile, shell_process_flags, skill_directories, skip_custom_instructions, trajectory_file, verbosity, working_directory, working_directory_context)
 
     def to_dict(self) -> dict:
         result: dict = {}
@@ -33197,6 +33576,8 @@ def to_dict(self) -> dict:
             result["reasoningEffort"] = from_union([from_str, from_none], self.reasoning_effort)
         if self.reasoning_summary is not None:
             result["reasoningSummary"] = from_union([lambda x: to_enum(ReasoningSummary, x), from_none], self.reasoning_summary)
+        if self.refresh_custom_instructions is not None:
+            result["refreshCustomInstructions"] = from_union([from_bool, from_none], self.refresh_custom_instructions)
         if self.remote_defaulted_on is not None:
             result["remoteDefaultedOn"] = from_union([from_bool, from_none], self.remote_defaulted_on)
         if self.remote_exporting is not None:
@@ -33886,7 +34267,7 @@ class CopilotUserResponse:
     """Per-category monthly quota allotments, keyed by quota category."""
 
     organization_list: Any = None
-    """Organizations the user belongs to, each with an optional login and display name."""
+    """Organizations the user belongs to, each with an optional ID, login, and display name."""
 
     organization_login_list: list[str] | None = None
     """Logins of the organizations the user belongs to."""
@@ -34513,6 +34894,80 @@ def to_dict(self) -> dict:
             result["login"] = from_union([from_str, from_none], self.login)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+class EventsCursorStatus(Enum):
+    """Cursor status: 'ok' means the read succeeded against the requested history; 'expired'
+    means the requested continuation is unavailable. Recovery is endpoint-specific:
+    session.eventLog.read returns a boundary window of remaining active history that may
+    overlap prior pages, while sessions.readPersistedEvents returns an empty terminal page
+    and never switches journal generations. An expired persisted read is not successful
+    completion; a complete persisted snapshot requires cursorStatus 'ok' and hasMore false.
+
+    Cursor status: 'ok' means the cursor was applied successfully. For session.eventLog.read,
+    'expired' means the cursor referred to an event that no longer exists in active history
+    and the read fell back to a boundary of the remaining history: the beginning for a
+    forward read or the newest window for a backward read. That fallback may overlap already
+    rendered events, so active-session consumers should reset, rebase, or deduplicate before
+    continuing. sessions.readPersistedEvents has stricter snapshot semantics: 'expired'
+    returns an empty terminal page and never switches to a replacement journal generation.
+    Other persisted-read I/O failures are RPC errors with diagnostics, not cursor expiry.
+    """
+    EXPIRED = "expired"
+    OK = "ok"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class EventsReadResult:
+    """Batch of session events returned by a read, with cursor and continuation metadata."""
+
+    cursor: str
+    """Opaque cursor for the next read. Pass back unchanged in the next read.cursor to continue
+    from where this read left off. Always present, even when no events were returned. For a
+    backward read this cursor pages toward OLDER events; keep passing `direction: backward`
+    with it (the cursor is also self-describing, so backward paging continues correctly).
+    """
+    cursor_status: EventsCursorStatus
+    """Cursor status: 'ok' means the cursor was applied successfully. For session.eventLog.read,
+    'expired' means the cursor referred to an event that no longer exists in active history
+    and the read fell back to a boundary of the remaining history: the beginning for a
+    forward read or the newest window for a backward read. That fallback may overlap already
+    rendered events, so active-session consumers should reset, rebase, or deduplicate before
+    continuing. sessions.readPersistedEvents has stricter snapshot semantics: 'expired'
+    returns an empty terminal page and never switches to a replacement journal generation.
+    Other persisted-read I/O failures are RPC errors with diagnostics, not cursor expiry.
+    """
+    events: list[SessionEvent]
+    """Session events for this batch, merged into a single stream in creation order: durable
+    (persisted) events and ephemeral events interleave exactly as they were emitted. Set
+    `includeEphemeral: false` to receive only durable events. Ephemeral events are never
+    replayable once pruned from the in-memory ring, so a consumer that needs them should keep
+    reading with a non-zero `waitMs`. For a backward (tail-first) read, the returned window
+    contains persisted events only, still in chronological (oldest-to-newest) append order.
+    """
+    has_more: bool
+    """True when more events are available in the read's direction. For a backward read, true
+    means older persisted events remain before the returned window. A persisted-event page
+    may contain fewer than `max` events because of its byte budget while still reporting
+    hasMore true; continue according to this flag rather than the event count.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'EventsReadResult':
+        assert isinstance(obj, dict)
+        cursor = from_str(obj.get("cursor"))
+        cursor_status = EventsCursorStatus(obj.get("cursorStatus"))
+        events = from_list(SessionEvent.from_dict, obj.get("events"))
+        has_more = from_bool(obj.get("hasMore"))
+        return EventsReadResult(cursor, cursor_status, events, has_more)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["cursor"] = from_str(self.cursor)
+        result["cursorStatus"] = to_enum(EventsCursorStatus, self.cursor_status)
+        result["events"] = from_list(lambda x: to_class(SessionEvent, x), self.events)
+        result["hasMore"] = from_bool(self.has_more)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class FactoryAgentSummary:
@@ -35939,6 +36394,10 @@ class ModelApplyStartupOverlayRequest:
     managed sources: it applies only when neither device nor server policy names a model, and
     an explicit user selection still wins.
     """
+    repo_auto_tier: str | None = None
+    """Auto routing preference selected by repository settings, when configured. Applied only
+    when the overlay selects the Auto model; beside a concrete model it stays dormant.
+    """
     repo_context_tier: str | None = None
     """Context tier selected by repository settings, when configured."""
 
@@ -35958,11 +36417,12 @@ def from_dict(obj: Any) -> 'ModelApplyStartupOverlayRequest':
         deferred_resume = from_union([from_bool, from_none], obj.get("deferredResume"))
         device_managed_model = from_union([from_str, from_none], obj.get("deviceManagedModel"))
         policy_helper_model = from_union([from_str, from_none], obj.get("policyHelperModel"))
+        repo_auto_tier = from_union([from_str, from_none], obj.get("repoAutoTier"))
         repo_context_tier = from_union([from_str, from_none], obj.get("repoContextTier"))
         repo_model = from_union([from_str, from_none], obj.get("repoModel"))
         repo_reasoning_effort = from_union([from_str, from_none], obj.get("repoReasoningEffort"))
         server_managed_model = from_union([from_str, from_none], obj.get("serverManagedModel"))
-        return ModelApplyStartupOverlayRequest(cli_model, deferred_resume, device_managed_model, policy_helper_model, repo_context_tier, repo_model, repo_reasoning_effort, server_managed_model)
+        return ModelApplyStartupOverlayRequest(cli_model, deferred_resume, device_managed_model, policy_helper_model, repo_auto_tier, repo_context_tier, repo_model, repo_reasoning_effort, server_managed_model)
 
     def to_dict(self) -> dict:
         result: dict = {}
@@ -35974,6 +36434,8 @@ def to_dict(self) -> dict:
             result["deviceManagedModel"] = from_union([from_str, from_none], self.device_managed_model)
         if self.policy_helper_model is not None:
             result["policyHelperModel"] = from_union([from_str, from_none], self.policy_helper_model)
+        if self.repo_auto_tier is not None:
+            result["repoAutoTier"] = from_union([from_str, from_none], self.repo_auto_tier)
         if self.repo_context_tier is not None:
             result["repoContextTier"] = from_union([from_str, from_none], self.repo_context_tier)
         if self.repo_model is not None:
@@ -37178,6 +37640,26 @@ class RPC:
     catalog_search_request: CatalogSearchRequest
     catalog_search_result: CatalogSearchResult
     catalog_search_succeeded: CatalogSearchSucceeded
+    catalog_trust_eligibility: CatalogTrustEligibility
+    catalog_trust_provenance: CatalogTrustProvenance
+    catalog_trust_snapshot: CatalogTrustSnapshot
+    catalog_trust_snapshot_absent: CatalogTrustSnapshotAbsent
+    catalog_trust_snapshot_absent_status: CatalogTrustSnapshotAbsentStatus
+    catalog_trust_snapshot_current: CatalogTrustSnapshotCurrent
+    catalog_trust_snapshot_current_status: CatalogTrustSnapshotCurrentStatus
+    catalog_trust_snapshot_downgraded: CatalogTrustSnapshotDowngraded
+    catalog_trust_snapshot_downgraded_status: CatalogTrustSnapshotDowngradedStatus
+    catalog_trust_snapshot_malformed: CatalogTrustSnapshotMalformed
+    catalog_trust_snapshot_malformed_status: CatalogTrustSnapshotMalformedStatus
+    catalog_trust_snapshot_revoked: CatalogTrustSnapshotRevoked
+    catalog_trust_snapshot_revoked_status: CatalogTrustSnapshotRevokedStatus
+    catalog_trust_snapshot_schema_version: CatalogTrustSnapshotSchemaVersion
+    catalog_trust_snapshot_stale: CatalogTrustSnapshotStale
+    catalog_trust_snapshot_stale_status: CatalogTrustSnapshotStaleStatus
+    catalog_trust_snapshot_unsupported: CatalogTrustSnapshotUnsupported
+    catalog_trust_snapshot_unsupported_status: CatalogTrustSnapshotUnsupportedStatus
+    catalog_trust_source: CatalogTrustSource
+    catalog_trust_tier: CatalogTrustTier
     catalog_unavailable_error: CatalogUnavailableError
     catalog_unavailable_reason: CatalogUnavailableReason
     catalog_unavailable_transport_error: CatalogUnavailableTransportError
@@ -37687,7 +38169,6 @@ class RPC:
     permission_decision_outcome: PermissionDecisionOutcome
     permission_decision_reject: PermissionDecisionReject
     permission_decision_request: PermissionDecisionRequest
-    permission_decision_source: PermissionDecisionSource
     permission_decision_surface: PermissionDecisionSurface
     permission_decision_user_not_available: PermissionDecisionUserNotAvailable
     permission_location_add_tool_approval_params: PermissionLocationAddToolApprovalParams
@@ -38416,6 +38897,26 @@ def from_dict(obj: Any) -> 'RPC':
         catalog_search_request = CatalogSearchRequest.from_dict(obj.get("CatalogSearchRequest"))
         catalog_search_result = _load_CatalogSearchResult(obj.get("CatalogSearchResult"))
         catalog_search_succeeded = CatalogSearchSucceeded.from_dict(obj.get("CatalogSearchSucceeded"))
+        catalog_trust_eligibility = CatalogTrustEligibility(obj.get("CatalogTrustEligibility"))
+        catalog_trust_provenance = CatalogTrustProvenance.from_dict(obj.get("CatalogTrustProvenance"))
+        catalog_trust_snapshot = _load_CatalogTrustSnapshot(obj.get("CatalogTrustSnapshot"))
+        catalog_trust_snapshot_absent = CatalogTrustSnapshotAbsent.from_dict(obj.get("CatalogTrustSnapshotAbsent"))
+        catalog_trust_snapshot_absent_status = CatalogTrustSnapshotAbsentStatus(obj.get("CatalogTrustSnapshotAbsentStatus"))
+        catalog_trust_snapshot_current = CatalogTrustSnapshotCurrent.from_dict(obj.get("CatalogTrustSnapshotCurrent"))
+        catalog_trust_snapshot_current_status = CatalogTrustSnapshotCurrentStatus(obj.get("CatalogTrustSnapshotCurrentStatus"))
+        catalog_trust_snapshot_downgraded = CatalogTrustSnapshotDowngraded.from_dict(obj.get("CatalogTrustSnapshotDowngraded"))
+        catalog_trust_snapshot_downgraded_status = CatalogTrustSnapshotDowngradedStatus(obj.get("CatalogTrustSnapshotDowngradedStatus"))
+        catalog_trust_snapshot_malformed = CatalogTrustSnapshotMalformed.from_dict(obj.get("CatalogTrustSnapshotMalformed"))
+        catalog_trust_snapshot_malformed_status = CatalogTrustSnapshotMalformedStatus(obj.get("CatalogTrustSnapshotMalformedStatus"))
+        catalog_trust_snapshot_revoked = CatalogTrustSnapshotRevoked.from_dict(obj.get("CatalogTrustSnapshotRevoked"))
+        catalog_trust_snapshot_revoked_status = CatalogTrustSnapshotRevokedStatus(obj.get("CatalogTrustSnapshotRevokedStatus"))
+        catalog_trust_snapshot_schema_version = CatalogTrustSnapshotSchemaVersion(obj.get("CatalogTrustSnapshotSchemaVersion"))
+        catalog_trust_snapshot_stale = CatalogTrustSnapshotStale.from_dict(obj.get("CatalogTrustSnapshotStale"))
+        catalog_trust_snapshot_stale_status = CatalogTrustSnapshotStaleStatus(obj.get("CatalogTrustSnapshotStaleStatus"))
+        catalog_trust_snapshot_unsupported = CatalogTrustSnapshotUnsupported.from_dict(obj.get("CatalogTrustSnapshotUnsupported"))
+        catalog_trust_snapshot_unsupported_status = CatalogTrustSnapshotUnsupportedStatus(obj.get("CatalogTrustSnapshotUnsupportedStatus"))
+        catalog_trust_source = CatalogTrustSource(obj.get("CatalogTrustSource"))
+        catalog_trust_tier = CatalogTrustTier(obj.get("CatalogTrustTier"))
         catalog_unavailable_error = CatalogUnavailableError.from_dict(obj.get("CatalogUnavailableError"))
         catalog_unavailable_reason = CatalogUnavailableReason(obj.get("CatalogUnavailableReason"))
         catalog_unavailable_transport_error = CatalogUnavailableTransportError.from_dict(obj.get("CatalogUnavailableTransportError"))
@@ -38925,7 +39426,6 @@ def from_dict(obj: Any) -> 'RPC':
         permission_decision_outcome = PermissionDecisionOutcome(obj.get("PermissionDecisionOutcome"))
         permission_decision_reject = PermissionDecisionReject.from_dict(obj.get("PermissionDecisionReject"))
         permission_decision_request = PermissionDecisionRequest.from_dict(obj.get("PermissionDecisionRequest"))
-        permission_decision_source = PermissionDecisionSource(obj.get("PermissionDecisionSource"))
         permission_decision_surface = PermissionDecisionSurface(obj.get("PermissionDecisionSurface"))
         permission_decision_user_not_available = PermissionDecisionUserNotAvailable.from_dict(obj.get("PermissionDecisionUserNotAvailable"))
         permission_location_add_tool_approval_params = PermissionLocationAddToolApprovalParams.from_dict(obj.get("PermissionLocationAddToolApprovalParams"))
@@ -39530,7 +40030,7 @@ def from_dict(obj: Any) -> 'RPC':
         subagent_settings = from_union([SubagentSettings.from_dict, from_none], obj.get("SubagentSettings"))
         task_progress = from_union([TaskProgress.from_dict, from_none], obj.get("TaskProgress"))
         workspace_summary = from_union([WorkspaceSummary.from_dict, from_none], obj.get("WorkspaceSummary"))
-        return RPC(abort_request, abort_result, account_all_users, account_get_all_users_result, account_get_current_auth_result, account_get_quota_request, account_get_quota_result, account_login_request, account_login_result, account_logout_request, account_logout_result, account_quota_snapshot, adaptive_thinking_support, agent_discovery_path, agent_discovery_path_list, agent_discovery_path_scope, agent_get_current_result, agent_info, agent_info_source, agent_list, agent_list_request, agent_registry_live_target_entry, agent_registry_live_target_entry_attention_kind, agent_registry_live_target_entry_kind, agent_registry_live_target_entry_last_terminal_event, agent_registry_live_target_entry_status, agent_registry_log_capture, agent_registry_log_capture_open_error_reason, agent_registry_spawn_error, agent_registry_spawn_permission_mode, agent_registry_spawn_registry_timeout, agent_registry_spawn_request, agent_registry_spawn_result, agent_registry_spawn_spawned, agent_registry_spawn_validation_error, agent_registry_spawn_validation_error_field, agent_registry_spawn_validation_error_reason, agent_reload_result, agents_discover_request, agent_select_request, agent_select_result, agent_set_prompt_request, agents_get_discovery_paths_request, api_key_auth_info, auth_identity, auth_info, auth_info_type, auth_validation_error, auth_validation_errors, autopilot_objective_credit_limit, autopilot_objective_get_state_result, autopilot_objective_state, autopilot_objective_status, built_in_model_catalog, built_in_model_catalog_entry, builtin_tool_descriptor, builtin_tool_format, builtin_tool_format_type, builtin_tool_input_schema, builtin_tool_input_schema_type, builtin_tool_safe_for_telemetry, builtin_tool_safe_telemetry_fields, cancel_user_requested_shell_command_result, canvas_action, canvas_action_invoke_request, canvas_action_invoke_result, canvas_close_request, canvas_host_context, canvas_host_context_capabilities, canvas_json_schema, canvas_list, canvas_list_open_result, canvas_open_request, canvas_provider_close_request, canvas_provider_invoke_action_request, canvas_provider_open_request, canvas_provider_open_result, canvas_provider_register_request, canvas_provider_unregister_request, canvas_session_context, capi_session_options, card_digest, card_digest_algorithm, card_digest_value, catalog_ai_skill_candidate, catalog_ai_skill_candidate_provenance, catalog_authentication_required_error, catalog_authentication_required_reason, catalog_candidate, catalog_candidate_kind, catalog_candidate_source, catalog_candidate_source_embedded, catalog_candidate_source_url, catalog_capability, catalog_capability_id, catalog_client_contract, catalog_contract_violation_error, catalog_contract_violation_reason, catalog_handle_rejected_error, catalog_handle_rejection_reason, catalog_handle_type, catalog_invalid_request_error, catalog_invalid_request_field, catalog_malformed_card_error, catalog_malformed_card_reason, catalog_mcp_server_candidate, catalog_mcp_server_candidate_provenance, catalog_mcp_server_installability, catalog_media_type, catalog_negotiated_contract, catalog_negotiation_refused_error, catalog_negotiation_refused_reason, catalog_network_failure_error, catalog_network_failure_reason, catalog_not_installable_error, catalog_not_installable_reason, catalog_policy_rejected_error, catalog_search_request, catalog_search_result, catalog_search_succeeded, catalog_unavailable_error, catalog_unavailable_reason, catalog_unavailable_transport_error, catalog_unavailable_transport_reason, catalog_unsafe_retrieval_error, catalog_unsafe_retrieval_reason, catalog_unsupported_kind_error, client_metadata, client_task_cancel_reason, client_task_cancel_request, client_task_cancel_result, command_list, commands_finalize_invocation_effect_request, commands_finalize_invocation_effect_result, commands_handle_pending_command_request, commands_handle_pending_command_result, commands_invocation_effect_outcome, commands_invocation_origin, commands_invoke_request, commands_list_request, commands_respond_to_queued_command_request, commands_respond_to_queued_command_result, completions_get_trigger_characters_result, completions_request_request, completions_request_result, configure_session_extensions_params, connect_client_info, connected_remote_session_metadata, connected_remote_session_metadata_kind, connected_remote_session_metadata_repository, connect_remote_session_params, connect_request, connect_result, content_exclusion_check_paths_request, content_exclusion_check_paths_result, content_exclusion_path_check, content_filter_mode, context_heaviest_message, copilot_api_token_auth_info, copilot_user_response, copilot_user_response_endpoints, copilot_user_response_quota_snapshots, copilot_user_response_quota_snapshots_chat, copilot_user_response_quota_snapshots_completions, copilot_user_response_quota_snapshots_premium_interactions, current_model, current_tool_metadata, debug_collect_logs_collected_entry, debug_collect_logs_destination, debug_collect_logs_entry, debug_collect_logs_entry_kind, debug_collect_logs_include, debug_collect_logs_redaction, debug_collect_logs_request, debug_collect_logs_result, debug_collect_logs_result_kind, debug_collect_logs_skipped_entry, debug_collect_logs_source, discovered_canvas, discovered_extension, discovered_extension_mode, discovered_extension_plugin, discovered_extensions, discovered_extensions_disable_request, discovered_extensions_enable_request, discovered_extension_source, discovered_hook, discovered_mcp_server, discovered_mcp_server_type, enqueue_command_params, enqueue_command_result, env_auth_info, event_log_read_request, event_log_release_interest_result, event_log_tail_result, event_log_types, events_agent_scope, events_cursor_status, events_read_direction, events_read_result, execute_command_params, execute_command_result, extension, extension_context_push_input, extension_launch_profile, extension_launch_provider_resolve_request, extension_launch_provider_resolve_result, extension_list, extensions_disable_request, extensions_enable_request, extension_source, extension_status, external_tool_result, external_tool_text_result_for_llm, external_tool_text_result_for_llm_binary_results_for_llm, external_tool_text_result_for_llm_binary_results_for_llm_type, external_tool_text_result_for_llm_content, external_tool_text_result_for_llm_content_audio, external_tool_text_result_for_llm_content_image, external_tool_text_result_for_llm_content_resource, external_tool_text_result_for_llm_content_resource_details, external_tool_text_result_for_llm_content_resource_link, external_tool_text_result_for_llm_content_resource_link_icon, external_tool_text_result_for_llm_content_resource_link_icon_theme, external_tool_text_result_for_llm_content_shell_exit, external_tool_text_result_for_llm_content_terminal, external_tool_text_result_for_llm_content_text, factory_abort_request, factory_ack_result, factory_agent_options, factory_agent_request, factory_agent_result, factory_agent_summary, factory_cancel_request, factory_current_phase, factory_declared_limits, factory_durable_operation, factory_execute_request, factory_execute_result, factory_get_run_progress_request, factory_get_run_request, factory_journal_get_request, factory_journal_get_result, factory_journal_put_request, factory_list_runs_request, factory_list_runs_result, factory_log_line, factory_log_line_kind, factory_log_request, factory_pause_checkpoint_action, factory_pause_checkpoint_request, factory_pause_checkpoint_result, factory_pause_info, factory_pause_request, factory_phase_observation, factory_phase_status, factory_progress_line, factory_progress_page, factory_resume_request, factory_resume_result, factory_run_consumed, factory_run_detail, factory_run_failure, factory_run_failure_kind, factory_run_limits, factory_run_request, factory_run_result, factory_run_status, factory_run_summary, factory_run_terminal, factory_tool_resume_request, factory_tool_run_options, factory_tool_run_request, filter_mapping, fleet_start_request, fleet_start_result, folder_trust_add_params, folder_trust_check_params, folder_trust_check_result, gh_cli_auth_info, git_hub_telemetry_client_info, git_hub_telemetry_event, git_hub_telemetry_notification, git_hub_token_acquire_reason, git_hub_token_acquire_request, git_hub_token_acquire_result, handle_pending_tool_call_request, handle_pending_tool_call_result, history_abort_manual_compaction_result, history_cancel_background_compaction_result, history_clear_context_request, history_clear_context_result, history_compact_context_window, history_compact_request, history_compact_result, history_file_restore_skip_reason, history_list_rewind_points_result, history_preview_rewind_request, history_preview_rewind_result, history_rewind_change_type, history_rewind_file_preview, history_rewind_mode, history_rewind_outcome, history_rewind_point, history_rewind_request, history_rewind_result, history_rewind_unavailable_reason, history_skipped_file_restore, history_summarize_for_handoff_result, history_truncate_request, history_truncate_result, hmac_auth_info, hook_invoke_request, hook_invoke_response, hook_origin, hooks_discover_request, hooks_discover_result, hook_type, installed_plugin, installed_plugin_info, installed_plugin_source, installed_plugin_source_git_hub, installed_plugin_source_local, installed_plugin_source_url, instruction_discovery_path, instruction_discovery_path_kind, instruction_discovery_path_list, instruction_discovery_path_location, instructions_discover_request, instructions_get_discovery_paths_request, instructions_get_sources_result, instruction_source, instruction_source_location, instruction_source_type, interrupt_main_turn_request, interrupt_main_turn_result, llm_inference_headers, llm_inference_http_request_chunk_request, llm_inference_http_request_chunk_result, llm_inference_http_request_start_request, llm_inference_http_request_start_result, llm_inference_http_request_start_transport, llm_inference_http_response_chunk_error, llm_inference_http_response_chunk_request, llm_inference_http_response_chunk_result, llm_inference_http_response_start_request, llm_inference_http_response_start_result, llm_inference_set_provider_result, local_session_metadata_value, log_request, log_result, lsp_initialize_request, managed_settings_read_result, marketplace_add_result, marketplace_browse_result, marketplace_info, marketplace_list_result, marketplace_plugin_info, marketplace_refresh_entry, marketplace_refresh_result, marketplace_remove_result, mcp_allowed_server, mcp_apps_call_tool_request, mcp_apps_diagnose_capability, mcp_apps_diagnose_request, mcp_apps_diagnose_result, mcp_apps_diagnose_server, mcp_apps_host_context, mcp_apps_host_context_details, mcp_apps_host_context_details_available_display_mode, mcp_apps_host_context_details_display_mode, mcp_apps_host_context_details_platform, mcp_apps_host_context_details_theme, mcp_apps_list_tools_request, mcp_apps_list_tools_result, mcp_apps_read_resource_request, mcp_apps_read_resource_result, mcp_apps_resource_content, mcp_apps_set_host_context_details, mcp_apps_set_host_context_details_available_display_mode, mcp_apps_set_host_context_details_display_mode, mcp_apps_set_host_context_details_platform, mcp_apps_set_host_context_details_theme, mcp_apps_set_host_context_request, mcp_cancel_sampling_execution_params, mcp_cancel_sampling_execution_result, mcp_config_add_request, mcp_config_disable_request, mcp_config_enable_request, mcp_config_list, mcp_config_remove_request, mcp_config_update_request, mcp_configure_git_hub_request, mcp_configure_git_hub_result, mcp_disable_request, mcp_discover_request, mcp_discover_result, mcp_elicitation_form_mode, mcp_enable_request, mcp_execute_sampling_params, mcp_execute_sampling_request, mcp_execute_sampling_result, mcp_failed_server, mcp_filtered_server, mcp_headers_handle_pending_headers_refresh_request, mcp_headers_handle_pending_headers_refresh_request_request, mcp_headers_handle_pending_headers_refresh_request_result, mcp_host_state, mcp_install_plan, mcp_is_server_running_request, mcp_is_server_running_result, mcp_list_tools_request, mcp_list_tools_result, mcp_oauth_authentication_state_changed_request, mcp_oauth_handle_pending_request, mcp_oauth_handle_pending_result, mcp_oauth_login_grant_type, mcp_oauth_login_request, mcp_oauth_login_result, mcp_oauth_pending_request_response, mcp_oauth_probe_needs_auth_reason, mcp_oauth_probe_request, mcp_oauth_probe_result, mcp_oauth_respond_request, mcp_oauth_respond_result, mcp_plan_configuration_change, mcp_plan_configuration_operation, mcp_plan_enum_value_type, mcp_plan_install_planned, mcp_plan_install_request, mcp_plan_install_result, mcp_plan_install_source, mcp_plan_install_source_candidate, mcp_plan_install_source_candidate_kind, mcp_plan_install_source_card, mcp_plan_install_source_card_kind, mcp_plan_package_install_method, mcp_plan_package_transport, mcp_plan_policy_decision, mcp_plan_policy_result, mcp_plan_policy_source, mcp_plan_provenance, mcp_plan_remote_install_method, mcp_plan_remote_transport, mcp_plan_required_value, mcp_plan_required_value_enum, mcp_plan_required_value_enum_kind, mcp_plan_required_value_scalar, mcp_plan_required_value_scalar_kind, mcp_plan_resource_identity, mcp_plan_scalar_value_type, mcp_plan_scope, mcp_plan_secret_placeholder, mcp_plan_secret_reference, mcp_plan_target, mcp_plan_transport_choice, mcp_plan_transport_choice_package, mcp_plan_transport_choice_remote, mcp_plan_value_category, mcp_register_external_client_request, mcp_reload_config, mcp_reload_with_config_request, mcp_remove_git_hub_result, mcp_resource, mcp_resource_annotations, mcp_resource_content, mcp_resource_icon, mcp_resources_list_request, mcp_resources_list_result, mcp_resources_list_templates_request, mcp_resources_list_templates_result, mcp_resources_read_request, mcp_resources_read_result, mcp_resource_template, mcp_restart_server_request, mcp_safe_for_telemetry, mcp_safe_for_telemetry_fields, mcp_sampling_execution_action, mcp_sampling_execution_result, mcp_serializable_server_config, mcp_server, mcp_server_auth_config, mcp_server_auth_config_redirect_port, mcp_server_card_embedded, mcp_server_card_embedded_kind, mcp_server_card_media_type, mcp_server_card_reference, mcp_server_card_url, mcp_server_card_url_kind, mcp_server_config, mcp_server_config_defer_tools, mcp_server_config_http, mcp_server_config_http_oauth_grant_type, mcp_server_config_http_type, mcp_server_config_memory, mcp_server_config_memory_type, mcp_server_config_stdio, mcp_server_config_stdio_type, mcp_server_failure_info, mcp_server_list, mcp_server_needs_auth_info, mcp_set_env_value_mode_details, mcp_set_env_value_mode_params, mcp_set_env_value_mode_result, mcp_source_file, mcp_source_plugin, mcp_source_ref, mcp_start_server_request, mcp_start_servers_result, mcp_stop_server_request, mcp_task_metadata, mcp_tools, mcp_tool_ui, mcp_tool_ui_visibility, mcp_unregister_external_client_request, memory_configuration, metadata_context_attribution_result, metadata_context_heaviest_messages_request, metadata_context_heaviest_messages_result, metadata_context_info_request, metadata_context_info_result, metadata_is_processing_result, metadata_recompute_context_tokens_request, metadata_recompute_context_tokens_result, metadata_record_context_change_request, metadata_record_context_change_result, metadata_set_working_directory_request, metadata_set_working_directory_result, metadata_snapshot_current_mode, metadata_snapshot_remote_metadata, metadata_snapshot_remote_metadata_repository, metadata_snapshot_remote_metadata_task_type, metadata_update_client_metadata_request, model, model_apply_startup_overlay_request, model_billing, model_billing_promo, model_billing_token_prices, model_billing_token_prices_long_context, model_capabilities, model_capabilities_limits, model_capabilities_limits_vision, model_capabilities_override, model_capabilities_override_limits, model_capabilities_override_limits_vision, model_capabilities_override_supports, model_capabilities_supports, model_list, model_list_request, model_message, model_picker_category, model_picker_persistence_request, model_picker_price_category, model_picker_settings_context, model_policy, model_policy_state, model_set_allowed_models_request, model_set_allowed_models_result, model_set_reasoning_effort_request, model_set_reasoning_effort_result, models_list_request, model_switch_auto_tier_request, model_switch_auto_tier_result, model_switch_auto_tier_status, model_switch_confirmation, model_switch_to_request, model_switch_to_result, model_warning_text, mode_set_request, mode_set_result, move_mcp_loading_to_background_result, named_provider_config, name_get_result, name_set_auto_request, name_set_auto_result, name_set_request, open_canvas_instance, options_update_additional_content_exclusion_policy, options_update_additional_content_exclusion_policy_rule, options_update_additional_content_exclusion_policy_rule_source, options_update_additional_content_exclusion_policy_scope, options_update_context_tier, options_update_env_value_mode, options_update_reasoning_summary, options_update_tool_filter_precedence, pending_permission_request, pending_permission_request_list, permission_decision, permission_decision_approved, permission_decision_approved_for_location, permission_decision_approved_for_session, permission_decision_approve_for_location, permission_decision_approve_for_location_approval, permission_decision_approve_for_location_approval_commands, permission_decision_approve_for_location_approval_custom_tool, permission_decision_approve_for_location_approval_extension_env_access, permission_decision_approve_for_location_approval_extension_management, permission_decision_approve_for_location_approval_extension_permission_access, permission_decision_approve_for_location_approval_factory, permission_decision_approve_for_location_approval_mcp, permission_decision_approve_for_location_approval_mcp_sampling, permission_decision_approve_for_location_approval_memory, permission_decision_approve_for_location_approval_read, permission_decision_approve_for_location_approval_write, permission_decision_approve_for_session, permission_decision_approve_for_session_approval, permission_decision_approve_for_session_approval_commands, permission_decision_approve_for_session_approval_custom_tool, permission_decision_approve_for_session_approval_extension_env_access, permission_decision_approve_for_session_approval_extension_management, permission_decision_approve_for_session_approval_extension_permission_access, permission_decision_approve_for_session_approval_factory, permission_decision_approve_for_session_approval_mcp, permission_decision_approve_for_session_approval_mcp_sampling, permission_decision_approve_for_session_approval_memory, permission_decision_approve_for_session_approval_read, permission_decision_approve_for_session_approval_write, permission_decision_approve_once, permission_decision_approve_permanently, permission_decision_cancelled, permission_decision_context, permission_decision_denied_by_content_exclusion_policy, permission_decision_denied_by_permission_request_hook, permission_decision_denied_by_rules, permission_decision_denied_interactively_by_user, permission_decision_denied_no_approval_rule_and_could_not_request_from_user, permission_decision_outcome, permission_decision_reject, permission_decision_request, permission_decision_source, permission_decision_surface, permission_decision_user_not_available, permission_location_add_tool_approval_params, permission_location_apply_params, permission_location_apply_result, permission_location_resolve_params, permission_location_resolve_result, permission_location_type, permission_mode_source, permission_paths_add_params, permission_paths_allowed_check_params, permission_paths_allowed_check_result, permission_paths_config, permission_paths_list, permission_paths_update_primary_params, permission_paths_workspace_check_params, permission_paths_workspace_check_result, permission_prompt_shown_notification, permission_request_result, permission_response_capability, permission_rules_set, permissions_configure_additional_content_exclusion_policy, permissions_configure_additional_content_exclusion_policy_rule, permissions_configure_additional_content_exclusion_policy_rule_source, permissions_configure_additional_content_exclusion_policy_scope, permissions_configure_params, permissions_configure_result, permissions_folder_trust_add_trusted_result, permissions_get_mode_request, permissions_get_mode_result, permissions_locations_add_tool_approval_details, permissions_locations_add_tool_approval_details_commands, permissions_locations_add_tool_approval_details_custom_tool, permissions_locations_add_tool_approval_details_extension_env_access, permissions_locations_add_tool_approval_details_extension_management, permissions_locations_add_tool_approval_details_extension_permission_access, permissions_locations_add_tool_approval_details_factory, permissions_locations_add_tool_approval_details_mcp, permissions_locations_add_tool_approval_details_mcp_sampling, permissions_locations_add_tool_approval_details_memory, permissions_locations_add_tool_approval_details_read, permissions_locations_add_tool_approval_details_write, permissions_locations_add_tool_approval_result, permissions_modify_rules_params, permissions_modify_rules_result, permissions_modify_rules_scope, permissions_notify_prompt_shown_result, permissions_paths_add_result, permissions_paths_list_request, permissions_paths_update_primary_result, permissions_pending_requests_request, permissions_reset_session_approvals_request, permissions_reset_session_approvals_result, permissions_set_approve_all_request, permissions_set_approve_all_result, permissions_set_approve_all_source, permissions_set_mode_request, permissions_set_mode_result, permissions_set_required_request, permissions_set_required_result, permissions_urls_set_unrestricted_mode_result, permission_urls_config, permission_urls_set_unrestricted_mode_params, ping_request, ping_result, plan_read_result, plan_read_sql_todos_result, plan_read_sql_todos_with_dependencies_result, plan_sql_todo_dependency, plan_sql_todos_row, plan_update_request, plugin, plugin_install_result, plugin_install_staging_mode, plugin_list, plugin_list_result, plugins_builtin_set_request, plugins_disable_request, plugins_enable_request, plugins_install_request, plugins_marketplaces_add_request, plugins_marketplaces_browse_request, plugins_marketplaces_refresh_request, plugins_marketplaces_remove_request, plugins_reload_request, plugins_uninstall_request, plugins_update_request, plugin_update_all_entry, plugin_update_all_result, plugin_update_result, protocol_external_tool_defer, protocol_external_tool_definition, provider_add_request, provider_add_result, provider_config, provider_config_azure, provider_config_transport, provider_config_type, provider_config_wire_api, provider_endpoint, provider_endpoint_transport, provider_endpoint_type, provider_endpoint_wire_api, provider_get_endpoint_request, provider_model_config, provider_session_token, provider_token_acquire_request, provider_token_acquire_result, push_attachment, push_attachment_blob, push_attachment_directory, push_attachment_file, push_attachment_file_line_range, push_attachment_git_hub_actions_job, push_attachment_git_hub_commit, push_attachment_git_hub_file, push_attachment_git_hub_file_diff, push_attachment_git_hub_file_diff_side, push_attachment_git_hub_reference, push_attachment_git_hub_reference_type, push_attachment_git_hub_release, push_attachment_git_hub_repository, push_attachment_git_hub_snippet, push_attachment_git_hub_tree_comparison, push_attachment_git_hub_tree_comparison_side, push_attachment_git_hub_url, push_attachment_selection, push_attachment_selection_details, push_attachment_selection_details_end, push_attachment_selection_details_start, push_git_hub_repo_ref, queue_begin_deferred_idle_drain_request, queue_begin_deferred_idle_drain_result, queue_consume_system_notifications_request, queued_command_handled, queued_command_not_handled, queued_command_result, queue_defer_session_idle_request, queue_duplicate_at_request, queue_duplicate_at_result, queue_enqueue_resume_pending_result, queue_finish_deferred_idle_drain_request, queue_finish_deferred_idle_drain_result, queue_has_pending_result, queue_insert_at_request, queue_insert_at_result, queue_insert_message, queue_move_item_request, queue_move_item_result, queue_pending_items, queue_pending_items_kind, queue_pending_items_result, queue_remove_at_request, queue_remove_at_result, queue_remove_most_recent_result, queue_send_now_request, queue_send_now_result, queue_set_drain_paused_request, queue_snapshot_result, queue_update_text_request, queue_update_text_result, register_event_interest_params, register_event_interest_result, register_extension_tools_params, register_extension_tools_result, release_event_interest_params, remote_control_config, remote_control_config_existing_mc_session, remote_control_status, remote_control_status_active, remote_control_status_connecting, remote_control_status_error, remote_control_status_off, remote_control_status_result, remote_control_stop_result, remote_control_transfer_result, remote_enable_request, remote_enable_result, remote_notify_steerable_changed_request, remote_notify_steerable_changed_result, remote_session_connection_result, remote_session_host_status, remote_session_metadata_repository, remote_session_metadata_task_type, remote_session_metadata_value, remote_session_mode, remote_session_repository, run_options, sandbox_config, sandbox_config_auth, sandbox_config_source, sandbox_config_user_policy, sandbox_config_user_policy_experimental, sandbox_config_user_policy_experimental_seatbelt, sandbox_config_user_policy_filesystem, sandbox_config_user_policy_network, sandbox_config_user_policy_network_proxy, sandbox_config_user_policy_seatbelt, sandbox_disable_for_session_request, sandbox_disable_for_session_result, sandbox_enforcement_status, schedule_add_at_request, schedule_add_cron_request, schedule_add_request, schedule_add_result, schedule_add_self_paced_request, schedule_entry, schedule_has_self_paced_result, schedule_list, schedule_rearm_self_paced_request, schedule_stop_request, schedule_stop_result, secrets_add_filter_values_request, secrets_add_filter_values_result, send_agent_mode, send_attachments_to_message_params, send_message_item, send_messages_request, send_messages_result, send_mode, send_request, send_result, send_system_notification_request, server_agent_list, server_instruction_source_list, server_skill, server_skill_list, session_activity, session_agent_list_request, session_auth_login_request, session_auth_logout_user_request, session_auth_status, session_auth_switch_request, session_bulk_delete_result, session_cancel_all_background_agents_result, session_capability, session_commands_list_request, session_completion_item, session_context, session_context_host_type, session_enrich_metadata_result, session_factory_pause_at_checkpoint_result, session_fs_append_file_request, session_fs_error, session_fs_error_code, session_fs_exists_request, session_fs_exists_result, session_fs_mkdir_request, session_fs_readdir_request, session_fs_readdir_result, session_fs_readdir_with_types_entry, session_fs_readdir_with_types_entry_type, session_fs_readdir_with_types_request, session_fs_readdir_with_types_result, session_fs_read_file_request, session_fs_read_file_result, session_fs_rename_request, session_fs_rm_request, session_fs_set_provider_capabilities, session_fs_set_provider_conventions, session_fs_set_provider_request, session_fs_set_provider_result, session_fs_sqlite_exists_request, session_fs_sqlite_exists_result, session_fs_sqlite_query_request, session_fs_sqlite_query_result, session_fs_sqlite_query_type, session_fs_sqlite_transaction_error, session_fs_sqlite_transaction_error_class, session_fs_sqlite_transaction_request, session_fs_sqlite_transaction_result, session_fs_sqlite_transaction_statement, session_fs_stat_request, session_fs_stat_result, session_fs_write_file_request, session_git_hub_auth_get_all_auth_available_result, session_git_hub_auth_logout_result, session_git_hub_auth_logout_user_result, session_history_compact_request, session_installed_plugin, session_installed_plugin_source, session_installed_plugin_source_git_hub, session_installed_plugin_source_local, session_installed_plugin_source_url, session_limit_prediction_baseline_data, session_limit_prediction_client_type, session_limit_prediction_details, session_limit_prediction_predict_request, session_limit_prediction_request, session_limit_prediction_result, session_limit_prediction_source, session_limit_prediction_tier, session_limit_prediction_tier_option, session_limit_prediction_unavailable_reason, session_list, session_list_entry, session_list_filter, session_load_deferred_repo_hooks_result, session_log_level, session_managed_permissions, session_managed_settings, session_mcp_apps_call_tool_result, session_metadata_snapshot, session_mode, session_model_list, session_model_list_request, session_model_price_category, session_open_options, session_open_options_additional_content_exclusion_policy, session_open_options_additional_content_exclusion_policy_rule, session_open_options_additional_content_exclusion_policy_rule_source, session_open_options_additional_content_exclusion_policy_scope, session_open_options_env_value_mode, session_open_options_reasoning_summary, session_open_params, session_open_result, session_plugins_reload_request, session_provider_get_endpoint_request, session_prune_result, sessions_bulk_delete_request, sessions_check_in_use_request, sessions_check_in_use_result, sessions_client_metadata_entry, sessions_close_request, sessions_close_result, sessions_delete_request, sessions_enrich_metadata_request, session_set_credentials_params, session_set_credentials_result, session_settings_built_in_tool_availability_snapshot, session_settings_evaluate_predicate_request, session_settings_evaluate_predicate_result, session_settings_job_snapshot, session_settings_model_snapshot, session_settings_online_evaluation_snapshot, session_settings_predicate_name, session_settings_repo_snapshot, session_settings_snapshot, session_settings_validation_snapshot, sessions_find_by_prefix_request, sessions_find_by_prefix_result, sessions_find_by_task_id_request, sessions_find_by_task_id_result, sessions_fork_request, sessions_fork_result, sessions_get_board_entry_count_request, sessions_get_board_entry_count_result, sessions_get_client_metadata_request, sessions_get_client_metadata_result, sessions_get_event_file_path_request, sessions_get_event_file_path_result, sessions_get_last_for_context_request, sessions_get_last_for_context_result, sessions_get_metadata_request, sessions_get_metadata_result, sessions_get_persisted_remote_steerable_request, sessions_get_persisted_remote_steerable_result, session_sizes, sessions_list_non_empty_session_ids_request, sessions_list_non_empty_session_ids_result, sessions_list_request, sessions_load_deferred_repo_hooks_request, sessions_open_attach, sessions_open_cloud, sessions_open_create, sessions_open_handoff, sessions_open_handoff_task_type, sessions_open_progress, sessions_open_progress_status, sessions_open_progress_step, sessions_open_remote, sessions_open_resume, sessions_open_resume_last, sessions_open_status, session_source, sessions_prune_old_request, sessions_read_persisted_events_request, sessions_register_extension_tools_on_session_options, sessions_release_lock_request, sessions_release_lock_result, sessions_reload_plugin_hooks_request, sessions_reload_plugin_hooks_result, sessions_save_request, sessions_save_result, sessions_set_additional_plugins_request, sessions_set_additional_plugins_result, sessions_set_remote_control_steering_request, sessions_start_remote_control_request, sessions_stop_remote_control_request, sessions_transfer_remote_control_request, session_telemetry_engagement, session_update_options_params, session_update_options_result, session_visibility_status, session_working_directory_context, session_working_directory_context_host_type, settable_auth_info, settable_token_auth_info, shell_cancel_user_requested_request, shell_credentials, shell_exec_request, shell_exec_result, shell_execute_user_requested_request, shell_init_profile, shell_init_script, shell_init_script_shell, shell_kill_request, shell_kill_result, shell_kill_signal, shell_options, shutdown_request, skill, skill_discovery_path, skill_discovery_path_list, skill_discovery_scope, skill_list, skill_provider_descriptor, skill_provider_list_request, skill_provider_list_result, skill_provider_read_request, skill_provider_read_result, skills_config_set_disabled_skills_request, skills_config_set_skill_disabled_request, skills_disable_request, skills_discover_request, skills_enable_request, skills_get_discovery_paths_request, skills_get_invoked_result, skills_invoked_skill, skills_load_diagnostics, slash_command_add_timeline_entry_result, slash_command_agent_prompt_result, slash_command_completed_result, slash_command_info, slash_command_input, slash_command_input_choice, slash_command_input_completion, slash_command_invocation_result, slash_command_kind, slash_command_model_picker_dialog, slash_command_select_subcommand_option, slash_command_select_subcommand_result, slash_command_set_model_result, slash_command_set_plan_model_result, slash_command_show_dialog_result, slash_command_text_result, slash_command_timeline_entry, subagent_settings_entry, subagent_settings_entry_context_tier, task_agent_info, task_agent_progress, task_client_active_status, task_client_execution_mode, task_client_info, task_client_owner, task_client_owner_kind, task_client_owner_presence, task_client_progress, task_client_status, task_client_type, task_client_update, task_complete_data, task_completion_decision, task_execution_mode, task_info, task_kind, task_list, task_progress_line, tasks_cancel_request, tasks_cancel_result, tasks_get_current_promotable_result, tasks_get_progress_request, tasks_get_progress_result, task_shell_info, task_shell_info_attachment_mode, task_shell_progress, tasks_promote_current_to_background_result, tasks_promote_to_background_request, tasks_promote_to_background_result, tasks_refresh_result, tasks_register_request, tasks_register_result, tasks_remove_request, tasks_remove_result, tasks_send_message_request, tasks_send_message_result, tasks_start_agent_request, tasks_start_agent_result, task_status, tasks_update_request, tasks_update_result, tasks_wait_for_pending_result, telemetry_set_feature_overrides_request, token_auth_info, token_provider_auth_info, tool, tool_list, tool_result, tool_result_expanded, tool_result_new_message, tool_result_type, tools_execute_request, tools_get_builtin_descriptors_request, tools_get_builtin_descriptors_result, tools_get_current_metadata_result, tools_initialize_and_validate_result, tools_list_request, tools_set_request, tools_set_result, tools_shell_descriptor_config, tools_task_complete_event_data_request, tools_update_subagent_settings_result, ui_auto_mode_switch_response, ui_elicitation_array_any_of_field, ui_elicitation_array_any_of_field_items, ui_elicitation_array_any_of_field_items_any_of, ui_elicitation_array_enum_field, ui_elicitation_array_enum_field_items, ui_elicitation_field_value, ui_elicitation_request, ui_elicitation_response, ui_elicitation_response_action, ui_elicitation_response_content, ui_elicitation_result, ui_elicitation_schema, ui_elicitation_schema_property, ui_elicitation_schema_property_boolean, ui_elicitation_schema_property_number, ui_elicitation_schema_property_number_type, ui_elicitation_schema_property_string, ui_elicitation_schema_property_string_format, ui_elicitation_string_enum_field, ui_elicitation_string_one_of_field, ui_elicitation_string_one_of_field_one_of, ui_ephemeral_query_request, ui_ephemeral_query_result, ui_exit_plan_mode_action, ui_exit_plan_mode_response, ui_handle_pending_auto_mode_switch_request, ui_handle_pending_elicitation_request, ui_handle_pending_exit_plan_mode_request, ui_handle_pending_result, ui_handle_pending_sampling_request, ui_handle_pending_sampling_response, ui_handle_pending_session_limits_exhausted_request, ui_handle_pending_user_input_request, ui_register_direct_auto_mode_switch_handler_result, ui_session_limits_exhausted_response, ui_session_limits_exhausted_response_action, ui_unregister_direct_auto_mode_switch_handler_request, ui_unregister_direct_auto_mode_switch_handler_result, ui_user_input_response, update_subagent_settings_request, usage_get_metrics_result, usage_metrics_agent_metric, usage_metrics_code_changes, usage_metrics_model_metric, usage_metrics_model_metric_requests, usage_metrics_model_metric_token_detail, usage_metrics_model_metric_usage, usage_metrics_token_detail, user_auth_info, user_requested_shell_command_result, user_setting_metadata, user_settings_get_result, user_settings_set_request, user_settings_set_result, visibility_get_result, visibility_set_request, visibility_set_result, workspace_diff_file_change, workspace_diff_file_change_type, workspace_diff_mode, workspace_diff_result, workspaces_add_summary_request, workspaces_add_summary_result, workspaces_autopilot_objective_exists_result, workspaces_checkpoints, workspaces_create_file_request, workspaces_delete_autopilot_objective_result, workspaces_diff_request, workspaces_ensure_request, workspaces_get_workspace_result, workspaces_list_checkpoints_result, workspaces_list_files_result, workspaces_read_autopilot_objective_result, workspaces_read_checkpoint_request, workspaces_read_checkpoint_result, workspaces_read_file_request, workspaces_read_file_result, workspaces_save_large_paste_request, workspaces_save_large_paste_result, workspaces_truncate_summaries_request, workspace_summary_host_type, workspaces_update_metadata_request, workspaces_workspace_details_host_type, workspaces_write_autopilot_objective_request, workspaces_write_autopilot_objective_result, session_auth_info_result, session_context_attribution, session_context_info, subagent_settings, task_progress, workspace_summary)
+        return RPC(abort_request, abort_result, account_all_users, account_get_all_users_result, account_get_current_auth_result, account_get_quota_request, account_get_quota_result, account_login_request, account_login_result, account_logout_request, account_logout_result, account_quota_snapshot, adaptive_thinking_support, agent_discovery_path, agent_discovery_path_list, agent_discovery_path_scope, agent_get_current_result, agent_info, agent_info_source, agent_list, agent_list_request, agent_registry_live_target_entry, agent_registry_live_target_entry_attention_kind, agent_registry_live_target_entry_kind, agent_registry_live_target_entry_last_terminal_event, agent_registry_live_target_entry_status, agent_registry_log_capture, agent_registry_log_capture_open_error_reason, agent_registry_spawn_error, agent_registry_spawn_permission_mode, agent_registry_spawn_registry_timeout, agent_registry_spawn_request, agent_registry_spawn_result, agent_registry_spawn_spawned, agent_registry_spawn_validation_error, agent_registry_spawn_validation_error_field, agent_registry_spawn_validation_error_reason, agent_reload_result, agents_discover_request, agent_select_request, agent_select_result, agent_set_prompt_request, agents_get_discovery_paths_request, api_key_auth_info, auth_identity, auth_info, auth_info_type, auth_validation_error, auth_validation_errors, autopilot_objective_credit_limit, autopilot_objective_get_state_result, autopilot_objective_state, autopilot_objective_status, built_in_model_catalog, built_in_model_catalog_entry, builtin_tool_descriptor, builtin_tool_format, builtin_tool_format_type, builtin_tool_input_schema, builtin_tool_input_schema_type, builtin_tool_safe_for_telemetry, builtin_tool_safe_telemetry_fields, cancel_user_requested_shell_command_result, canvas_action, canvas_action_invoke_request, canvas_action_invoke_result, canvas_close_request, canvas_host_context, canvas_host_context_capabilities, canvas_json_schema, canvas_list, canvas_list_open_result, canvas_open_request, canvas_provider_close_request, canvas_provider_invoke_action_request, canvas_provider_open_request, canvas_provider_open_result, canvas_provider_register_request, canvas_provider_unregister_request, canvas_session_context, capi_session_options, card_digest, card_digest_algorithm, card_digest_value, catalog_ai_skill_candidate, catalog_ai_skill_candidate_provenance, catalog_authentication_required_error, catalog_authentication_required_reason, catalog_candidate, catalog_candidate_kind, catalog_candidate_source, catalog_candidate_source_embedded, catalog_candidate_source_url, catalog_capability, catalog_capability_id, catalog_client_contract, catalog_contract_violation_error, catalog_contract_violation_reason, catalog_handle_rejected_error, catalog_handle_rejection_reason, catalog_handle_type, catalog_invalid_request_error, catalog_invalid_request_field, catalog_malformed_card_error, catalog_malformed_card_reason, catalog_mcp_server_candidate, catalog_mcp_server_candidate_provenance, catalog_mcp_server_installability, catalog_media_type, catalog_negotiated_contract, catalog_negotiation_refused_error, catalog_negotiation_refused_reason, catalog_network_failure_error, catalog_network_failure_reason, catalog_not_installable_error, catalog_not_installable_reason, catalog_policy_rejected_error, catalog_search_request, catalog_search_result, catalog_search_succeeded, catalog_trust_eligibility, catalog_trust_provenance, catalog_trust_snapshot, catalog_trust_snapshot_absent, catalog_trust_snapshot_absent_status, catalog_trust_snapshot_current, catalog_trust_snapshot_current_status, catalog_trust_snapshot_downgraded, catalog_trust_snapshot_downgraded_status, catalog_trust_snapshot_malformed, catalog_trust_snapshot_malformed_status, catalog_trust_snapshot_revoked, catalog_trust_snapshot_revoked_status, catalog_trust_snapshot_schema_version, catalog_trust_snapshot_stale, catalog_trust_snapshot_stale_status, catalog_trust_snapshot_unsupported, catalog_trust_snapshot_unsupported_status, catalog_trust_source, catalog_trust_tier, catalog_unavailable_error, catalog_unavailable_reason, catalog_unavailable_transport_error, catalog_unavailable_transport_reason, catalog_unsafe_retrieval_error, catalog_unsafe_retrieval_reason, catalog_unsupported_kind_error, client_metadata, client_task_cancel_reason, client_task_cancel_request, client_task_cancel_result, command_list, commands_finalize_invocation_effect_request, commands_finalize_invocation_effect_result, commands_handle_pending_command_request, commands_handle_pending_command_result, commands_invocation_effect_outcome, commands_invocation_origin, commands_invoke_request, commands_list_request, commands_respond_to_queued_command_request, commands_respond_to_queued_command_result, completions_get_trigger_characters_result, completions_request_request, completions_request_result, configure_session_extensions_params, connect_client_info, connected_remote_session_metadata, connected_remote_session_metadata_kind, connected_remote_session_metadata_repository, connect_remote_session_params, connect_request, connect_result, content_exclusion_check_paths_request, content_exclusion_check_paths_result, content_exclusion_path_check, content_filter_mode, context_heaviest_message, copilot_api_token_auth_info, copilot_user_response, copilot_user_response_endpoints, copilot_user_response_quota_snapshots, copilot_user_response_quota_snapshots_chat, copilot_user_response_quota_snapshots_completions, copilot_user_response_quota_snapshots_premium_interactions, current_model, current_tool_metadata, debug_collect_logs_collected_entry, debug_collect_logs_destination, debug_collect_logs_entry, debug_collect_logs_entry_kind, debug_collect_logs_include, debug_collect_logs_redaction, debug_collect_logs_request, debug_collect_logs_result, debug_collect_logs_result_kind, debug_collect_logs_skipped_entry, debug_collect_logs_source, discovered_canvas, discovered_extension, discovered_extension_mode, discovered_extension_plugin, discovered_extensions, discovered_extensions_disable_request, discovered_extensions_enable_request, discovered_extension_source, discovered_hook, discovered_mcp_server, discovered_mcp_server_type, enqueue_command_params, enqueue_command_result, env_auth_info, event_log_read_request, event_log_release_interest_result, event_log_tail_result, event_log_types, events_agent_scope, events_cursor_status, events_read_direction, events_read_result, execute_command_params, execute_command_result, extension, extension_context_push_input, extension_launch_profile, extension_launch_provider_resolve_request, extension_launch_provider_resolve_result, extension_list, extensions_disable_request, extensions_enable_request, extension_source, extension_status, external_tool_result, external_tool_text_result_for_llm, external_tool_text_result_for_llm_binary_results_for_llm, external_tool_text_result_for_llm_binary_results_for_llm_type, external_tool_text_result_for_llm_content, external_tool_text_result_for_llm_content_audio, external_tool_text_result_for_llm_content_image, external_tool_text_result_for_llm_content_resource, external_tool_text_result_for_llm_content_resource_details, external_tool_text_result_for_llm_content_resource_link, external_tool_text_result_for_llm_content_resource_link_icon, external_tool_text_result_for_llm_content_resource_link_icon_theme, external_tool_text_result_for_llm_content_shell_exit, external_tool_text_result_for_llm_content_terminal, external_tool_text_result_for_llm_content_text, factory_abort_request, factory_ack_result, factory_agent_options, factory_agent_request, factory_agent_result, factory_agent_summary, factory_cancel_request, factory_current_phase, factory_declared_limits, factory_durable_operation, factory_execute_request, factory_execute_result, factory_get_run_progress_request, factory_get_run_request, factory_journal_get_request, factory_journal_get_result, factory_journal_put_request, factory_list_runs_request, factory_list_runs_result, factory_log_line, factory_log_line_kind, factory_log_request, factory_pause_checkpoint_action, factory_pause_checkpoint_request, factory_pause_checkpoint_result, factory_pause_info, factory_pause_request, factory_phase_observation, factory_phase_status, factory_progress_line, factory_progress_page, factory_resume_request, factory_resume_result, factory_run_consumed, factory_run_detail, factory_run_failure, factory_run_failure_kind, factory_run_limits, factory_run_request, factory_run_result, factory_run_status, factory_run_summary, factory_run_terminal, factory_tool_resume_request, factory_tool_run_options, factory_tool_run_request, filter_mapping, fleet_start_request, fleet_start_result, folder_trust_add_params, folder_trust_check_params, folder_trust_check_result, gh_cli_auth_info, git_hub_telemetry_client_info, git_hub_telemetry_event, git_hub_telemetry_notification, git_hub_token_acquire_reason, git_hub_token_acquire_request, git_hub_token_acquire_result, handle_pending_tool_call_request, handle_pending_tool_call_result, history_abort_manual_compaction_result, history_cancel_background_compaction_result, history_clear_context_request, history_clear_context_result, history_compact_context_window, history_compact_request, history_compact_result, history_file_restore_skip_reason, history_list_rewind_points_result, history_preview_rewind_request, history_preview_rewind_result, history_rewind_change_type, history_rewind_file_preview, history_rewind_mode, history_rewind_outcome, history_rewind_point, history_rewind_request, history_rewind_result, history_rewind_unavailable_reason, history_skipped_file_restore, history_summarize_for_handoff_result, history_truncate_request, history_truncate_result, hmac_auth_info, hook_invoke_request, hook_invoke_response, hook_origin, hooks_discover_request, hooks_discover_result, hook_type, installed_plugin, installed_plugin_info, installed_plugin_source, installed_plugin_source_git_hub, installed_plugin_source_local, installed_plugin_source_url, instruction_discovery_path, instruction_discovery_path_kind, instruction_discovery_path_list, instruction_discovery_path_location, instructions_discover_request, instructions_get_discovery_paths_request, instructions_get_sources_result, instruction_source, instruction_source_location, instruction_source_type, interrupt_main_turn_request, interrupt_main_turn_result, llm_inference_headers, llm_inference_http_request_chunk_request, llm_inference_http_request_chunk_result, llm_inference_http_request_start_request, llm_inference_http_request_start_result, llm_inference_http_request_start_transport, llm_inference_http_response_chunk_error, llm_inference_http_response_chunk_request, llm_inference_http_response_chunk_result, llm_inference_http_response_start_request, llm_inference_http_response_start_result, llm_inference_set_provider_result, local_session_metadata_value, log_request, log_result, lsp_initialize_request, managed_settings_read_result, marketplace_add_result, marketplace_browse_result, marketplace_info, marketplace_list_result, marketplace_plugin_info, marketplace_refresh_entry, marketplace_refresh_result, marketplace_remove_result, mcp_allowed_server, mcp_apps_call_tool_request, mcp_apps_diagnose_capability, mcp_apps_diagnose_request, mcp_apps_diagnose_result, mcp_apps_diagnose_server, mcp_apps_host_context, mcp_apps_host_context_details, mcp_apps_host_context_details_available_display_mode, mcp_apps_host_context_details_display_mode, mcp_apps_host_context_details_platform, mcp_apps_host_context_details_theme, mcp_apps_list_tools_request, mcp_apps_list_tools_result, mcp_apps_read_resource_request, mcp_apps_read_resource_result, mcp_apps_resource_content, mcp_apps_set_host_context_details, mcp_apps_set_host_context_details_available_display_mode, mcp_apps_set_host_context_details_display_mode, mcp_apps_set_host_context_details_platform, mcp_apps_set_host_context_details_theme, mcp_apps_set_host_context_request, mcp_cancel_sampling_execution_params, mcp_cancel_sampling_execution_result, mcp_config_add_request, mcp_config_disable_request, mcp_config_enable_request, mcp_config_list, mcp_config_remove_request, mcp_config_update_request, mcp_configure_git_hub_request, mcp_configure_git_hub_result, mcp_disable_request, mcp_discover_request, mcp_discover_result, mcp_elicitation_form_mode, mcp_enable_request, mcp_execute_sampling_params, mcp_execute_sampling_request, mcp_execute_sampling_result, mcp_failed_server, mcp_filtered_server, mcp_headers_handle_pending_headers_refresh_request, mcp_headers_handle_pending_headers_refresh_request_request, mcp_headers_handle_pending_headers_refresh_request_result, mcp_host_state, mcp_install_plan, mcp_is_server_running_request, mcp_is_server_running_result, mcp_list_tools_request, mcp_list_tools_result, mcp_oauth_authentication_state_changed_request, mcp_oauth_handle_pending_request, mcp_oauth_handle_pending_result, mcp_oauth_login_grant_type, mcp_oauth_login_request, mcp_oauth_login_result, mcp_oauth_pending_request_response, mcp_oauth_probe_needs_auth_reason, mcp_oauth_probe_request, mcp_oauth_probe_result, mcp_oauth_respond_request, mcp_oauth_respond_result, mcp_plan_configuration_change, mcp_plan_configuration_operation, mcp_plan_enum_value_type, mcp_plan_install_planned, mcp_plan_install_request, mcp_plan_install_result, mcp_plan_install_source, mcp_plan_install_source_candidate, mcp_plan_install_source_candidate_kind, mcp_plan_install_source_card, mcp_plan_install_source_card_kind, mcp_plan_package_install_method, mcp_plan_package_transport, mcp_plan_policy_decision, mcp_plan_policy_result, mcp_plan_policy_source, mcp_plan_provenance, mcp_plan_remote_install_method, mcp_plan_remote_transport, mcp_plan_required_value, mcp_plan_required_value_enum, mcp_plan_required_value_enum_kind, mcp_plan_required_value_scalar, mcp_plan_required_value_scalar_kind, mcp_plan_resource_identity, mcp_plan_scalar_value_type, mcp_plan_scope, mcp_plan_secret_placeholder, mcp_plan_secret_reference, mcp_plan_target, mcp_plan_transport_choice, mcp_plan_transport_choice_package, mcp_plan_transport_choice_remote, mcp_plan_value_category, mcp_register_external_client_request, mcp_reload_config, mcp_reload_with_config_request, mcp_remove_git_hub_result, mcp_resource, mcp_resource_annotations, mcp_resource_content, mcp_resource_icon, mcp_resources_list_request, mcp_resources_list_result, mcp_resources_list_templates_request, mcp_resources_list_templates_result, mcp_resources_read_request, mcp_resources_read_result, mcp_resource_template, mcp_restart_server_request, mcp_safe_for_telemetry, mcp_safe_for_telemetry_fields, mcp_sampling_execution_action, mcp_sampling_execution_result, mcp_serializable_server_config, mcp_server, mcp_server_auth_config, mcp_server_auth_config_redirect_port, mcp_server_card_embedded, mcp_server_card_embedded_kind, mcp_server_card_media_type, mcp_server_card_reference, mcp_server_card_url, mcp_server_card_url_kind, mcp_server_config, mcp_server_config_defer_tools, mcp_server_config_http, mcp_server_config_http_oauth_grant_type, mcp_server_config_http_type, mcp_server_config_memory, mcp_server_config_memory_type, mcp_server_config_stdio, mcp_server_config_stdio_type, mcp_server_failure_info, mcp_server_list, mcp_server_needs_auth_info, mcp_set_env_value_mode_details, mcp_set_env_value_mode_params, mcp_set_env_value_mode_result, mcp_source_file, mcp_source_plugin, mcp_source_ref, mcp_start_server_request, mcp_start_servers_result, mcp_stop_server_request, mcp_task_metadata, mcp_tools, mcp_tool_ui, mcp_tool_ui_visibility, mcp_unregister_external_client_request, memory_configuration, metadata_context_attribution_result, metadata_context_heaviest_messages_request, metadata_context_heaviest_messages_result, metadata_context_info_request, metadata_context_info_result, metadata_is_processing_result, metadata_recompute_context_tokens_request, metadata_recompute_context_tokens_result, metadata_record_context_change_request, metadata_record_context_change_result, metadata_set_working_directory_request, metadata_set_working_directory_result, metadata_snapshot_current_mode, metadata_snapshot_remote_metadata, metadata_snapshot_remote_metadata_repository, metadata_snapshot_remote_metadata_task_type, metadata_update_client_metadata_request, model, model_apply_startup_overlay_request, model_billing, model_billing_promo, model_billing_token_prices, model_billing_token_prices_long_context, model_capabilities, model_capabilities_limits, model_capabilities_limits_vision, model_capabilities_override, model_capabilities_override_limits, model_capabilities_override_limits_vision, model_capabilities_override_supports, model_capabilities_supports, model_list, model_list_request, model_message, model_picker_category, model_picker_persistence_request, model_picker_price_category, model_picker_settings_context, model_policy, model_policy_state, model_set_allowed_models_request, model_set_allowed_models_result, model_set_reasoning_effort_request, model_set_reasoning_effort_result, models_list_request, model_switch_auto_tier_request, model_switch_auto_tier_result, model_switch_auto_tier_status, model_switch_confirmation, model_switch_to_request, model_switch_to_result, model_warning_text, mode_set_request, mode_set_result, move_mcp_loading_to_background_result, named_provider_config, name_get_result, name_set_auto_request, name_set_auto_result, name_set_request, open_canvas_instance, options_update_additional_content_exclusion_policy, options_update_additional_content_exclusion_policy_rule, options_update_additional_content_exclusion_policy_rule_source, options_update_additional_content_exclusion_policy_scope, options_update_context_tier, options_update_env_value_mode, options_update_reasoning_summary, options_update_tool_filter_precedence, pending_permission_request, pending_permission_request_list, permission_decision, permission_decision_approved, permission_decision_approved_for_location, permission_decision_approved_for_session, permission_decision_approve_for_location, permission_decision_approve_for_location_approval, permission_decision_approve_for_location_approval_commands, permission_decision_approve_for_location_approval_custom_tool, permission_decision_approve_for_location_approval_extension_env_access, permission_decision_approve_for_location_approval_extension_management, permission_decision_approve_for_location_approval_extension_permission_access, permission_decision_approve_for_location_approval_factory, permission_decision_approve_for_location_approval_mcp, permission_decision_approve_for_location_approval_mcp_sampling, permission_decision_approve_for_location_approval_memory, permission_decision_approve_for_location_approval_read, permission_decision_approve_for_location_approval_write, permission_decision_approve_for_session, permission_decision_approve_for_session_approval, permission_decision_approve_for_session_approval_commands, permission_decision_approve_for_session_approval_custom_tool, permission_decision_approve_for_session_approval_extension_env_access, permission_decision_approve_for_session_approval_extension_management, permission_decision_approve_for_session_approval_extension_permission_access, permission_decision_approve_for_session_approval_factory, permission_decision_approve_for_session_approval_mcp, permission_decision_approve_for_session_approval_mcp_sampling, permission_decision_approve_for_session_approval_memory, permission_decision_approve_for_session_approval_read, permission_decision_approve_for_session_approval_write, permission_decision_approve_once, permission_decision_approve_permanently, permission_decision_cancelled, permission_decision_context, permission_decision_denied_by_content_exclusion_policy, permission_decision_denied_by_permission_request_hook, permission_decision_denied_by_rules, permission_decision_denied_interactively_by_user, permission_decision_denied_no_approval_rule_and_could_not_request_from_user, permission_decision_outcome, permission_decision_reject, permission_decision_request, permission_decision_surface, permission_decision_user_not_available, permission_location_add_tool_approval_params, permission_location_apply_params, permission_location_apply_result, permission_location_resolve_params, permission_location_resolve_result, permission_location_type, permission_mode_source, permission_paths_add_params, permission_paths_allowed_check_params, permission_paths_allowed_check_result, permission_paths_config, permission_paths_list, permission_paths_update_primary_params, permission_paths_workspace_check_params, permission_paths_workspace_check_result, permission_prompt_shown_notification, permission_request_result, permission_response_capability, permission_rules_set, permissions_configure_additional_content_exclusion_policy, permissions_configure_additional_content_exclusion_policy_rule, permissions_configure_additional_content_exclusion_policy_rule_source, permissions_configure_additional_content_exclusion_policy_scope, permissions_configure_params, permissions_configure_result, permissions_folder_trust_add_trusted_result, permissions_get_mode_request, permissions_get_mode_result, permissions_locations_add_tool_approval_details, permissions_locations_add_tool_approval_details_commands, permissions_locations_add_tool_approval_details_custom_tool, permissions_locations_add_tool_approval_details_extension_env_access, permissions_locations_add_tool_approval_details_extension_management, permissions_locations_add_tool_approval_details_extension_permission_access, permissions_locations_add_tool_approval_details_factory, permissions_locations_add_tool_approval_details_mcp, permissions_locations_add_tool_approval_details_mcp_sampling, permissions_locations_add_tool_approval_details_memory, permissions_locations_add_tool_approval_details_read, permissions_locations_add_tool_approval_details_write, permissions_locations_add_tool_approval_result, permissions_modify_rules_params, permissions_modify_rules_result, permissions_modify_rules_scope, permissions_notify_prompt_shown_result, permissions_paths_add_result, permissions_paths_list_request, permissions_paths_update_primary_result, permissions_pending_requests_request, permissions_reset_session_approvals_request, permissions_reset_session_approvals_result, permissions_set_approve_all_request, permissions_set_approve_all_result, permissions_set_approve_all_source, permissions_set_mode_request, permissions_set_mode_result, permissions_set_required_request, permissions_set_required_result, permissions_urls_set_unrestricted_mode_result, permission_urls_config, permission_urls_set_unrestricted_mode_params, ping_request, ping_result, plan_read_result, plan_read_sql_todos_result, plan_read_sql_todos_with_dependencies_result, plan_sql_todo_dependency, plan_sql_todos_row, plan_update_request, plugin, plugin_install_result, plugin_install_staging_mode, plugin_list, plugin_list_result, plugins_builtin_set_request, plugins_disable_request, plugins_enable_request, plugins_install_request, plugins_marketplaces_add_request, plugins_marketplaces_browse_request, plugins_marketplaces_refresh_request, plugins_marketplaces_remove_request, plugins_reload_request, plugins_uninstall_request, plugins_update_request, plugin_update_all_entry, plugin_update_all_result, plugin_update_result, protocol_external_tool_defer, protocol_external_tool_definition, provider_add_request, provider_add_result, provider_config, provider_config_azure, provider_config_transport, provider_config_type, provider_config_wire_api, provider_endpoint, provider_endpoint_transport, provider_endpoint_type, provider_endpoint_wire_api, provider_get_endpoint_request, provider_model_config, provider_session_token, provider_token_acquire_request, provider_token_acquire_result, push_attachment, push_attachment_blob, push_attachment_directory, push_attachment_file, push_attachment_file_line_range, push_attachment_git_hub_actions_job, push_attachment_git_hub_commit, push_attachment_git_hub_file, push_attachment_git_hub_file_diff, push_attachment_git_hub_file_diff_side, push_attachment_git_hub_reference, push_attachment_git_hub_reference_type, push_attachment_git_hub_release, push_attachment_git_hub_repository, push_attachment_git_hub_snippet, push_attachment_git_hub_tree_comparison, push_attachment_git_hub_tree_comparison_side, push_attachment_git_hub_url, push_attachment_selection, push_attachment_selection_details, push_attachment_selection_details_end, push_attachment_selection_details_start, push_git_hub_repo_ref, queue_begin_deferred_idle_drain_request, queue_begin_deferred_idle_drain_result, queue_consume_system_notifications_request, queued_command_handled, queued_command_not_handled, queued_command_result, queue_defer_session_idle_request, queue_duplicate_at_request, queue_duplicate_at_result, queue_enqueue_resume_pending_result, queue_finish_deferred_idle_drain_request, queue_finish_deferred_idle_drain_result, queue_has_pending_result, queue_insert_at_request, queue_insert_at_result, queue_insert_message, queue_move_item_request, queue_move_item_result, queue_pending_items, queue_pending_items_kind, queue_pending_items_result, queue_remove_at_request, queue_remove_at_result, queue_remove_most_recent_result, queue_send_now_request, queue_send_now_result, queue_set_drain_paused_request, queue_snapshot_result, queue_update_text_request, queue_update_text_result, register_event_interest_params, register_event_interest_result, register_extension_tools_params, register_extension_tools_result, release_event_interest_params, remote_control_config, remote_control_config_existing_mc_session, remote_control_status, remote_control_status_active, remote_control_status_connecting, remote_control_status_error, remote_control_status_off, remote_control_status_result, remote_control_stop_result, remote_control_transfer_result, remote_enable_request, remote_enable_result, remote_notify_steerable_changed_request, remote_notify_steerable_changed_result, remote_session_connection_result, remote_session_host_status, remote_session_metadata_repository, remote_session_metadata_task_type, remote_session_metadata_value, remote_session_mode, remote_session_repository, run_options, sandbox_config, sandbox_config_auth, sandbox_config_source, sandbox_config_user_policy, sandbox_config_user_policy_experimental, sandbox_config_user_policy_experimental_seatbelt, sandbox_config_user_policy_filesystem, sandbox_config_user_policy_network, sandbox_config_user_policy_network_proxy, sandbox_config_user_policy_seatbelt, sandbox_disable_for_session_request, sandbox_disable_for_session_result, sandbox_enforcement_status, schedule_add_at_request, schedule_add_cron_request, schedule_add_request, schedule_add_result, schedule_add_self_paced_request, schedule_entry, schedule_has_self_paced_result, schedule_list, schedule_rearm_self_paced_request, schedule_stop_request, schedule_stop_result, secrets_add_filter_values_request, secrets_add_filter_values_result, send_agent_mode, send_attachments_to_message_params, send_message_item, send_messages_request, send_messages_result, send_mode, send_request, send_result, send_system_notification_request, server_agent_list, server_instruction_source_list, server_skill, server_skill_list, session_activity, session_agent_list_request, session_auth_login_request, session_auth_logout_user_request, session_auth_status, session_auth_switch_request, session_bulk_delete_result, session_cancel_all_background_agents_result, session_capability, session_commands_list_request, session_completion_item, session_context, session_context_host_type, session_enrich_metadata_result, session_factory_pause_at_checkpoint_result, session_fs_append_file_request, session_fs_error, session_fs_error_code, session_fs_exists_request, session_fs_exists_result, session_fs_mkdir_request, session_fs_readdir_request, session_fs_readdir_result, session_fs_readdir_with_types_entry, session_fs_readdir_with_types_entry_type, session_fs_readdir_with_types_request, session_fs_readdir_with_types_result, session_fs_read_file_request, session_fs_read_file_result, session_fs_rename_request, session_fs_rm_request, session_fs_set_provider_capabilities, session_fs_set_provider_conventions, session_fs_set_provider_request, session_fs_set_provider_result, session_fs_sqlite_exists_request, session_fs_sqlite_exists_result, session_fs_sqlite_query_request, session_fs_sqlite_query_result, session_fs_sqlite_query_type, session_fs_sqlite_transaction_error, session_fs_sqlite_transaction_error_class, session_fs_sqlite_transaction_request, session_fs_sqlite_transaction_result, session_fs_sqlite_transaction_statement, session_fs_stat_request, session_fs_stat_result, session_fs_write_file_request, session_git_hub_auth_get_all_auth_available_result, session_git_hub_auth_logout_result, session_git_hub_auth_logout_user_result, session_history_compact_request, session_installed_plugin, session_installed_plugin_source, session_installed_plugin_source_git_hub, session_installed_plugin_source_local, session_installed_plugin_source_url, session_limit_prediction_baseline_data, session_limit_prediction_client_type, session_limit_prediction_details, session_limit_prediction_predict_request, session_limit_prediction_request, session_limit_prediction_result, session_limit_prediction_source, session_limit_prediction_tier, session_limit_prediction_tier_option, session_limit_prediction_unavailable_reason, session_list, session_list_entry, session_list_filter, session_load_deferred_repo_hooks_result, session_log_level, session_managed_permissions, session_managed_settings, session_mcp_apps_call_tool_result, session_metadata_snapshot, session_mode, session_model_list, session_model_list_request, session_model_price_category, session_open_options, session_open_options_additional_content_exclusion_policy, session_open_options_additional_content_exclusion_policy_rule, session_open_options_additional_content_exclusion_policy_rule_source, session_open_options_additional_content_exclusion_policy_scope, session_open_options_env_value_mode, session_open_options_reasoning_summary, session_open_params, session_open_result, session_plugins_reload_request, session_provider_get_endpoint_request, session_prune_result, sessions_bulk_delete_request, sessions_check_in_use_request, sessions_check_in_use_result, sessions_client_metadata_entry, sessions_close_request, sessions_close_result, sessions_delete_request, sessions_enrich_metadata_request, session_set_credentials_params, session_set_credentials_result, session_settings_built_in_tool_availability_snapshot, session_settings_evaluate_predicate_request, session_settings_evaluate_predicate_result, session_settings_job_snapshot, session_settings_model_snapshot, session_settings_online_evaluation_snapshot, session_settings_predicate_name, session_settings_repo_snapshot, session_settings_snapshot, session_settings_validation_snapshot, sessions_find_by_prefix_request, sessions_find_by_prefix_result, sessions_find_by_task_id_request, sessions_find_by_task_id_result, sessions_fork_request, sessions_fork_result, sessions_get_board_entry_count_request, sessions_get_board_entry_count_result, sessions_get_client_metadata_request, sessions_get_client_metadata_result, sessions_get_event_file_path_request, sessions_get_event_file_path_result, sessions_get_last_for_context_request, sessions_get_last_for_context_result, sessions_get_metadata_request, sessions_get_metadata_result, sessions_get_persisted_remote_steerable_request, sessions_get_persisted_remote_steerable_result, session_sizes, sessions_list_non_empty_session_ids_request, sessions_list_non_empty_session_ids_result, sessions_list_request, sessions_load_deferred_repo_hooks_request, sessions_open_attach, sessions_open_cloud, sessions_open_create, sessions_open_handoff, sessions_open_handoff_task_type, sessions_open_progress, sessions_open_progress_status, sessions_open_progress_step, sessions_open_remote, sessions_open_resume, sessions_open_resume_last, sessions_open_status, session_source, sessions_prune_old_request, sessions_read_persisted_events_request, sessions_register_extension_tools_on_session_options, sessions_release_lock_request, sessions_release_lock_result, sessions_reload_plugin_hooks_request, sessions_reload_plugin_hooks_result, sessions_save_request, sessions_save_result, sessions_set_additional_plugins_request, sessions_set_additional_plugins_result, sessions_set_remote_control_steering_request, sessions_start_remote_control_request, sessions_stop_remote_control_request, sessions_transfer_remote_control_request, session_telemetry_engagement, session_update_options_params, session_update_options_result, session_visibility_status, session_working_directory_context, session_working_directory_context_host_type, settable_auth_info, settable_token_auth_info, shell_cancel_user_requested_request, shell_credentials, shell_exec_request, shell_exec_result, shell_execute_user_requested_request, shell_init_profile, shell_init_script, shell_init_script_shell, shell_kill_request, shell_kill_result, shell_kill_signal, shell_options, shutdown_request, skill, skill_discovery_path, skill_discovery_path_list, skill_discovery_scope, skill_list, skill_provider_descriptor, skill_provider_list_request, skill_provider_list_result, skill_provider_read_request, skill_provider_read_result, skills_config_set_disabled_skills_request, skills_config_set_skill_disabled_request, skills_disable_request, skills_discover_request, skills_enable_request, skills_get_discovery_paths_request, skills_get_invoked_result, skills_invoked_skill, skills_load_diagnostics, slash_command_add_timeline_entry_result, slash_command_agent_prompt_result, slash_command_completed_result, slash_command_info, slash_command_input, slash_command_input_choice, slash_command_input_completion, slash_command_invocation_result, slash_command_kind, slash_command_model_picker_dialog, slash_command_select_subcommand_option, slash_command_select_subcommand_result, slash_command_set_model_result, slash_command_set_plan_model_result, slash_command_show_dialog_result, slash_command_text_result, slash_command_timeline_entry, subagent_settings_entry, subagent_settings_entry_context_tier, task_agent_info, task_agent_progress, task_client_active_status, task_client_execution_mode, task_client_info, task_client_owner, task_client_owner_kind, task_client_owner_presence, task_client_progress, task_client_status, task_client_type, task_client_update, task_complete_data, task_completion_decision, task_execution_mode, task_info, task_kind, task_list, task_progress_line, tasks_cancel_request, tasks_cancel_result, tasks_get_current_promotable_result, tasks_get_progress_request, tasks_get_progress_result, task_shell_info, task_shell_info_attachment_mode, task_shell_progress, tasks_promote_current_to_background_result, tasks_promote_to_background_request, tasks_promote_to_background_result, tasks_refresh_result, tasks_register_request, tasks_register_result, tasks_remove_request, tasks_remove_result, tasks_send_message_request, tasks_send_message_result, tasks_start_agent_request, tasks_start_agent_result, task_status, tasks_update_request, tasks_update_result, tasks_wait_for_pending_result, telemetry_set_feature_overrides_request, token_auth_info, token_provider_auth_info, tool, tool_list, tool_result, tool_result_expanded, tool_result_new_message, tool_result_type, tools_execute_request, tools_get_builtin_descriptors_request, tools_get_builtin_descriptors_result, tools_get_current_metadata_result, tools_initialize_and_validate_result, tools_list_request, tools_set_request, tools_set_result, tools_shell_descriptor_config, tools_task_complete_event_data_request, tools_update_subagent_settings_result, ui_auto_mode_switch_response, ui_elicitation_array_any_of_field, ui_elicitation_array_any_of_field_items, ui_elicitation_array_any_of_field_items_any_of, ui_elicitation_array_enum_field, ui_elicitation_array_enum_field_items, ui_elicitation_field_value, ui_elicitation_request, ui_elicitation_response, ui_elicitation_response_action, ui_elicitation_response_content, ui_elicitation_result, ui_elicitation_schema, ui_elicitation_schema_property, ui_elicitation_schema_property_boolean, ui_elicitation_schema_property_number, ui_elicitation_schema_property_number_type, ui_elicitation_schema_property_string, ui_elicitation_schema_property_string_format, ui_elicitation_string_enum_field, ui_elicitation_string_one_of_field, ui_elicitation_string_one_of_field_one_of, ui_ephemeral_query_request, ui_ephemeral_query_result, ui_exit_plan_mode_action, ui_exit_plan_mode_response, ui_handle_pending_auto_mode_switch_request, ui_handle_pending_elicitation_request, ui_handle_pending_exit_plan_mode_request, ui_handle_pending_result, ui_handle_pending_sampling_request, ui_handle_pending_sampling_response, ui_handle_pending_session_limits_exhausted_request, ui_handle_pending_user_input_request, ui_register_direct_auto_mode_switch_handler_result, ui_session_limits_exhausted_response, ui_session_limits_exhausted_response_action, ui_unregister_direct_auto_mode_switch_handler_request, ui_unregister_direct_auto_mode_switch_handler_result, ui_user_input_response, update_subagent_settings_request, usage_get_metrics_result, usage_metrics_agent_metric, usage_metrics_code_changes, usage_metrics_model_metric, usage_metrics_model_metric_requests, usage_metrics_model_metric_token_detail, usage_metrics_model_metric_usage, usage_metrics_token_detail, user_auth_info, user_requested_shell_command_result, user_setting_metadata, user_settings_get_result, user_settings_set_request, user_settings_set_result, visibility_get_result, visibility_set_request, visibility_set_result, workspace_diff_file_change, workspace_diff_file_change_type, workspace_diff_mode, workspace_diff_result, workspaces_add_summary_request, workspaces_add_summary_result, workspaces_autopilot_objective_exists_result, workspaces_checkpoints, workspaces_create_file_request, workspaces_delete_autopilot_objective_result, workspaces_diff_request, workspaces_ensure_request, workspaces_get_workspace_result, workspaces_list_checkpoints_result, workspaces_list_files_result, workspaces_read_autopilot_objective_result, workspaces_read_checkpoint_request, workspaces_read_checkpoint_result, workspaces_read_file_request, workspaces_read_file_result, workspaces_save_large_paste_request, workspaces_save_large_paste_result, workspaces_truncate_summaries_request, workspace_summary_host_type, workspaces_update_metadata_request, workspaces_workspace_details_host_type, workspaces_write_autopilot_objective_request, workspaces_write_autopilot_objective_result, session_auth_info_result, session_context_attribution, session_context_info, subagent_settings, task_progress, workspace_summary)
 
     def to_dict(self) -> dict:
         result: dict = {}
@@ -39654,6 +40154,26 @@ def to_dict(self) -> dict:
         result["CatalogSearchRequest"] = to_class(CatalogSearchRequest, self.catalog_search_request)
         result["CatalogSearchResult"] = (self.catalog_search_result).to_dict()
         result["CatalogSearchSucceeded"] = to_class(CatalogSearchSucceeded, self.catalog_search_succeeded)
+        result["CatalogTrustEligibility"] = to_enum(CatalogTrustEligibility, self.catalog_trust_eligibility)
+        result["CatalogTrustProvenance"] = to_class(CatalogTrustProvenance, self.catalog_trust_provenance)
+        result["CatalogTrustSnapshot"] = (self.catalog_trust_snapshot).to_dict()
+        result["CatalogTrustSnapshotAbsent"] = to_class(CatalogTrustSnapshotAbsent, self.catalog_trust_snapshot_absent)
+        result["CatalogTrustSnapshotAbsentStatus"] = to_enum(CatalogTrustSnapshotAbsentStatus, self.catalog_trust_snapshot_absent_status)
+        result["CatalogTrustSnapshotCurrent"] = to_class(CatalogTrustSnapshotCurrent, self.catalog_trust_snapshot_current)
+        result["CatalogTrustSnapshotCurrentStatus"] = to_enum(CatalogTrustSnapshotCurrentStatus, self.catalog_trust_snapshot_current_status)
+        result["CatalogTrustSnapshotDowngraded"] = to_class(CatalogTrustSnapshotDowngraded, self.catalog_trust_snapshot_downgraded)
+        result["CatalogTrustSnapshotDowngradedStatus"] = to_enum(CatalogTrustSnapshotDowngradedStatus, self.catalog_trust_snapshot_downgraded_status)
+        result["CatalogTrustSnapshotMalformed"] = to_class(CatalogTrustSnapshotMalformed, self.catalog_trust_snapshot_malformed)
+        result["CatalogTrustSnapshotMalformedStatus"] = to_enum(CatalogTrustSnapshotMalformedStatus, self.catalog_trust_snapshot_malformed_status)
+        result["CatalogTrustSnapshotRevoked"] = to_class(CatalogTrustSnapshotRevoked, self.catalog_trust_snapshot_revoked)
+        result["CatalogTrustSnapshotRevokedStatus"] = to_enum(CatalogTrustSnapshotRevokedStatus, self.catalog_trust_snapshot_revoked_status)
+        result["CatalogTrustSnapshotSchemaVersion"] = to_enum(CatalogTrustSnapshotSchemaVersion, self.catalog_trust_snapshot_schema_version)
+        result["CatalogTrustSnapshotStale"] = to_class(CatalogTrustSnapshotStale, self.catalog_trust_snapshot_stale)
+        result["CatalogTrustSnapshotStaleStatus"] = to_enum(CatalogTrustSnapshotStaleStatus, self.catalog_trust_snapshot_stale_status)
+        result["CatalogTrustSnapshotUnsupported"] = to_class(CatalogTrustSnapshotUnsupported, self.catalog_trust_snapshot_unsupported)
+        result["CatalogTrustSnapshotUnsupportedStatus"] = to_enum(CatalogTrustSnapshotUnsupportedStatus, self.catalog_trust_snapshot_unsupported_status)
+        result["CatalogTrustSource"] = to_enum(CatalogTrustSource, self.catalog_trust_source)
+        result["CatalogTrustTier"] = to_enum(CatalogTrustTier, self.catalog_trust_tier)
         result["CatalogUnavailableError"] = to_class(CatalogUnavailableError, self.catalog_unavailable_error)
         result["CatalogUnavailableReason"] = to_enum(CatalogUnavailableReason, self.catalog_unavailable_reason)
         result["CatalogUnavailableTransportError"] = to_class(CatalogUnavailableTransportError, self.catalog_unavailable_transport_error)
@@ -40163,7 +40683,6 @@ def to_dict(self) -> dict:
         result["PermissionDecisionOutcome"] = to_enum(PermissionDecisionOutcome, self.permission_decision_outcome)
         result["PermissionDecisionReject"] = to_class(PermissionDecisionReject, self.permission_decision_reject)
         result["PermissionDecisionRequest"] = to_class(PermissionDecisionRequest, self.permission_decision_request)
-        result["PermissionDecisionSource"] = to_enum(PermissionDecisionSource, self.permission_decision_source)
         result["PermissionDecisionSurface"] = to_enum(PermissionDecisionSurface, self.permission_decision_surface)
         result["PermissionDecisionUserNotAvailable"] = to_class(PermissionDecisionUserNotAvailable, self.permission_decision_user_not_available)
         result["PermissionLocationAddToolApprovalParams"] = to_class(PermissionLocationAddToolApprovalParams, self.permission_location_add_tool_approval_params)
@@ -40837,6 +41356,22 @@ def _load_CatalogSearchResult(obj: Any) -> "CatalogSearchResult":
         case "unavailable": return CatalogUnavailableError.from_dict(obj)
         case _: raise ValueError(f"Unknown CatalogSearchResult kind: {kind!r}")
 
+# A versioned, bounded trust observation carried unchanged with a catalog candidate and its private handle context. Current observations require a recognised T1/T2 tier; every non-current state structurally forbids a tier. Eligibility remains `unknown` while Agent Finder supplies no exposure decision, and states absent from its current wire are never inferred from age, relevance, popularity, or a tier transition.
+CatalogTrustSnapshot = CatalogTrustSnapshotCurrent | CatalogTrustSnapshotAbsent | CatalogTrustSnapshotStale | CatalogTrustSnapshotDowngraded | CatalogTrustSnapshotRevoked | CatalogTrustSnapshotUnsupported | CatalogTrustSnapshotMalformed
+
+def _load_CatalogTrustSnapshot(obj: Any) -> "CatalogTrustSnapshot":
+    assert isinstance(obj, dict)
+    kind = obj.get("status")
+    match kind:
+        case "current": return CatalogTrustSnapshotCurrent.from_dict(obj)
+        case "absent": return CatalogTrustSnapshotAbsent.from_dict(obj)
+        case "stale": return CatalogTrustSnapshotStale.from_dict(obj)
+        case "downgraded": return CatalogTrustSnapshotDowngraded.from_dict(obj)
+        case "revoked": return CatalogTrustSnapshotRevoked.from_dict(obj)
+        case "unsupported": return CatalogTrustSnapshotUnsupported.from_dict(obj)
+        case "malformed": return CatalogTrustSnapshotMalformed.from_dict(obj)
+        case _: raise ValueError(f"Unknown CatalogTrustSnapshot status: {kind!r}")
+
 # A content block within a tool result, which may be text, terminal output, image, audio, or a resource
 ExternalToolTextResultForLlmContent = ExternalToolTextResultForLlmContentText | ExternalToolTextResultForLlmContentTerminal | ExternalToolTextResultForLlmContentShellExit | ExternalToolTextResultForLlmContentImage | ExternalToolTextResultForLlmContentAudio | ExternalToolTextResultForLlmContentResourceLink | ExternalToolTextResultForLlmContentResource
 
@@ -41665,7 +42200,7 @@ async def get_client_metadata(self, params: SessionsGetClientMetadataRequest, *,
         return list(await self._client.request("sessions.getClientMetadata", params_dict, **_timeout_kwargs(timeout)))
 
     async def read_persisted_events(self, params: SessionsReadPersistedEventsRequest, *, timeout: float | None = None) -> EventsReadResult:
-        "Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The initial backward read uses a bounded tail scan for fast first paint; cursor continuations preserve the session event-log paging semantics. Persisted events may omit payloads that are reconstructed only for an active session.\n\nArgs:\n    params: Pagination options for reading an inactive or active local session's persisted event journal.\n\nReturns:\n    Batch of session events returned by a read, with cursor and continuation metadata."
+        "Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The first read pins the currently opened journal generation and its byte-length boundary; opaque cursor continuations remain on that generation across runtime-owned compaction, truncation, and rewrite operations, which replace the live path atomically, and events appended after the boundary are excluded. For cold hydration, await the first successful page before activation and establish lossless live-event buffering before resume; merge subsequent live events by ID, preserving persisted order and letting live payloads win. Continuations are process-local, single-use capabilities bound to the originating session and storage context and must be paged sequentially; concurrent or repeated use of the same cursor expires that duplicate read rather than reading the generation twice. A complete snapshot has cursorStatus 'ok' and hasMore false. Snapshots expire after five idle minutes, with at most eight retained per process and idle-only eviction under pressure; completion and cancelled-worker exit release their handles. No transcript copy is created, but retained handles may keep replaced files' disk blocks alive until release. Pages have a soft 1 MiB serialized event-array budget including resolved binary assets; one oversized event is returned alone to guarantee progress. Working memory also includes a record/lookahead and asset resolution; resolving the first binary reference may scan the full pinned generation to build a bounded offset index. If the snapshot expires, is evicted, is cancelled before a continuation is established, or becomes unreadable after an observable unsupported in-place shortening, the continuation returns cursorStatus 'expired' with an empty terminal page and never falls back to a different generation. A missing or initially unreadable journal is an RPC error. Persisted history excludes ephemeral events and may omit payloads that are reconstructed only for an active session; use the active session event stream for post-resume live events.\n\nArgs:\n    params: Pagination options for reading an inactive or active local session's persisted event journal.\n\nReturns:\n    Batch of session events returned by a read, with cursor and continuation metadata."
         params_dict = {k: v for k, v in params.to_dict().items() if v is not None}
         return EventsReadResult.from_dict(await self._client.request("sessions.readPersistedEvents", params_dict, **_timeout_kwargs(timeout)))
 
@@ -42289,7 +42824,7 @@ def __init__(self, client: "JsonRpcClient", session_id: str):
         self._session_id = session_id
 
     async def start(self, params: FleetStartRequest, *, timeout: float | None = None) -> FleetStartResult:
-        "Starts fleet mode by submitting the fleet orchestration prompt to the session.\n\nArgs:\n    params: Optional user prompt to combine with the fleet orchestration instructions.\n\nReturns:\n    Indicates whether fleet mode was successfully activated."
+        "Starts fleet mode by submitting the fleet orchestration prompt to the session.\n\nArgs:\n    params: Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.\n\nReturns:\n    Indicates whether fleet mode was successfully activated."
         params_dict: dict[str, Any] = {k: v for k, v in params.to_dict().items() if v is not None}
         params_dict["sessionId"] = self._session_id
         return FleetStartResult.from_dict(await self._client.request("session.fleet.start", params_dict, **_timeout_kwargs(timeout)))
@@ -44258,6 +44793,27 @@ async def handle_git_hub_token_get_token(params: dict) -> dict | None:
     "CatalogSearchResultReason",
     "CatalogSearchSucceeded",
     "CatalogSearchSucceededKind",
+    "CatalogTrustEligibility",
+    "CatalogTrustProvenance",
+    "CatalogTrustSnapshot",
+    "CatalogTrustSnapshotAbsent",
+    "CatalogTrustSnapshotAbsentStatus",
+    "CatalogTrustSnapshotCurrent",
+    "CatalogTrustSnapshotCurrentStatus",
+    "CatalogTrustSnapshotDowngraded",
+    "CatalogTrustSnapshotDowngradedStatus",
+    "CatalogTrustSnapshotMalformed",
+    "CatalogTrustSnapshotMalformedStatus",
+    "CatalogTrustSnapshotRevoked",
+    "CatalogTrustSnapshotRevokedStatus",
+    "CatalogTrustSnapshotSchemaVersion",
+    "CatalogTrustSnapshotStale",
+    "CatalogTrustSnapshotStaleStatus",
+    "CatalogTrustSnapshotStatus",
+    "CatalogTrustSnapshotUnsupported",
+    "CatalogTrustSnapshotUnsupportedStatus",
+    "CatalogTrustSource",
+    "CatalogTrustTier",
     "CatalogUnavailableError",
     "CatalogUnavailableErrorKind",
     "CatalogUnavailableReason",
@@ -44867,7 +45423,6 @@ async def handle_git_hub_token_get_token(params: dict) -> dict | None:
     "PermissionDecisionReject",
     "PermissionDecisionRejectKind",
     "PermissionDecisionRequest",
-    "PermissionDecisionSource",
     "PermissionDecisionSurface",
     "PermissionDecisionUserNotAvailable",
     "PermissionDecisionUserNotAvailableKind",
diff --git a/python/copilot/generated/session_events.py b/python/copilot/generated/session_events.py
index f70a1caa70..fa18b439f1 100644
--- a/python/copilot/generated/session_events.py
+++ b/python/copilot/generated/session_events.py
@@ -221,6 +221,14 @@ class SessionEventType(Enum):
     SYSTEM_NOTIFICATION = "system.notification"
     PERMISSION_REQUESTED = "permission.requested"
     PERMISSION_COMPLETED = "permission.completed"
+    # Experimental: this event is part of an experimental API and may change or be removed.
+    PERMISSION_CARRIED_FORWARD = "permission.carriedForward"
+    # Experimental: this event is part of an experimental API and may change or be removed.
+    PERMISSION_MESSAGE_AUTHORIZATION = "permission.messageAuthorization"
+    # Experimental: this event is part of an experimental API and may change or be removed.
+    PERMISSION_MESSAGE_AUTHORIZATION_READ = "permission.messageAuthorizationRead"
+    # Experimental: this event is part of an experimental API and may change or be removed.
+    PERMISSION_MESSAGE_AUTHORIZATION_DEGRADED = "permission.messageAuthorizationDegraded"
     USER_INPUT_REQUESTED = "user_input.requested"
     USER_INPUT_COMPLETED = "user_input.completed"
     ELICITATION_REQUESTED = "elicitation.requested"
@@ -1483,6 +1491,148 @@ def to_dict(self) -> dict:
         return result
 
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class PermissionCarriedForwardData:
+    "Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left."
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    decision_source: PermissionDecisionSource
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    record_id: str
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    request_id: str
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    tool_call_id: str
+
+    @staticmethod
+    def from_dict(obj: Any) -> "PermissionCarriedForwardData":
+        assert isinstance(obj, dict)
+        decision_source = parse_enum(PermissionDecisionSource, obj.get("decisionSource"))
+        record_id = from_str(obj.get("recordId"))
+        request_id = from_str(obj.get("requestId"))
+        tool_call_id = from_str(obj.get("toolCallId"))
+        return PermissionCarriedForwardData(
+            decision_source=decision_source,
+            record_id=record_id,
+            request_id=request_id,
+            tool_call_id=tool_call_id,
+        )
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["decisionSource"] = to_enum(PermissionDecisionSource, self.decision_source)
+        result["recordId"] = from_str(self.record_id)
+        result["requestId"] = from_str(self.request_id)
+        result["toolCallId"] = from_str(self.tool_call_id)
+        return result
+
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class PermissionMessageAuthorizationData:
+    "Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume."
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    action_class: str
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    polarity: PermissionMessageAuthorizationPolarity
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    record_id: str
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    span_end: int
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    span_start: int
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    turn_index: int
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    target_members: list[str] | None = None
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    task: str | None = None
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    world: Any = None
+
+    @staticmethod
+    def from_dict(obj: Any) -> "PermissionMessageAuthorizationData":
+        assert isinstance(obj, dict)
+        action_class = from_str(obj.get("actionClass"))
+        polarity = parse_enum(PermissionMessageAuthorizationPolarity, obj.get("polarity"))
+        record_id = from_str(obj.get("recordId"))
+        span_end = from_int(obj.get("spanEnd"))
+        span_start = from_int(obj.get("spanStart"))
+        turn_index = from_int(obj.get("turnIndex"))
+        target_members = from_union([from_none, lambda x: from_list(from_str, x)], obj.get("targetMembers"))
+        task = from_union([from_none, from_str], obj.get("task"))
+        world = obj.get("world")
+        return PermissionMessageAuthorizationData(
+            action_class=action_class,
+            polarity=polarity,
+            record_id=record_id,
+            span_end=span_end,
+            span_start=span_start,
+            turn_index=turn_index,
+            target_members=target_members,
+            task=task,
+            world=world,
+        )
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["actionClass"] = from_str(self.action_class)
+        result["polarity"] = to_enum(PermissionMessageAuthorizationPolarity, self.polarity)
+        result["recordId"] = from_str(self.record_id)
+        result["spanEnd"] = to_int(self.span_end)
+        result["spanStart"] = to_int(self.span_start)
+        result["turnIndex"] = to_int(self.turn_index)
+        if self.target_members is not None:
+            result["targetMembers"] = from_union([from_none, lambda x: from_list(from_str, x)], self.target_members)
+        if self.task is not None:
+            result["task"] = from_union([from_none, from_str], self.task)
+        if self.world is not None:
+            result["world"] = self.world
+        return result
+
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class PermissionMessageAuthorizationDegradedData:
+    "Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt."
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    turn_index: int
+
+    @staticmethod
+    def from_dict(obj: Any) -> "PermissionMessageAuthorizationDegradedData":
+        assert isinstance(obj, dict)
+        turn_index = from_int(obj.get("turnIndex"))
+        return PermissionMessageAuthorizationDegradedData(
+            turn_index=turn_index,
+        )
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["turnIndex"] = to_int(self.turn_index)
+        return result
+
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class PermissionMessageAuthorizationReadData:
+    "Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism."
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    turn_index: int
+
+    @staticmethod
+    def from_dict(obj: Any) -> "PermissionMessageAuthorizationReadData":
+        assert isinstance(obj, dict)
+        turn_index = from_int(obj.get("turnIndex"))
+        return PermissionMessageAuthorizationReadData(
+            turn_index=turn_index,
+        )
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["turnIndex"] = to_int(self.turn_index)
+        return result
+
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class SessionAutoModeResolvedData:
@@ -5876,6 +6026,8 @@ class PermissionCompletedData:
     "Permission request completion notification signaling UI dismissal"
     request_id: str
     result: PermissionResult
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    decision_source: PermissionDecisionSource | None = None
     tool_call_id: str | None = None
 
     @staticmethod
@@ -5883,10 +6035,12 @@ def from_dict(obj: Any) -> "PermissionCompletedData":
         assert isinstance(obj, dict)
         request_id = from_str(obj.get("requestId"))
         result = _load_PermissionResult(obj.get("result"))
+        decision_source = from_union([from_none, lambda x: parse_enum(PermissionDecisionSource, x)], obj.get("decisionSource"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         return PermissionCompletedData(
             request_id=request_id,
             result=result,
+            decision_source=decision_source,
             tool_call_id=tool_call_id,
         )
 
@@ -5894,6 +6048,8 @@ def to_dict(self) -> dict:
         result: dict = {}
         result["requestId"] = from_str(self.request_id)
         result["result"] = self.result.to_dict()
+        if self.decision_source is not None:
+            result["decisionSource"] = from_union([from_none, lambda x: to_enum(PermissionDecisionSource, x)], self.decision_source)
         if self.tool_call_id is not None:
             result["toolCallId"] = from_union([from_none, from_str], self.tool_call_id)
         return result
@@ -6532,6 +6688,8 @@ class PermissionPromptRequestRead:
     # Experimental: this field is part of an experimental API and may change or be removed.
     assisted_approval: PermissionAssistedApproval | None = None
     managed_approval_required: bool | None = None
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    resolved_path: str | None = None
     tool_call_id: str | None = None
 
     @staticmethod
@@ -6541,12 +6699,14 @@ def from_dict(obj: Any) -> "PermissionPromptRequestRead":
         path = from_str(obj.get("path"))
         assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         managed_approval_required = from_union([from_none, from_bool], obj.get("managedApprovalRequired"))
+        resolved_path = from_union([from_none, from_str], obj.get("resolvedPath"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         return PermissionPromptRequestRead(
             intention=intention,
             path=path,
             assisted_approval=assisted_approval,
             managed_approval_required=managed_approval_required,
+            resolved_path=resolved_path,
             tool_call_id=tool_call_id,
         )
 
@@ -6559,6 +6719,8 @@ def to_dict(self) -> dict:
             result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.managed_approval_required is not None:
             result["managedApprovalRequired"] = from_union([from_none, from_bool], self.managed_approval_required)
+        if self.resolved_path is not None:
+            result["resolvedPath"] = from_union([from_none, from_str], self.resolved_path)
         if self.tool_call_id is not None:
             result["toolCallId"] = from_union([from_none, from_str], self.tool_call_id)
         return result
@@ -6632,6 +6794,8 @@ class PermissionPromptRequestWrite:
     assisted_approval: PermissionAssistedApproval | None = None
     managed_approval_required: bool | None = None
     new_file_contents: str | None = None
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    resolved_path: str | None = None
     tool_call_id: str | None = None
 
     @staticmethod
@@ -6644,6 +6808,7 @@ def from_dict(obj: Any) -> "PermissionPromptRequestWrite":
         assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         managed_approval_required = from_union([from_none, from_bool], obj.get("managedApprovalRequired"))
         new_file_contents = from_union([from_none, from_str], obj.get("newFileContents"))
+        resolved_path = from_union([from_none, from_str], obj.get("resolvedPath"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         return PermissionPromptRequestWrite(
             can_offer_session_approval=can_offer_session_approval,
@@ -6653,6 +6818,7 @@ def from_dict(obj: Any) -> "PermissionPromptRequestWrite":
             assisted_approval=assisted_approval,
             managed_approval_required=managed_approval_required,
             new_file_contents=new_file_contents,
+            resolved_path=resolved_path,
             tool_call_id=tool_call_id,
         )
 
@@ -6669,6 +6835,8 @@ def to_dict(self) -> dict:
             result["managedApprovalRequired"] = from_union([from_none, from_bool], self.managed_approval_required)
         if self.new_file_contents is not None:
             result["newFileContents"] = from_union([from_none, from_str], self.new_file_contents)
+        if self.resolved_path is not None:
+            result["resolvedPath"] = from_union([from_none, from_str], self.resolved_path)
         if self.tool_call_id is not None:
             result["toolCallId"] = from_union([from_none, from_str], self.tool_call_id)
         return result
@@ -7092,6 +7260,8 @@ class PermissionRequestRead:
     managed_approval_required: bool | None = None
     request_sandbox_bypass: bool | None = None
     request_sandbox_bypass_reason: str | None = None
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    resolved_path: str | None = None
     tool_call_id: str | None = None
 
     @staticmethod
@@ -7102,6 +7272,7 @@ def from_dict(obj: Any) -> "PermissionRequestRead":
         managed_approval_required = from_union([from_none, from_bool], obj.get("managedApprovalRequired"))
         request_sandbox_bypass = from_union([from_none, from_bool], obj.get("requestSandboxBypass"))
         request_sandbox_bypass_reason = from_union([from_none, from_str], obj.get("requestSandboxBypassReason"))
+        resolved_path = from_union([from_none, from_str], obj.get("resolvedPath"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         return PermissionRequestRead(
             intention=intention,
@@ -7109,6 +7280,7 @@ def from_dict(obj: Any) -> "PermissionRequestRead":
             managed_approval_required=managed_approval_required,
             request_sandbox_bypass=request_sandbox_bypass,
             request_sandbox_bypass_reason=request_sandbox_bypass_reason,
+            resolved_path=resolved_path,
             tool_call_id=tool_call_id,
         )
 
@@ -7123,6 +7295,8 @@ def to_dict(self) -> dict:
             result["requestSandboxBypass"] = from_union([from_none, from_bool], self.request_sandbox_bypass)
         if self.request_sandbox_bypass_reason is not None:
             result["requestSandboxBypassReason"] = from_union([from_none, from_str], self.request_sandbox_bypass_reason)
+        if self.resolved_path is not None:
+            result["resolvedPath"] = from_union([from_none, from_str], self.resolved_path)
         if self.tool_call_id is not None:
             result["toolCallId"] = from_union([from_none, from_str], self.tool_call_id)
         return result
@@ -7144,6 +7318,10 @@ class PermissionRequestShell:
     request_sandbox_bypass: bool | None = None
     request_sandbox_bypass_reason: str | None = None
     request_sandbox_permissive: bool | None = None
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    resolved_paths: dict[str, str] | None = None
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    resolved_working_directory: str | None = None
     tool_call_id: str | None = None
     warning: str | None = None
 
@@ -7162,6 +7340,8 @@ def from_dict(obj: Any) -> "PermissionRequestShell":
         request_sandbox_bypass = from_union([from_none, from_bool], obj.get("requestSandboxBypass"))
         request_sandbox_bypass_reason = from_union([from_none, from_str], obj.get("requestSandboxBypassReason"))
         request_sandbox_permissive = from_union([from_none, from_bool], obj.get("requestSandboxPermissive"))
+        resolved_paths = from_union([from_none, lambda x: from_dict(from_str, x)], obj.get("resolvedPaths"))
+        resolved_working_directory = from_union([from_none, from_str], obj.get("resolvedWorkingDirectory"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         warning = from_union([from_none, from_str], obj.get("warning"))
         return PermissionRequestShell(
@@ -7177,6 +7357,8 @@ def from_dict(obj: Any) -> "PermissionRequestShell":
             request_sandbox_bypass=request_sandbox_bypass,
             request_sandbox_bypass_reason=request_sandbox_bypass_reason,
             request_sandbox_permissive=request_sandbox_permissive,
+            resolved_paths=resolved_paths,
+            resolved_working_directory=resolved_working_directory,
             tool_call_id=tool_call_id,
             warning=warning,
         )
@@ -7201,6 +7383,10 @@ def to_dict(self) -> dict:
             result["requestSandboxBypassReason"] = from_union([from_none, from_str], self.request_sandbox_bypass_reason)
         if self.request_sandbox_permissive is not None:
             result["requestSandboxPermissive"] = from_union([from_none, from_bool], self.request_sandbox_permissive)
+        if self.resolved_paths is not None:
+            result["resolvedPaths"] = from_union([from_none, lambda x: from_dict(from_str, x)], self.resolved_paths)
+        if self.resolved_working_directory is not None:
+            result["resolvedWorkingDirectory"] = from_union([from_none, from_str], self.resolved_working_directory)
         if self.tool_call_id is not None:
             result["toolCallId"] = from_union([from_none, from_str], self.tool_call_id)
         if self.warning is not None:
@@ -7335,6 +7521,8 @@ class PermissionRequestWrite:
     new_file_contents: str | None = None
     request_sandbox_bypass: bool | None = None
     request_sandbox_bypass_reason: str | None = None
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    resolved_path: str | None = None
     tool_call_id: str | None = None
 
     @staticmethod
@@ -7348,6 +7536,7 @@ def from_dict(obj: Any) -> "PermissionRequestWrite":
         new_file_contents = from_union([from_none, from_str], obj.get("newFileContents"))
         request_sandbox_bypass = from_union([from_none, from_bool], obj.get("requestSandboxBypass"))
         request_sandbox_bypass_reason = from_union([from_none, from_str], obj.get("requestSandboxBypassReason"))
+        resolved_path = from_union([from_none, from_str], obj.get("resolvedPath"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         return PermissionRequestWrite(
             can_offer_session_approval=can_offer_session_approval,
@@ -7358,6 +7547,7 @@ def from_dict(obj: Any) -> "PermissionRequestWrite":
             new_file_contents=new_file_contents,
             request_sandbox_bypass=request_sandbox_bypass,
             request_sandbox_bypass_reason=request_sandbox_bypass_reason,
+            resolved_path=resolved_path,
             tool_call_id=tool_call_id,
         )
 
@@ -7376,6 +7566,8 @@ def to_dict(self) -> dict:
             result["requestSandboxBypass"] = from_union([from_none, from_bool], self.request_sandbox_bypass)
         if self.request_sandbox_bypass_reason is not None:
             result["requestSandboxBypassReason"] = from_union([from_none, from_str], self.request_sandbox_bypass_reason)
+        if self.resolved_path is not None:
+            result["resolvedPath"] = from_union([from_none, from_str], self.resolved_path)
         if self.tool_call_id is not None:
             result["toolCallId"] = from_union([from_none, from_str], self.tool_call_id)
         return result
@@ -11159,6 +11351,7 @@ class ToolExecutionStartData:
     fusion: FusionAttribution | None = None
     mcp_server_name: str | None = None
     mcp_tool_name: str | None = None
+    mcp_transport: McpServerTransport | None = None
     model: str | None = None
     # Deprecated: this field is deprecated.
     parent_tool_call_id: str | None = None
@@ -11177,6 +11370,7 @@ def from_dict(obj: Any) -> "ToolExecutionStartData":
         fusion = from_union([from_none, FusionAttribution.from_dict], obj.get("fusion"))
         mcp_server_name = from_union([from_none, from_str], obj.get("mcpServerName"))
         mcp_tool_name = from_union([from_none, from_str], obj.get("mcpToolName"))
+        mcp_transport = from_union([from_none, lambda x: parse_enum(McpServerTransport, x)], obj.get("mcpTransport"))
         model = from_union([from_none, from_str], obj.get("model"))
         parent_tool_call_id = from_union([from_none, from_str], obj.get("parentToolCallId"))
         rte = from_union([from_none, from_bool], obj.get("rte"))
@@ -11191,6 +11385,7 @@ def from_dict(obj: Any) -> "ToolExecutionStartData":
             fusion=fusion,
             mcp_server_name=mcp_server_name,
             mcp_tool_name=mcp_tool_name,
+            mcp_transport=mcp_transport,
             model=model,
             parent_tool_call_id=parent_tool_call_id,
             rte=rte,
@@ -11213,6 +11408,8 @@ def to_dict(self) -> dict:
             result["mcpServerName"] = from_union([from_none, from_str], self.mcp_server_name)
         if self.mcp_tool_name is not None:
             result["mcpToolName"] = from_union([from_none, from_str], self.mcp_tool_name)
+        if self.mcp_transport is not None:
+            result["mcpTransport"] = from_union([from_none, lambda x: to_enum(McpServerTransport, x)], self.mcp_transport)
         if self.model is not None:
             result["model"] = from_union([from_none, from_str], self.model)
         if self.parent_tool_call_id is not None:
@@ -12125,6 +12322,15 @@ class FusionTurnKind(Enum):
     COMPACTION = "compaction"
 
 
+# Experimental: this enum is part of an experimental API and may change or be removed.
+class PermissionMessageAuthorizationPolarity(Enum):
+    "Which direction a message-backed authorization claim moves authority in."
+    # The human's words authorized an effect.
+    GRANT = "grant"
+    # The human's words refused an effect.
+    DENIAL = "denial"
+
+
 # Experimental: this enum is part of an experimental API and may change or be removed.
 class PermissionMode(Enum):
     "Permission mode for the session."
@@ -12661,6 +12867,20 @@ class OmittedBinaryType(Enum):
     RESOURCE = "resource"
 
 
+class PermissionDecisionSource(Enum):
+    "Controlled reason or actor responsible for a permission response."
+    # The response followed the assisted-approval judge recommendation.
+    ASSISTED_APPROVAL = "assisted_approval"
+    # A human supplied the response through an interactive prompt.
+    HUMAN_RESPONSE = "human_response"
+    # The host applied a standing policy or override rather than a judge recommendation or human decision.
+    HOST_POLICY = "host_policy"
+    # The host denied the request because no interactive user response was available.
+    UNATTENDED_FALLBACK = "unattended_fallback"
+    # A live authorization record from an earlier human decision in this session contained the proposal, so it ran without another prompt. This is not a new human decision and never mints authority of its own.
+    AUTHORIZATION_CARRY_FORWARD = "authorization_carry_forward"
+
+
 class PermissionPromptRequestPathAccessKind(Enum):
     "Underlying permission kind that needs path approval"
     # Read access to a filesystem path.
@@ -12963,7 +13183,7 @@ class WorkspaceFileChangedOperation(Enum):
     UPDATE = "update"
 
 
-SessionEventData = SessionStartData | SessionResumeData | SessionRemoteSteerableChangedData | SessionErrorData | SessionIdleData | SessionTitleChangedData | SessionScheduleCreatedData | SessionScheduleCancelledData | SessionScheduleRearmedData | SessionAutopilotObjectiveChangedData | SessionInfoData | SessionWarningData | SessionModelChangeData | SessionAutoTierRecommendationData | SessionAutoTierSwitchFailedData | SessionModeChangedData | SessionModeNoticeDeliveredData | SessionSessionLimitsChangedData | SessionPermissionsChangedData | SessionPlanChangedData | SessionTodosChangedData | SessionWorkspaceFileChangedData | SessionHandoffData | SessionTruncationData | SessionSnapshotRewindData | SessionShutdownData | SessionUsageCheckpointData | SessionContextChangedData | SessionUsageInfoData | SessionContextClearedData | SessionCompactionStartData | SessionCompactionCompleteData | SessionTaskCompleteData | SessionCompletionReceiptData | SessionFusionRouteStartedData | SessionFusionRouteFailedData | SessionFusionResolvedData | SessionFusionCompletedData | UserMessageData | PendingMessagesModifiedData | AssistantTurnStartData | AssistantTurnRetryData | AgentInterruptedData | AssistantIntentData | AssistantFusionPhaseStartedData | AssistantFusionPhaseActivityData | AssistantFusionPhaseCompletedData | AssistantFusionPhaseFailedData | AssistantServerToolProgressData | AssistantReasoningData | AssistantReasoningDeltaData | AssistantToolCallDeltaData | AssistantStreamingDeltaData | AssistantMessageData | AssistantMessageStartData | AssistantMessageDeltaData | AssistantTurnEndData | AssistantIdleData | AssistantUsageData | PromptCacheBreakData | ModelCallFailureData | ModelCallFinishedData | ModelCallStartData | AbortData | ToolUserRequestedData | ToolExecutionStartData | ToolExecutionPartialResultData | ToolExecutionProgressData | ToolExecutionCompleteData | ToolSearchActivatedData | SkillInvokedData | SandboxDecisionData | SubagentStartedData | SubagentConfiguredData | SubagentCompletedData | SubagentFailedData | SubagentSelectedData | SubagentDeselectedData | HookStartData | HookEndData | HookProgressData | SessionBinaryAssetData | SystemMessageData | SystemNotificationData | PermissionRequestedData | PermissionCompletedData | UserInputRequestedData | UserInputCompletedData | ElicitationRequestedData | ElicitationCompletedData | SamplingRequestedData | SamplingCompletedData | McpOauthRequiredData | McpOauthCompletedData | McpHeadersRefreshRequiredData | McpHeadersRefreshCompletedData | SessionCustomNotificationData | UiEphemeralQueryData | ExternalToolRequestedData | ExternalToolCompletedData | CommandQueuedData | CommandExecuteData | CommandCompletedData | AutoModeSwitchRequestedData | AutoModeSwitchCompletedData | SessionLimitsExhaustedRequestedData | SessionLimitsExhaustedCompletedData | SessionAutoModeResolvedData | SessionManagedSettingsResolvedData | SessionManagedSettingsEnforcedData | CommandsChangedData | CapabilitiesChangedData | ExitPlanModeRequestedData | ExitPlanModeCompletedData | SessionToolsUpdatedData | SessionBackgroundTasksChangedData | FactoryRunUpdatedData | FactoryRunStartedData | FactoryRunSettledData | SessionSkillsLoadedData | SessionCustomAgentsUpdatedData | SessionMcpServersLoadedData | SessionMcpServerStatusChangedData | SessionMcpServerRemovedData | SessionMcpServerNeedsReconnectData | McpToolsListChangedData | McpResourcesListChangedData | McpPromptsListChangedData | SessionExtensionsLoadedData | SessionCanvasOpenedData | SessionCanvasRegistryChangedData | SessionCanvasClosedData | SessionCanvasUnavailableData | SessionCanvasRecordedData | SessionCanvasRemovedData | SessionExtensionsAttachmentsPushedData | McpAppToolCallCompleteData | RawSessionEventData | Data
+SessionEventData = SessionStartData | SessionResumeData | SessionRemoteSteerableChangedData | SessionErrorData | SessionIdleData | SessionTitleChangedData | SessionScheduleCreatedData | SessionScheduleCancelledData | SessionScheduleRearmedData | SessionAutopilotObjectiveChangedData | SessionInfoData | SessionWarningData | SessionModelChangeData | SessionAutoTierRecommendationData | SessionAutoTierSwitchFailedData | SessionModeChangedData | SessionModeNoticeDeliveredData | SessionSessionLimitsChangedData | SessionPermissionsChangedData | SessionPlanChangedData | SessionTodosChangedData | SessionWorkspaceFileChangedData | SessionHandoffData | SessionTruncationData | SessionSnapshotRewindData | SessionShutdownData | SessionUsageCheckpointData | SessionContextChangedData | SessionUsageInfoData | SessionContextClearedData | SessionCompactionStartData | SessionCompactionCompleteData | SessionTaskCompleteData | SessionCompletionReceiptData | SessionFusionRouteStartedData | SessionFusionRouteFailedData | SessionFusionResolvedData | SessionFusionCompletedData | UserMessageData | PendingMessagesModifiedData | AssistantTurnStartData | AssistantTurnRetryData | AgentInterruptedData | AssistantIntentData | AssistantFusionPhaseStartedData | AssistantFusionPhaseActivityData | AssistantFusionPhaseCompletedData | AssistantFusionPhaseFailedData | AssistantServerToolProgressData | AssistantReasoningData | AssistantReasoningDeltaData | AssistantToolCallDeltaData | AssistantStreamingDeltaData | AssistantMessageData | AssistantMessageStartData | AssistantMessageDeltaData | AssistantTurnEndData | AssistantIdleData | AssistantUsageData | PromptCacheBreakData | ModelCallFailureData | ModelCallFinishedData | ModelCallStartData | AbortData | ToolUserRequestedData | ToolExecutionStartData | ToolExecutionPartialResultData | ToolExecutionProgressData | ToolExecutionCompleteData | ToolSearchActivatedData | SkillInvokedData | SandboxDecisionData | SubagentStartedData | SubagentConfiguredData | SubagentCompletedData | SubagentFailedData | SubagentSelectedData | SubagentDeselectedData | HookStartData | HookEndData | HookProgressData | SessionBinaryAssetData | SystemMessageData | SystemNotificationData | PermissionRequestedData | PermissionCompletedData | PermissionCarriedForwardData | PermissionMessageAuthorizationData | PermissionMessageAuthorizationReadData | PermissionMessageAuthorizationDegradedData | UserInputRequestedData | UserInputCompletedData | ElicitationRequestedData | ElicitationCompletedData | SamplingRequestedData | SamplingCompletedData | McpOauthRequiredData | McpOauthCompletedData | McpHeadersRefreshRequiredData | McpHeadersRefreshCompletedData | SessionCustomNotificationData | UiEphemeralQueryData | ExternalToolRequestedData | ExternalToolCompletedData | CommandQueuedData | CommandExecuteData | CommandCompletedData | AutoModeSwitchRequestedData | AutoModeSwitchCompletedData | SessionLimitsExhaustedRequestedData | SessionLimitsExhaustedCompletedData | SessionAutoModeResolvedData | SessionManagedSettingsResolvedData | SessionManagedSettingsEnforcedData | CommandsChangedData | CapabilitiesChangedData | ExitPlanModeRequestedData | ExitPlanModeCompletedData | SessionToolsUpdatedData | SessionBackgroundTasksChangedData | FactoryRunUpdatedData | FactoryRunStartedData | FactoryRunSettledData | SessionSkillsLoadedData | SessionCustomAgentsUpdatedData | SessionMcpServersLoadedData | SessionMcpServerStatusChangedData | SessionMcpServerRemovedData | SessionMcpServerNeedsReconnectData | McpToolsListChangedData | McpResourcesListChangedData | McpPromptsListChangedData | SessionExtensionsLoadedData | SessionCanvasOpenedData | SessionCanvasRegistryChangedData | SessionCanvasClosedData | SessionCanvasUnavailableData | SessionCanvasRecordedData | SessionCanvasRemovedData | SessionExtensionsAttachmentsPushedData | McpAppToolCallCompleteData | RawSessionEventData | Data
 
 
 @dataclass
@@ -13075,6 +13295,10 @@ def from_dict(obj: Any) -> "SessionEvent":
             case SessionEventType.SYSTEM_NOTIFICATION: data = SystemNotificationData.from_dict(data_obj)
             case SessionEventType.PERMISSION_REQUESTED: data = PermissionRequestedData.from_dict(data_obj)
             case SessionEventType.PERMISSION_COMPLETED: data = PermissionCompletedData.from_dict(data_obj)
+            case SessionEventType.PERMISSION_CARRIED_FORWARD: data = PermissionCarriedForwardData.from_dict(data_obj)
+            case SessionEventType.PERMISSION_MESSAGE_AUTHORIZATION: data = PermissionMessageAuthorizationData.from_dict(data_obj)
+            case SessionEventType.PERMISSION_MESSAGE_AUTHORIZATION_READ: data = PermissionMessageAuthorizationReadData.from_dict(data_obj)
+            case SessionEventType.PERMISSION_MESSAGE_AUTHORIZATION_DEGRADED: data = PermissionMessageAuthorizationDegradedData.from_dict(data_obj)
             case SessionEventType.USER_INPUT_REQUESTED: data = UserInputRequestedData.from_dict(data_obj)
             case SessionEventType.USER_INPUT_COMPLETED: data = UserInputCompletedData.from_dict(data_obj)
             case SessionEventType.ELICITATION_REQUESTED: data = ElicitationRequestedData.from_dict(data_obj)
@@ -13346,12 +13570,18 @@ def session_event_to_dict(x: SessionEvent) -> Any:
     "PermissionApprovedForSession",
     "PermissionAssistedApproval",
     "PermissionCancelled",
+    "PermissionCarriedForwardData",
     "PermissionCompletedData",
+    "PermissionDecisionSource",
     "PermissionDeniedByContentExclusionPolicy",
     "PermissionDeniedByPermissionRequestHook",
     "PermissionDeniedByRules",
     "PermissionDeniedInteractivelyByUser",
     "PermissionDeniedNoApprovalRuleAndCouldNotRequestFromUser",
+    "PermissionMessageAuthorizationData",
+    "PermissionMessageAuthorizationDegradedData",
+    "PermissionMessageAuthorizationPolarity",
+    "PermissionMessageAuthorizationReadData",
     "PermissionMode",
     "PermissionPromptRequest",
     "PermissionPromptRequestCommands",
diff --git a/rust/src/generated/api_types.rs b/rust/src/generated/api_types.rs
index 7500c30745..eef0c4fb2d 100644
--- a/rust/src/generated/api_types.rs
+++ b/rust/src/generated/api_types.rs
@@ -12,9 +12,10 @@ use serde::{Deserialize, Serialize};
 use super::session_events::{
     AbortReason, AgentModelPolicy, AutoTier, ContextTier, McpOauthHttpResponse,
     McpOauthWWWAuthenticateParams, McpServerMetadata, McpServerSource, McpServerStatus,
-    ModelChangeSource, OmittedBinaryOmittedReason, PermissionMode, PermissionPromptRequest,
-    PermissionRule, ReasoningSummary, RemediationAction, SessionLimitsConfig, SessionMode,
-    ShutdownType, SkillSource, TaskCompletionOutcome, UserToolSessionApproval, Verbosity,
+    ModelChangeSource, OmittedBinaryOmittedReason, PermissionDecisionSource, PermissionMode,
+    PermissionPromptRequest, PermissionRule, ReasoningSummary, RemediationAction,
+    SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompletionOutcome,
+    UserToolSessionApproval, Verbosity,
 };
 use crate::types::{RequestId, SessionEvent, SessionId};
 
@@ -1143,7 +1144,7 @@ pub struct CopilotUserResponse {
     /// Per-category monthly quota allotments, keyed by quota category.
     #[serde(rename = "monthly_quotas", skip_serializing_if = "Option::is_none")]
     pub monthly_quotas: Option<HashMap<String, f64>>,
-    /// Organizations the user belongs to, each with an optional login and display name.
+    /// Organizations the user belongs to, each with an optional ID, login, and display name.
     #[serde(rename = "organization_list", skip_serializing_if = "Option::is_none")]
     pub organization_list: Option<serde_json::Value>,
     /// Logins of the organizations the user belongs to.
@@ -3241,6 +3242,9 @@ pub struct CatalogAiSkillCandidate {
     pub publisher: Option<String>,
     /// Where the card came from: exactly one of a URL or embedded data, encoded as a tagged union so neither both nor neither can be represented.
     pub source: CatalogCandidateSource,
+    /// Versioned trust metadata observed from the catalog authority. Optional for protocol-3 compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits an explicit snapshot even when the authority omitted or malformed its trust field.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub trust: Option<serde_json::Value>,
 }
 
 /// An optional catalog authentication exchange did not establish the caller's identity. Anonymous search remains supported; this refusal is reserved for an operation that cannot continue after the attempted exchange. It is distinct from `policy-rejected` and from a network failure, and the reason identifies the recovery action.
@@ -3314,6 +3318,9 @@ pub struct CatalogMcpServerCandidate {
     pub publisher: Option<String>,
     /// Where the card came from: exactly one of a URL or embedded data, encoded as a tagged union so neither both nor neither can be represented.
     pub source: CatalogCandidateSource,
+    /// Versioned trust metadata observed from the catalog authority. Optional for protocol-3 compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits an explicit snapshot even when the authority omitted or malformed its trust field.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub trust: Option<serde_json::Value>,
 }
 
 /// The protocol version and capability set a caller requires, supplied on every catalog request so negotiation cannot be skipped by omission.
@@ -3452,8 +3459,8 @@ pub struct CatalogNegotiationRefusedError {
     pub reason: CatalogNegotiationRefusedReason,
     /// Protocol version of the runtime that refused the request.
     pub runtime_protocol_version: i64,
-    /// Every wire feature this runtime understands, so the caller can retry within that contract. This list does not imply that every deployment has enabled every operation.
-    pub supported_capabilities: Vec<CatalogCapability>,
+    /// Capabilities this runtime can safely advertise to this caller. The complete five-capability protocol-3 legacy set is always present; every capability added after that baseline appears only when the caller required it, so an older closed-enum decoder can still consume a refusal. This list does not imply that every deployment has enabled every operation.
+    pub supported_capabilities: Vec<String>,
     /// The subset of the caller's bounded extensible capability identifiers this runtime cannot honour.
     pub unsupported_capabilities: Vec<String>,
 }
@@ -3626,6 +3633,172 @@ pub struct CatalogUnavailableError {
     pub reason: CatalogUnavailableReason,
 }
 
+/// Where and when the runtime observed the trust metadata. Observation time is not the authority's evaluation time and must not be used to infer staleness.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogTrustProvenance {
+    /// ISO 8601 timestamp with a timezone offset at which the runtime observed the search result carrying this trust field.
+    pub observed_at: String,
+    /// Bounded authority that supplied the trust field.
+    pub source: CatalogTrustSource,
+}
+
+/// Discriminator: the authority omitted trust metadata.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogTrustSnapshotAbsent {
+    /// Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field.
+    pub eligibility: CatalogTrustEligibility,
+    /// Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust.
+    pub provenance: CatalogTrustProvenance,
+    /// Schema version of this runtime-owned snapshot envelope.
+    pub schema_version: CatalogTrustSnapshotSchemaVersion,
+    /// Discriminator: the authority omitted trust metadata.
+    pub status: CatalogTrustSnapshotAbsentStatus,
+}
+
+/// A recognised current Agent Finder T1 or T2 trust tier.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogTrustSnapshotCurrent {
+    /// Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field.
+    pub eligibility: CatalogTrustEligibility,
+    /// Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust.
+    pub provenance: CatalogTrustProvenance,
+    /// Schema version of this runtime-owned snapshot envelope.
+    pub schema_version: CatalogTrustSnapshotSchemaVersion,
+    /// Discriminator: a recognised current trust tier was observed.
+    pub status: CatalogTrustSnapshotCurrentStatus,
+    /// Service-computed T1 or T2 trust tier.
+    pub tier: CatalogTrustTier,
+}
+
+/// Discriminator: the authority explicitly reported a downgraded assessment.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogTrustSnapshotDowngraded {
+    /// Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field.
+    pub eligibility: CatalogTrustEligibility,
+    /// Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust.
+    pub provenance: CatalogTrustProvenance,
+    /// Schema version of this runtime-owned snapshot envelope.
+    pub schema_version: CatalogTrustSnapshotSchemaVersion,
+    /// Discriminator: the authority explicitly reported a downgraded assessment.
+    pub status: CatalogTrustSnapshotDowngradedStatus,
+}
+
+/// Discriminator: the trust field was empty, unbounded, or had the wrong JSON type.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogTrustSnapshotMalformed {
+    /// Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field.
+    pub eligibility: CatalogTrustEligibility,
+    /// Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust.
+    pub provenance: CatalogTrustProvenance,
+    /// Schema version of this runtime-owned snapshot envelope.
+    pub schema_version: CatalogTrustSnapshotSchemaVersion,
+    /// Discriminator: the trust field was empty, unbounded, or had the wrong JSON type.
+    pub status: CatalogTrustSnapshotMalformedStatus,
+}
+
+/// Discriminator: the authority explicitly revoked the assessment.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogTrustSnapshotRevoked {
+    /// Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field.
+    pub eligibility: CatalogTrustEligibility,
+    /// Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust.
+    pub provenance: CatalogTrustProvenance,
+    /// Schema version of this runtime-owned snapshot envelope.
+    pub schema_version: CatalogTrustSnapshotSchemaVersion,
+    /// Discriminator: the authority explicitly revoked the assessment.
+    pub status: CatalogTrustSnapshotRevokedStatus,
+}
+
+/// Discriminator: the authority explicitly marked the assessment stale.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogTrustSnapshotStale {
+    /// Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field.
+    pub eligibility: CatalogTrustEligibility,
+    /// Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust.
+    pub provenance: CatalogTrustProvenance,
+    /// Schema version of this runtime-owned snapshot envelope.
+    pub schema_version: CatalogTrustSnapshotSchemaVersion,
+    /// Discriminator: the authority explicitly marked the assessment stale.
+    pub status: CatalogTrustSnapshotStaleStatus,
+}
+
+/// Discriminator: the authority supplied a bounded trust value this runtime does not understand.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogTrustSnapshotUnsupported {
+    /// Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field.
+    pub eligibility: CatalogTrustEligibility,
+    /// Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust.
+    pub provenance: CatalogTrustProvenance,
+    /// Schema version of this runtime-owned snapshot envelope.
+    pub schema_version: CatalogTrustSnapshotSchemaVersion,
+    /// Discriminator: the authority supplied a bounded trust value this runtime does not understand.
+    pub status: CatalogTrustSnapshotUnsupportedStatus,
+}
+
 /// No transport this runtime can use is available for the requested server.
 ///
 /// <div class="warning">
@@ -4780,11 +4953,11 @@ pub struct EventLogTailResult {
 pub struct EventsReadResult {
     /// Opaque cursor for the next read. Pass back unchanged in the next read.cursor to continue from where this read left off. Always present, even when no events were returned. For a backward read this cursor pages toward OLDER events; keep passing `direction: backward` with it (the cursor is also self-describing, so backward paging continues correctly).
     pub cursor: String,
-    /// Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history. For a forward read the fallback starts from the beginning of the remaining history; for a backward read it falls back to the tail (the newest window). Because the fallback page is a fresh boundary snapshot rather than a continuation of the requested cursor, it may overlap events the consumer has already rendered — a backward fallback to the tail in particular can repeat the newest window. On 'expired', consumers should reset or rebase their local pagination state (or deduplicate by event id) before continuing from the returned cursor rather than blindly appending/prepending the fallback page.
+    /// Cursor status: 'ok' means the cursor was applied successfully. For session.eventLog.read, 'expired' means the cursor referred to an event that no longer exists in active history and the read fell back to a boundary of the remaining history: the beginning for a forward read or the newest window for a backward read. That fallback may overlap already rendered events, so active-session consumers should reset, rebase, or deduplicate before continuing. sessions.readPersistedEvents has stricter snapshot semantics: 'expired' returns an empty terminal page and never switches to a replacement journal generation. Other persisted-read I/O failures are RPC errors with diagnostics, not cursor expiry.
     pub cursor_status: EventsCursorStatus,
     /// Session events for this batch, merged into a single stream in creation order: durable (persisted) events and ephemeral events interleave exactly as they were emitted. Set `includeEphemeral: false` to receive only durable events. Ephemeral events are never replayable once pruned from the in-memory ring, so a consumer that needs them should keep reading with a non-zero `waitMs`. For a backward (tail-first) read, the returned window contains persisted events only, still in chronological (oldest-to-newest) append order.
     pub events: Vec<SessionEvent>,
-    /// True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window.
+    /// True when more events are available in the read's direction. For a backward read, true means older persisted events remain before the returned window. A persisted-event page may contain fewer than `max` events because of its byte budget while still reporting hasMore true; continue according to this flag rather than the event count.
     pub has_more: bool,
 }
 
@@ -6150,7 +6323,7 @@ pub(crate) struct FactoryToolRunRequest {
     pub tool_call_id: Option<String>,
 }
 
-/// Optional user prompt to combine with the fleet orchestration instructions.
+/// Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.
 ///
 /// <div class="warning">
 ///
@@ -6161,9 +6334,19 @@ pub(crate) struct FactoryToolRunRequest {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct FleetStartRequest {
+    /// Optional attachments (files, directories, selections, blobs, GitHub references) to include with the fleet request
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub attachments: Option<Vec<serde_json::Value>>,
+    /// If false, this request will not trigger a Premium Request Unit charge. User requests default to billable.
+    #[doc(hidden)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) billable: Option<bool>,
     /// Optional user prompt to combine with fleet instructions
     #[serde(skip_serializing_if = "Option::is_none")]
     pub prompt: Option<String>,
+    /// If true, await completion of the agentic loop for this fleet request before returning. Defaults to false.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wait: Option<bool>,
 }
 
 /// Indicates whether fleet mode was successfully activated.
@@ -10614,6 +10797,9 @@ pub struct ModelApplyStartupOverlayRequest {
     /// Startup default model from the enterprise policy helper, when configured. Weakest of the managed sources: it applies only when neither device nor server policy names a model, and an explicit user selection still wins.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub policy_helper_model: Option<String>,
+    /// Auto routing preference selected by repository settings, when configured. Applied only when the overlay selects the Auto model; beside a concrete model it stays dormant.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repo_auto_tier: Option<String>,
     /// Context tier selected by repository settings, when configured.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub repo_context_tier: Option<String>,
@@ -11060,6 +11246,9 @@ pub struct ModeSetRequest {
     /// Explicit response to a model-switch compaction preflight.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub compaction_decision: Option<String>,
+    /// Mode the session must currently be in for the change to apply. When set and the session is in a different mode the request is a no-op and reports status 'unchanged'.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub expected_mode: Option<SessionMode>,
     /// Session whose plan-mode base state should be inherited.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub inherit_plan_base_from_session_id: Option<String>,
@@ -11117,6 +11306,9 @@ pub struct ModeSetResult {
     /// User-facing outcome message for the model switch triggered by the mode change.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub message: Option<String>,
+    /// Whether the requested mode was applied to the session. False only when an 'expectedMode' precondition did not hold, in which case any model change reported alongside it was still applied.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mode_applied: Option<bool>,
     /// Whether applying the mode changed the active model.
     pub model_changed: bool,
     /// Lifecycle status of the requested mode change.
@@ -17454,6 +17646,9 @@ pub struct SessionOpenOptions {
     /// Initial reasoning summary mode for supported model clients.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub reasoning_summary: Option<SessionOpenOptionsReasoningSummary>,
+    /// Whether to invalidate cached custom-instruction discovery before constructing the session. Use when instruction files may have changed earlier in the same runtime process.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub refresh_custom_instructions: Option<bool>,
     /// Telemetry-only remote-defaulted flag.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub remote_defaulted_on: Option<bool>,
@@ -18561,13 +18756,13 @@ pub struct SessionsPruneOldRequest {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SessionsReadPersistedEventsRequest {
-    /// Opaque cursor returned by a previous persisted-event read. Omit on the first call.
+    /// Opaque, process-local, single-use cursor returned by the previous persisted-event read. Omit on the first call and issue continuations sequentially; reusing the same cursor returns an expired terminal page.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub cursor: Option<String>,
-    /// Direction to page through persisted history. Forward starts at the beginning; backward starts with the newest events. Events in each page remain chronological.
+    /// Direction to page through persisted history. Forward starts at the beginning; backward starts with the newest events. Events in each page remain chronological. This selects the initial read only; a continuation always uses the direction bound into its cursor.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub direction: Option<EventsReadDirection>,
-    /// Maximum number of events to return in this batch (1–1000, default 200).
+    /// Maximum number of events to return in this batch (1–1000, default 200). Pages may contain fewer events to keep the serialized event array within a soft 1 MiB budget including resolved binary assets; one oversized event is returned alone to guarantee progress.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub max: Option<i64>,
     /// Session ID whose persisted event journal should be read.
@@ -22778,11 +22973,11 @@ pub struct SessionsListResult {
 pub struct SessionsReadPersistedEventsResult {
     /// Opaque cursor for the next read. Pass back unchanged in the next read.cursor to continue from where this read left off. Always present, even when no events were returned. For a backward read this cursor pages toward OLDER events; keep passing `direction: backward` with it (the cursor is also self-describing, so backward paging continues correctly).
     pub cursor: String,
-    /// Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history. For a forward read the fallback starts from the beginning of the remaining history; for a backward read it falls back to the tail (the newest window). Because the fallback page is a fresh boundary snapshot rather than a continuation of the requested cursor, it may overlap events the consumer has already rendered — a backward fallback to the tail in particular can repeat the newest window. On 'expired', consumers should reset or rebase their local pagination state (or deduplicate by event id) before continuing from the returned cursor rather than blindly appending/prepending the fallback page.
+    /// Cursor status: 'ok' means the cursor was applied successfully. For session.eventLog.read, 'expired' means the cursor referred to an event that no longer exists in active history and the read fell back to a boundary of the remaining history: the beginning for a forward read or the newest window for a backward read. That fallback may overlap already rendered events, so active-session consumers should reset, rebase, or deduplicate before continuing. sessions.readPersistedEvents has stricter snapshot semantics: 'expired' returns an empty terminal page and never switches to a replacement journal generation. Other persisted-read I/O failures are RPC errors with diagnostics, not cursor expiry.
     pub cursor_status: EventsCursorStatus,
     /// Session events for this batch, merged into a single stream in creation order: durable (persisted) events and ephemeral events interleave exactly as they were emitted. Set `includeEphemeral: false` to receive only durable events. Ephemeral events are never replayable once pruned from the in-memory ring, so a consumer that needs them should keep reading with a non-zero `waitMs`. For a backward (tail-first) read, the returned window contains persisted events only, still in chronological (oldest-to-newest) append order.
     pub events: Vec<SessionEvent>,
-    /// True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window.
+    /// True when more events are available in the read's direction. For a backward read, true means older persisted events remain before the returned window. A persisted-event page may contain fewer than `max` events because of its byte budget while still reporting hasMore true; continue according to this flag rather than the event count.
     pub has_more: bool,
 }
 
@@ -24062,6 +24257,9 @@ pub struct SessionModeSetResult {
     /// User-facing outcome message for the model switch triggered by the mode change.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub message: Option<String>,
+    /// Whether the requested mode was applied to the session. False only when an 'expectedMode' precondition did not hold, in which case any model change reported alongside it was still applied.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mode_applied: Option<bool>,
     /// Whether applying the mode changed the active model.
     pub model_changed: bool,
     /// Lifecycle status of the requested mode change.
@@ -27851,11 +28049,11 @@ pub struct SessionQueueProcessParams {
 pub struct SessionEventLogReadResult {
     /// Opaque cursor for the next read. Pass back unchanged in the next read.cursor to continue from where this read left off. Always present, even when no events were returned. For a backward read this cursor pages toward OLDER events; keep passing `direction: backward` with it (the cursor is also self-describing, so backward paging continues correctly).
     pub cursor: String,
-    /// Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history. For a forward read the fallback starts from the beginning of the remaining history; for a backward read it falls back to the tail (the newest window). Because the fallback page is a fresh boundary snapshot rather than a continuation of the requested cursor, it may overlap events the consumer has already rendered — a backward fallback to the tail in particular can repeat the newest window. On 'expired', consumers should reset or rebase their local pagination state (or deduplicate by event id) before continuing from the returned cursor rather than blindly appending/prepending the fallback page.
+    /// Cursor status: 'ok' means the cursor was applied successfully. For session.eventLog.read, 'expired' means the cursor referred to an event that no longer exists in active history and the read fell back to a boundary of the remaining history: the beginning for a forward read or the newest window for a backward read. That fallback may overlap already rendered events, so active-session consumers should reset, rebase, or deduplicate before continuing. sessions.readPersistedEvents has stricter snapshot semantics: 'expired' returns an empty terminal page and never switches to a replacement journal generation. Other persisted-read I/O failures are RPC errors with diagnostics, not cursor expiry.
     pub cursor_status: EventsCursorStatus,
     /// Session events for this batch, merged into a single stream in creation order: durable (persisted) events and ephemeral events interleave exactly as they were emitted. Set `includeEphemeral: false` to receive only durable events. Ephemeral events are never replayable once pruned from the in-memory ring, so a consumer that needs them should keep reading with a non-zero `waitMs`. For a backward (tail-first) read, the returned window contains persisted events only, still in chronological (oldest-to-newest) append order.
     pub events: Vec<SessionEvent>,
-    /// True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window.
+    /// True when more events are available in the read's direction. For a backward read, true means older persisted events remain before the returned window. A persisted-event page may contain fewer than `max` events because of its byte budget while still reporting hasMore true; continue according to this flag rather than the event count.
     pub has_more: bool,
 }
 
@@ -29437,6 +29635,9 @@ pub enum CatalogCapability {
     /// Understands plans that enumerate every eligible transport rather than a single preferred one.
     #[serde(rename = "multiple-transport-choice")]
     MultipleTransportChoice,
+    /// Understands versioned candidate trust snapshots. Protocol-3 callers must require this capability before the runtime adds the optional snapshot field.
+    #[serde(rename = "trust-snapshot")]
+    TrustSnapshot,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
@@ -29920,6 +30121,225 @@ pub enum CatalogSearchResult {
     Unavailable(CatalogUnavailableError),
 }
 
+/// Authority-computed exposure eligibility, kept separate from tier. The current tier-only Agent Finder response maps to `unknown`, never to a locally inferred eligibility.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogTrustEligibility {
+    /// Eligible for default catalogue exposure.
+    #[serde(rename = "default")]
+    Default,
+    /// Eligible only when expanded or community results are requested.
+    #[serde(rename = "expanded")]
+    Expanded,
+    /// Not eligible for normal catalogue exposure.
+    #[serde(rename = "hidden")]
+    Hidden,
+    /// The authority did not supply an eligibility decision.
+    #[serde(rename = "unknown")]
+    UnknownValue,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// Bounded authority that supplied a catalogue trust observation
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogTrustSource {
+    /// GitHub Agent Finder supplied the trust field on its search result.
+    #[serde(rename = "agent-finder")]
+    AgentFinder,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// Schema version of the catalogue trust snapshot envelope
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogTrustSnapshotSchemaVersion {
+    /// Initial envelope carrying one bounded service tier or one explicit unavailable state.
+    #[serde(rename = "v1")]
+    V1,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// The authority omitted trust metadata.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogTrustSnapshotAbsentStatus {
+    /// The authority omitted trust metadata.
+    #[serde(rename = "absent")]
+    Absent,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// A recognised T1 or T2 service tier was observed.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogTrustSnapshotCurrentStatus {
+    /// A recognised T1 or T2 service tier was observed.
+    #[serde(rename = "current")]
+    Current,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// Service-computed trust tier currently emitted by Agent Finder. It is independent of search score, popularity, and client-side ranking.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogTrustTier {
+    /// Tier one as assigned by the catalogue authority.
+    T1,
+    /// Tier two as assigned by the catalogue authority.
+    T2,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// The authority explicitly reported a downgraded assessment.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogTrustSnapshotDowngradedStatus {
+    /// The authority explicitly reported a downgraded assessment.
+    #[serde(rename = "downgraded")]
+    Downgraded,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// The trust field was empty, unbounded, or had the wrong JSON type.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogTrustSnapshotMalformedStatus {
+    /// The trust field was empty, unbounded, or had the wrong JSON type.
+    #[serde(rename = "malformed")]
+    Malformed,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// The authority explicitly revoked its assessment.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogTrustSnapshotRevokedStatus {
+    /// The authority explicitly revoked its assessment.
+    #[serde(rename = "revoked")]
+    Revoked,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// The authority explicitly marked its assessment stale.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogTrustSnapshotStaleStatus {
+    /// The authority explicitly marked its assessment stale.
+    #[serde(rename = "stale")]
+    Stale,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// The authority supplied a bounded trust value this runtime does not understand.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogTrustSnapshotUnsupportedStatus {
+    /// The authority supplied a bounded trust value this runtime does not understand.
+    #[serde(rename = "unsupported")]
+    Unsupported,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
 /// Discriminator: no usable transport is available
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub enum CatalogUnavailableTransportErrorKind {
@@ -30469,7 +30889,7 @@ pub enum EventsReadDirection {
     Unknown,
 }
 
-/// Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history (the beginning for a forward read, the tail for a backward read). The fallback page is a fresh boundary snapshot, not a continuation of the requested cursor, so it may overlap already-rendered events; on 'expired' a consumer should reset/rebase its pagination state (or deduplicate by event id) before continuing from the returned cursor.
+/// Cursor status: 'ok' means the read succeeded against the requested history; 'expired' means the requested continuation is unavailable. Recovery is endpoint-specific: session.eventLog.read returns a boundary window of remaining active history that may overlap prior pages, while sessions.readPersistedEvents returns an empty terminal page and never switches journal generations. An expired persisted read is not successful completion; a complete persisted snapshot requires cursorStatus 'ok' and hasMore false.
 ///
 /// <div class="warning">
 ///
@@ -30479,10 +30899,10 @@ pub enum EventsReadDirection {
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub enum EventsCursorStatus {
-    /// The cursor was applied successfully.
+    /// The read succeeded against the requested history.
     #[serde(rename = "ok")]
     Ok,
-    /// The cursor referred to history that is no longer available.
+    /// The requested continuation is unavailable; see the endpoint's recovery semantics.
     #[serde(rename = "expired")]
     Expired,
     /// Unknown variant for forward compatibility.
@@ -32978,34 +33398,6 @@ pub enum PermissionResponseCapability {
     Unknown,
 }
 
-/// Controlled reason or actor responsible for a permission response.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum PermissionDecisionSource {
-    /// The response followed the assisted-approval judge recommendation.
-    #[serde(rename = "assisted_approval")]
-    AssistedApproval,
-    /// A human supplied the response through an interactive prompt.
-    #[serde(rename = "human_response")]
-    HumanResponse,
-    /// The host applied a standing policy or override rather than a judge recommendation or human decision.
-    #[serde(rename = "host_policy")]
-    HostPolicy,
-    /// The host denied the request because no interactive user response was available.
-    #[serde(rename = "unattended_fallback")]
-    UnattendedFallback,
-    /// Unknown variant for forward compatibility.
-    #[default]
-    #[serde(other)]
-    Unknown,
-}
-
 /// Client surface that submitted a permission response.
 ///
 /// <div class="warning">
diff --git a/rust/src/generated/rpc.rs b/rust/src/generated/rpc.rs
index 789514b708..fd54f8dcb8 100644
--- a/rust/src/generated/rpc.rs
+++ b/rust/src/generated/rpc.rs
@@ -1983,7 +1983,7 @@ impl<'a> ClientRpcSessions<'a> {
         Ok(serde_json::from_value(_value)?)
     }
 
-    /// Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The initial backward read uses a bounded tail scan for fast first paint; cursor continuations preserve the session event-log paging semantics. Persisted events may omit payloads that are reconstructed only for an active session.
+    /// Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The first read pins the currently opened journal generation and its byte-length boundary; opaque cursor continuations remain on that generation across runtime-owned compaction, truncation, and rewrite operations, which replace the live path atomically, and events appended after the boundary are excluded. For cold hydration, await the first successful page before activation and establish lossless live-event buffering before resume; merge subsequent live events by ID, preserving persisted order and letting live payloads win. Continuations are process-local, single-use capabilities bound to the originating session and storage context and must be paged sequentially; concurrent or repeated use of the same cursor expires that duplicate read rather than reading the generation twice. A complete snapshot has cursorStatus 'ok' and hasMore false. Snapshots expire after five idle minutes, with at most eight retained per process and idle-only eviction under pressure; completion and cancelled-worker exit release their handles. No transcript copy is created, but retained handles may keep replaced files' disk blocks alive until release. Pages have a soft 1 MiB serialized event-array budget including resolved binary assets; one oversized event is returned alone to guarantee progress. Working memory also includes a record/lookahead and asset resolution; resolving the first binary reference may scan the full pinned generation to build a bounded offset index. If the snapshot expires, is evicted, is cancelled before a continuation is established, or becomes unreadable after an observable unsupported in-place shortening, the continuation returns cursorStatus 'expired' with an empty terminal page and never falls back to a different generation. A missing or initially unreadable journal is an RPC error. Persisted history excludes ephemeral events and may omit payloads that are reconstructed only for an active session; use the active session event stream for post-resume live events.
     ///
     /// Wire method: `sessions.readPersistedEvents`.
     ///
@@ -5351,7 +5351,7 @@ impl<'a> SessionRpcFleet<'a> {
     ///
     /// # Parameters
     ///
-    /// * `params` - Optional user prompt to combine with the fleet orchestration instructions.
+    /// * `params` - Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.
     ///
     /// # Returns
     ///
diff --git a/rust/src/generated/session_events.rs b/rust/src/generated/session_events.rs
index 611f04d40f..05e3590043 100644
--- a/rust/src/generated/session_events.rs
+++ b/rust/src/generated/session_events.rs
@@ -267,6 +267,42 @@ pub enum SessionEventType {
     PermissionRequested,
     #[serde(rename = "permission.completed")]
     PermissionCompleted,
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(rename = "permission.carriedForward")]
+    PermissionCarriedForward,
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(rename = "permission.messageAuthorization")]
+    PermissionMessageAuthorization,
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(rename = "permission.messageAuthorizationRead")]
+    PermissionMessageAuthorizationRead,
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(rename = "permission.messageAuthorizationDegraded")]
+    PermissionMessageAuthorizationDegraded,
     #[serde(rename = "user_input.requested")]
     UserInputRequested,
     #[serde(rename = "user_input.completed")]
@@ -721,6 +757,42 @@ pub enum SessionEventData {
     PermissionRequested(PermissionRequestedData),
     #[serde(rename = "permission.completed")]
     PermissionCompleted(PermissionCompletedData),
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(rename = "permission.carriedForward")]
+    PermissionCarriedForward(PermissionCarriedForwardData),
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(rename = "permission.messageAuthorization")]
+    PermissionMessageAuthorization(PermissionMessageAuthorizationData),
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(rename = "permission.messageAuthorizationRead")]
+    PermissionMessageAuthorizationRead(PermissionMessageAuthorizationReadData),
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(rename = "permission.messageAuthorizationDegraded")]
+    PermissionMessageAuthorizationDegraded(PermissionMessageAuthorizationDegradedData),
     #[serde(rename = "user_input.requested")]
     UserInputRequested(UserInputRequestedData),
     #[serde(rename = "user_input.completed")]
@@ -3538,6 +3610,9 @@ pub struct ToolExecutionStartData {
     /// Original tool name on the MCP server, when the tool is an MCP tool
     #[serde(skip_serializing_if = "Option::is_none")]
     pub mcp_tool_name: Option<String>,
+    /// Transport the MCP server hosting this tool is connected over, when the tool is an MCP tool and the server is configured
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mcp_transport: Option<McpServerTransport>,
     /// Model identifier that generated this tool call
     #[serde(skip_serializing_if = "Option::is_none")]
     pub model: Option<String>,
@@ -4506,6 +4581,26 @@ pub struct PermissionRequestShell {
     /// True when the requested escalation is a permissive retry rather than a full bypass: the command re-runs inside the sandbox with its file and process restrictions recording instead of blocking, while the network policy stays enforced. Always accompanied by requestSandboxBypass, so hosts that do not recognize this field still treat the request as the escalation it is. Hosts that do recognize it must not describe the command as running outside the sandbox, which would overstate the privilege being granted.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub request_sandbox_permissive: Option<bool>,
+    /// Runtime-resolved canonical object each possiblePaths entry names, keyed by the requested spelling, used for authorization identity checks. Internal and experimental; clients should continue to display possiblePaths.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub resolved_paths: Option<HashMap<String, String>>,
+    /// Runtime-resolved canonical working directory the command runs in, used for authorization identity checks. Internal and experimental; clients should not display it.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub resolved_working_directory: Option<String>,
     /// Tool call ID that triggered this permission request
     #[serde(skip_serializing_if = "Option::is_none")]
     pub tool_call_id: Option<String>,
@@ -4540,6 +4635,16 @@ pub struct PermissionRequestWrite {
     /// Justification for the sandbox-bypass request. Only meaningful when requestSandboxBypass is true.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub request_sandbox_bypass_reason: Option<String>,
+    /// Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display fileName.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub resolved_path: Option<String>,
     /// Tool call ID that triggered this permission request
     #[serde(skip_serializing_if = "Option::is_none")]
     pub tool_call_id: Option<String>,
@@ -4564,6 +4669,16 @@ pub struct PermissionRequestRead {
     /// What the tool tells the user about the bypass on offer: which policy rule blocked the call, or why it cannot be sandboxed. Only meaningful when requestSandboxBypass is true.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub request_sandbox_bypass_reason: Option<String>,
+    /// Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display path.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub resolved_path: Option<String>,
     /// Tool call ID that triggered this permission request
     #[serde(skip_serializing_if = "Option::is_none")]
     pub tool_call_id: Option<String>,
@@ -4938,6 +5053,16 @@ pub struct PermissionPromptRequestWrite {
     /// Complete new file contents for newly created files
     #[serde(skip_serializing_if = "Option::is_none")]
     pub new_file_contents: Option<String>,
+    /// Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display fileName.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub resolved_path: Option<String>,
     /// Tool call ID that triggered this permission request
     #[serde(skip_serializing_if = "Option::is_none")]
     pub tool_call_id: Option<String>,
@@ -4966,6 +5091,16 @@ pub struct PermissionPromptRequestRead {
     pub managed_approval_required: Option<bool>,
     /// Path of the file or directory being read
     pub path: String,
+    /// Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display path.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub resolved_path: Option<String>,
     /// Tool call ID that triggered this permission request
     #[serde(skip_serializing_if = "Option::is_none")]
     pub tool_call_id: Option<String>,
@@ -5551,6 +5686,16 @@ pub struct PermissionDeniedByPermissionRequestHook {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PermissionCompletedData {
+    /// Who decided this permission request. Absent on completions recorded before this field existed, which consumers must treat as "not a human decision" rather than assuming one. Authorization records are minted only for `human_response`; an assisted-approval verdict, a host policy, an unattended fallback, and a hook resolution all produce the same `result` a person does, so this is the only field that distinguishes them.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub decision_source: Option<PermissionDecisionSource>,
     /// Request ID of the resolved permission request; clients should dismiss any UI for this request
     pub request_id: RequestId,
     /// The result of the permission request
@@ -5560,6 +5705,196 @@ pub struct PermissionCompletedData {
     pub tool_call_id: Option<String>,
 }
 
+/// Session event "permission.carriedForward". Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PermissionCarriedForwardData {
+    /// Always `authorization_carry_forward`. Stated explicitly so a consumer reading this event cannot mistake it for a human, host-policy, or assisted-approval decision.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    pub decision_source: PermissionDecisionSource,
+    /// Identity of the prior authorization record that contained the proposal.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    pub record_id: String,
+    /// Authorization edge minted for this admission. Not a prompt id: no prompt was raised, so no client should expect a request with this id.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    pub request_id: RequestId,
+    /// Tool call this admission authorizes. Its execution receipts the prior grant, which is how a single-effect approval is spent rather than carried forward again.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    pub tool_call_id: String,
+}
+
+/// Session event "permission.messageAuthorization". Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PermissionMessageAuthorizationData {
+    /// The kind of effect authorized, as an action-class identifier.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    pub action_class: String,
+    /// Whether the claim granted or denied authority.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    pub polarity: PermissionMessageAuthorizationPolarity,
+    /// Deterministic identity of the record, derived from the turn and span offsets so re-extracting the same span mints nothing new.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    pub record_id: String,
+    /// End byte offset of the authorizing span within the turn.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    pub span_end: i64,
+    /// Start byte offset of the authorizing span within the turn.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    pub span_start: i64,
+    /// Concrete named targets that appear verbatim inside the span.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub target_members: Option<Vec<String>>,
+    /// The task the permission is scoped to, when the human named one.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task: Option<String>,
+    /// The human turn the quoted span was read from.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    pub turn_index: i64,
+    /// The trusted version discriminator, when one exists. Exact shell-command grants carry the byte-identical commands grounded in the human span; world-derived classes carry a file object, remote tip, or runner only when that state was captured safely. An opaque object mirroring the runtime's adjacently-tagged resolution.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub world: Option<serde_json::Value>,
+}
+
+/// Session event "permission.messageAuthorizationRead". Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PermissionMessageAuthorizationReadData {
+    /// The human turn that was read by the proposer.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    pub turn_index: i64,
+}
+
+/// Session event "permission.messageAuthorizationDegraded". Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PermissionMessageAuthorizationDegradedData {
+    /// The human turn that could not be represented safely.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    pub turn_index: i64,
+}
+
 /// Session event "user_input.requested". User input request notification with question and optional predefined choices
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -7584,6 +7919,27 @@ pub enum AbortReason {
     Unknown,
 }
 
+/// Transport mechanism: stdio, http, sse (deprecated), or memory (in-process MCP server)
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum McpServerTransport {
+    /// Server communicates over stdio with a local child process.
+    #[serde(rename = "stdio")]
+    Stdio,
+    /// Server communicates over streamable HTTP.
+    #[serde(rename = "http")]
+    Http,
+    /// Server communicates over Server-Sent Events (deprecated).
+    #[serde(rename = "sse")]
+    Sse,
+    /// Server is backed by an in-memory runtime implementation.
+    #[serde(rename = "memory")]
+    Memory,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
 /// Allowed values for the `ToolExecutionStartToolDescriptionMetaUIVisibility` enumeration.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub enum ToolExecutionStartToolDescriptionMetaUIVisibility {
@@ -8274,6 +8630,30 @@ pub enum PermissionPromptRequest {
     ExtensionEnvAccess(PermissionPromptRequestExtensionEnvAccess),
 }
 
+/// Controlled reason or actor responsible for a permission response.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum PermissionDecisionSource {
+    /// The response followed the assisted-approval judge recommendation.
+    #[serde(rename = "assisted_approval")]
+    AssistedApproval,
+    /// A human supplied the response through an interactive prompt.
+    #[serde(rename = "human_response")]
+    HumanResponse,
+    /// The host applied a standing policy or override rather than a judge recommendation or human decision.
+    #[serde(rename = "host_policy")]
+    HostPolicy,
+    /// The host denied the request because no interactive user response was available.
+    #[serde(rename = "unattended_fallback")]
+    UnattendedFallback,
+    /// A live authorization record from an earlier human decision in this session contained the proposal, so it ran without another prompt. This is not a new human decision and never mints authority of its own.
+    #[serde(rename = "authorization_carry_forward")]
+    AuthorizationCarryForward,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
 /// The permission request was approved
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub enum PermissionApprovedKind {
@@ -8459,6 +8839,28 @@ pub enum PermissionResult {
     DeniedByPermissionRequestHook(PermissionDeniedByPermissionRequestHook),
 }
 
+/// Which direction a message-backed authorization claim moves authority in.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum PermissionMessageAuthorizationPolarity {
+    /// The human's words authorized an effect.
+    #[serde(rename = "grant")]
+    Grant,
+    /// The human's words refused an effect.
+    #[serde(rename = "denial")]
+    Denial,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
 /// Elicitation mode; "form" for structured input, "url" for browser-based. Defaults to "form" when absent.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub enum ElicitationRequestedMode {
@@ -8878,27 +9280,6 @@ pub enum McpServerStatus {
     Unknown,
 }
 
-/// Transport mechanism: stdio, http, sse (deprecated), or memory (in-process MCP server)
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpServerTransport {
-    /// Server communicates over stdio with a local child process.
-    #[serde(rename = "stdio")]
-    Stdio,
-    /// Server communicates over streamable HTTP.
-    #[serde(rename = "http")]
-    Http,
-    /// Server communicates over Server-Sent Events (deprecated).
-    #[serde(rename = "sse")]
-    Sse,
-    /// Server is backed by an in-memory runtime implementation.
-    #[serde(rename = "memory")]
-    Memory,
-    /// Unknown variant for forward compatibility.
-    #[default]
-    #[serde(other)]
-    Unknown,
-}
-
 /// Discovery source
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub enum ExtensionsLoadedExtensionSource {
diff --git a/scripts/codegen/rust.ts b/scripts/codegen/rust.ts
index b3cc5d5753..776f468495 100644
--- a/scripts/codegen/rust.ts
+++ b/scripts/codegen/rust.ts
@@ -85,6 +85,12 @@ const STRING_NEWTYPE_OVERRIDES: Record<string, string> = {
 	requestId: "RequestId",
 };
 
+const STRING_ENUM_VARIANT_OVERRIDES: Record<string, Record<string, string>> = {
+	CatalogTrustEligibility: {
+		unknown: "UnknownValue",
+	},
+};
+
 // ── Naming helpers ──────────────────────────────────────────────────────────
 
 function toPascalCase(s: string): string {
@@ -115,8 +121,9 @@ function uniqueRustPascalIdentifier(
 	used: Set<string>,
 	fallback: string,
 	reserved: Set<string> = new Set(),
+	override?: string,
 ): string {
-	const identifier = toRustPascalIdentifier(value, fallback);
+	const identifier = override ?? toRustPascalIdentifier(value, fallback);
 	if (used.has(identifier) || reserved.has(identifier)) {
 		throw new Error(
 			`Generated Rust enum variant identifier "${identifier}" is not unique for value "${value}". Add an explicit naming rule instead of stabilizing an arbitrary public variant name.`,
@@ -1045,6 +1052,7 @@ function emitRustStringEnum(
 			usedVariantNames,
 			"Value",
 			reservedVariantNames,
+			STRING_ENUM_VARIANT_OVERRIDES[enumName]?.[value],
 		);
 		pushRustDoc(lines, enumValueDescriptions?.[value], "    ");
 		if (variantName !== value) {