SaladDay · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026
diff --git a/contracts/agents-api/admin-api.md b/contracts/agents-api/admin-api.md
@@ -133,7 +133,7 @@ After an uncertain `POST` response, `GET` the archive before writing again. Repe
 
 ## Execution configuration
 
-`GET /projects/{project_id}/sessions/{session_id}/execution-configuration` reports the model, Harness, native parameters and model provider a Session froze at creation. It reads only stored configuration: it never contacts a provider, starts a Turn or wakes a sandbox. Responses carry `Cache-Control: no-store`.
+`GET /projects/{project_id}/sessions/{session_id}/execution-configuration` reports the Session's current model, and the Harness, native parameters and model provider it froze at creation. A model changed by a Session update reads with source `session`. It reads only stored configuration: it never contacts a provider, starts a Turn or wakes a sandbox. Responses carry `Cache-Control: no-store`.
 
 ```json
 {

diff --git a/contracts/agents-api/harness-capabilities.md b/contracts/agents-api/harness-capabilities.md
@@ -27,6 +27,8 @@ Placements are `none` (no Environment), hosted (`openai_hosted`) and self-hosted
 | `reasoning.summary` | `concise`, `detailed`, `auto`: admitted | `auto`: admitted | Rejected |
 | `service_tier` other than `auto` | `default`, `flex`, `priority`, `fast`: admitted; `ultrafast` rejected | Rejected | Rejected |
 | `text.verbosity` other than `medium` | Admitted; the native model decides | Rejected | Rejected |
+| Session update of `agent.model`, `reasoning.effort` (including null), `service_tier` and `review: auto_review` | Rejected | Rejected | Rejected |
+| Session update of `agent.tools` | Rejected | Rejected | Rejected |
 | `compaction.async: true`, `experimental.time_awareness: true` and the `automations` and `computer_use` tools | Rejected | Rejected | Rejected |
 | [Public token usage](./sessions-events.md) | Measured counters | Null | Null |
 

diff --git a/contracts/agents-api/harness-onboarding.md b/contracts/agents-api/harness-onboarding.md
@@ -184,7 +184,8 @@ The declaration holds:
 - the model `Configuration` ([native model configuration](#native-model-configuration));
 - `Capabilities`, a `proto.AgentKindCapabilities` that states the most the Harness can do on a capable host, with every field `Supported` or `Unsupported` and the zero value invalid ([Capability declarations](../../docs/runtime-protocol.md#capability-declarations));
 - the supported `Placements` and public `MCPOrigins`, whether whitespace-only text is accepted, and `MaxInstructionsBytes`, the native byte limit on an Agent's instructions (zero declares none), which admission rejects above;
-- `Execution`, the official execution option values the adapter maps to native settings: web search modes and whether search settings are accepted, reasoning efforts and summaries, service tiers, programmatic-tool-calling values and text verbosities. Core admission and the Runtime reject an undeclared value with the same check ([tool policy](./execution-tools.md#web-search-and-programmatic-tool-calling)). Core always sends the official default text verbosity, so `TextVerbosities` must include `medium`;
+- `Execution`, the official execution option values the adapter maps to native settings: web search modes and whether search settings are accepted, reasoning efforts and summaries, service tiers, programmatic-tool-calling values and text verbosities. Core admission and the Runtime reject an undeclared value with the same check ([tool policy](./execution-tools.md#web-search-and-programmatic-tool-calling)). Core always sends the official default text verbosity, so `TextVerbosities` must include `medium`. `Reviews` lists the supported `review` values other than `none` (only `auto_review`);
+- `SessionUpdates`, whether the adapter applies a Session update natively between root Turns of a retained Executor: `Model`, `ReasoningEffort`, `ReasoningEffortReset` (null effort) and `ServiceTier`, each `Supported` or `Unsupported`. Core rejects an update that changes an unsupported setting, and a change to a supported one reaches the adapter in the next Turn's settings;
 - optional pure restrictions, `ValidateConfiguration`, `ValidateTools`, `ValidateMessageInput` and `ValidateFunctionResult`, that add native limits to the common checks. `ValidateMessageInput` runs only for messages that carry images, after the `MessageImages` capability check and before anything is stored, and decides which `image_url` values the Harness accepts; Core checks only that the reference is not blank. A nil validator means the common checks suffice. They cannot query business data, decrypt credentials or control native processes. Configuration restrictions run first, and a tool-decoding error precedes `ValidateTools`.
 
 `harnessconfig.NewRegistry` validates every declaration and panics on an invalid or duplicate one: kinds and labels must be nonempty, placements must list at least one supported placement, MCP origins must be a non-nil list, unknown or duplicate choices and origins without a corresponding placement are rejected, bearer support requires an MCP origin, and `Execution` must declare text verbosity `medium`. Shared dispatch checks capability combinations, never engine names.

diff --git a/contracts/agents-api/index.md b/contracts/agents-api/index.md
@@ -27,7 +27,7 @@ Evidence for a status comes from the pinned official SDK and raw HTTP against th
 | Resource | Operations | Status | Contract |
 | --- | --- | --- | --- |
 | Agents | create, retrieve, update, list, delete | Implemented. Every pinned setting is saved; Session admission runs a subset | [Agents](./wire-semantics.md#agents) |
-| Sessions | create (JSON or stream), retrieve, update, list, delete | Implemented. Update takes `metadata` only and `agent` is rejected; list filters on `metadata[key]=value`; deletion requires an idle or failed Session | [Sessions](./wire-semantics.md#sessions), [creation streaming](./sessions-events.md#creation-streaming) |
+| Sessions | create (JSON or stream), retrieve, update, list, delete | Implemented. Update takes `metadata`, `agent.model`, `agent.reasoning`, `agent.service_tier` and `review`, and rejects `agent.tools`; list filters on `metadata[key]=value`; deletion requires an idle or failed Session | [Sessions](./wire-semantics.md#sessions), [creation streaming](./sessions-events.md#creation-streaming) |
 | Session events | create, stream | Partial: messages with text and images, cancellation, function results; the stream is live only | [Sessions, events and history](./sessions-events.md), [message content](./message-content.md) |
 | Turns | retrieve, list; Turn Items | Implemented; Session Turn routes hold root Turns only | [Turns and Items](./sessions-events.md#turns-and-items) |
 | Items | list | Partial: messages, commands, MCP calls, functions, web search, reasoning and Subagent coordination Items; other native variants are not projected | [Turns and Items](./sessions-events.md#turns-and-items) |
@@ -146,6 +146,7 @@ Each item is Core's deliberate or native behavior where the official service beh
 - `compaction.async: true`, `experimental.time_awareness: true` and the `automations` and `computer_use` tools are saved but rejected at Session admission for every Harness, because none runs them natively ([Session admission](./wire-semantics.md#session-admission)).
 - Harness support for tools, structured output, deferred discovery, subagents and MCP differs by Harness and placement; see the [Harness capabilities](./harness-capabilities.md). MiniMax Code has no image input and accepts at most 32 KiB of `instructions`.
 - Model-derived reasoning defaults are not resolved.
+- A Session update that changes `agent.model`, `agent.reasoning.effort`, `agent.service_tier` or `review` is rejected when the Harness cannot apply it natively between Turns ([Harness capabilities](./harness-capabilities.md#execution-and-input)).
 
 **Execution and history**
 
@@ -185,12 +186,15 @@ Each item is Core's deliberate or native behavior where the official service beh
 
 **Sessions**
 
+- A Session update rejects `agent.tools`, because no Harness changes its tools after it starts.
 - The pinned SDK sends `spend_control` on Session create and update, but the pinned OpenAPI schema does not define it; Core rejects it as an unknown parameter.
 - Session deletion does not purge the stored history physically.
 - Stream lifetimes for `self_hosted`, hosted and no-input creation, and the creation-stream retry, are Core's own choices.
 
 ### Unverified against the official service
 
+- When a Session update binds to a queued Turn: Core binds each root Turn's settings when it accepts the input that creates the Turn, so a Turn queued before an update keeps the earlier values.
+- The meaning of "automatic review is not enabled" in a Session response: Core omits `review` unless it is `auto_review`.
 - The order of errors when one request has several faults, and error, default and payload-limit parity in general.
 - A Subagent's function call: Core makes it a required action of the root Turn that runs the child, with `turn_id` set to that Turn, and publishes the child's `function_call` Item once as `agent.session.turn.item.added` with the child Turn ID and a null `output_index`; a result may name either Turn. The Turn is `waiting` and the Session `requires_action` while root output may continue, and the `call_id` equals the `call_id` of the child's `function_call` Item. Claude Code publishes the child's Items when the root Turn settles, after the required action.
 - Whether the official service emits Environment `pending` and when: Core emits it when a hosted Environment's initialization starts, and the one official sample showed only `ready`, about 29 s after creation.

diff --git a/contracts/agents-api/model-execution.md b/contracts/agents-api/model-execution.md
@@ -117,7 +117,7 @@ Claude `thinking` accepts `display` (`summarized` or `omitted`) for `adaptive` a
 
 A supplied object replaces the whole object; `{}` clears it and null is invalid. A Session that selects a model or provider without supplying native parameters uses `{}` instead of inheriting another model's parameters. Otherwise a saved Agent supplies its object, and an inline Session using the deployment model uses the deployment object. Changing the Harness clears inherited parameters, and so does an Agent update of model, provider or Harness that does not supply `harness_config`. There is no deep merge. An inline extension that sets only native parameters keeps the saved Harness.
 
-Core validates the resolved configuration before writing the Session and freezes it in the Session's Agent configuration; the administrator execution-configuration read shows its value and source. Native parameters are not confidential; provider keys stay in the separate encrypted bundle. Reconnection uses the frozen configuration and cannot change the provider, protocol or parameters; an incompatible frozen configuration fails. Protocol support does not qualify structured output, tool discovery, web search, verbosity or image input by itself, and a supported connection does not prove that the remote model accepts a parameter.
+Core validates the resolved configuration before writing the Session and freezes it in the Session's Agent configuration; the administrator execution-configuration read shows its value and source. Native parameters are not confidential; provider keys stay in the separate encrypted bundle. A Session update can change the model for later Turns; the provider, protocol and native parameters stay frozen. Reconnection uses the frozen configuration and cannot change the provider, protocol or parameters; an incompatible frozen configuration fails. Protocol support does not qualify structured output, tool discovery, web search, verbosity or image input by itself, and a supported connection does not prove that the remote model accepts a parameter.
 
 ## Deployment defaults
 

diff --git a/contracts/agents-api/wire-semantics.md b/contracts/agents-api/wire-semantics.md
@@ -195,8 +195,7 @@ These official fields have no Core meaning. A request that sets one returns 400
 
 | Field | Param |
 | --- | --- |
-| Session update `agent` with any member; `{}` changes nothing | `agent` |
-| Session `review: auto_review` on create or update; `none` is accepted and responses omit `review` | `review` |
+| Session update `agent.tools` | `agent.tools` |
 | `environment.environment_id` | `environment_id` |
 | `environment.container_size`; responses carry `container_size: null` | `container_size` |
 | `desktop.enabled: true`; responses carry `desktop: {"enabled": false}` | `desktop.enabled` |
@@ -212,6 +211,7 @@ A Session's effective configuration must also pass execution admission, which ap
 | --- | --- |
 | A `reasoning.effort`, `reasoning.summary`, `service_tier` (including `ultrafast`), `web_search` mode or setting, `programmatic_tool_calling` value or `text.verbosity` the Harness does not declare | A message naming the field, such as `reasoning.effort "max" is not supported by this Harness.`; see [tool policy](./execution-tools.md#web-search-and-programmatic-tool-calling) and [Harness capabilities](./harness-capabilities.md#execution-and-input) |
 | `compaction.async: true`, `experimental.time_awareness: true`, or an `automations` or `computer_use` tool, on every Harness, since none runs them natively | A message naming the field, such as `compaction.async=true is not supported.` |
+| A `review: auto_review` the Harness does not declare, on create or update; `none` is always accepted and responses omit it | A message naming the field, such as `review "auto_review" is not supported by this Harness.` |
 | A function name that is blank or repeated | "Function names must be nonempty and unique." |
 | A Harness that does not declare `retained_native_history`, on a sandbox provider that keeps every Environment on workspace storage ([Harness capabilities](./harness-capabilities.md)) | "This Session's harness does not retain its native history, which the sandbox provider's workspace storage requires. Use a harness that supports retained_native_history, or a sandbox provider with its own disk." |
 
@@ -231,7 +231,7 @@ Omitted, null and explicit `medium` text verbosity give the same Session configu
 
 ### Configuration snapshot
 
-Session creation copies the effective Agent configuration into an immutable snapshot. With `agent_id`, the saved Agent is read once; fields in the inline `agent` replace the saved field whole, including arrays, and null `tools` clears the list. Omitted fields inherit; an inline `x_agents_core` that omits `harness` keeps the saved Harness. Saved Agent metadata never becomes Session metadata. Later Agent updates or deletion affect only new Sessions.
+Session creation copies the effective Agent configuration into an immutable snapshot. With `agent_id`, the saved Agent is read once; fields in the inline `agent` replace the saved field whole, including arrays, and null `tools` clears the list. Omitted fields inherit; an inline `x_agents_core` that omits `harness` keeps the saved Harness. Saved Agent metadata never becomes Session metadata. Later Agent updates or deletion affect only new Sessions. The snapshot changes only through a Session update, and each root Turn takes the settings current when Core accepts the input that creates it.
 
 `stream` defaults to false. `stream` and `agent_id` cannot be null. Omitted or null `metadata` is `{}`.
 
@@ -251,7 +251,9 @@ Keys are scoped to the Project; any key of the Project, including one issued aft
 
 ### Update and list
 
-`POST /agents/sessions/{session_id}` changes only `metadata`: null or `{}` clears it and an object replaces all pairs. A body with only `review` or an empty `agent` changes nothing and returns the Session; a body with none of `metadata`, `agent` or `review` returns 400. An `agent` with members is rejected ([unsupported fields](#unsupported-fields)). Execution state and the creation retry identity are unchanged.
+`POST /agents/sessions/{session_id}` applies only the members present, in one transaction, and returns the Session. `metadata` null or `{}` clears it and an object replaces all pairs. `agent.model`, `agent.reasoning.effort` (null selects the model's default), `agent.service_tier` (null becomes `auto`) and `review` change the snapshot for Turns whose input is accepted later; a Turn that already exists, with its Subagents, keeps its settings. `agent.tools` is rejected ([unsupported fields](#unsupported-fields)). An empty `agent` changes nothing, and a body with none of `metadata`, `agent` or `review` returns 400.
+
+A changed value that the Harness does not declare it applies natively between Turns, or a `review` it does not declare, returns 400 `unsupported_or_invalid_configuration` naming the field, and nothing is written. An unchanged value always passes. The creation retry identity is unchanged.
 
 `GET /agents/sessions` accepts `agent_id`, which matches the Session's immutable root Agent ID, including inline Agent IDs and Agents that were since updated or deleted. The filter applies before pagination; an empty `agent_id` is a filter, not an omission. The [`metadata` filter](#query-parameters) applies too.
 

diff --git a/contracts/agents-api/zh/admin-api.md b/contracts/agents-api/zh/admin-api.md
@@ -1,7 +1,7 @@
 ---
 title: "Core 管理 API"
 source: contracts/agents-api/admin-api.md
-source_hash: 664b5d01759bf29735e4e062739843b48c8130b302002b7a3c0e53b2306e7057
+source_hash: 32e834142d199c6ba6ec276e6cd4365c551235e9d2233d296f3f18ab90e86046
 ---
 
 Core 管理 API（`/core/v1`）用于管理安装实例：项目及其 API 密钥、项目资源的读取和删除、执行器凭据、部署默认模型、沙箱部署及其节点、监控和审计。Web 的[控制台服务器](../../../docs/zh/web/console-server.md#forwarding-to-core)会为已登录的管理员调用它；运维人员则从 Core 主机上的脚本调用它（[编写 Core API 脚本](../../../docs/zh/getting-started/operations.md#script-the-core-api)）。生成的架构是 [core.openapi.yaml](../core.openapi.yaml)，所有错误都使用 [Core 错误封装](core-errors.md)。
@@ -135,7 +135,7 @@ GET 返回所选配置和租户容量策略；尚未配置时返回 404 `workspa
 
 ## 执行配置 {#execution-configuration}
 
-`GET /projects/{project_id}/sessions/{session_id}/execution-configuration` 报告 Session 在创建时冻结的模型、Harness、原生参数和模型提供商。它仅读取已存储的配置：绝不会联系提供商、启动 Turn 或唤醒沙箱。响应带有 `Cache-Control: no-store`。
+`GET /projects/{project_id}/sessions/{session_id}/execution-configuration` 报告 Session 当前的模型，以及它在创建时冻结的 Harness、原生参数和模型提供商。经 Session 更新改变的模型，其来源读为 `session`。它仅读取已存储的配置：绝不会联系提供商、启动 Turn 或唤醒沙箱。响应带有 `Cache-Control: no-store`。
 
 ```json
 {

diff --git a/contracts/agents-api/zh/harness-capabilities.md b/contracts/agents-api/zh/harness-capabilities.md
@@ -1,7 +1,7 @@
 ---
 title: "Harness 能力"
 source: contracts/agents-api/harness-capabilities.md
-source_hash: f83d80711825f65c897822f172f3a979f3e996eb864355f18f128751575f810d
+source_hash: 97c83c3295b7150e81118d5fa302463b7781689e533d8906ce1b85baa26b54af
 ---
 
 本页列出每个 Harness 在每种部署位置支持的能力。Core 根据 `internal/harnessconfig/<package>/declaration.go` 中 Harness 的声明决定准入，运行 Session 的 Runtime 也必须声明操作。所链接契约定义各操作；[Harness 接入](harness-onboarding.md#qualify-the-adapter)说明资格验证方法。
@@ -29,6 +29,8 @@ source_hash: f83d80711825f65c897822f172f3a979f3e996eb864355f18f128751575f810d
 | `reasoning.summary` | `concise`、`detailed`、`auto`：已准入 | `auto`：已准入 | 已拒绝 |
 | 非 `auto` 的 `service_tier` | `default`、`flex`、`priority`、`fast`：已准入；`ultrafast` 已拒绝 | 已拒绝 | 已拒绝 |
 | 非 `medium` 的 `text.verbosity` | 已准入；由原生模型决定 | 已拒绝 | 已拒绝 |
+| Session 更新 `agent.model`、`reasoning.effort`（含 null）、`service_tier` 和 `review: auto_review` | 已拒绝 | 已拒绝 | 已拒绝 |
+| Session 更新 `agent.tools` | 已拒绝 | 已拒绝 | 已拒绝 |
 | `compaction.async: true`、`experimental.time_awareness: true`，以及 `automations` 和 `computer_use` 工具 | 已拒绝 | 已拒绝 | 已拒绝 |
 | [公开 token 用量](sessions-events.md) | 测量计数器 | Null | Null |
-Original file line number
+Diff line change
@@ Expand Up @@
     ## Execution configuration
-    `GET /projects/{project_id}/sessions/{session_id}/execution-configuration` reports the model, Harness, native parameters and model provider a Session froze at creation. It reads only stored configuration: it never contacts a provider, starts a Turn or wakes a sandbox. Responses carry `Cache-Control: no-store`.
+    `GET /projects/{project_id}/sessions/{session_id}/execution-configuration` reports the Session's current model, and the Harness, native parameters and model provider it froze at creation. A model changed by a Session update reads with source `session`. It reads only stored configuration: it never contacts a provider, starts a Turn or wakes a sandbox. Responses carry `Cache-Control: no-store`.
     ```json
     {
@@ Expand Down @@