diff --git a/AGENTS.md b/AGENTS.md
index 8f55e61..7887048 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -47,6 +47,9 @@ test/fmsg-docker.e2e.test.ts   real two-host run, gated by FMSG_E2E=1
 - Every tool returns concise Markdown in `content[0].text` **and** `structuredContent` matching its
   `outputSchema`. Failures are `isError: true` results built by `src/errors.ts`, never thrown past
   the handler.
+- Output schemas stay open because hosts cache them: build every output object with `outputObject`,
+  type values that may grow with `openEnum` (never `z.enum`/`z.literal`), add new fields as optional,
+  and never remove or rename one. `test/output-schemas.test.ts` enforces this.
 - Irreversible send-type tools carry `destructiveHint: true`; reversible reactions use
   `destructiveHint: false` and `idempotentHint: true`. Read tools use `readOnlyHint: true`.
 - Outbound bodies/topics and every error string pass through `redactSecrets`. Never log an API key;
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2b94659..5ff9161 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,24 @@
 
 ## Unreleased
 
+- Tool output schemas are open and additive, so hosts that cache a tool's `outputSchema` when the
+  connector is added keep validating results after upgrades. Every output object, at every depth,
+  accepts unknown properties (no `additionalProperties: false`); values that may grow (statuses,
+  transports, resolutions, delivery `status` and `via`, skip reasons, `authentication`) are strings
+  with their current values in the description instead of enums; and only fields present since
+  0.2.5 are required, so fields added later are optional in the schema though still returned.
+  Schemas published by 0.2.6 and earlier were closed, so hosts that cached one reject results with
+  newer fields ("must NOT have additional properties") until the connector is reconnected once;
+  no server change can fix an already-cached closed schema.
+- `whoami` again matches its 0.2.5 shape: `transport` is `stdio` or `http` (0.2.6 reported
+  `streamable-http`; the text still says Streamable HTTP) and `directory_names` is always present,
+  empty when there is no directory. Hosts holding 0.2.5 schemas validate `whoami`,
+  `resolve_address`, `mark_read` and `react` again. Hosts that cached 0.2.6 schemas validate every
+  tool except `whoami` over HTTP, which needs the one-time reconnect.
+- Tests check that no published output schema is closed or uses `enum`/`const`, that required
+  fields match 0.2.5, and that representative results of every tool validate against the
+  published schemas and against the 0.2.5 schemas apart from unknown properties.
+
 - Graceful shutdown. On SIGINT/SIGTERM or `HttpServerHandle.close()`, in-flight `wait_for_message`
   calls return at once with the new status `interrupted`, the caller's `after_id` and a `next`
   step ("call again with the same after_id; no messages are lost") instead of hanging until the
@@ -34,9 +52,8 @@
   count as pending rather than failed.
 - List items add `reaction` (the emoji when the item is itself a reaction). Hidden reactions never
   count as unread; `mark_read` accepts listed ones.
-- `whoami` reports `transport` as `stdio` or `streamable-http` (was `http`), says "connected over
-  Streamable HTTP", and no longer states the token expiry in its text; `token_expires_at` stays in
-  the structured result, described as internal. `directory_names` is omitted when empty.
+- `whoami` says "connected over Streamable HTTP" and no longer states the token expiry in its
+  text; `token_expires_at` stays in the structured result, described as internal.
   `resolve_address`'s description names only the resolution steps the operator configured.
 - Descriptions and errors mention `save_attachment` and `get_attachment_download_url` only where
   those tools are registered. The server instructions now state that other fmsg tools or local
diff --git a/README.md b/README.md
index 743251b..01b4c6e 100644
--- a/README.md
+++ b/README.md
@@ -128,7 +128,7 @@ See the [TLS reverse-proxy example](docs/http-deployment.md) for a loopback depl
 
 | Tool | What it does |
 |---|---|
-| `whoami` | The address this server acts as, the public API URL (when known), the transport (`stdio` or `streamable-http`) and short-name defaults |
+| `whoami` | The address this server acts as, the public API URL (when known), the transport (`stdio` or `http`, which is Streamable HTTP) and short-name defaults |
 | `resolve_address` | Turn a short name into `@user@domain` (directory, then default domain) |
 | `list_messages` | Inbox, newest first, with previews and attachment types; reactions hidden and never counted as unread unless `include_reactions` |
 | `list_sent` | Sent messages with per-recipient delivery state |
@@ -151,6 +151,16 @@ other parties' words repeat that in `untrusted_content_notice`, since some hosts
 structured result instead of the text. Attachment types come from the host when it recorded one,
 otherwise from the filename extension, so every tool reports the same type.
 
+### Output schema compatibility
+
+Some MCP hosts cache each tool's `outputSchema` when the connector is added and validate every later
+result against that copy. Output schemas are therefore open and additive: objects accept unknown
+properties, values that may grow (statuses, transports, resolutions, delivery state) are strings
+whose current values are listed in their descriptions, and only fields present since 0.2.5 are
+required. Releases add fields and values; they do not remove or rename them. Schemas published by
+0.2.6 and earlier were closed, so a host that cached one rejects results with newer fields (for
+example "must NOT have additional properties"); remove and re-add the connector once to refresh it.
+
 Resources `fmsg://message/{id}` and `fmsg://thread/{id}` expose the same content to hosts that
 attach resources; prompts `chat` and `reply` script the wait → reply loop and a guided reply.
 
diff --git a/docs/http-deployment.md b/docs/http-deployment.md
index cb66c1f..021a78e 100644
--- a/docs/http-deployment.md
+++ b/docs/http-deployment.md
@@ -63,6 +63,14 @@ The metadata routes are public in `oauth` and `oauth+api-key` modes and must rea
 MCP authorization discovery. In API-key mode they return 404. When OAuth is configured, its resource URL supplies
 the public same-origin value, so explicitly listing that origin is optional.
 
+## Upgrades and cached tool schemas
+
+Chat hosts may cache each tool's `outputSchema` from when the connector was added and validate
+results against it. Output schemas are open and additive (see "Output schema compatibility" in the
+README), so later upgrades keep validating. Schemas published by 0.2.6 and earlier were closed: after
+upgrading from those releases, users whose host reports that structured content does not match the
+tool's output schema must reconnect (remove and re-add) the connector once.
+
 ## Binary attachment downloads
 
 `get_attachment_download_url` returns a resource link such as
diff --git a/src/tools/common.ts b/src/tools/common.ts
index dba7267..002e210 100644
--- a/src/tools/common.ts
+++ b/src/tools/common.ts
@@ -21,14 +21,30 @@ export const SENDS: ToolAnnotations = { readOnlyHint: false, destructiveHint: tr
 
 export const idSchema = z.string().regex(/^[0-9]+$/u, "fmsg message ids are decimal integers").describe("fmsg message id");
 
-export const attachmentItem = z.object({
+/**
+ * Output schemas must stay valid for hosts that cached an earlier copy and validate every later result against it.
+ * So every output object accepts unknown properties, and fields added after 0.2.5 are optional: a release may add
+ * fields and values but never remove or rename them.
+ */
+export const outputObject = z.looseObject;
+
+/**
+ * A string output whose current values are listed only in its description. Publishing an enum would make every
+ * new value fail validation for hosts holding the older schema.
+ */
+export function openEnum(values: readonly string[], detail?: string): z.ZodString {
+  const list = values.map((v) => JSON.stringify(v)).join(", ");
+  return z.string().describe(`one of ${list}${detail ? `; ${detail}` : ""}. More values may be added`);
+}
+
+export const attachmentItem = outputObject({
   filename: z.string(),
   size: z.number(),
-  type: z.string().describe("media type; inferred from the filename when the host records none"),
+  type: z.string().optional().describe("media type; inferred from the filename when the host records none"),
 });
 
 /** Structured results that carry other parties' words repeat the text's safety framing. */
-export const untrustedNotice = { untrusted_content_notice: z.string() };
+export const untrustedNotice = { untrusted_content_notice: z.string().optional() };
 export const UNTRUSTED = { untrusted_content_notice: UNTRUSTED_CONTENT_NOTICE };
 
 /** fmsg response codes (fmsg specification, Response Codes) a delivery record can carry; -1 is a host-local "no response". */
@@ -42,20 +58,21 @@ function responseCodeMeaning(code: number | null): string | null {
   return code === null ? null : (RESPONSE_CODES[code] ?? null);
 }
 
-export const deliveryItem = z.object({
+export const deliveryItem = outputObject({
   addr: z.string(),
-  status: z.enum(["delivered", "pending", "failed"]).describe(
+  status: openEnum(
+    ["delivered", "pending", "failed"],
     "delivered once the receiving host accepted it; failed when the last attempt was rejected (the host may retry temporary failures); otherwise pending",
   ),
   time: z.string().nullable().describe("when delivery was confirmed"),
   code: z.number().nullable().describe(
     "the receiving host's fmsg response code for the last attempt when recorded: 200 means accepted, other codes are rejections; null when not recorded, including some successful deliveries",
   ),
-  code_meaning: z.string().nullable().describe("the code's name in the fmsg specification, when known"),
-  via: z.enum(["to", "add_to"]),
+  code_meaning: z.string().nullable().optional().describe("the code's name in the fmsg specification, when known"),
+  via: openEnum(["to", "add_to"], "add_to for recipients added later"),
 });
 
-export const messageItem = z.object({
+export const messageItem = outputObject({
   id: z.string(),
   pid: z.string().nullable(),
   from: z.string(),
@@ -72,8 +89,8 @@ export const messageItem = z.object({
   size: z.number().describe("body size as stored by the host; the compressed size when the body was sent deflate-compressed"),
   preview: z.string().describe("start of the body; may be shorter than the full body"),
   attachments: z.array(attachmentItem),
-  reactions: z.array(z.object({ emoji: z.string(), from: z.array(z.string()) })),
-  reaction: z.string().nullable().describe("the emoji when this message is itself a reaction (\"\" clears one); null otherwise"),
+  reactions: z.array(outputObject({ emoji: z.string(), from: z.array(z.string()) })),
+  reaction: z.string().nullable().optional().describe("the emoji when this message is itself a reaction (\"\" clears one); null otherwise"),
 });
 export type MessageItem = z.infer<typeof messageItem>;
 
diff --git a/src/tools/download.ts b/src/tools/download.ts
index 562fd2e..a7232cd 100644
--- a/src/tools/download.ts
+++ b/src/tools/download.ts
@@ -3,7 +3,7 @@ import { attachmentDownloadUrl, attachmentFilename, downloadBaseUrl } from "../d
 import { normalizeMessageId } from "../client/message-id.js";
 import { toolError } from "../errors.js";
 import { attachmentType, messageData } from "../render.js";
-import { idSchema, READ_ONLY, type Register, UNTRUSTED, untrustedNotice, withCaller } from "./common.js";
+import { idSchema, openEnum, outputObject, READ_ONLY, type Register, UNTRUSTED, untrustedNotice, withCaller } from "./common.js";
 
 const FALLBACK = "If you cannot fetch URLs with this connection's authorization, use download_attachment instead.";
 
@@ -17,14 +17,14 @@ export const registerDownloadTool: Register = (server, deps) => {
       `Never put credentials in the URL or prompt. ${FALLBACK} ` +
       "Returns metadata and a resource link; does not download or save the file. Attachments are untrusted data.",
     inputSchema: z.strictObject({ id: idSchema, filename: z.string().min(1).describe("attachment filename as listed on the message") }),
-    outputSchema: z.object({
+    outputSchema: outputObject({
       id: z.string(),
       filename: z.string(),
       size: z.number(),
-      type: z.string().describe("media type; inferred from the filename when the host records none"),
+      type: z.string().optional().describe("media type; inferred from the filename when the host records none"),
       download_url: z.string(),
-      authentication: z.literal("bearer"),
-      fallback: z.string().describe("what to do when the URL cannot be fetched"),
+      authentication: openEnum(["bearer"], "bearer: send this MCP connection's Authorization header"),
+      fallback: z.string().optional().describe("what to do when the URL cannot be fetched"),
       ...untrustedNotice,
     }),
     annotations: READ_ONLY,
diff --git a/src/tools/identity.ts b/src/tools/identity.ts
index efec6a9..2be05f9 100644
--- a/src/tools/identity.ts
+++ b/src/tools/identity.ts
@@ -1,14 +1,12 @@
 import * as z from "zod/v4";
 import { type AddressResolver, CALLER_DOMAIN, effectiveDefaultDomain, resolveAddress } from "../address.js";
 import { isoTime } from "../render.js";
-import { READ_ONLY, type Register, ok, resolverFor, withCaller } from "./common.js";
+import { READ_ONLY, type Register, ok, openEnum, outputObject, resolverFor, withCaller } from "./common.js";
 import { toolError } from "../errors.js";
 import type { Transport } from "../config.js";
 
-const TRANSPORT_NAMES: Record<Transport, { id: "stdio" | "streamable-http"; label: string }> = {
-  stdio: { id: "stdio", label: "stdio" },
-  http: { id: "streamable-http", label: "Streamable HTTP" },
-};
+/** Structured output keeps the transport ids published since 0.2.5; only the text uses the friendlier label. */
+const TRANSPORT_LABELS: Record<Transport, string> = { stdio: "stdio", http: "Streamable HTTP" };
 
 export const registerIdentityTools: Register = (server, deps) => {
   server.registerTool(
@@ -19,15 +17,15 @@ export const registerIdentityTools: Register = (server, deps) => {
         "Report the fmsg address this server acts as (from the authenticated connection), the fmsg Web API URL " +
         "(null when the server does not publish it), the MCP transport and the address-resolution defaults. " +
         "Access is renewed automatically; no action is needed. Call this first if unsure who you are sending as.",
-      outputSchema: z.object({
+      outputSchema: outputObject({
         address: z.string(),
         api_url: z.string().nullable(),
         token_expires_at: z.string().nullable().describe(
           "internal: when the server's current upstream access token expires; it is renewed automatically, so no action is needed",
         ),
-        transport: z.enum(["stdio", "streamable-http"]),
+        transport: openEnum(["stdio", "http"], "http is Streamable HTTP"),
         default_domain: z.string().nullable(),
-        directory_names: z.array(z.string()).optional().describe("short names in the operator-configured directory; omitted when there are none"),
+        directory_names: z.array(z.string()).describe("short names in the operator-configured directory; empty when there are none"),
       }),
       annotations: { ...READ_ONLY, openWorldHint: false },
     },
@@ -36,19 +34,19 @@ export const registerIdentityTools: Register = (server, deps) => {
         const expires = isoTime((await caller.tokenExpiresAt()) / 1000);
         const defaultDomain = effectiveDefaultDomain(deps.config.defaultDomain, caller.address);
         const directoryNames = Object.keys(deps.config.directory ?? {});
-        const transport = TRANSPORT_NAMES[deps.config.transport];
+        const transport = TRANSPORT_LABELS[deps.config.transport];
         const structured = {
           address: caller.address,
           api_url: deps.config.apiPublicUrl ?? null,
           token_expires_at: expires,
-          transport: transport.id,
+          transport: deps.config.transport,
           default_domain: defaultDomain ?? null,
-          ...(directoryNames.length ? { directory_names: directoryNames } : {}),
+          directory_names: directoryNames,
         };
         const lines = [
           deps.config.apiPublicUrl
-            ? `You are **${caller.address}** on ${deps.config.apiPublicUrl}, connected over ${transport.label}.`
-            : `You are **${caller.address}**, connected over ${transport.label}.`,
+            ? `You are **${caller.address}** on ${deps.config.apiPublicUrl}, connected over ${transport}.`
+            : `You are **${caller.address}**, connected over ${transport}.`,
           "Access is renewed automatically.",
         ];
         if (defaultDomain) lines.push(`Short names resolve to @name@${defaultDomain}.`);
@@ -72,7 +70,7 @@ export const registerIdentityTools: Register = (server, deps) => {
         `as-is${steps.length ? `, ${steps.join(", ")}` : "; this server has no short-name defaults, so other names fail"}. ` +
         "Fails when nothing matches so you can ask the user for the full address.",
       inputSchema: z.object({ name: z.string().describe("Full fmsg address (@user@domain) or a short name") }),
-      outputSchema: z.object({ address: z.string(), resolution: z.enum(["literal", "directory", "default_domain"]) }),
+      outputSchema: outputObject({ address: z.string(), resolution: openEnum(["literal", "directory", "default_domain"]) }),
       annotations: { ...READ_ONLY, openWorldHint: false },
     },
     async ({ name }, ctx) => {
diff --git a/src/tools/list.ts b/src/tools/list.ts
index 8c410b7..b7653f6 100644
--- a/src/tools/list.ts
+++ b/src/tools/list.ts
@@ -1,6 +1,8 @@
 import * as z from "zod/v4";
 import { messageData, messageLine } from "../render.js";
-import { READ_ONLY, type Register, UNTRUSTED, deliveryItem, deliveryOf, messageItem, ok, toItem, untrustedNotice, withCaller } from "./common.js";
+import {
+  READ_ONLY, type Register, UNTRUSTED, deliveryItem, deliveryOf, messageItem, ok, outputObject, toItem, untrustedNotice, withCaller,
+} from "./common.js";
 
 const pageInput = {
   limit: z.number().int().min(1).max(100).default(20).describe("page size (host maximum 100)"),
@@ -24,7 +26,7 @@ export const registerListTools: Register = (server, deps) => {
         ...pageInput,
         unread_only: z.boolean().default(false).describe("keep only unread messages from the fetched page (reactions only with include_reactions)"),
       }),
-      outputSchema: z.object({
+      outputSchema: outputObject({
         messages: z.array(messageItem),
         count: z.number(),
         offset: z.number(),
@@ -59,7 +61,7 @@ export const registerListTools: Register = (server, deps) => {
         "List messages sent by this address (including unsent drafts, shown with time null), newest first, with " +
         "per-recipient delivery state. Use delivery_status for one message's detail.",
       inputSchema: z.object(pageInput),
-      outputSchema: z.object({
+      outputSchema: outputObject({
         messages: z.array(messageItem.extend({ delivery: z.array(deliveryItem) })),
         count: z.number(),
         offset: z.number(),
diff --git a/src/tools/read.ts b/src/tools/read.ts
index 28f59d7..b95b5cd 100644
--- a/src/tools/read.ts
+++ b/src/tools/read.ts
@@ -6,10 +6,11 @@ import { downloadBaseUrl } from "../download.js";
 import { messageData, isoTime, renderMessage, truncateUtf8, truncationNote } from "../render.js";
 import { assembleThread, renderThread, threadNext } from "../thread.js";
 import {
-  READ_ONLY, type Register, type ToolDeps, UNTRUSTED, deliveryItem, deliveryOf, idSchema, messageItem, ok, toItem, untrustedNotice, withCaller,
+  READ_ONLY, type Register, type ToolDeps, UNTRUSTED, attachmentItem, deliveryItem, deliveryOf, idSchema, messageItem, ok, openEnum, outputObject, toItem,
+  untrustedNotice, withCaller,
 } from "./common.js";
 
-const assembledMessage = z.object({
+const assembledMessage = outputObject({
   id: z.string(),
   pid: z.string().nullable(),
   visible: z.boolean(),
@@ -23,7 +24,7 @@ const assembledMessage = z.object({
   body: z.string().nullable(),
   body_truncated: z.boolean(),
   body_bytes: z.number().optional().describe("decoded body length when the body text was read"),
-  attachments: z.array(z.object({ filename: z.string(), size: z.number(), type: z.string() })),
+  attachments: z.array(attachmentItem),
 });
 
 /** Where larger attachments can go, naming only the tools this server registered. */
@@ -47,7 +48,7 @@ export const registerReadTools: Register = (server, deps) => {
         id: idSchema,
         max_body_bytes: z.number().int().min(0).max(1_048_576).default(65_536).describe("truncate the body beyond this many bytes"),
       }),
-      outputSchema: z.object({
+      outputSchema: outputObject({
         message: messageItem,
         body: z.string().nullable().describe("null for non-text bodies"),
         body_truncated: z.boolean(),
@@ -89,18 +90,18 @@ export const registerReadTools: Register = (server, deps) => {
         max_body_bytes_per_message: z.number().int().min(0).max(1_048_576).default(16_384),
         max_total_bytes: z.number().int().min(0).max(8_388_608).default(262_144),
       }),
-      outputSchema: z.object({
+      outputSchema: outputObject({
         root_id: z.string(),
         trigger_id: z.string(),
         complete: z.boolean(),
-        source: z.enum(["thread_messages", "pid_walk"]),
-        thread_topic: z.string().nullable().describe("the thread root's topic (replies carry none); null when the root is not visible"),
+        source: openEnum(["thread_messages", "pid_walk"]),
+        thread_topic: z.string().nullable().optional().describe("the thread root's topic (replies carry none); null when the root is not visible"),
         participants: z.array(z.string()).describe("everyone on the target message except you (reply-all default)"),
         reply_target_id: z.string(),
         terminal: z.boolean(),
         omitted: z.number(),
         messages: z.array(assembledMessage),
-        next: z.string().describe("how to continue the thread"),
+        next: z.string().optional().describe("how to continue the thread"),
         ...untrustedNotice,
       }),
       annotations: READ_ONLY,
@@ -127,7 +128,7 @@ export const registerReadTools: Register = (server, deps) => {
         "including some successful deliveries). Delivery to other hosts is asynchronous, so pending recipients may " +
         "still be delivered and the host may retry temporary failures.",
       inputSchema: z.object({ id: idSchema }),
-      outputSchema: z.object({
+      outputSchema: outputObject({
         id: z.string(),
         sent_at: z.string().nullable(),
         recipients: z.array(deliveryItem),
@@ -156,9 +157,9 @@ export const registerReadTools: Register = (server, deps) => {
       description: "Mark received messages as read, including reaction messages listed with include_reactions. " +
         "Reading a message with get_message does not mark it read.",
       inputSchema: z.object({ ids: z.array(idSchema).min(1).max(100) }),
-      outputSchema: z.object({
-        marked: z.array(z.object({ id: z.string(), time_read: z.string().nullable() })),
-        failed: z.array(z.object({ id: z.string(), error: z.string() })),
+      outputSchema: outputObject({
+        marked: z.array(outputObject({ id: z.string(), time_read: z.string().nullable() })),
+        failed: z.array(outputObject({ id: z.string(), error: z.string() })),
       }),
       annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     },
@@ -197,7 +198,7 @@ export const registerReadTools: Register = (server, deps) => {
         filename: z.string().min(1).describe("attachment filename as listed on the message"),
         max_inline_bytes: z.number().int().min(0).max(16_777_216).default(262_144),
       }),
-      outputSchema: z.object({
+      outputSchema: outputObject({
         id: z.string(),
         filename: z.string(),
         size: z.number(),
diff --git a/src/tools/save.ts b/src/tools/save.ts
index 3ef8147..189d719 100644
--- a/src/tools/save.ts
+++ b/src/tools/save.ts
@@ -4,7 +4,7 @@ import path from "node:path";
 import * as z from "zod/v4";
 import { normalizeMessageId } from "../client/message-id.js";
 import { messageData } from "../render.js";
-import { idSchema, ok, type Register, UNTRUSTED, untrustedNotice, withCaller } from "./common.js";
+import { idSchema, ok, outputObject, type Register, UNTRUSTED, untrustedNotice, withCaller } from "./common.js";
 
 /** Produce one portable leaf name, even for unusual upstream filenames. */
 function localName(id: string, filename: string): string {
@@ -23,7 +23,7 @@ export const registerSaveTool: Register = (server, deps) => {
       "Creates a new file named from its message id and filename, adding -1, -2, etc. for repeat saves; never overwrites. No destination path is accepted. " +
       "Returns the saved path and byte count. Available only in stdio when a download folder is configured.",
     inputSchema: z.strictObject({ id: idSchema, filename: z.string().min(1).regex(/^[^/\\\u0000]+$/u, "use an attachment filename without directory components") }),
-    outputSchema: z.object({ id: z.string(), filename: z.string(), saved_to: z.string(), size: z.number(), content_type: z.string(), ...untrustedNotice }),
+    outputSchema: outputObject({ id: z.string(), filename: z.string(), saved_to: z.string(), size: z.number(), content_type: z.string(), ...untrustedNotice }),
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
   }, async ({ id, filename }, ctx) => withCaller(deps, ctx, async (caller, signal) => {
     const mid = normalizeMessageId(id);
diff --git a/src/tools/send.ts b/src/tools/send.ts
index def4363..8e785ce 100644
--- a/src/tools/send.ts
+++ b/src/tools/send.ts
@@ -3,7 +3,7 @@ import { resolveAddresses, sameAddress } from "../address.js";
 import type { OutboundAttachment } from "../client/types.js";
 import { toolError } from "../errors.js";
 import { attachmentType, isoTime, participantsOf } from "../render.js";
-import { SENDS, type Register, attachmentItem, idSchema, ok, resolverFor, withCaller } from "./common.js";
+import { SENDS, type Register, attachmentItem, idSchema, ok, outputObject, resolverFor, withCaller } from "./common.js";
 
 const IMMUTABLE = "fmsg messages are immutable: once sent they cannot be edited or recalled. Send within the user's requested task or authorized automation.";
 
@@ -26,7 +26,7 @@ function decodeAttachments(items: z.infer<typeof attachmentInput>[] | undefined)
   });
 }
 
-const sentOutput = z.object({
+const sentOutput = outputObject({
   id: z.string(),
   time: z.string().nullable(),
   from: z.string(),
@@ -166,10 +166,10 @@ export const registerSendTools: Register = (server, deps) => {
         recipients: z.array(z.string()).min(1).optional().describe("addresses or short names to add"),
         add_to: z.array(z.string()).min(1).optional().describe("deprecated alias of recipients; pass one or the other"),
       }),
-      outputSchema: z.object({
+      outputSchema: outputObject({
         id: z.string(),
         added: z.number(),
-        recipients: z.array(z.string()),
+        recipients: z.array(z.string()).optional().describe("the resolved addresses that were added"),
         add_to: z.array(z.string()).describe("deprecated copy of recipients"),
       }),
       annotations: { ...SENDS, idempotentHint: true },
@@ -195,7 +195,7 @@ export const registerSendTools: Register = (server, deps) => {
         id: idSchema,
         emoji: z.string().max(32).nullable().describe("a single emoji; null or empty clears your reaction"),
       }),
-      outputSchema: z.object({ id: z.string(), reaction_id: z.string().nullable(), time: z.string().nullable(), cleared: z.boolean() }),
+      outputSchema: outputObject({ id: z.string(), reaction_id: z.string().nullable(), time: z.string().nullable(), cleared: z.boolean() }),
       annotations: { ...SENDS, destructiveHint: false, idempotentHint: true },
     },
     async ({ id, emoji }, ctx) =>
diff --git a/src/tools/wait.ts b/src/tools/wait.ts
index 69d0490..782e946 100644
--- a/src/tools/wait.ts
+++ b/src/tools/wait.ts
@@ -3,7 +3,9 @@ import { resolveAddress } from "../address.js";
 import { assembleThread, renderThread } from "../thread.js";
 import { DATA_NOT_INSTRUCTIONS, fence, headerValue, messageData, messageLine } from "../render.js";
 import { type Skipped, waitForMessage } from "../wait.js";
-import { READ_ONLY, type Register, UNTRUSTED, idSchema, messageItem, ok, resolverFor, toItem, untrustedNotice, withCaller } from "./common.js";
+import {
+  READ_ONLY, type Register, UNTRUSTED, idSchema, messageItem, ok, openEnum, outputObject, resolverFor, toItem, untrustedNotice, withCaller,
+} from "./common.js";
 
 /** Skipped reactions as one line each, for the data block. */
 function reactionLines(skipped: Skipped[]): string[] {
@@ -40,27 +42,27 @@ export const registerWaitTools: Register = (server, deps) => {
         settle_seconds: z.number().int().min(0).max(30).default(3).describe("after the first message, keep collecting same-thread messages for this long"),
         include_thread: z.boolean().default(true).describe("include the assembled thread context of the newest message"),
       }),
-      outputSchema: z.object({
-        status: z.enum(["message", "timeout", "interrupted"]).describe("interrupted: the server is restarting; call again with after_id"),
+      outputSchema: outputObject({
+        status: openEnum(["message", "timeout", "interrupted"], "interrupted: the server is restarting; call again with after_id"),
         after_id: z.string().describe("pass this as after_id on the next call"),
         thread_root_id: z.string().nullable(),
-        thread_topic: z.string().nullable().describe("the thread root's topic (replies carry none); null when unknown"),
+        thread_topic: z.string().nullable().optional().describe("the thread root's topic (replies carry none); null when unknown"),
         reply_target_id: z.string().nullable().describe("newest message of the batch; reply to this one"),
         messages: z.array(messageItem.extend({ body: z.string().nullable() })),
-        pending_other_threads: z.array(z.object({ id: z.string(), from: z.string(), root_id: z.string().nullable() })),
-        skipped: z.array(z.object({
+        pending_other_threads: z.array(outputObject({ id: z.string(), from: z.string(), root_id: z.string().nullable() })),
+        skipped: z.array(outputObject({
           id: z.string(),
-          reason: z.enum(["own", "reaction", "no_reply", "from_mismatch", "other_thread"]),
-          from: z.string(),
+          reason: openEnum(["own", "reaction", "no_reply", "from_mismatch", "other_thread"]),
+          from: z.string().optional(),
           emoji: z.string().optional().describe("for reactions: the emoji (\"\" clears a reaction)"),
           reaction_to: z.string().nullable().optional().describe("for reactions: the message reacted to"),
         })).describe("messages deliberately passed over; after_id has advanced past them"),
-        unclassified: z.array(z.object({ id: z.string(), from: z.string(), error: z.string() })).describe(
+        unclassified: z.array(outputObject({ id: z.string(), from: z.string(), error: z.string() })).describe(
           "messages whose thread could not be determined; after_id is held before them, call again to retry",
         ),
-        transport: z.enum(["websocket", "poll"]),
+        transport: openEnum(["websocket", "poll"]),
         note: z.string().nullable(),
-        next: z.string().describe("what to do with this result"),
+        next: z.string().optional().describe("what to do with this result"),
         ...untrustedNotice,
       }),
       annotations: { ...READ_ONLY, idempotentHint: false },
diff --git a/test/fixtures/output-schemas-0.2.5.json b/test/fixtures/output-schemas-0.2.5.json
new file mode 100644
index 0000000..291f8b9
--- /dev/null
+++ b/test/fixtures/output-schemas-0.2.5.json
@@ -0,0 +1 @@
+{"whoami":{"type":"object","properties":{"address":{"type":"string"},"api_url":{"type":["string","null"]},"token_expires_at":{"type":["string","null"]},"transport":{"type":"string","enum":["stdio","http"]},"default_domain":{"type":["string","null"]},"directory_names":{"type":"array","items":{"type":"string"}}},"required":["address","api_url","token_expires_at","transport","default_domain","directory_names"],"additionalProperties":false},"resolve_address":{"type":"object","properties":{"address":{"type":"string"},"resolution":{"type":"string","enum":["literal","directory","default_domain"]}},"required":["address","resolution"],"additionalProperties":false},"list_messages":{"type":"object","properties":{"messages":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"pid":{"type":["string","null"]},"from":{"type":"string"},"to":{"type":"array","items":{"type":"string"}},"added":{"type":"array","items":{"type":"string"}},"topic":{"type":"string"},"time":{"type":["string","null"]},"time_posix":{"type":["number","null"]},"read":{"type":["boolean","null"]},"important":{"type":"boolean"},"no_reply":{"type":"boolean"},"terminal":{"type":"boolean"},"type":{"type":"string"},"size":{"type":"number"},"preview":{"type":"string"},"attachments":{"type":"array","items":{"type":"object","properties":{"filename":{"type":"string"},"size":{"type":"number"}},"required":["filename","size"],"additionalProperties":false}},"reactions":{"type":"array","items":{"type":"object","properties":{"emoji":{"type":"string"},"from":{"type":"array","items":{"type":"string"}}},"required":["emoji","from"],"additionalProperties":false}}},"required":["id","pid","from","to","added","topic","time","time_posix","read","important","no_reply","terminal","type","size","preview","attachments","reactions"],"additionalProperties":false}},"count":{"type":"number"},"offset":{"type":"number"},"next_offset":{"type":["number","null"]}},"required":["messages","count","offset","next_offset"],"additionalProperties":false},"list_sent":{"type":"object","properties":{"messages":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"pid":{"type":["string","null"]},"from":{"type":"string"},"to":{"type":"array","items":{"type":"string"}},"added":{"type":"array","items":{"type":"string"}},"topic":{"type":"string"},"time":{"type":["string","null"]},"time_posix":{"type":["number","null"]},"read":{"type":["boolean","null"]},"important":{"type":"boolean"},"no_reply":{"type":"boolean"},"terminal":{"type":"boolean"},"type":{"type":"string"},"size":{"type":"number"},"preview":{"type":"string"},"attachments":{"type":"array","items":{"type":"object","properties":{"filename":{"type":"string"},"size":{"type":"number"}},"required":["filename","size"],"additionalProperties":false}},"reactions":{"type":"array","items":{"type":"object","properties":{"emoji":{"type":"string"},"from":{"type":"array","items":{"type":"string"}}},"required":["emoji","from"],"additionalProperties":false}},"delivery":{"type":"array","items":{"type":"object","properties":{"addr":{"type":"string"},"status":{"type":"string","enum":["delivered","pending","failed"]},"time":{"type":["string","null"]},"code":{"type":["number","null"]},"via":{"type":"string","enum":["to","add_to"]}},"required":["addr","status","time","code","via"],"additionalProperties":false}}},"required":["id","pid","from","to","added","topic","time","time_posix","read","important","no_reply","terminal","type","size","preview","attachments","reactions","delivery"],"additionalProperties":false}},"count":{"type":"number"},"offset":{"type":"number"},"next_offset":{"type":["number","null"]}},"required":["messages","count","offset","next_offset"],"additionalProperties":false},"get_message":{"type":"object","properties":{"message":{"type":"object","properties":{"id":{"type":"string"},"pid":{"type":["string","null"]},"from":{"type":"string"},"to":{"type":"array","items":{"type":"string"}},"added":{"type":"array","items":{"type":"string"}},"topic":{"type":"string"},"time":{"type":["string","null"]},"time_posix":{"type":["number","null"]},"read":{"type":["boolean","null"]},"important":{"type":"boolean"},"no_reply":{"type":"boolean"},"terminal":{"type":"boolean"},"type":{"type":"string"},"size":{"type":"number"},"preview":{"type":"string"},"attachments":{"type":"array","items":{"type":"object","properties":{"filename":{"type":"string"},"size":{"type":"number"}},"required":["filename","size"],"additionalProperties":false}},"reactions":{"type":"array","items":{"type":"object","properties":{"emoji":{"type":"string"},"from":{"type":"array","items":{"type":"string"}}},"required":["emoji","from"],"additionalProperties":false}}},"required":["id","pid","from","to","added","topic","time","time_posix","read","important","no_reply","terminal","type","size","preview","attachments","reactions"],"additionalProperties":false},"body":{"type":["string","null"]},"body_truncated":{"type":"boolean"},"body_bytes":{"type":"number"},"delivery":{"type":"array","items":{"type":"object","properties":{"addr":{"type":"string"},"status":{"type":"string","enum":["delivered","pending","failed"]},"time":{"type":["string","null"]},"code":{"type":["number","null"]},"via":{"type":"string","enum":["to","add_to"]}},"required":["addr","status","time","code","via"],"additionalProperties":false}}},"required":["message","body","body_truncated","body_bytes","delivery"],"additionalProperties":false},"get_thread":{"type":"object","properties":{"root_id":{"type":"string"},"trigger_id":{"type":"string"},"complete":{"type":"boolean"},"source":{"type":"string","enum":["thread_messages","pid_walk"]},"participants":{"type":"array","items":{"type":"string"}},"reply_target_id":{"type":"string"},"terminal":{"type":"boolean"},"omitted":{"type":"number"},"messages":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"pid":{"type":["string","null"]},"visible":{"type":"boolean"},"from":{"type":"string"},"to":{"type":"array","items":{"type":"string"}},"time":{"type":["string","null"]},"time_posix":{"type":["number","null"]},"topic":{"type":"string"},"type":{"type":"string"},"size":{"type":"number"},"body":{"type":["string","null"]},"body_truncated":{"type":"boolean"},"attachments":{"type":"array","items":{"type":"object","properties":{"filename":{"type":"string"},"size":{"type":"number"},"type":{"type":"string"}},"required":["filename","size"],"additionalProperties":false}}},"required":["id","pid","visible","time","time_posix","body","body_truncated","attachments"],"additionalProperties":false}}},"required":["root_id","trigger_id","complete","source","participants","reply_target_id","terminal","omitted","messages"],"additionalProperties":false},"delivery_status":{"type":"object","properties":{"id":{"type":"string"},"sent_at":{"type":["string","null"]},"recipients":{"type":"array","items":{"type":"object","properties":{"addr":{"type":"string"},"status":{"type":"string","enum":["delivered","pending","failed"]},"time":{"type":["string","null"]},"code":{"type":["number","null"]},"via":{"type":"string","enum":["to","add_to"]}},"required":["addr","status","time","code","via"],"additionalProperties":false}}},"required":["id","sent_at","recipients"],"additionalProperties":false},"mark_read":{"type":"object","properties":{"marked":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"time_read":{"type":["string","null"]}},"required":["id","time_read"],"additionalProperties":false}},"failed":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"error":{"type":"string"}},"required":["id","error"],"additionalProperties":false}}},"required":["marked","failed"],"additionalProperties":false},"download_attachment":{"type":"object","properties":{"id":{"type":"string"},"filename":{"type":"string"},"size":{"type":"number"},"content_type":{"type":"string"}},"required":["id","filename","size","content_type"],"additionalProperties":false},"save_attachment":{"type":"object","properties":{"id":{"type":"string"},"filename":{"type":"string"},"saved_to":{"type":"string"},"size":{"type":"number"},"content_type":{"type":"string"}},"required":["id","filename","saved_to","size","content_type"],"additionalProperties":false},"send_message":{"type":"object","properties":{"id":{"type":"string"},"time":{"type":["string","null"]},"from":{"type":"string"},"to":{"type":"array","items":{"type":"string"}},"topic":{"type":"string"},"parent_id":{"type":["string","null"]},"attachments":{"type":"array","items":{"type":"object","properties":{"filename":{"type":"string"},"size":{"type":"number"}},"required":["filename","size"],"additionalProperties":false}},"redactions":{"type":"number"},"warnings":{"type":"array","items":{"type":"string"}}},"required":["id","time","from","to","topic","parent_id","attachments","redactions","warnings"],"additionalProperties":false},"reply":{"type":"object","properties":{"id":{"type":"string"},"time":{"type":["string","null"]},"from":{"type":"string"},"to":{"type":"array","items":{"type":"string"}},"topic":{"type":"string"},"parent_id":{"type":["string","null"]},"attachments":{"type":"array","items":{"type":"object","properties":{"filename":{"type":"string"},"size":{"type":"number"}},"required":["filename","size"],"additionalProperties":false}},"redactions":{"type":"number"},"warnings":{"type":"array","items":{"type":"string"}}},"required":["id","time","from","to","topic","parent_id","attachments","redactions","warnings"],"additionalProperties":false},"add_recipients":{"type":"object","properties":{"id":{"type":"string"},"added":{"type":"number"},"add_to":{"type":"array","items":{"type":"string"}}},"required":["id","added","add_to"],"additionalProperties":false},"react":{"type":"object","properties":{"id":{"type":"string"},"reaction_id":{"type":["string","null"]},"time":{"type":["string","null"]},"cleared":{"type":"boolean"}},"required":["id","reaction_id","time","cleared"],"additionalProperties":false},"wait_for_message":{"type":"object","properties":{"status":{"type":"string","enum":["message","timeout"]},"after_id":{"type":"string"},"thread_root_id":{"type":["string","null"]},"reply_target_id":{"type":["string","null"]},"messages":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"pid":{"type":["string","null"]},"from":{"type":"string"},"to":{"type":"array","items":{"type":"string"}},"added":{"type":"array","items":{"type":"string"}},"topic":{"type":"string"},"time":{"type":["string","null"]},"time_posix":{"type":["number","null"]},"read":{"type":["boolean","null"]},"important":{"type":"boolean"},"no_reply":{"type":"boolean"},"terminal":{"type":"boolean"},"type":{"type":"string"},"size":{"type":"number"},"preview":{"type":"string"},"attachments":{"type":"array","items":{"type":"object","properties":{"filename":{"type":"string"},"size":{"type":"number"}},"required":["filename","size"],"additionalProperties":false}},"reactions":{"type":"array","items":{"type":"object","properties":{"emoji":{"type":"string"},"from":{"type":"array","items":{"type":"string"}}},"required":["emoji","from"],"additionalProperties":false}},"body":{"type":["string","null"]}},"required":["id","pid","from","to","added","topic","time","time_posix","read","important","no_reply","terminal","type","size","preview","attachments","reactions","body"],"additionalProperties":false}},"pending_other_threads":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"from":{"type":"string"},"root_id":{"type":["string","null"]}},"required":["id","from","root_id"],"additionalProperties":false}},"skipped":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"reason":{"type":"string","enum":["own","reaction","no_reply","from_mismatch","other_thread"]}},"required":["id","reason"],"additionalProperties":false}},"unclassified":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"from":{"type":"string"},"error":{"type":"string"}},"required":["id","from","error"],"additionalProperties":false}},"transport":{"type":"string","enum":["websocket","poll"]},"note":{"type":["string","null"]}},"required":["status","after_id","thread_root_id","reply_target_id","messages","pending_other_threads","skipped","unclassified","transport","note"],"additionalProperties":false},"get_attachment_download_url":{"type":"object","properties":{"id":{"type":"string"},"filename":{"type":"string"},"size":{"type":"number"},"download_url":{"type":"string"},"authentication":{"type":"string","const":"bearer"}},"required":["id","filename","size","download_url","authentication"],"additionalProperties":false}}
diff --git a/test/fmsg-docker.e2e.test.ts b/test/fmsg-docker.e2e.test.ts
index 6271795..631e633 100644
--- a/test/fmsg-docker.e2e.test.ts
+++ b/test/fmsg-docker.e2e.test.ts
@@ -116,7 +116,7 @@ describe.skipIf(!enabled)("fmsg-docker end to end", () => {
     const client = new Client({ name: "e2e-http", version: "0.0.0" }, { versionNegotiation: { mode: "auto" } });
     await client.connect(transport);
     try {
-      expect(structured<{ address: string; transport: string }>(await call(client, "whoami"))).toMatchObject({ address: ALICE, transport: "streamable-http" });
+      expect(structured<{ address: string; transport: string }>(await call(client, "whoami"))).toMatchObject({ address: ALICE, transport: "http" });
       const bytes = Buffer.from([0, 255, 128, 13, 10, 42]);
       const sent = structured<{ id: string }>(await call(client, "send_message", { to: [BOB], topic: `binary download ${token}`, body: "binary attachment",
         attachments: [{ filename: "binary.bin", data_base64: bytes.toString("base64"), content_type: "application/octet-stream" }] }));
diff --git a/test/http.test.ts b/test/http.test.ts
index 3120c6b..61888c3 100644
--- a/test/http.test.ts
+++ b/test/http.test.ts
@@ -209,7 +209,7 @@ describe("HTTP transport", () => {
     const alice = await connect("fmsgk_alice_secret");
     const bob = await connect("fmsgk_bob_secret");
     try {
-      expect(structured<{ address: string; transport: string }>(await call(alice, "whoami"))).toMatchObject({ address: ALICE, transport: "streamable-http" });
+      expect(structured<{ address: string; transport: string }>(await call(alice, "whoami"))).toMatchObject({ address: ALICE, transport: "http" });
       expect(structured<{ address: string }>(await call(bob, "whoami")).address).toBe(BOB);
       fake.seed({ from: BOB, to: [ALICE], topic: "for alice", data: "hi alice" });
       expect(structured<{ count: number }>(await call(alice, "list_messages")).count).toBe(1);
diff --git a/test/oauth.test.ts b/test/oauth.test.ts
index cc0c49a..45493d9 100644
--- a/test/oauth.test.ts
+++ b/test/oauth.test.ts
@@ -178,7 +178,7 @@ describe("HTTP OAuth", () => {
     const token = await idp.token();
     const client = await connect(token);
     expect(client.getInstructions()).toContain(ALICE);
-    expect(structured(await call(client, "whoami"))).toMatchObject({ address: ALICE, transport: "streamable-http" });
+    expect(structured(await call(client, "whoami"))).toMatchObject({ address: ALICE, transport: "http" });
     expect((await call(client, "send_message", { to: [BOB], topic: "Hello", body: "hello" })).isError).toBeFalsy();
     expect((await call(client, "list_messages")).isError).toBeFalsy();
     expect(idp.exchanges).toHaveLength(1);
@@ -500,7 +500,7 @@ describe("HTTP OAuth combined with API keys", () => {
     const oauthVerify = vi.spyOn(oauth, "verifyAccessToken");
     const issuerVerify = vi.spyOn(oauth.issuer, "verify");
     const client = await connect("fmsgk_alice_secret");
-    expect(structured(await call(client, "whoami"))).toMatchObject({ address: ALICE, transport: "streamable-http" });
+    expect(structured(await call(client, "whoami"))).toMatchObject({ address: ALICE, transport: "http" });
     expect((await call(client, "send_message", { to: [BOB], topic: "Hello", body: "hello" })).isError).toBeFalsy();
     expect(oauthVerify).not.toHaveBeenCalled();
     expect(issuerVerify).not.toHaveBeenCalled();
@@ -513,7 +513,7 @@ describe("HTTP OAuth combined with API keys", () => {
   it("serves OAuth callers through token exchange, never as API keys", async () => {
     const apiKeyVerify = vi.spyOn(apiKeys, "verifyAccessToken");
     const client = await connect(await idp.token());
-    expect(structured(await call(client, "whoami"))).toMatchObject({ address: ALICE, transport: "streamable-http" });
+    expect(structured(await call(client, "whoami"))).toMatchObject({ address: ALICE, transport: "http" });
     expect(apiKeyVerify).not.toHaveBeenCalled();
     expect(idp.exchanges).toHaveLength(1);
     expect(api.requests.every(req => req.path !== "/fmsg/token" && req.authorization === `Bearer ${idp.exchanges[0]!.token}`)).toBe(true);
diff --git a/test/output-schemas.test.ts b/test/output-schemas.test.ts
new file mode 100644
index 0000000..c54d1b9
--- /dev/null
+++ b/test/output-schemas.test.ts
@@ -0,0 +1,169 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import type { Client } from "@modelcontextprotocol/client";
+import { AjvJsonSchemaValidator } from "@modelcontextprotocol/client/validators/ajv";
+import type { CallToolResult } from "@modelcontextprotocol/server";
+import { StaticCallerProvider } from "../src/context.js";
+import { FakeFmsgServer } from "./fake-fmsg-server.js";
+import { ALICE, BOB, CAROL, type Harness, call, configFor, connectHttpShaped, connectInMemory, structured } from "./helpers.js";
+
+type Schema = Record<string, unknown>;
+
+/**
+ * Output paths ("tool.field.nested[]") allowed to publish enum or const, each with its reason. A closed value
+ * set makes every new value fail for hosts that cached the schema, so keep this empty unless a value can never grow.
+ */
+const CLOSED_VALUES_ALLOWED: Record<string, string> = {};
+
+/** Tools whose 0.2.5 output schema still validates current results without relaxing additionalProperties. */
+const UNCHANGED_SINCE_0_2_5 = ["mark_read", "react", "resolve_address", "whoami"];
+
+const validator = new AjvJsonSchemaValidator();
+
+function closedSchemaProblems(schema: unknown, at: string, problems: string[] = []): string[] {
+  if (Array.isArray(schema)) {
+    for (const item of schema) closedSchemaProblems(item, at, problems);
+    return problems;
+  }
+  if (!schema || typeof schema !== "object") return problems;
+  const s = schema as Schema;
+  if (s.additionalProperties === false || s.unevaluatedProperties === false) problems.push(`${at}: closed object`);
+  if (("enum" in s || "const" in s) && !CLOSED_VALUES_ALLOWED[at]) problems.push(`${at}: closed value set`);
+  for (const [key, value] of Object.entries(s)) {
+    if (key === "properties" && value && typeof value === "object") {
+      for (const [name, property] of Object.entries(value)) closedSchemaProblems(property, `${at}.${name}`, problems);
+    } else if (key === "items" || key === "prefixItems") {
+      closedSchemaProblems(value, `${at}[]`, problems);
+    } else if (value && typeof value === "object") {
+      closedSchemaProblems(value, at, problems);
+    }
+  }
+  return problems;
+}
+
+/** What a host holding the 0.2.5 schema would accept if it ignored unknown properties. */
+function withoutClosedObjects(schema: unknown): unknown {
+  if (Array.isArray(schema)) return schema.map(withoutClosedObjects);
+  if (!schema || typeof schema !== "object") return schema;
+  return Object.fromEntries(Object.entries(schema).filter(([k, v]) => !(k === "additionalProperties" && v === false))
+    .map(([k, v]) => [k, withoutClosedObjects(v)]));
+}
+
+function validate(schema: unknown, result: CallToolResult): string | undefined {
+  const check = validator.getValidator(schema as Schema)(result.structuredContent);
+  return check.valid ? undefined : check.errorMessage;
+}
+
+async function outputSchemas(client: Client): Promise<Map<string, Schema>> {
+  const { tools } = await client.listTools();
+  return new Map(tools.map((t) => [t.name, t.outputSchema as Schema]));
+}
+
+describe("published output schemas", () => {
+  let fake: FakeFmsgServer;
+  let directory: string;
+  let local: Harness;
+  let remote: Harness;
+  beforeEach(async () => {
+    fake = new FakeFmsgServer();
+    await fake.start();
+    directory = await mkdtemp(path.join(os.tmpdir(), "fmsg-schema-"));
+    local = await connectInMemory(fake, "fmsgk_alice_secret", { FMSG_DEFAULT_DOMAIN: "example.net", FMSG_MCP_DOWNLOAD_DIR: directory });
+    const config = configFor(fake, "http", { FMSG_MCP_PUBLIC_URL: "https://mcp.example.com/mcp" });
+    remote = await connectHttpShaped(fake, new StaticCallerProvider(local.fmsg), undefined, config);
+  });
+  afterEach(async () => {
+    await local.close();
+    await remote.close();
+    await fake.stop();
+    await rm(directory, { recursive: true, force: true });
+  });
+
+  async function allSchemas(): Promise<Map<string, Schema>> {
+    return new Map([...await outputSchemas(remote.client), ...await outputSchemas(local.client)]);
+  }
+
+  it("are open at every depth and publish no closed value sets", async () => {
+    const schemas = await allSchemas();
+    expect(schemas.size).toBeGreaterThanOrEqual(16);
+    const problems: string[] = [];
+    for (const [name, schema] of schemas) {
+      expect(schema, name).toBeTruthy();
+      closedSchemaProblems(schema, name, problems);
+    }
+    expect(problems).toEqual([]);
+  });
+
+  it("keep the fields required by 0.2.5 and require nothing new", async () => {
+    const baseline = JSON.parse(await readFile(new URL("./fixtures/output-schemas-0.2.5.json", import.meta.url), "utf8")) as Record<string, Schema>;
+    const required = (schema: unknown, at: string, out: Map<string, string[]> = new Map()): Map<string, string[]> => {
+      if (!schema || typeof schema !== "object") return out;
+      const s = schema as Schema;
+      if (Array.isArray(s.required)) out.set(at, [...(s.required as string[])].sort());
+      for (const [name, property] of Object.entries((s.properties ?? {}) as Record<string, unknown>)) required(property, `${at}.${name}`, out);
+      if (s.items) required(s.items, `${at}[]`, out);
+      return out;
+    };
+    for (const [name, schema] of await allSchemas()) {
+      const before = baseline[name];
+      if (!before) continue;
+      expect(Object.fromEntries(required(schema, name)), name).toEqual(Object.fromEntries(required(before, name)));
+    }
+  });
+
+  it("validate representative results, including against 0.2.5 schemas", async () => {
+    const results: Array<[string, CallToolResult]> = [];
+    const run = async (client: Client, name: string, args: Record<string, unknown> = {}) => {
+      const result = await call(client, name, args);
+      structured(result);
+      results.push([name, result]);
+      return result;
+    };
+
+    const root = fake.seed({ from: BOB, to: [ALICE, CAROL], topic: "plans", data: "root",
+      attachments: [{ filename: "p.png", data: Buffer.from([0x89, 0x50]), type: "image/png" }, { filename: "n.txt", data: Buffer.from("hi"), type: "text/plain" }] });
+    const reply = fake.seed({ from: CAROL, to: [ALICE, BOB], pid: root.id, data: "reply" });
+    fake.seed({ from: BOB, to: [ALICE], pid: reply.id, data: "👍", reaction: "👍", terminal: true, no_reply: true });
+    const own = fake.seed({ from: ALICE, to: [BOB], topic: "mine", data: "sent by me" });
+
+    await run(local.client, "whoami");
+    await run(remote.client, "whoami");
+    await run(local.client, "resolve_address", { name: "bob" });
+    await run(local.client, "list_messages", { include_reactions: true });
+    await run(local.client, "get_message", { id: root.id });
+    await run(local.client, "get_thread", { id: reply.id });
+    await run(local.client, "delivery_status", { id: own.id });
+    await run(local.client, "mark_read", { ids: [root.id] });
+    await run(local.client, "download_attachment", { id: root.id, filename: "n.txt" });
+    await run(local.client, "download_attachment", { id: root.id, filename: "p.png" });
+    await run(local.client, "save_attachment", { id: root.id, filename: "p.png" });
+    await run(remote.client, "get_attachment_download_url", { id: root.id, filename: "p.png" });
+    await run(local.client, "add_recipients", { id: own.id, recipients: [CAROL] });
+    await run(local.client, "react", { id: root.id, emoji: "🎉" });
+    await run(local.client, "react", { id: root.id, emoji: null });
+    await run(local.client, "send_message", { to: ["bob"], topic: "new", body: "hello",
+      attachments: [{ filename: "a.txt", data_base64: Buffer.from("x").toString("base64") }] });
+    await run(local.client, "reply", { id: reply.id, body: "thanks" });
+    await run(local.client, "list_sent", { include_reactions: true });
+    await run(local.client, "wait_for_message", { after_id: "0", timeout_seconds: 1, settle_seconds: 0 });
+    const newest = (await local.fmsg.listInbox(1, 0))[0]!.id;
+    await run(local.client, "wait_for_message", { after_id: newest, timeout_seconds: 1 });
+
+    const schemas = await allSchemas();
+    expect(new Set(results.map(([name]) => name))).toEqual(new Set(schemas.keys()));
+    const baseline = JSON.parse(await readFile(new URL("./fixtures/output-schemas-0.2.5.json", import.meta.url), "utf8")) as Record<string, Schema>;
+    for (const [name, result] of results) {
+      expect(validate(schemas.get(name), result), name).toBeUndefined();
+      expect(validate(withoutClosedObjects(baseline[name]), result), `${name} (0.2.5 ignoring unknown properties)`).toBeUndefined();
+      if (UNCHANGED_SINCE_0_2_5.includes(name)) expect(validate(baseline[name], result), `${name} (0.2.5 as published)`).toBeUndefined();
+    }
+  });
+
+  it("flags closed objects and enums", () => {
+    expect(closedSchemaProblems({ type: "object", additionalProperties: false, properties: {
+      list: { type: "array", items: { type: "object", additionalProperties: false, properties: { kind: { enum: ["a"] } } } },
+    } }, "tool")).toEqual(["tool: closed object", "tool.list[]: closed object", "tool.list[].kind: closed value set"]);
+  });
+});
diff --git a/test/public-api-url.test.ts b/test/public-api-url.test.ts
index 6e87f40..12f74fa 100644
--- a/test/public-api-url.test.ts
+++ b/test/public-api-url.test.ts
@@ -70,7 +70,7 @@ describe("whoami api_url", () => {
     const h = await connectHttpShaped(fake, new StaticCallerProvider(new FmsgClient(fake.baseUrl, "fmsgk_alice_secret")), undefined);
     try {
       const result = await call(h.client, "whoami");
-      expect(structured(result)).toMatchObject({ address: ALICE, api_url: null, transport: "streamable-http" });
+      expect(structured(result)).toMatchObject({ address: ALICE, api_url: null, transport: "http" });
       expect(text(result)).not.toContain(fake.baseUrl);
       expect(text(result)).toContain(`You are **${ALICE}**, connected over Streamable HTTP.`);
     } finally { await h.close(); }
diff --git a/test/tools.test.ts b/test/tools.test.ts
index 628581b..c7f8a08 100644
--- a/test/tools.test.ts
+++ b/test/tools.test.ts
@@ -454,12 +454,12 @@ describe("tools (stdio-shaped)", () => {
     expect(tools.find((t) => t.name === "wait_for_message")!.description).toContain("each wait is a model turn");
   });
 
-  it("whoami keeps token timing out of its text and omits an empty directory", async () => {
+  it("whoami keeps token timing out of its text and reports an empty directory", async () => {
     const result = await call(h.client, "whoami");
     expect(text(result)).toContain("connected over stdio");
     expect(text(result)).toContain("Access is renewed automatically.");
     expect(text(result)).not.toMatch(/expires|\d{4}-\d{2}-\d{2}T/u);
-    expect(structured(result)).not.toHaveProperty("directory_names");
+    expect(structured(result)).toMatchObject({ transport: "stdio", directory_names: [] });
     const resolve = (await h.client.listTools()).tools.find((t) => t.name === "resolve_address")!;
     expect(resolve.description).not.toContain("directory");
     expect(resolve.description).toContain("otherwise @name@example.net");