@cohortapp/agent-sdk 2.5.1 → 2.6.1

package/lib/mandate/derive.mjs

@@ -70,6 +70,34 @@ export const SENSOR_HINTS = Object.freeze([
 /** Default review rhythm per objective kind. */
 const DEFAULT_CADENCE = { PILLAR: "quarterly", OBJECTIVE: "weekly", GOAL: "monthly" };
 
+/**
+ * Could a human adopt this node TODAY?
+ *
+ * The client-side mirror of hq's `assessAdmissibility(..., "adopt")`. It is not
+ * a gate — derivation proposes, it never adopts — it is a REPORT. The single
+ * most useful number a seat can print about its own mandate is "of the N things
+ * I proposed, M are actually adoptable", because the difference is always
+ * measurement debt somebody has to pay, and it is invisible otherwise.
+ *
+ * Funding and the slate caps are deliberately NOT checked here: they are facts
+ * about the seat, not about the objective, and only hq holds them.
+ */
+export function isAdoptable(o) {
+  if (!o) return false;
+  if (String(o.kind).toUpperCase() === "PILLAR") return !!o.charterSectionId;
+  return (
+    !!o.parentKey &&
+    !!o.charterSectionId &&
+    !!o.metric &&
+    Number.isFinite(Number(o.target)) &&
+    o.target != null &&
+    !!o.cadence &&
+    !!o.sensor &&
+    o.sensor.source === "method" &&
+    !!o.sensor.capability
+  );
+}
+
 /** Deterministic, stable, url-safe slug. Collisions are disambiguated by caller. */
 export function slug(text, max = 48) {
   const s = String(text || "")
@@ -138,13 +166,25 @@ export function deriveMandate(input = {}) {
   const degradations = [];
   const used = new Set();
 
-  /** Reserve a unique key. */
+  /**
+   * Reserve a key, or report that it is ALREADY TAKEN.
+   *
+   * This used to mint `x-2` on a collision. That is where the OBJECTIVE/GOAL
+   * mirror came from: an archetype kpiCategory and a config/priorities.yaml
+   * entry that reduce to the same slug produced TWO rows — `x` (OBJECTIVE,
+   * weekly) and `x-2` (GOAL, monthly) — describing one thing, with one gap, one
+   * sensor and two obligations. Ten of A016's 35 proposals were exactly that
+   * pair. A slug collision means the same accountability was named twice; the
+   * honest resolution is to keep the first and SAY the second was folded in, not
+   * to invent a second objective by suffixing a digit onto its name.
+   *
+   * @returns {{key:string, taken:boolean}}
+   */
   const key = (base) => {
-    let k = slug(base);
-    let n = 2;
-    while (used.has(k)) k = `${slug(base)}-${n++}`;
+    const k = slug(base);
+    if (used.has(k)) return { key: k, taken: true };
     used.add(k);
-    return k;
+    return { key: k, taken: false };
   };
 
   // ── 1. PILLARs from the charter ─────────────────────────────────────────
@@ -155,7 +195,11 @@ export function deriveMandate(input = {}) {
 
   for (const s of pillars) {
     const text = firstClause(s.title || s.body);
-    const k = key(text);
+    const { key: k, taken } = key(text);
+    if (taken) {
+      degradations.push({ kind: "duplicate_key", key: k, reason: `two charter sections reduce to the slug "${k}" — the second is skipped` });
+      continue;
+    }
     objectives.push({
       key: k,
       kind: "PILLAR",
@@ -174,8 +218,21 @@ export function deriveMandate(input = {}) {
     degradations.push({ kind: "no_charter_pillars", reason: "config/agent.json has no charter.sections of kind PILLAR/CAPABILITY — objectives will have no charter provenance" });
   }
 
-  /** Attach an objective to the most textually-related pillar, else the first. */
   const pillarKeys = objectives.filter((o) => o.kind === "PILLAR").map((o) => ({ key: o.key, text: o.text }));
+  /**
+   * Attach an objective to the most textually-related pillar — or to NOTHING.
+   *
+   * The old fallback was `pillarKeys[0].key`: any objective that overlapped no
+   * pillar was parented onto whichever pillar happened to be first. On A016 that
+   * put 33 of 35 objectives — `global-footprint` and `capital-formation-aum-growth`
+   * among them — under `own-the-agent-platform-substrate`. The edge existed, the
+   * tree rendered, the provenance walk returned a chain, and every bit of it was
+   * fiction. A fabricated edge is worse than a missing one, because a missing one
+   * is visible.
+   *
+   * Now: no overlap, no parent. The caller drops the node and records WHY, which
+   * is a fact an operator can act on ("this charter has no pillar for revenue").
+   */
   const parentFor = (text) => {
     if (!pillarKeys.length) return null;
     const t = String(text || "").toLowerCase();
@@ -185,16 +242,68 @@ export function deriveMandate(input = {}) {
       const score = overlapScore(t, p.text.toLowerCase());
       if (score > bestScore) { bestScore = score; best = p.key; }
     }
-    return bestScore > 0 ? best : pillarKeys[0].key;
+    return bestScore > 0 ? best : null;
+  };
+
+  /** The charter section a pillar key carries, for provenance inheritance. */
+  const sectionForPillar = new Map(
+    objectives.filter((o) => o.kind === "PILLAR").map((o) => [o.key, o.charterSectionId || null])
+  );
+
+  /**
+   * The one place a derived OBJECTIVE/GOAL enters the tree.
+   *
+   * Two different failures, deliberately handled two different ways:
+   *
+   *   MIRROR (`taken`)   — dropped. A slug collision means one accountability
+   *                        was named twice; keeping both would produce two
+   *                        obligations, two sensors and two gaps for one thing.
+   *                        There is nothing to preserve.
+   *   NO PILLAR          — KEPT, with `parentKey: null` and a named degradation.
+   *                        The node is real; what is missing is a human decision
+   *                        about where it belongs. Dropping it would delete work
+   *                        somebody asked for; fabricating an edge (the old
+   *                        `pillarKeys[0]` fallback) would answer that decision
+   *                        with a coin flip. So it is carried, unplaced, and
+   *                        `isAdoptable` returns false for it until a human
+   *                        places it.
+   *
+   * Neither path is ever silent. `counts.adoptable` and `degradations[]` are
+   * what an operator reads to see the difference between "I have 35 objectives"
+   * and "I am accountable for 4".
+   */
+  const record = (obj, { taken, base }) => {
+    if (taken) {
+      degradations.push({
+        kind: "duplicate_key",
+        key: obj.key,
+        reason: `"${base}" reduces to the already-used slug "${obj.key}" — folded into the existing objective rather than minting an "${obj.key}-2" mirror row`,
+      });
+      return;
+    }
+    objectives.push(obj);
+    if (!obj.parentKey) {
+      degradations.push({
+        kind: "no_pillar_trace",
+        key: obj.key,
+        reason: `"${obj.text}" overlaps no PILLAR/CAPABILITY section on this seat's charter — it is carried UNPLACED and is not adoptable until a human parents it. It is NOT auto-attached to the first pillar: a fabricated provenance edge is worse than a missing one, because a missing one is visible.`,
+      });
+    }
   };
 
   // ── 2. OBJECTIVEs from the org's strategy streams ───────────────────────
   for (const stream of strategyStreams(strategy)) {
     const text = firstClause(stream.title || stream.name || stream.code);
-    const k = key(text);
+    const { key: k, taken } = key(text);
     const sensor = pickSensor(`${text} ${stream.detail || ""}`, reachable);
-    objectives.push(buildObjective({ k, text, parentKey: parentFor(text), sensor, cadence: "weekly", origin: "strategy", ref: stream.code || stream.id || text, overrides }));
-    if (sensor.source === "human") degradations.push({ kind: "no_reachable_sensor", key: k, reason: `no reachable capability measures "${text}" (considered: ${sensor.considered.join(", ") || "none"})` });
+    const parentKey = parentFor(text);
+    record(
+      buildObjective({ k, text, parentKey, charterSectionId: sectionForPillar.get(parentKey) || null, sensor, cadence: "weekly", origin: "strategy", ref: stream.code || stream.id || text, overrides }),
+      { taken, base: text }
+    );
+    // Placement and measurability are INDEPENDENT debts. Reporting the sensor
+    // debt only for placed nodes would hide it exactly where it is worst.
+    if (!taken && sensor.source === "human") degradations.push({ kind: "no_reachable_sensor", key: k, reason: `no reachable capability measures "${text}" (considered: ${sensor.considered.join(", ") || "none"})` });
   }
 
   // ── 3. OBJECTIVEs from the archetype's KPI categories ───────────────────
@@ -202,13 +311,14 @@ export function deriveMandate(input = {}) {
     if (!cat || !cat.id) continue;
     const text = cat.name || cat.id;
     const example = Array.isArray(cat.examples) && cat.examples.length ? cat.examples[0] : "";
-    const k = key(cat.id);
+    const { key: k, taken } = key(cat.id);
     const sensor = pickSensor(`${text} ${example}`, reachable);
-    objectives.push(buildObjective({
-      k, text, parentKey: parentFor(`${text} ${example}`), sensor, cadence: "weekly",
+    const parentKey = parentFor(`${text} ${example}`);
+    record(buildObjective({
+      k, text, parentKey, charterSectionId: sectionForPillar.get(parentKey) || null, sensor, cadence: "weekly",
       origin: "archetype", ref: `kpiCategory:${cat.id}`, metric: example ? slug(example).replace(/-/g, "_") : undefined, overrides,
-    }));
-    if (sensor.source === "human") degradations.push({ kind: "no_reachable_sensor", key: k, reason: `no reachable capability measures "${text}" (considered: ${sensor.considered.join(", ") || "none"})` });
+    }), { taken, base: cat.id });
+    if (!taken && sensor.source === "human") degradations.push({ kind: "no_reachable_sensor", key: k, reason: `no reachable capability measures "${text}" (considered: ${sensor.considered.join(", ") || "none"})` });
   }
   if (kpiCategories.length === 0) {
     degradations.push({ kind: "no_kpi_categories", reason: "archetype profile carried no kpiCategories — the mandate has no role-derived objectives" });
@@ -218,10 +328,13 @@ export function deriveMandate(input = {}) {
   for (const p of priorities) {
     const text = firstClause(p && (p.title || p.text || p.id));
     if (!text) continue;
-    const k = key(text);
+    const { key: k, taken } = key(text);
     const sensor = pickSensor(text, reachable);
     const parent = parentFor(text);
-    objectives.push(buildObjective({ k, text, parentKey: parent, sensor, cadence: "monthly", origin: "priorities", ref: (p && p.id) || text, kind: "GOAL", overrides }));
+    record(
+      buildObjective({ k, text, parentKey: parent, charterSectionId: sectionForPillar.get(parent) || null, sensor, cadence: "monthly", origin: "priorities", ref: (p && p.id) || text, kind: "GOAL", overrides }),
+      { taken, base: text }
+    );
   }
 
   const counts = {
@@ -230,6 +343,12 @@ export function deriveMandate(input = {}) {
     goals: objectives.filter((o) => o.kind === "GOAL").length,
     withMethodSensor: objectives.filter((o) => o.sensor && o.sensor.source === "method").length,
     proposed: objectives.length,
+    // What a human could ACTUALLY adopt today. This is the number that matters:
+    // "35 proposed / 0 adoptable" is the report A016 should have been producing
+    // for months, and "0 of 35 adopted" is what it produced instead.
+    adoptable: objectives.filter((o) => isAdoptable(o)).length,
+    // Named refusals, so the gap between the two numbers is never a mystery.
+    refused: degradations.filter((d) => d.kind === "no_pillar_trace" || d.kind === "duplicate_key").length,
   };
 
   return { objectives, degradations, counts };
@@ -289,14 +408,20 @@ export function toMandateBody(o = {}) {
 // helpers
 // ---------------------------------------------------------------------------
 
-function buildObjective({ k, text, parentKey, sensor, cadence, origin, ref, metric, kind = "OBJECTIVE", overrides = {} }) {
+function buildObjective({ k, text, parentKey, charterSectionId = null, sensor, cadence, origin, ref, metric, kind = "OBJECTIVE", overrides = {} }) {
   const ov = overrides[k] || {};
   const obj = {
     key: k,
     kind,
     text,
     parentKey: parentKey || null,
-    charterSectionId: null,
+    // INHERITED from the pillar this node hangs off. It used to be hardcoded
+    // null, and `lib/setup/sections/mandate.mjs` then posted `parentKey` to
+    // `mandate.propose` — which takes `parentId`/`charterSectionId` and ignores
+    // unknown params. So every proposal reached hq with BOTH provenance columns
+    // null, and hq's tree could never trace one back to a charter clause. Two
+    // silent drops, one on each side of the wire.
+    charterSectionId: charterSectionId || null,
     state: "proposed",
     metric: ov.metric || metric || `${k.replace(/-/g, "_")}`,
     unit: ov.unit || sensor.unit || null,
@@ -358,4 +483,4 @@ function overlapScore(a, b) {
   return n;
 }
 
-export default { deriveMandate, toMandateBody, pickSensor, slug, firstClause, SENSOR_HINTS, OBJECTIVE_KINDS, DIRECTIONS, CADENCES };
+export default { deriveMandate, toMandateBody, pickSensor, isAdoptable, slug, firstClause, SENSOR_HINTS, OBJECTIVE_KINDS, DIRECTIONS, CADENCES };

package/lib/mandate/derive.test.mjs

@@ -16,7 +16,7 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
 
-import { deriveMandate, toMandateBody, pickSensor, slug, firstClause } from "./derive.mjs";
+import { deriveMandate, toMandateBody, pickSensor, slug, firstClause, isAdoptable } from "./derive.mjs";
 import { validateMandateBody, pillars, ancestry, provenanceOf } from "./model.mjs";
 
 // ---------------------------------------------------------------------------
@@ -83,8 +83,10 @@ test("charter PILLAR sections become PILLAR nodes carrying their charterSectionI
 test("EVERYTHING derived is proposed — derivation can never adopt", () => {
   const r = deriveMandate({
     charterSections: CHARTER,
-    kpiCategories: [{ id: "pipeline", name: "Pipeline coverage", examples: ["pipeline_coverage_x"] }],
-    priorities: [{ id: "p1", title: "Land three lighthouse accounts" }],
+    // Both of these overlap a pillar's own words, so both are PLACEABLE — see
+    // the unplaced-node test below for the other half.
+    kpiCategories: [{ id: "revenue-coverage", name: "Revenue pipeline coverage", examples: ["pipeline_coverage_x"] }],
+    priorities: [{ id: "p1", title: "Lift retention among customers we win" }],
     manifest: MANIFEST,
   });
   assert.ok(r.objectives.length >= 4);
@@ -101,7 +103,7 @@ test("the derived tree is structurally valid: every objective hangs off a pillar
   const r = deriveMandate({
     charterSections: CHARTER,
     kpiCategories: [
-      { id: "pipeline", name: "Pipeline coverage", examples: ["pipeline_coverage_x"] },
+      { id: "revenue-coverage", name: "Revenue pipeline coverage", examples: ["pipeline_coverage_x"] },
       { id: "churn", name: "Customer retention rate", examples: ["logo_retention_pct"] },
     ],
     manifest: MANIFEST,
@@ -122,7 +124,7 @@ test("the derived tree is structurally valid: every objective hangs off a pillar
 test("provenance walks objective → pillar → charter clause, offline", () => {
   const r = deriveMandate({
     charterSections: CHARTER,
-    kpiCategories: [{ id: "pipeline", name: "Pipeline coverage", examples: ["pipeline_coverage_x"] }],
+    kpiCategories: [{ id: "revenue-coverage", name: "Revenue pipeline coverage", examples: ["pipeline_coverage_x"] }],
     manifest: MANIFEST,
   });
   const obj = r.objectives.find((o) => o.kind === "OBJECTIVE");
@@ -130,13 +132,55 @@ test("provenance walks objective → pillar → charter clause, offline", () =>
   assert.ok(prov.pillar, "an objective must resolve to a pillar");
   assert.match(prov.clause, /^cs_/, "and the pillar must carry the charter clause id");
   assert.ok(prov.chain.includes(obj.key));
+  // The clause id is also stamped on the OBJECTIVE ITSELF, not only on its
+  // pillar. hq's `mandate.propose` takes `charterSectionId`; it has no idea what
+  // a `parentKey` is, so a node that carried provenance only through its parent
+  // reached the server with BOTH provenance columns null — which is why all 35
+  // of A016's proposals had `charterSectionId: null`.
+  assert.equal(obj.charterSectionId, prov.clause);
+});
+
+test("an objective that overlaps NO pillar is carried UNPLACED, never auto-attached to the first one", () => {
+  // The old fallback parented anything unmatched onto `pillarKeys[0]`. On A016
+  // that put `global-footprint` and `capital-formation-aum-growth` under
+  // `own-the-agent-platform-substrate`: an edge that existed, rendered, and was
+  // fiction.
+  const r = deriveMandate({
+    charterSections: CHARTER,
+    kpiCategories: [{ id: "warehouse-latency", name: "Warehouse latency", examples: ["p95_ms"] }],
+    manifest: MANIFEST,
+  });
+  const orphan = r.objectives.find((o) => o.key === "warehouse-latency");
+  assert.ok(orphan, "the node is KEPT — dropping it would delete work somebody asked for");
+  assert.equal(orphan.parentKey, null, "and it is NOT attached to an unrelated pillar");
+  assert.equal(orphan.charterSectionId, null);
+  assert.ok(
+    r.degradations.some((d) => d.kind === "no_pillar_trace" && d.key === "warehouse-latency"),
+    `expected a no_pillar_trace degradation; got ${JSON.stringify(r.degradations)}`
+  );
+  assert.equal(isAdoptable(orphan), false, "an unplaced objective is not adoptable");
+});
+
+test("a slug collision folds into the existing objective instead of minting an `x-2` mirror", () => {
+  // Ten of A016's 35 proposals were `x` (OBJECTIVE/weekly) + `x-2` (GOAL/monthly)
+  // pairs: one accountability, two rows, two obligations, two gaps.
+  const r = deriveMandate({
+    charterSections: CHARTER,
+    kpiCategories: [{ id: "revenue-coverage", name: "Revenue pipeline coverage", examples: ["pipeline_coverage_x"] }],
+    priorities: [{ id: "p1", title: "Revenue coverage" }],
+    manifest: MANIFEST,
+  });
+  const keys = r.objectives.map((o) => o.key);
+  assert.equal(keys.filter((k) => k === "revenue-coverage").length, 1);
+  assert.ok(!keys.some((k) => /-\d+$/.test(k)), `no mirror key may be minted; got ${keys.join(", ")}`);
+  assert.ok(r.degradations.some((d) => d.kind === "duplicate_key"));
 });
 
 test("an objective with no reachable sensor is a recorded DEGRADATION, not a silent human task", () => {
   const r = deriveMandate({
     charterSections: CHARTER,
     // A KPI category nothing in the manifest can measure.
-    kpiCategories: [{ id: "brand-sentiment", name: "Brand sentiment", examples: ["nps_score"] }],
+    kpiCategories: [{ id: "brand-sentiment", name: "Customer brand sentiment", examples: ["nps_score"] }],
     manifest: MANIFEST,
   });
   const obj = r.objectives.find((o) => o.key === "brand-sentiment");

package/lib/mandate/model.mjs

@@ -327,16 +327,43 @@ export function adoptedObjectives(source, opts = {}) {
     if (!o || bad.has(o.key)) return false;
     if (!MEASURABLE_KINDS.includes(String(o.kind).toUpperCase())) return false;
     if (o.state !== "active") return false;
-    if (isSelfAdopted(o, owner)) return false;
+    if (adoptionDefect(o, owner)) return false;
     return true;
   });
 }
 
+/**
+ * Why this objective's adoption cannot be trusted, or null when it can.
+ *
+ * TWO defects, and the second one used to FAIL OPEN — which mattered, because it
+ * was the cheaper attack. The stated threat model is "an agent handed a
+ * hand-edited state file"; forging a plausible supervisor id is work, DELETING
+ * the `adoptedById` field is one keystroke, and `isSelfAdopted` returned false
+ * for a missing field, so the row sailed through and compiled a live OUTCOME
+ * obligation with no adopter at all.
+ *
+ *   "missing_adoption_provenance" — `state:"active"` with no `adoptedById`. hq
+ *       stamps that column on every adopt, so an active row without one is
+ *       either a tampered cache or an hq bug. Both mean the same thing offline:
+ *       nobody is on record as having handed this seat the number, so it may not
+ *       drive graded work. Fail CLOSED, and name it.
+ *   "self_adopted" — the owner adopted its own target.
+ *
+ * @param {object} objective
+ * @param {string|null} [ownerMemberId]
+ * @returns {"missing_adoption_provenance"|"self_adopted"|null}
+ */
+export function adoptionDefect(objective, ownerMemberId) {
+  if (!objective) return null;
+  if (!objective.adoptedById) return "missing_adoption_provenance";
+  const owner = ownerMemberId || objective.ownerMemberId || objective.memberId || null;
+  if (owner && objective.adoptedById === owner) return "self_adopted";
+  return null;
+}
+
 /** True when a node was adopted by its own owning seat (the Goodhart hole). */
 export function isSelfAdopted(objective, ownerMemberId) {
-  if (!objective || !objective.adoptedById) return false;
-  const owner = ownerMemberId || objective.ownerMemberId || objective.memberId || null;
-  return !!owner && objective.adoptedById === owner;
+  return adoptionDefect(objective, ownerMemberId) === "self_adopted";
 }
 
 export default {
@@ -357,5 +384,6 @@ export default {
   provenanceOf,
   pillars,
   adoptedObjectives,
+  adoptionDefect,
   isSelfAdopted,
 };

package/lib/mandate/refresh.test.mjs

@@ -110,8 +110,22 @@ test("the staleness ladder degrades on a ramp, not a cliff", () => {
   assert.equal(permissionsForTier("expired").react, "none");
 });
 
-test("adoptedObjectives from the cache admits only active nodes", () => {
-  const rec = { body: { objectives: [{ key: "a", state: "active" }, { key: "b", state: "proposed" }] } };
+test("adoptedObjectives from the cache carries the WHOLE law, not just the state column", () => {
+  // cache.mjs used to export a second, law-free implementation that filtered on
+  // `state === "active"` alone — so whichever module a caller happened to import
+  // decided whether the anti-Goodhart law applied. It now delegates to
+  // lib/mandate/model.adoptedObjectives. One law, one implementation.
+  const rec = {
+    body: {
+      memberId: "M-OWNER",
+      objectives: [
+        { key: "a", kind: "OBJECTIVE", state: "active", adoptedById: "M-SUPERVISOR" },
+        { key: "b", kind: "OBJECTIVE", state: "proposed", adoptedById: "M-SUPERVISOR" },
+        { key: "c", kind: "OBJECTIVE", state: "active", adoptedById: "M-OWNER" },   // self-adopted
+        { key: "d", kind: "OBJECTIVE", state: "active" },                            // no provenance
+      ],
+    },
+  };
   assert.deepEqual(adoptedObjectives(rec).map((o) => o.key), ["a"]);
   assert.deepEqual(adoptedObjectives(null), []);
 });

package/lib/mcp/server.test.mjs

@@ -145,7 +145,16 @@ test("tools/list: full active surface (email tools present — family is vendore
   const r = await h.request("tools/list", {});
   const tools = r.result.tools;
   assert.equal(tools.length, getOrgTools().length, "one MCP tool per active table entry");
-  assert.equal(tools.length, 108, "email + artifact + desk families vendored → 108 tools");
+  // 108 → 117: the conversation-parity delta (+4 messaging per-message actions,
+  // +2 huddle start/join) and the macro/parity delta (+org_pulse, +org_huddle_end,
+  // +memory_recall).
+  // 117 → 122: the engagement + work-visibility delta. Three room primitives
+  // (messaging_open_group / messaging_create_channel / messaging_add_to_channel)
+  // are what let an agent START a conversation rather than only answer one;
+  // engage_colleagues is the judged version of that; work_track puts the ask on
+  // the board and moves it. The line above is the real invariant — this one just
+  // pins the number so a silent table change is visible in review.
+  assert.equal(tools.length, 122, "email + artifact + desk families vendored → 122 tools");
   const names = tools.map((t) => t.name);
   for (const expected of ["org_whoami", "org_describe", "org_rpc", "org_read", "messaging_send", "task_assign", "board_ready", "email_send", "email_inbox", "artifact_create", "artifact_act", "artifact_catalog", "email_mailboxes", "email_draft_send", "files_list", "calendar_find_a_time", "crm_list_deals", "books_reports", "meetings_recap_file"]) {
     assert.ok(names.includes(expected), `${expected} listed`);
@@ -154,10 +163,10 @@ test("tools/list: full active surface (email tools present — family is vendore
   h.server.stop();
 });
 
-test("tools/list honours the email gate (emailAvailable:false → 103 tools)", async () => {
+test("tools/list honours the email gate (emailAvailable:false → 117 tools)", async () => {
   const h = harness({ emailAvailable: false });
   const r = await h.request("tools/list", {});
-  assert.equal(r.result.tools.length, 103, "the 5 own-mailbox email tools drop out");
+  assert.equal(r.result.tools.length, 117, "the 5 own-mailbox email tools drop out");
   const names = new Set(r.result.tools.map((t) => t.name));
   // The five own-mailbox tools (email:true) are gated out …
   for (const gated of ["email_send", "email_inbox", "email_message", "email_thread", "email_mark_read"]) {