@sema-agent/client-core 0.97.1 → 0.99.0

package/dist/hitl/sessionPolicyDeliverable.js

@@ -1,8 +1,10 @@
-import { CONFIG_LEGACY_TOOL_NAME, RULES_LEGACY_TOOL_NAME } from '../engineErrorCodes.js';
+import { CONFIG_LEGACY_TOOL_NAME } from '../engineErrorCodes.js';
 import { rosterMountedNames } from '../rosterMountedNames.js';
 import { ruleCompileVerdict } from '../ruleCompileVerdict.js';
+import { readRuleEntry } from '../coreValuePorts.js';
+import { readOwnDataValue } from '../ownKey.js';
 import { ruleToolNameVerdictOf } from '../protocolSegment.js';
-import { PREFIXES_IN_PROSE, REFUSED_NAME_CLASSES, REFUSED_NAME_FIX, RULES_LEGACY_TOOL_NAME_WRITE_NOTE } from './refusedToolNameProse.js';
+import { PREFIXES_IN_PROSE, REFUSED_NAME_CLASSES, REFUSED_NAME_FIX } from './refusedToolNameProse.js';
 import { CORE_PROTOCOL_PREFIXES } from '../generated/toolNameTables.js';
 const COVERING_NAMESPACE_PREFIXES = CORE_PROTOCOL_PREFIXES;
 const WITHHELD_NOTICE = {
@@ -90,8 +92,9 @@ export function sessionPolicyDeliverable(behavior, rules, opts) {
             continue;
         }
         let why = withheldWhyOf(r);
+        const engineAsked = why === undefined;
         let currentName;
-        if (why === undefined) {
+        if (engineAsked) {
             const verdict = ruleToolNameVerdictOf(r);
             if (verdict.kind === 'unknown')
                 return unreadable();
@@ -103,6 +106,17 @@ export function sessionPolicyDeliverable(behavior, rules, opts) {
             else if (verdict.kind === 'unmintable_segment')
                 why = 'not_a_tool_name';
         }
+        let inertReason;
+        if (engineAsked) {
+            const reading = entryReadingOf(r);
+            if (reading === 'unknown')
+                return unreadable();
+            if (reading !== 'row') {
+                inertReason = reading.reason;
+                if (why === undefined)
+                    why = reading.why;
+            }
+        }
         if (why === undefined) {
             const grammar = ruleCompileVerdict(r, 'deny').kind;
             if (grammar === 'unknown')
@@ -115,13 +129,42 @@ export function sessionPolicyDeliverable(behavior, rules, opts) {
         if (why === undefined)
             exact.push(r);
         else {
-            withheld.push(why === 'legacy_tool_name' && currentName !== undefined ? { rule: r, why, currentName } : { rule: r, why });
+            withheld.push({
+                rule: r,
+                why,
+                ...(why === 'legacy_tool_name' && currentName !== undefined ? { currentName } : {}),
+                ...(inertReason !== undefined ? { inertReason } : {}),
+            });
         }
     }
-    if (withheld.length > 0 || exact.length === 0)
+    const blocking = withheld.some((w) => w.inertReason === undefined);
+    if (blocking || exact.length === 0)
         return { deliverable: {}, withheld };
     return { deliverable: { toolDeny: exact }, withheld };
 }
+function entryReadingOf(rule) {
+    try {
+        const reading = readRuleEntry(rule, 'deny');
+        if (typeof reading !== 'object' || reading === null)
+            return 'unknown';
+        const kind = readOwnDataValue(reading, 'kind');
+        if (kind === 'row') {
+            const compiled = readOwnDataValue(reading, 'compiled');
+            return typeof compiled === 'object' && compiled !== null ? 'row' : 'unknown';
+        }
+        if (kind !== 'inert')
+            return 'unknown';
+        const reason = readOwnDataValue(reading, 'reason');
+        if (reason === 'grammar' || reason === 'content_unsupported')
+            return { why: 'not_a_tool_name', reason };
+        if (reason === 'wildcard_all' || reason === 'namespace_wildcard')
+            return { why: 'wildcard', reason };
+        return 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
 export function sessionPolicyWithheldNotice(why) {
     return typeof why === 'string' && Object.hasOwn(WITHHELD_NOTICE, why)
         ? WITHHELD_NOTICE[why]
@@ -132,7 +175,5 @@ const LEGACY_TOOL_NAME_FAILURE_NOTE = `This run did not start: a tool rule appli
 export function legacyToolNameFailureNoteOf(code) {
     if (code === CONFIG_LEGACY_TOOL_NAME)
         return LEGACY_TOOL_NAME_FAILURE_NOTE;
-    if (code === RULES_LEGACY_TOOL_NAME)
-        return RULES_LEGACY_TOOL_NAME_WRITE_NOTE;
     return undefined;
 }

package/dist/hitl/sessionPolicyWire.d.ts

@@ -1,8 +1,10 @@
 import type { SessionPermissionRules, StoredSessionRules } from '@sema-agent/sdk';
+import type { UiLanguage } from '../env/uiLanguage.js';
 import type { SessionPolicyReading } from '../sessionPolicyCapability.js';
 import type { ToolRosterView } from '../toolRoster.js';
-import { CORE_RULE_TOOL_NAME_VERDICTS } from '../generated/engineFactTables.js';
+import { CORE_ALLOW_ENTRY_INERT_REASONS, CORE_RULE_TOOL_NAME_VERDICTS } from '../generated/engineFactTables.js';
 export type LegacyToolNameVerdict = Exclude<(typeof CORE_RULE_TOOL_NAME_VERDICTS)[number], 'current'>;
+export type SessionRuleInertReason = (typeof CORE_ALLOW_ENTRY_INERT_REASONS)[number];
 export interface SessionPolicyFacade {
     getPolicy(sessionId: string, opts?: {
         signal?: AbortSignal;
@@ -41,10 +43,16 @@ export type SessionPolicyFailure = {
     kind: 'request-rejected';
     message: string;
 } | {
-    kind: 'legacy-tool-name';
+    kind: 'earlier-grammar';
+    message: string;
+    field?: 'toolAllow';
+    entry?: string;
+} | {
+    kind: 'inert-entry';
     message: string;
     field?: SessionPolicyRemovedEntry['field'];
-    name?: string;
+    entry?: string;
+    reason?: SessionRuleInertReason;
     verdict?: LegacyToolNameVerdict;
     currentName?: string;
 } | {
@@ -58,11 +66,12 @@ export type SessionPolicyFailure = {
     message: string;
 };
 export declare function classifySessionPolicyFailure(e: unknown): SessionPolicyFailure;
-export type SessionPolicyMalformedWhy = 'envelope' | 'rev' | 'rule_field';
+export type SessionPolicyMalformedWhy = 'envelope' | 'rev' | 'rule_field' | 'grammar_stamp';
 export type SessionPolicyReadOutcome = {
     kind: 'present';
     rev: number;
     rules: SessionPermissionRules;
+    grammar?: number;
 } | {
     kind: 'malformed';
     why: SessionPolicyMalformedWhy;
@@ -82,6 +91,11 @@ export interface SessionPolicyTightenRequest {
 }
 export type SessionPolicyTightenUnknownWhy = 'face_unavailable' | 'session_not_found' | 'session_ownerless' | 'unauthorized' | 'request_rejected' | 'store_corrupt' | 'read_unreadable' | 'read_failed' | 'write_refused' | 'write_indeterminate' | 'write_receipt_unreadable' | 'write_receipt_mismatch';
 export declare const SESSION_POLICY_TIGHTEN_UNKNOWN_WHY: readonly SessionPolicyTightenUnknownWhy[];
+export type SessionPolicyEarlierGrammarRefusal = {
+    kind: 'refused';
+    why: 'earlier_grammar_rows';
+    entries: readonly SessionPolicyRemovedEntry[];
+};
 export type SessionPolicyTightenOutcome = {
     kind: 'written';
     rev: number;
@@ -94,23 +108,27 @@ export type SessionPolicyTightenOutcome = {
 } | {
     kind: 'capability_absent';
     why: 'not_reported' | 'absent';
-} | {
-    kind: 'legacy_tool_name';
-    message: string;
-    field?: SessionPolicyRemovedEntry['field'];
-    name?: string;
-    verdict?: LegacyToolNameVerdict;
-    currentName?: string;
+} | SessionPolicyEarlierGrammarRefusal | ({
+    kind: 'inert_entry';
+} & SessionPolicyInertEntryRefusal & {
     alreadyInRecord?: boolean;
-} | {
+}) | {
     kind: 'unknown';
     why: SessionPolicyTightenUnknownWhy;
     message?: string;
 };
+export interface SessionPolicyInertEntryRefusal {
+    message: string;
+    field?: SessionPolicyRemovedEntry['field'];
+    entry?: string;
+    reason?: SessionRuleInertReason;
+    verdict?: LegacyToolNameVerdict;
+    currentName?: string;
+}
 export declare function tightenSessionPolicy(facade: SessionPolicyFacade, req: SessionPolicyTightenRequest, opts?: {
     signal?: AbortSignal;
 }): Promise<SessionPolicyTightenOutcome>;
-export declare function sessionPolicyTightenNotice(outcome: SessionPolicyTightenOutcome): string;
+export declare function sessionPolicyTightenNotice(outcome: SessionPolicyTightenOutcome, lang?: UiLanguage): string;
 export declare function sessionPolicyReadNotice(outcome: Exclude<SessionPolicyReadOutcome, {
     kind: 'present';
 }> | {
@@ -153,14 +171,9 @@ export type SessionPolicyRemovalOutcome = {
     kind: 'write_unconfirmed';
     why: Extract<SessionPolicyTightenUnknownWhy, 'write_indeterminate' | 'write_receipt_unreadable' | 'write_receipt_mismatch'>;
     message?: string;
-} | {
-    kind: 'legacy_tool_name';
-    message: string;
-    field?: SessionPolicyRemovedEntry['field'];
-    name?: string;
-    verdict?: LegacyToolNameVerdict;
-    currentName?: string;
-};
+} | SessionPolicyEarlierGrammarRefusal | ({
+    kind: 'inert_entry';
+} & SessionPolicyInertEntryRefusal);
 export type SessionPolicyRosterRequiredWhy = 'absent' | 'unreadable';
 export declare function removeRefusedSessionRules(facade: SessionPolicyFacade, sessionId: string, roster: ToolRosterView | undefined, opts?: {
     signal?: AbortSignal;

package/dist/hitl/sessionPolicyWire.js

@@ -1,10 +1,17 @@
 import { wireFailureShapeOf } from '../wireFailureShape.js';
 import { hostLog } from '../host.js';
+import { msg, renderMessage } from '../i18n/translate.js';
 import { ruleToolNameVerdictOf } from '../protocolSegment.js';
-import { RULES_LEGACY_TOOL_NAME_WRITE_NOTE } from './refusedToolNameProse.js';
-import { RULES_LEGACY_TOOL_NAME, isRulesRefusalCode } from '../engineErrorCodes.js';
+import { RULES_INERT_ENTRY, RULES_INVALID_SHAPE, isRulesRefusalCode } from '../engineErrorCodes.js';
+import { deniedEntryToolName } from '../engineToolDirectory.js';
 import { rosterMountedNames } from '../rosterMountedNames.js';
-import { CORE_RULE_TOOL_NAME_VERDICTS } from '../generated/engineFactTables.js';
+import { CORE_ALLOW_ENTRY_INERT_REASONS, CORE_RULE_TOOL_NAME_VERDICTS } from '../generated/engineFactTables.js';
+const EARLIER_GRAMMAR_REASON = 'earlier_grammar';
+const _inertReasonPin = true;
+void _inertReasonPin;
+function isSessionRuleInertReason(v) {
+    return typeof v === 'string' && CORE_ALLOW_ENTRY_INERT_REASONS.includes(v);
+}
 function isLegacyToolNameVerdict(v) {
     return typeof v === 'string' && v !== 'current' && CORE_RULE_TOOL_NAME_VERDICTS.includes(v);
 }
@@ -12,25 +19,43 @@ const RULE_FIELD_PRESENCE = {
     toolAllow: true,
     toolDeny: true,
     allowDirs: true,
-    commandAllow: true,
-    commandDeny: true,
 };
+const RECORD_META_KEYS = Object.freeze(['rev', 'gen', 'grammar']);
+const _metaKeysPin = true;
+void _metaKeysPin;
 export const SESSION_POLICY_RULE_FIELDS = Object.freeze(Object.keys(RULE_FIELD_PRESENCE));
+function foreignRecordKeysOf(record) {
+    return Object.getOwnPropertyNames(record).filter((key) => !SESSION_POLICY_RULE_FIELDS.includes(key) && !RECORD_META_KEYS.includes(key));
+}
+function recordKeyLabel(key) {
+    return /^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(key) ? `"${key}"` : 'unnamed';
+}
 const MAX_RULE_ENTRIES = 10_000;
 export function classifySessionPolicyFailure(e) {
-    const { status, errorCode, message, bodyField, bodyName, bodyVerdict, bodyCurrentName } = wireFailureShapeOf(e);
+    const { status, errorCode, message, bodyField, bodyVerdict, bodyCurrentName, bodyEntry, bodyReason } = wireFailureShapeOf(e);
     if (errorCode === undefined || errorCode === '')
         return { kind: 'no-verdict', message };
-    if (errorCode === RULES_LEGACY_TOOL_NAME) {
+    if (errorCode === RULES_INERT_ENTRY && bodyReason === EARLIER_GRAMMAR_REASON && status !== undefined && status >= 400 && status < 500) {
+        return {
+            kind: 'earlier-grammar',
+            message,
+            ...(bodyField === 'toolAllow' ? { field: bodyField } : {}),
+            ...(bodyEntry !== undefined && bodyEntry !== '' ? { entry: bodyEntry } : {}),
+        };
+    }
+    if (errorCode === RULES_INERT_ENTRY && status !== undefined && status >= 400 && status < 500) {
         return {
-            kind: 'legacy-tool-name',
+            kind: 'inert-entry',
             message,
             ...(bodyField === 'toolDeny' || bodyField === 'toolAllow' ? { field: bodyField } : {}),
-            ...(bodyName !== undefined && bodyName !== '' ? { name: bodyName } : {}),
+            ...(bodyEntry !== undefined && bodyEntry !== '' ? { entry: bodyEntry } : {}),
+            ...(isSessionRuleInertReason(bodyReason) ? { reason: bodyReason } : {}),
             ...(isLegacyToolNameVerdict(bodyVerdict) ? { verdict: bodyVerdict } : {}),
             ...(bodyCurrentName !== undefined && bodyCurrentName !== '' ? { currentName: bodyCurrentName } : {}),
         };
     }
+    if (errorCode === RULES_INVALID_SHAPE && status !== undefined && status >= 400 && status < 500)
+        return { kind: 'request-rejected', message };
     if (isRulesRefusalCode(errorCode) && status !== undefined && status >= 400 && status < 500)
         return { kind: 'error', message };
     if (status === 501 || errorCode === 'capability.session_store_required') {
@@ -95,6 +120,21 @@ function narrowStoredRecord(body) {
     if (typeof rev !== 'number' || !Number.isSafeInteger(rev) || rev < 0) {
         return { ok: false, why: 'rev', detail: 'policy record carries no readable version stamp' };
     }
+    let grammarSlot;
+    try {
+        grammarSlot = Object.getOwnPropertyDescriptor(envelope, 'grammar');
+    }
+    catch {
+        return { ok: false, why: 'grammar_stamp', detail: 'policy record’s rule-grammar stamp could not be read' };
+    }
+    let grammar;
+    if (grammarSlot !== undefined) {
+        const v = Object.hasOwn(grammarSlot, 'value') ? grammarSlot.value : undefined;
+        if (typeof v !== 'number' || !Number.isSafeInteger(v) || v < 0) {
+            return { ok: false, why: 'grammar_stamp', detail: 'policy record carries a rule-grammar stamp that is not a whole number of 0 or more' };
+        }
+        grammar = v;
+    }
     const rules = {};
     for (const field of SESSION_POLICY_RULE_FIELDS) {
         if (!Object.hasOwn(envelope, field))
@@ -107,7 +147,19 @@ function narrowStoredRecord(body) {
             return { ok: false, why: 'rule_field', detail: read.detail };
         rules[field] = read.list;
     }
-    return { ok: true, rev, rules };
+    for (const key of foreignRecordKeysOf(envelope)) {
+        const slot = Object.getOwnPropertyDescriptor(envelope, key);
+        if (slot === undefined)
+            continue;
+        if (!Object.hasOwn(slot, 'value') || Array.isArray(slot.value)) {
+            return {
+                ok: false,
+                why: 'rule_field',
+                detail: `policy record carries a rule field this client does not read (${recordKeyLabel(key)}) — refusing to treat it as readable, since writing the record back would drop that field`,
+            };
+        }
+    }
+    return { ok: true, rev, rules, grammar };
 }
 export async function readSessionPolicy(facade, sessionId, opts) {
     let body;
@@ -126,7 +178,7 @@ export async function readSessionPolicy(facade, sessionId, opts) {
     }
     if (!read.ok)
         return { kind: 'malformed', why: read.why, detail: read.detail };
-    return { kind: 'present', rev: read.rev, rules: read.rules };
+    return { kind: 'present', rev: read.rev, rules: read.rules, ...(read.grammar !== undefined ? { grammar: read.grammar } : {}) };
 }
 export function tightenedSessionRules(prior, add) {
     const p = narrowRulesInput(prior, 'prior');
@@ -159,6 +211,10 @@ function narrowRulesInput(raw, side) {
     if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
         throw new TypeError(`tightenedSessionRules: "${side}" must be a rules record object`);
     }
+    const foreign = foreignRecordKeysOf(raw);
+    if (foreign.length > 0) {
+        throw new TypeError(`tightenedSessionRules: "${side}" carries a key that is not a rule field (${recordKeyLabel(foreign[0] ?? '')}) — it would not be written, so the record is refused instead of written without it`);
+    }
     const out = {};
     for (const field of SESSION_POLICY_RULE_FIELDS) {
         if (!Object.hasOwn(raw, field))
@@ -173,10 +229,13 @@ function narrowRulesInput(raw, side) {
     }
     return out;
 }
-function receiptMismatch(sent, receipt, sentRev, receiptRev) {
+function receiptMismatch(sent, receipt, sentRev, receiptRev, sentGrammar, receiptGrammar) {
     if (receiptRev <= sentRev) {
         return `policy write receipt did not advance the version stamp (sent with ${sentRev}, receipt says ${receiptRev})`;
     }
+    if (sentGrammar !== undefined && (receiptGrammar === undefined || receiptGrammar < sentGrammar)) {
+        return `policy write receipt does not carry the rule-grammar stamp that was sent (sent ${sentGrammar}, receipt ${receiptGrammar === undefined ? 'carries none' : `says ${receiptGrammar}`}) — the stored entries may now read differently`;
+    }
     for (const field of SESSION_POLICY_RULE_FIELDS) {
         const s = Object.hasOwn(sent, field) ? sent[field] : undefined;
         if (s === undefined)
@@ -227,32 +286,66 @@ function unknownFrom(failure, leg) {
             return { kind: 'unknown', why: leg === 'read' ? 'read_failed' : 'write_indeterminate', message };
         case 'loosen-forbidden':
         case 'cas-conflict':
-        case 'legacy-tool-name':
+        case 'earlier-grammar':
+        case 'inert-entry':
         case 'error':
             return { kind: 'unknown', why: leg === 'read' ? 'read_failed' : 'write_refused', message };
     }
 }
-function legacyToolNameOutcome(failure, prior, add) {
-    const { field, name, verdict, currentName } = failure;
-    let alreadyInRecord;
-    if (field !== undefined && name !== undefined) {
-        const inPrior = Object.hasOwn(prior, field) ? prior[field] : undefined;
-        const inAdd = Object.hasOwn(add, field) ? add[field] : undefined;
-        if (inPrior !== undefined && inPrior.includes(name))
-            alreadyInRecord = true;
-        else if (inAdd !== undefined && inAdd.includes(name))
-            alreadyInRecord = false;
-    }
+function alreadyInRecordOf(field, entry, prior, add) {
+    if (field === undefined || entry === undefined)
+        return undefined;
+    const inPrior = Object.hasOwn(prior, field) ? prior[field] : undefined;
+    const inAdd = Object.hasOwn(add, field) ? add[field] : undefined;
+    if (inPrior !== undefined && inPrior.includes(entry))
+        return true;
+    if (inAdd !== undefined && inAdd.includes(entry))
+        return false;
+    return undefined;
+}
+function inertEntryRefusalOf(failure) {
+    const { field, entry, reason, verdict, currentName } = failure;
     return {
-        kind: 'legacy_tool_name',
         message: failure.message,
         ...(field !== undefined ? { field } : {}),
-        ...(name !== undefined ? { name } : {}),
+        ...(entry !== undefined ? { entry } : {}),
+        ...(reason !== undefined ? { reason } : {}),
         ...(verdict !== undefined ? { verdict } : {}),
         ...(currentName !== undefined ? { currentName } : {}),
-        ...(alreadyInRecord !== undefined ? { alreadyInRecord } : {}),
     };
 }
+function earlierGrammarEntriesOf(prior, outgoing) {
+    const priorAllow = Object.hasOwn(prior, 'toolAllow') ? prior.toolAllow : undefined;
+    const outAllow = Object.hasOwn(outgoing, 'toolAllow') ? outgoing.toolAllow : undefined;
+    if (priorAllow === undefined || outAllow === undefined)
+        return [];
+    const carried = new Set(outAllow);
+    const seen = new Set();
+    const out = [];
+    for (const rule of priorAllow) {
+        if (seen.has(rule) || !carried.has(rule))
+            continue;
+        const name = deniedEntryToolName(rule);
+        if (name === undefined || name === rule)
+            continue;
+        seen.add(rule);
+        out.push({ field: 'toolAllow', rule });
+    }
+    return out;
+}
+function earlierGrammarOutcome(failure) {
+    return {
+        kind: 'refused',
+        why: 'earlier_grammar_rows',
+        entries: Object.hasOwn(failure, 'field') && Object.hasOwn(failure, 'entry') && failure.field !== undefined && failure.entry !== undefined ? [{ field: failure.field, rule: failure.entry }] : [],
+    };
+}
+function rulesWithStamp(rules, grammar) {
+    return grammar === undefined ? rules : { ...rules, grammar };
+}
+function grammarStampOf(read) {
+    return Object.hasOwn(read, 'grammar') ? read.grammar : undefined;
+}
 async function attemptTighten(facade, req, opts) {
     const read = await readSessionPolicy(facade, req.sessionId, opts);
     if (read.kind === 'failed')
@@ -261,9 +354,15 @@ async function attemptTighten(facade, req, opts) {
         return { done: { kind: 'unknown', why: 'read_unreadable', message: read.detail } };
     }
     const rules = tightenedSessionRules(read.rules, req.add);
+    const stamp = grammarStampOf(read);
+    if (stamp === undefined) {
+        const earlier = earlierGrammarEntriesOf(read.rules, rules);
+        if (earlier.length > 0)
+            return { done: { kind: 'refused', why: 'earlier_grammar_rows', entries: earlier } };
+    }
     let receipt;
     try {
-        receipt = await facade.putPolicy(req.sessionId, { rules, expectedRev: read.rev }, opts);
+        receipt = await facade.putPolicy(req.sessionId, { rules: rulesWithStamp(rules, stamp), expectedRev: read.rev }, opts);
     }
     catch (e) {
         const failure = classifySessionPolicyFailure(e);
@@ -271,8 +370,12 @@ async function attemptTighten(facade, req, opts) {
             return { done: { kind: 'loosen_forbidden', message: failure.message } };
         if (failure.kind === 'cas-conflict')
             return { retryAtRev: read.rev };
-        if (failure.kind === 'legacy-tool-name')
-            return { done: legacyToolNameOutcome(failure, read.rules, req.add) };
+        if (failure.kind === 'earlier-grammar')
+            return { done: earlierGrammarOutcome(failure) };
+        if (failure.kind === 'inert-entry') {
+            const alreadyInRecord = alreadyInRecordOf(failure.field, failure.entry, read.rules, req.add);
+            return { done: { kind: 'inert_entry', ...inertEntryRefusalOf(failure), ...(alreadyInRecord !== undefined ? { alreadyInRecord } : {}) } };
+        }
         return { done: unknownFrom(failure, 'write') };
     }
     let narrowed;
@@ -285,7 +388,7 @@ async function attemptTighten(facade, req, opts) {
     if (!narrowed.ok) {
         return { done: { kind: 'unknown', why: 'write_receipt_unreadable', message: narrowed.detail } };
     }
-    const mismatch = receiptMismatch(rules, narrowed.rules, read.rev, narrowed.rev);
+    const mismatch = receiptMismatch(rules, narrowed.rules, read.rev, narrowed.rev, stamp, narrowed.grammar);
     if (mismatch !== null)
         return { done: { kind: 'unknown', why: 'write_receipt_mismatch', message: mismatch } };
     return { done: { kind: 'written', rev: narrowed.rev } };
@@ -309,46 +412,48 @@ export async function tightenSessionPolicy(facade, req, opts) {
         return second.done;
     return { kind: 'conflict', rev: second.retryAtRev };
 }
-export function sessionPolicyTightenNotice(outcome) {
+const earlierGrammarNote = (lang) => renderMessage(msg('rules.sessionPolicy.tighten.earlierGrammar'), lang);
+export function sessionPolicyTightenNotice(outcome, lang) {
+    const say = (key, params) => renderMessage(msg(key, params), lang);
     switch (outcome.kind) {
         case 'written':
-            return `Session rules saved (version ${outcome.rev}) — the record now holds everything it already had plus the entries sent here, and it applies from this session’s next tool gate onward; the step already running is not interrupted.`;
+            return say('rules.sessionPolicy.tighten.written', { rev: outcome.rev });
         case 'conflict':
-            return 'Session rules were changed by someone else while this tightening was being written, twice in a row — nothing was written. Re-read the current rules and try again, or let the other writer finish first.';
+            return say('rules.sessionPolicy.tighten.conflict');
         case 'loosen_forbidden':
-            return 'The engine refused this write because it would relax the session rules: at least one entry sent here widens what is allowed rather than narrowing it. Only entries that add restrictions are accepted on this path.';
+            return say('rules.sessionPolicy.tighten.loosenForbidden');
         case 'capability_absent':
-            return outcome.why === 'absent'
-                ? 'This deployment does not keep per-session tool rules, so there is nothing to tighten here.'
-                : 'This engine does not say whether it keeps per-session tool rules — it predates that answer — so the tightening entry stays hidden rather than being written blind.';
-        case 'legacy_tool_name':
-            return RULES_LEGACY_TOOL_NAME_WRITE_NOTE;
+            return outcome.why === 'absent' ? say('rules.sessionPolicy.tighten.capabilityAbsent') : say('rules.sessionPolicy.tighten.capabilityNotReported');
+        case 'refused':
+            return earlierGrammarNote(lang);
+        case 'inert_entry':
+            return say('rules.sessionPolicy.tighten.inertEntry');
         case 'unknown':
             switch (outcome.why) {
                 case 'face_unavailable':
-                    return 'This deployment does not keep per-session tool rules, so nothing was written.';
+                    return say('rules.sessionPolicy.tighten.unknown.faceUnavailable');
                 case 'session_not_found':
-                    return 'This session is not readable from here — it may not exist, or it may belong to someone else (the engine answers both the same way, so this client cannot tell which); nothing was written.';
+                    return say('rules.sessionPolicy.tighten.unknown.sessionNotFound');
                 case 'session_ownerless':
-                    return 'This session has no owner, so a rule written for it could never be read back; nothing was written. Attach an identity to the session and try again.';
+                    return say('rules.sessionPolicy.tighten.unknown.sessionOwnerless');
                 case 'unauthorized':
-                    return 'This call could not present a verifiable identity, so nothing was written.';
+                    return say('rules.sessionPolicy.tighten.unknown.unauthorized');
                 case 'request_rejected':
-                    return 'The engine rejected the shape of this rule record, so nothing was written. Fix the entries before sending them again.';
+                    return say('rules.sessionPolicy.tighten.unknown.requestRejected');
                 case 'store_corrupt':
-                    return 'The engine could not establish which version this session’s rules are at and refused to stamp a new one, so nothing was written. The entries sent here are not the problem — this needs an operator to look at the rule store.';
+                    return say('rules.sessionPolicy.tighten.unknown.storeCorrupt');
                 case 'read_unreadable':
-                    return 'The session’s current rules could not be read, so nothing was written — writing over a record that cannot be read would replace real restrictions with an empty one.';
+                    return say('rules.sessionPolicy.tighten.unknown.readUnreadable');
                 case 'read_failed':
-                    return 'The session’s current rules could not be fetched, so nothing was written.';
+                    return say('rules.sessionPolicy.tighten.unknown.readFailed');
                 case 'write_refused':
-                    return 'The engine refused this write, so nothing was written. Re-read the current rules before trying again.';
+                    return say('rules.sessionPolicy.tighten.unknown.writeRefused');
                 case 'write_indeterminate':
-                    return 'The write never came back with an answer from the engine — it may or may not have taken effect. Re-read the current rules before writing anything else.';
+                    return say('rules.sessionPolicy.tighten.unknown.writeIndeterminate');
                 case 'write_receipt_unreadable':
-                    return 'The tightening was sent but the engine’s answer could not be read — it may already be in effect. Re-read the current rules before writing anything else.';
+                    return say('rules.sessionPolicy.tighten.unknown.writeReceiptUnreadable');
                 case 'write_receipt_mismatch':
-                    return 'The tightening was sent but the engine’s answer does not account for it (the version did not advance, or the entries sent here are not in the returned record) — it may already be in effect. Re-read the current rules before writing anything else.';
+                    return say('rules.sessionPolicy.tighten.unknown.writeReceiptMismatch');
             }
     }
 }
@@ -371,8 +476,10 @@ function readFailureSentence(kind) {
             return 'This session is not readable from here — it may not exist, or it may belong to someone else (the engine answers both the same way, so this client cannot tell which) — so its rule record cannot be shown. Check that you are connected to the engine and the session you meant, or continue in a new session.';
         case 'request-rejected':
             return 'The engine rejected the request to read this session’s rule record as malformed, so it could not be read. Sending the same request again will not change that; check which session was asked for.';
-        case 'legacy-tool-name':
-            return 'The engine answered this read with a refusal about a tool name it no longer accepts, so this session’s rule record could not be read. Try again; if it keeps happening, whoever runs the engine needs to look at it.';
+        case 'earlier-grammar':
+            return 'The engine answered this read with a refusal that only applies to writing back rules saved under an earlier rule grammar, so this session’s rule record could not be read. Try again; if it keeps happening, whoever runs the engine needs to look at it.';
+        case 'inert-entry':
+            return 'The engine answered this read with a refusal that only applies to writing a rule entry it reads as matching nothing, so this session’s rule record could not be read. Try again; if it keeps happening, whoever runs the engine needs to look at it.';
         case 'unauthorized':
             return 'This call could not present a verifiable identity, so this session’s rule record could not be read.';
         case 'error':
@@ -389,6 +496,8 @@ function readMalformedSentence(why) {
             return 'The engine’s answer for this session’s rule record carried no usable version, so this version will not show it — a record it cannot place may still hold restrictions that are in effect. Try again.';
         case 'rule_field':
             return 'One of the lists in this session’s rule record came back in a form this version cannot read, so none of the record is shown rather than part of it — a partly shown record could leave out restrictions that are in effect.';
+        case 'grammar_stamp':
+            return 'The engine’s answer for this session’s rule record carried a rule-grammar mark this version cannot read, so it will not show the record — the same entry can mean different things in different grammars, so what it allows is not known. Try again; if it keeps happening, this version and the engine may be out of step.';
     }
 }
 function ownRead(o, key) {
@@ -492,9 +601,15 @@ async function attemptRemoval(facade, sessionId, mounted, opts) {
     const { next, removed } = judged;
     if (removed.length === 0)
         return { done: { kind: 'nothing_to_remove', rev: read.rev } };
+    const stamp = grammarStampOf(read);
+    if (stamp === undefined) {
+        const earlier = earlierGrammarEntriesOf(read.rules, next);
+        if (earlier.length > 0)
+            return { done: { kind: 'refused', why: 'earlier_grammar_rows', entries: earlier } };
+    }
     let receipt;
     try {
-        receipt = await facade.putPolicy(sessionId, { rules: next, expectedRev: read.rev }, opts);
+        receipt = await facade.putPolicy(sessionId, { rules: rulesWithStamp(next, stamp), expectedRev: read.rev }, opts);
     }
     catch (e) {
         const failure = classifySessionPolicyFailure(e);
@@ -502,18 +617,10 @@ async function attemptRemoval(facade, sessionId, mounted, opts) {
             return { done: { kind: 'loosen_forbidden', message: failure.message, refused: removed } };
         if (failure.kind === 'cas-conflict')
             return { retryAtRev: read.rev };
-        if (failure.kind === 'legacy-tool-name') {
-            return {
-                done: {
-                    kind: 'legacy_tool_name',
-                    message: failure.message,
-                    ...(failure.field !== undefined ? { field: failure.field } : {}),
-                    ...(failure.name !== undefined ? { name: failure.name } : {}),
-                    ...(failure.verdict !== undefined ? { verdict: failure.verdict } : {}),
-                    ...(failure.currentName !== undefined ? { currentName: failure.currentName } : {}),
-                },
-            };
-        }
+        if (failure.kind === 'earlier-grammar')
+            return { done: earlierGrammarOutcome(failure) };
+        if (failure.kind === 'inert-entry')
+            return { done: { kind: 'inert_entry', ...inertEntryRefusalOf(failure) } };
         return { done: removalFailed(failure, 'write') };
     }
     let narrowed;
@@ -525,7 +632,7 @@ async function attemptRemoval(facade, sessionId, mounted, opts) {
     }
     if (!narrowed.ok)
         return { done: { kind: 'write_unconfirmed', why: 'write_receipt_unreadable', message: narrowed.detail } };
-    const mismatch = receiptMismatch(next, narrowed.rules, read.rev, narrowed.rev) ??
+    const mismatch = receiptMismatch(next, narrowed.rules, read.rev, narrowed.rev, stamp, narrowed.grammar) ??
         (removed.some((e) => {
             const r = Object.hasOwn(narrowed.rules, e.field) ? narrowed.rules[e.field] : undefined;
             return r !== undefined && r.includes(e.rule);
@@ -609,8 +716,10 @@ export function sessionPolicyRemovalNotice(outcome) {
             }
         case 'write_unconfirmed':
             return 'The removal was sent but no clear answer came back from the engine — it may already be in effect. Run the removal again: it re-reads the record, and reports nothing left to remove if it did take effect.';
-        case 'legacy_tool_name':
-            return 'Nothing was changed: the engine refused to write this session’s rule record back, because an entry this removal keeps is a name the engine no longer accepts in that record (the engine\'s own error text names the entry). The removal keeps it on purpose — the supplied roster mounts a tool by exactly that name, or this version does not yet recognise the name as one the engine refuses. While the record holds that entry it cannot be written, so the entries this removal meant to take out stay in it as well.';
+        case 'refused':
+            return earlierGrammarNote();
+        case 'inert_entry':
+            return 'Nothing was changed: the engine refused to write this session’s rule record back, because an entry this removal keeps reads as matching nothing (the engine’s own error text names the entry and why). This removal only takes out names the engine refuses to start a run with, so it leaves that entry for a person to correct or remove; while the record holds it, it cannot be written, so the entries this removal meant to take out stay in it as well.';
         default:
             return generic;
     }