@sema-agent/core 7.24.2 → 7.24.4

package/CHANGELOG.md

@@ -1,6 +1,56 @@
 # Changelog
 
-## Unreleased
+## 7.24.4 — 2026-09-20
+
+### Every rule source is re-read at every gate (#978 ①; P2; behavior-face widening of when a session rule binds; no wire key; @server @cli @test)
+- **Before.** `sessionPolicyStore.getRules` was read ONCE, at prepare, and the compiled rules were frozen for the leg; only the ANCESTOR snapshots were re-read live, and only at prepare too. The permission-rule store, meanwhile, is read at every adjudicated call. So a deployment that wrote a `deny` to a session's policy row while the run was going — the ordinary shape of an operator narrowing a task already in flight — watched the run's next calls execute anyway; the deny bound the NEXT run. Measured downstream: the row was written at the first `tool_end` and 3/3 later calls of that tool still ran. Worse, a session with NO row at prepare composed no layer at all, so a session's FIRST rule could never bind mid-run whatever the read tempo.
+- **After — one law, both stores.** A session-rule layer takes its rules from a `SessionRuleSource` at EVERY gate. The prepare read is a SEED, not the reading: it is what the prepare-time policy-name audit sees and the floor a live read may never loosen. The layer is composed whenever the store is wired for the session, including when the row is empty (an empty seed constrains nothing, and a layer that was never composed cannot re-read anything). The ancestor lane uses the same reader rather than its own hand-written live-preferring read.
+- **Direction, unchanged.** Whole-row replacement at `live.rev >= floor.rev` — an operator's AUTHORIZED change propagates in both directions (tighten and relax). What the floor forbids is an UNAUTHORIZED loosening: a lagging replica, a deleted row and an unreachable store each enforce the floor instead. The floor RATCHETS to the highest-rev row the layer has served, so a row tightened mid-run and then unreadable cannot fall back past the tightening.
+- **Cost and loudness.** One store read per adjudicated call per layer, shared inside one call by the same bounded per-call handoff the permission-rule lanes use (first reader hands, second claims). That handoff has a real firing path here: `policyLayers` re-appends the narrowing layers AFTER a rewrite-capable caller layer, so one adjudication asks the layer twice under one id and both passes must judge one set of rules. A source that cannot be read discloses once per distinct reason through `onError` (`phase: "config"`, `code: "config.session_rules_unreadable"`) — the advisory channel the policy-name audit already uses, not a new notice code.
+- **The read is BOUNDED.** This is the only I/O the narrowing fold performs, and the resumed-execution path awaits that fold with a consumed approval already claimed — a store that never settled would strand the call rather than refuse it. The read now rides `withGateTimeout` on the gate's own signal and the tree's default deadline; an elapsed or aborted wait takes the same fail-closed arm as a throwing store (enforce the floor, disclose once).
+- **A vanished row ends its rev line.** `rev` counts within ONE row's lifetime — both bundled backends restart it at 1 after a delete, and the tighten gate has no prior row to judge the first write against, so a recreated row's rev can be climbed past an enforced floor by ordinary non-operator writes (measured: enforce rev 2, delete, three `{}` writes, rev 3 replaces the restriction). Once a row this layer served is observed GONE, nothing that appears afterwards is comparable to it and the floor is final for the leg. COST: a legitimate delete-then-recreate is not picked up until the next run, and a backend that answers "no row" transiently ends the line early — both conservative. A session that simply never had a row is unaffected and silent (absence is not a deletion).
+- **Five bounds an adversarial round added.** (a) A live row replaces the floor only on a STRICTLY GREATER `rev`: both bundled backends compute `rev` as `(prior?.rev ?? 0) + 1`, so a DELETED-and-recreated row restarts at 1, and at `>=` a recreated row that merely tied the enforced one would replace it — an unauthorized loosening wearing an update's shape. A tie now enforces the floor (a no-op for the honest case, where equal rev is the same row). This raises the cost of the recycle rather than closing it — the rev can still be climbed past the floor by repeated writes, because the tighten gate has no prior row to judge against after a delete; closing it belongs to the STORE's rev lifecycle (a counter that survives deletion, or a generation identity) and is a cross-backend contract change. (b) A handed read is CLAIMED only while its `rev` still stands at the enforced floor: `toolCallId` is not always unique (the turn-boundary read-visibility query reuses one synthetic id for every path and every turn), and a claim from a later adjudication would otherwise walk back past a tightening the layer already applied. (c) The enforced row is published for the child chain from the same place it is enforced, each time the floor advances — so a rule written mid-run reaches a child spawned after it, and a child whose own store read fails falls back to its parent's CURRENT floor rather than an older one. The empty seed is never published (it is not a row a child may inherit).
+- **Reach.** `createSessionRulePolicy`'s first parameter widens to `SessionPermissionRules | SessionRuleSource` (additive; a plain rules object is still the constant source and every existing caller is unchanged). No wire key, code or closed-set member moves. RESIDUAL, recorded: a child spawned BEFORE the session's first row exists inherits no ancestor entry — seeding an empty one would put an `ancestorRules` row on every delegated child of every store-bearing deployment, which other readers take to mean "this leg is delegated". `test/backlog978-session-rules-every-gate.test.ts` pins the mid-run first deny, the mid-run tighten, the authorized relaxation, the three fail-closed arms (store down, lagging replica, deleted row), the ancestor lane, the read count, the handoff, the rev-recycle / claim-revalidation / vanished-row / bounded-read arms, the child-chain publication, and the two no-rule controls; 8 of the 10 Runner-level ones are red on 7.24.2.
+
+### One sentence for "a rule refused this call" (#978 ②; P2; refusal TEXT change on two lanes; no wire key; @cli @server @test)
+- **Before.** Two rule stores can refuse a call and each spelled it its own way: `tool "X" is denied by a session rule`, `denied by permission rule "R" (layer)`, plus four further shapes for the session lane's containment arms (`write-capable tool "X" denied: …`, `write to "p" is outside …`), and a session `commandDeny` that came out as the coarse policy's generic `command "curl" is denied by policy`. The resumed-execution re-check asserted `a session rule` for a fold that also holds inherited ancestor rules, the frozen constraint projections and the skill scope. A consumer could not read which store had spoken — the confusion that produced the wrong answer to "is the rule store re-read at every gate?".
+- **After.** `src/core/rule-denial-sentence.ts` mints them all: `[tool "<tool>" is ]denied by <source>[ "<rule>"][ (<origin>)][: <detail>]`, over a closed source vocabulary derived from its own phrase table (`session` / `permission` / `narrowing`). The seven session-lane exits now differ only in the `detail` that says WHY; the session `commandDeny` refusal is re-minted as the session lane's own, carrying the coarse policy's sentence as its detail; the resumed re-check names the fold instead of one of its layers.
+- **What a reader keyed on the old text sees.** The permission lane's sentence gained a head and kept its tail byte-for-byte (`denied by permission rule "Bash(rm -r:*)" (settings.permissions.deny)` still `toContain`s). The session lane's plain tool-name denial is unchanged. The containment arms and the allowlist miss are REWORDED and keep their diagnostic substrings (`cannot be path-confined`, `declares no path target`, `no resolvable path`, `outside the session-rule allowDirs`, `not in the session-rule allowlist`). The ASK sentence (`flagged by permission rule …`) is deliberately untouched: an ask is a question on a card, not a refusal in a tool result.
+- **Reach.** No wire key, code, closed-set member or export moves; `PermissionResult.message` is a rendered string and this is a rendering change. `@cli` renders these in tool results — a fence pinned on a session-lane containment wording should re-pin on the substrings above. `test/backlog978-rule-denial-sentence.test.ts` pins the grammar, the two lanes' agreement on it, every session exit, the mint's composition, and a source scan holding the denial spellings to one module (its ceiling is stated: code lines only, and the ask / non-rule-store `denied by policy` faces are out of scope).
+
+### A workflow agent's fleet row now says which attempt it is on (#979; P2; presence change on an existing wire key, additive; no new key, no export; @client-core @server)
+- **Before.** `BackgroundChildEvent.seq` is contracted as "present whenever a cycle number is knowable, absent when no carrier exists". The `a*` delegation lanes have carried it on spawn / tick / terminal since #258; the `wa*` workflow lane carried it on NONE of its three frames — while it has held a carrier all along: the orchestration layer's stall/throttle retry re-runs the same logical agent on a fresh session under the SAME `wa*` id, which is exactly the "one row, two cycles" shape the field exists to separate. A fleet consumer folding rows by generation had a structurally unreachable third branch on this lane.
+- **After.** The `wa*` row carries a generation: a fresh spawn is `1`, and each retry of the same agent bumps it, so a tick or terminal says which attempt produced it. The number is the ROW's, taken at emit — never copied from a forwarded descendant's frame, the same rule `agentType` and `model` already follow on this lane.
+- **The carrier is the ATTEMPT counter, not the session rebind.** A retry also rebinds the row's transcript coordinate, and today the two move together — but the coordinate is a different fact (it is skipped for a spec shape that mints no id, and once the run is finalized), so counting rebinds would make the generation a property of whether a coordinate existed.
+- **Reach.** `seq` is now ALWAYS present on a `wa*` row, where it was always absent; a consumer that read that absence as "this lane has no generation" must now read the number, and an absent `seq` on a `wa*` row dates the producer as pre-7.24.4. `task_progress.seq` is UNCHANGED and still absent for workflow agents (no `a*` registry row). `@client-core` B4 folds rows by generation; `@server` relays the frame unchanged; `@cli` has no `wa*` fleet renderer. `docs/wire-consumption/unreleased-979.md` carries the table, including the disclosure that one Workflow fan-out's children all share ONE `parentToolCallId` (up to `maxAgents`, default 50) — `seq` separates one row's cycles, not two rows. `test/backlog979-workflow-bce-seq.test.ts` pins the six readings with a five-row mutation table.
+
+## 7.24.3 — 2026-09-20
+
+### A per-session value high in the prompt costs the whole shared prefix (#975; P2; prompt SECTION ORDER, no key and no wording change; @server @cli @client-core)
+- **Before.** The session reminder-mark declaration extended the reminder sentence inline, ~290 characters into the system prompt. The value is per-session random, and a provider-side prefix cache (vLLM automatic prefix caching, Anthropic prompt caching) reuses the longest IDENTICAL token prefix — so a new session matched those ~290 characters and re-prefilled everything after them. Measured on a real deployment at 7.24.1: the same body replayed 120–306ms TTFB, a NEW session's first turn 440–500ms, the same session's second turn 216–290ms.
+- **After.** The declaration is its own section, `core/harness.reminder-mark` (rank 590), emitted with the prompt's session-variable group: declaration → environment block → memory tail. The `# Harness` head went back to the mark-free sentence it carried before the mark existed. On the default assembly the first byte that differs between two sessions moved from index 290 to 9 406 of 10 280 (2.8% → 91.5%); the ratio is fixture-dependent (a large env tail lowers it) but the property is not — nothing of the shared base follows the declaration any more.
+- **Nothing about the defense changed.** Same sentence, same wording, exactly one per composed prompt, and `<system-reminder mark="…">` comparison never read position to begin with. The section is LOCKED: a `replaceAll` persona does not displace it (it is mechanism truth, not identity), and the already-assembled pass-through still gets the existing "declaration missing" disclosure rather than a second copy. **Only this sentence moved** — cwd/date have ridden the environment tail since the pack existed.
+- **No public composite emits the grant without its caveat.** The head GRANTS `<system-reminder>` tags authority and the declaration is what lets the model tell an engine mint from a forgery, so the two travel together: `harnessContext()` appends the declaration when a mark is threaded, and `constitutionBlocks()` / `composeConstitution()` / `defaultPromptProvider.stableSystem` inherit exactly one. The single deliberate exception is `harnessHeadLines()` — the PACK's section source, which returns the grant alone because the pack ranks the caveat itself; it no longer takes a `reminderMark` at all, so it cannot regrow one by accident. Two adversarial rounds pushed this boundary down to the lowest level it can sit at.
+- **CC 2.1.259, checked.** CC has no per-session mark, so this seat is UNANCHORED. Its nearest relative, CC's `env_info_simple` block, sits MID-list in the default builder (ahead of several static sections) and near the tail in the subagent builder; sema keeps its environment tail strictly last and puts this beside it — a divergence that predates this change and is kept on purpose (CC caches behind explicit breakpoints, sema's deployments behind longest-identical-prefix caches).
+- **Reach.** `prompt.assembled` gains one block id (`harness.reminder-mark`) and `harness.context` loses 886 characters to it; a prompt EPOCH re-pins once per session on upgrade, which is the ordinary declared-bytes-changed path. No wire key, no code, no posture. `test/backlog975-reminder-mark-prefix.test.ts` pins the two-session prefix property with a positive control (two distinct marks), the one-declaration/nothing-stable-after rule, the same-session byte-identity invariant #254 established, and both the task-`systemPrompt` and `replaceAll` shapes.
+
+### An MCP server's reachability is its own fact, and absence of it is indeterminate (#874; P2; additive wire key + additive record field + 3 exports; @server @cli @client-core)
+- **Before.** Three faces reported three different things about an MCP server and none of them answered "can the engine reach it right now": `wiring_manifest.mcp[].status` is the connect-time verdict of the dial, deliberately frozen (a server that dies mid-task still reads `connected`); `McpServerStatus.transportClosed` is one EVENT, and only on transports that raise one — a streamable-HTTP endpoint that dies never does; `McpReconnectResult.outcome` is one action's judgment. A shell asking "is this server up" had to infer it, and every inference folded an unknown into a health verdict.
+- **After.** `wiring_manifest.mcp[].liveness` (and the same record on `McpServerStatus.liveness`) carries `{state, observedAt, errorCode?}` — the engine's last OBSERVATION, stamped where the connection layer already works: the dial, a re-dial, a transport close, and a request that comes back with the transport gone (the one case `transportClosed` structurally cannot see). **No probe, no poll, no timer**: core adds no traffic of its own, so the manifest's copy is a per-leg snapshot and nothing pretends otherwise.
+- **Three words, one question — "did an exchange complete".** `reachable` includes a server that ANSWERED the handshake with a protocol error, so `status:"failed"` beside `liveness.state:"reachable"` is a real row and a useful one (up, and misconfigured). `unreachable` = refused / reset / closed / unspawnable / timed out. `unknown` = something came back and it does not say (an HTTP status a gateway in front of the server may have written, a non-MCP payload, a thrown value with no structure). The mapping is ONE table over the existing `MCP_FAILURE_KINDS` (`LIVENESS_BY_FAILURE_KIND`, fenced like `DELIVERED_BY_KIND`) — no new code vocabulary, and a new failure class cannot land without saying what it means for reach.
+- **Absence is the fourth reading and is not a word.** The key is present IFF an observation exists: a `skipped` row never reached a transport, a malformed declaration (`invalid_config`) was never dialed, and an older manifest has no field. A consumer must not fold absence into `unknown` — `unknown` is the stronger statement that core DID look and could not tell.
+- **`errorCode` inside the record rides `unreachable` only**, deliberately: on `unknown` the failure class was judged NOT to decide reachability, and carrying it there would invite a reach action keyed on evidence that says nothing about reach. The connect-time class is still reported in its own right as the row's top-level `errorCode`.
+- **Every exchange reports, at the REQUEST boundary; the record is the LAST observation, not the worst one.** A dial, a tool call, a resource read, each listing page, a refresh's failed listing and the idle watchdog's own expiry report their outcome through the same writer — including SUCCESS, so a demotion can never outlive the next exchange that works. Deliberately NOT after a paginating helper returns: those recover from later-page failures and can return having issued no request at all, so a stamp there would fabricate a recovery (`KL-874a` names the three paths that therefore take no observation, and what a stale record costs). The first cut filtered the request lane to `connection_closed` and an adversarial round showed why that is the wrong half: a streamable-HTTP endpoint that dies raises no close notification, and its next request fails `connect_refused` / `connection_failed`. There is no per-site judgment about which failures "count" — the class table decides, and a class that decides nothing about reach writes nothing.
+- **The engine's own teardown records nothing.** All observations go through ONE lifecycle-aware writer on the per-server health object (the slot discipline `announce.fn` already used): it is silent while the task is tearing down — our own `dispose()` closes every transport, and stamping "this server died" on the way out is a lie a consumer reading the statuses afterwards cannot tell from the truth — and it is DISARMED when a re-dial deliberately replaces a handle. An adversarial round found the first cut recording a teardown as an outage; the fix removed a write site rather than adding a guard.
+- **Reach.** Additive: one optional wire key, one optional field on an existing public record, three new exports (`MCP_LIVENESS_STATES`, `McpLivenessState`, `McpServerLiveness`). No key removed, re-typed or re-meant; `status`, `transportClosed` and the re-dial result are byte-unchanged. `@client-core` asked for this face (CC-36); `@server` relays the manifest; `@cli` renders it. `test/backlog874-mcp-liveness.test.ts` pins the three states and the two absence forms on REAL `wiring_manifest` frames (a live stdio server, a missing binary, a real HTTP endpoint answering 401, a malformed url), the re-dial flip, and the `errorCode`-only-on-`unreachable` law.
+
+### One extraction of shell read candidates, ahead of one judge (#945 S0; zero behaviour change; no wire key; no export)
+- **What lands.** `src/tools/fs/shell-read-plan.ts` — `planShellReads(command, decl)`, a pure, zero-I/O parse of a shell command into every path word it MAY read, each tagged with its provenance (`READ_CANDIDATE_PROVENANCES`, a closed set of ten words registered in `docs/CLOSED-SETS.md`) and the working-directory candidates it is relative to; nested plans for substitution bodies, unquoted here-document substitutions and re-entered shell text (`sh -c`, `eval`, `env -S`, a launcher handing text to a shell); `<` targets as read candidates and `>`-family targets as tagged write targets; `cd` threaded as a base-candidate set (`&&` proves a move), a loop body replayed per literal beat. Nothing consumes it yet: the three shell faces judge exactly as before.
+- **What moves.** The filesystem-resolving read boundary (`createCanonicalReadBoundary`, its glob matcher and bounds, `BoundaryQuestions`) leaves `fs-bash.ts` for `src/tools/fs/shell-read-establish.ts`, byte-for-byte; `fs-bash.ts` imports it back. `dist/` shows the move; no call site changed.
+- **Two readers now say more, to the same callers.** `readSedScript` returns the file names its `r`/`R` (read) and `w`/`W` (write) commands name and the command lines its `e` commands run, where it used to answer only "names"; every existing caller reads the same kind it always did (pinned). `LauncherRow` gains a `commandString` arity (`env`'s `-S` / `--split-string`); the program-position reader still refuses that spelling exactly as before (pinned) — only the candidate extraction reads the value.
+- **The proof of "zero behaviour change" is a 219-cell matrix in tree** (`test/backlog945-matrix.test.ts`): three shell faces × two moments over the design's 38 shapes, the no-deny controls, and four `#976` shapes, every cell a reading taken on the pre-slice base with the same harness. LEAK cells are recorded as leaks; the pipeline slice flips them one marked commit at a time.
+- **Two operand readers are exported from `bash-readonly-classifier.ts`** for the plan (`readVerbOptionSlot`, `slotValueCandidates`, `attachedOptionPayloads`, `segmentSelectsRecursiveRead`, `inlineProgramClause`, …): internal modules, not on the package's export surface (`handoff:diff` v7.24.2 → HEAD: +0 −0).
+- Reach: @server / @cli / @client-core zero; headless zero.
 
 ## 7.24.2 — 2026-09-20
 

package/dist/core/mcp-failure.d.ts

@@ -46,6 +46,79 @@ export declare const DELIVERED_BY_KIND: {
 };
 /** The fence over the delivery table: `never` while every kind has a verdict. */
 export type DeliveryTableCoversEveryMcpFailureKind = AssertAllKeysHandled<Exclude<McpFailureKind, keyof typeof DELIVERED_BY_KIND>>;
+/**
+ * The closed set of {@link McpServerLiveness.state} — the engine's answer to ONE question, "can this
+ * client complete an exchange with this server":
+ *  · `reachable`   — an exchange COMPLETED (the dial handshaked and listed, a re-dial succeeded, or the
+ *                    server itself answered — an MCP-level rejection is an answer, so it proves reach
+ *                    even though it failed);
+ *  · `unreachable` — an exchange was attempted and lost at the transport or the clock (refused, reset,
+ *                    closed, unspawnable, timed out);
+ *  · `unknown`     — an exchange was attempted and what came back does not answer the question (a status
+ *                    a gateway in front of the server may have written, a non-MCP payload, a thrown value
+ *                    with no structure this table reads).
+ * ABSENCE is the fourth reading and is NOT one of these words: no observation exists at all (the leg
+ * never reached this server, or the declaration could not be dialed). A consumer must not fold an absent
+ * record into either `unknown` or a health verdict — absent means indeterminate, and `unknown` means
+ * "we looked and could not tell".
+ */
+export declare const MCP_LIVENESS_STATES: readonly ["reachable", "unreachable", "unknown"];
+export type McpLivenessState = (typeof MCP_LIVENESS_STATES)[number];
+/**
+ * One liveness OBSERVATION about one server (see {@link MCP_LIVENESS_STATES} for the words). It answers
+ * what the engine last LEARNED, at `observedAt` (epoch ms) — never what is true now, and never a poll:
+ * the engine makes no probe of its own, so every record here is a by-product of work the task already
+ * did (the dial, a re-dial, a transport close).
+ *
+ * `errorCode` rides `unreachable` ONLY, and names the failure class that decided it (a `spawn_failed` is
+ * a missing binary, a `connect_refused` a closed port). It is deliberately absent on `unknown`: the whole
+ * point of that word is that the failure did NOT decide reachability, so carrying its class there would
+ * invite a consumer to key a reach action off evidence that says nothing about reach. The connect-time
+ * class is still reported in its own right beside this record (the status / manifest row's `errorCode`).
+ */
+export interface McpServerLiveness {
+    state: McpLivenessState;
+    observedAt: number;
+    errorCode?: McpFailureKind;
+}
+/**
+ * What each failure CLASS says about reachability — the second disposition table over
+ * {@link MCP_FAILURE_KINDS}, beside {@link DELIVERED_BY_KIND}, and deliberately NOT derived from it:
+ * delivery asks "did the caller's request run", reachability asks "did an exchange complete", and the two
+ * part company on both edges — a `timeout` leaves delivery `unknown` while the exchange provably did not
+ * complete, and a `protocol` rejection is a failure the caller must handle while being the strongest
+ * proof of reach there is.
+ *
+ * `invalid_config` maps to `undefined` — the one class that is NOT an observation: a declaration that
+ * could not be dialed means no transport was ever attempted, so the honest record is no record (see the
+ * absence reading in {@link MCP_LIVENESS_STATES}), not a third-hand `unknown`.
+ */
+export declare const LIVENESS_BY_FAILURE_KIND: {
+    readonly connect_refused: "unreachable";
+    readonly connection_failed: "unreachable";
+    readonly connection_closed: "unreachable";
+    readonly http_status: "unknown";
+    readonly not_mcp_response: "unknown";
+    readonly spawn_failed: "unreachable";
+    readonly timeout: "unreachable";
+    readonly protocol: "reachable";
+    readonly invalid_config: undefined;
+    readonly unknown: "unknown";
+};
+/** The fence over the liveness table: `never` while every kind has a verdict. */
+export type LivenessTableCoversEveryMcpFailureKind = AssertAllKeysHandled<Exclude<McpFailureKind, keyof typeof LIVENESS_BY_FAILURE_KIND>>;
+/**
+ * What ONE exchange with a server tells the liveness record: the CLASS of the failure it ended in, or
+ * `"completed"` when it finished. Every round trip the engine makes — a dial, a tool call, a resource
+ * read, a listing, a refresh — reports exactly this, so the engine needs no second vocabulary and no
+ * per-site judgment about which failures "count".
+ */
+export type McpExchangeOutcome = McpFailureKind | "completed";
+/** The liveness observation an exchange supports, or `undefined` when the outcome is not an observation
+ *  at all (see {@link LIVENESS_BY_FAILURE_KIND}: a declaration that could never be dialed). THE single
+ *  mint of the record — no two sites can disagree about the word, about which words may carry
+ *  `errorCode`, or about what a completed exchange proves. */
+export declare function livenessOf(outcome: McpExchangeOutcome, observedAt: number): McpServerLiveness | undefined;
 /** Where the failure was judged: at the dial (connect + initial listing), where an errno on a stdio
  *  transport is the child process failing to spawn, or on a request over an established connection. */
 export type McpFailureSite = {

package/dist/core/mcp-failure.js

@@ -25,6 +25,27 @@ export const DELIVERED_BY_KIND = {
     invalid_config: "no",
     unknown: "unknown",
 };
+export const MCP_LIVENESS_STATES = ["reachable", "unreachable", "unknown"];
+export const LIVENESS_BY_FAILURE_KIND = {
+    connect_refused: "unreachable",
+    connection_failed: "unreachable",
+    connection_closed: "unreachable",
+    http_status: "unknown",
+    not_mcp_response: "unknown",
+    spawn_failed: "unreachable",
+    timeout: "unreachable",
+    protocol: "reachable",
+    invalid_config: undefined,
+    unknown: "unknown",
+};
+export function livenessOf(outcome, observedAt) {
+    if (outcome === "completed")
+        return { state: "reachable", observedAt };
+    const state = LIVENESS_BY_FAILURE_KIND[outcome];
+    if (state === undefined)
+        return undefined;
+    return state === "unreachable" ? { state, observedAt, errorCode: outcome } : { state, observedAt };
+}
 const CONNECT_KEEPS_THE_TABLE_VERDICT = new Set(["protocol", "http_status"]);
 const NETWORK_CODES_NEVER_DELIVERED = new Set([
     "ECONNREFUSED",

package/dist/core/mcp.d.ts

@@ -1,5 +1,5 @@
 import { type ProtocolId } from "./protocol-table.js";
-import { type McpDelivered, type McpFailureKind } from "./mcp-failure.js";
+import { type McpDelivered, type McpFailureKind, type McpServerLiveness } from "./mcp-failure.js";
 import type { AgentTool } from "../internal/harness-types.js";
 import type { ImageContent, TextContent } from "../internal/llm.js";
 import { type McpImageResizer } from "./image-downsample.js";
@@ -344,6 +344,23 @@ export interface McpServerStatus {
      * server name and the outcome) and this field stays absent.
      */
     transportClosed?: boolean;
+    /**
+     * The engine's last liveness OBSERVATION about this server ({@link McpServerLiveness}) — a different
+     * question from all three of its neighbours, and the note each of them carries says so:
+     *  · {@link status} is the CONNECT-TIME verdict of this leg, frozen at the dial — it is not this;
+     *  · {@link transportClosed} is one EVENT (a close notification arrived), on the transports that have
+     *    one — it is not this (this record also carries an `unreachable` that no close ever announced);
+     *  · `McpReconnectResult.outcome` is one ACTION's judgment — it is not this (it says what a re-dial
+     *    did, this says what the connection layer last learned).
+     * Written where the connection layer establishes or loses a connection (the dial, a re-dial, a close,
+     * a request that comes back with the transport gone), never on a timer and never by a probe: the
+     * engine adds no traffic of its own to answer it.
+     *
+     * ABSENT = no observation ({@link import("./mcp-failure.js").MCP_LIVENESS_STATES}): a declaration that could not be dialed
+     * (`invalid_config`) never touched a transport, and an older / foreign record predates the field. A
+     * consumer must read absence as indeterminate — never as healthy, never as off.
+     */
+    liveness?: McpServerLiveness;
 }
 /**
  * design/108 ① (CC 2.1.187 parity) — the GLOBAL `mcp__` marker prefix. CC names every MCP tool

package/dist/core/mcp.js

@@ -6,7 +6,7 @@ import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolNa
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { classifyMcpFailure, describeHttpTransportFailure } from "./mcp-failure.js";
+import { classifyMcpFailure, describeHttpTransportFailure, livenessOf } from "./mcp-failure.js";
 import { lstat, mkdir, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -213,6 +213,7 @@ function rethrowHonestMcpError(err, ctx) {
     };
     sanitizeMcpErrorTextInPlace(err);
     if (ctx.idle?.signal.reason === IDLE_WATCHDOG_ABORT_REASON) {
+        ctx.liveness?.observe?.("timeout");
         const serverLabel = inlineUntrusted(ctx.server);
         finish(markMcpFailure(new Error(`${ctx.what} on MCP server "${serverLabel}" received no response for ${ctx.idle.idleMs}ms (idle watchdog — ` +
             `distinct from the ${ctx.timeoutMs}ms total ceiling above). The server may still be alive but is not ` +
@@ -224,6 +225,7 @@ function rethrowHonestMcpError(err, ctx) {
     const serverLabel = inlineUntrusted(ctx.server);
     const fenceServerText = (label, raw) => delimitUntrusted(label, truncateMcpErrorText(raw));
     const failure = classifyMcpFailure(err, { phase: "request" });
+    ctx.liveness?.observe?.(failure.kind);
     const details = (extra) => ({ code: failure.kind, delivered: failure.delivered, server: ctx.server, ...extra });
     switch (failure.kind) {
         case "timeout": {
@@ -721,10 +723,19 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
         else
             serverHandles[hIdx] = handle;
         const hasInstructions = s.instructions !== undefined;
+        const observe = (outcome) => {
+            if (disposing)
+                return;
+            const observed = livenessOf(outcome, Date.now());
+            if (observed !== undefined)
+                s.status.liveness = observed;
+        };
+        s.health.observe = observe;
         const announceClose = () => {
             if (disposing)
                 return;
             s.status.transportClosed = true;
+            observe("connection_closed");
             if (hasInstructions)
                 instructionsDelta.pendingRemovals.push(spec.name);
         };
@@ -807,7 +818,8 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
             else {
                 warnings.push(asServerWarning(spec, r.reason));
                 const { kind, delivered, httpStatus } = classifyMcpFailure(r.reason, { phase: "connect", transport: dialKinds[i] });
-                statuses.push({ name: spec.name, status: "failed", errorCode: kind, delivered, ...(httpStatus !== undefined ? { httpStatus } : {}), error: namedMcpFailureText(r.reason) });
+                const liveness = livenessOf(kind, Date.now());
+                statuses.push({ name: spec.name, status: "failed", errorCode: kind, delivered, ...(httpStatus !== undefined ? { httpStatus } : {}), error: namedMcpFailureText(r.reason), ...(liveness !== undefined ? { liveness } : {}) });
             }
         }
         const resourceTools = buildResourceTools(resourceServers, isServerRevoked);
@@ -838,6 +850,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
             const priorInstructions = prior?.instructions;
             if (prior) {
                 prior.announce.fn = undefined;
+                prior.health.observe = undefined;
                 serverHandles.splice(hIdx, 1);
                 const cIdx = clients.indexOf(prior.client);
                 if (cIdx !== -1)
@@ -851,7 +864,8 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
             }
             catch (err) {
                 const { kind, delivered, httpStatus } = classifyMcpFailure(err, { phase: "connect", transport: dialKind });
-                const status = { name: server, status: "failed", errorCode: kind, delivered, ...(httpStatus !== undefined ? { httpStatus } : {}), error: namedMcpFailureText(err) };
+                const redialLiveness = livenessOf(kind, Date.now());
+                const status = { name: server, status: "failed", errorCode: kind, delivered, ...(httpStatus !== undefined ? { httpStatus } : {}), error: namedMcpFailureText(err), ...(redialLiveness !== undefined ? { liveness: redialLiveness } : {}) };
                 const sIdx = statuses.findIndex((st) => st.name === server);
                 if (sIdx === -1)
                     statuses.push(status);
@@ -953,6 +967,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
                     });
                 }
                 catch (err) {
+                    h.health.observe?.(classifyMcpFailure(err, { phase: "request" }).kind);
                     results.push({
                         server: h.name,
                         prefix: prefixOf(h.name),
@@ -1334,7 +1349,8 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                 try {
                     res = await rs.client
                         .readResource({ uri }, { signal: watchdog.combinedSignal, timeout: timeoutMs })
-                        .catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs, writeEffect: false, signal, attributeServer: true, idle: { signal: watchdog.idleSignal, idleMs } }));
+                        .catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs, writeEffect: false, signal, attributeServer: true, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
+                    rs.health.observe?.("completed");
                 }
                 finally {
                     watchdog.dispose();
@@ -1393,7 +1409,7 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                 try {
                     const ext = rs.client.getServerCapabilities()?.extensions?.[MCP_SKILLS_EXTENSION];
                     if (ext?.directoryRead === true) {
-                        const r = await readDirViaExtension(rs, uri, signal, timeoutMs, watchdog).catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs, writeEffect: false, signal, attributeServer: true, idle: { signal: watchdog.idleSignal, idleMs } }));
+                        const r = await readDirViaExtension(rs, uri, signal, timeoutMs, watchdog).catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs, writeEffect: false, signal, attributeServer: true, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
                         const serverSaid = (detail) => `\nThe server's error text follows as external/untrusted data:\n${delimitUntrusted(`${server} error`, truncateMcpErrorText(detail))}`;
                         if (r.kind === "not_found") {
                             return {
@@ -1421,7 +1437,8 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                     const walk = await walkMcpListPages(async (cursor, remainingMs) => {
                         const page = await rs.client
                             .listResources(cursor === undefined ? undefined : { cursor }, { signal: watchdog.combinedSignal, timeout: remainingMs })
-                            .catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs: remainingMs, writeEffect: false, signal, attributeServer: true, idle: { signal: watchdog.idleSignal, idleMs } }));
+                            .catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs: remainingMs, writeEffect: false, signal, attributeServer: true, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
+                        rs.health.observe?.("completed");
                         return { items: page.resources, ...(page.nextCursor !== undefined ? { nextCursor: page.nextCursor } : {}) };
                     }, { budgetMs: timeoutMs, onPage: () => watchdog.rearm(), fingerprintOf: listEntryFingerprint, ...(signal !== undefined ? { signal } : {}) });
                     const dirPrefix = uri.endsWith("/") ? uri : `${uri}/`;
@@ -1552,13 +1569,15 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
         const rawInstructions = client.getInstructions();
         const instructions = rawInstructions && rawInstructions.trim() ? sanitizeUntrustedText(rawInstructions.trim()) : undefined;
         const info = client.getServerVersion();
+        const status = {
+            name: spec.name,
+            status: "connected",
+            ...(info ? { serverInfo: { name: info.name, version: info.version } } : {}),
+            toolNames: serverTools.map((t) => t.name),
+            liveness: livenessOf("completed", Date.now()),
+        };
         return {
-            status: {
-                name: spec.name,
-                status: "connected",
-                ...(info ? { serverInfo: { name: info.name, version: info.version } } : {}),
-                toolNames: serverTools.map((t) => t.name),
-            },
+            status,
             client,
             health,
             announce,
@@ -1693,10 +1712,12 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
                         writeEffect,
                         signal,
                         idle: { signal: watchdog.idleSignal, idleMs },
+                        liveness: health,
                         ...(reminderDisclosure !== undefined
                             ? { reminder: { mark: reminderDisclosure.mark, outlet: "mcp", ...(reminderDisclosure.counts !== undefined ? { counts: reminderDisclosure.counts } : {}) } }
                             : {}),
                     }));
+                    health.observe?.("completed");
                 }
                 finally {
                     watchdog.dispose();

package/dist/core/permission-rules.js

@@ -5,6 +5,7 @@ import { PATH_RULE_BASE_LABEL, isUsablePathBase, parseRuleText, pathRuleReachOf,
 import { pathFamilyOf } from "../tools/fs/safety.js";
 import { effectivePathTargetOf } from "./effective-path-target.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
+import { ruleDenialSentence } from "./rule-denial-sentence.js";
 export { parsePermissionRule };
 export const BASH_GENERIC_PARAMS = new Set(catalogRuleFaceOf("Bash")?.params ?? []);
 const DEFAULT_CAPS = {
@@ -267,8 +268,11 @@ function matchParamRules(rules, args, maxScalarValueChars) {
     }
     return undefined;
 }
-function ruleMessage(kind, ruleText, source) {
-    return `${kind} by permission rule "${ruleText}"${source ? ` (${source})` : ""}`;
+function ruleDenial(req, ruleText, source) {
+    return ruleDenialSentence({ source: "permission", tool: req.toolName, rule: ruleText, ...(source ? { origin: source } : {}) });
+}
+function ruleAskMessage(ruleText, source) {
+    return `flagged by permission rule "${ruleText}"${source ? ` (${source})` : ""}`;
 }
 export function createPermissionRulePolicy(rules, opts) {
     const caps = { ...DEFAULT_CAPS, ...opts?.caps };
@@ -357,45 +361,45 @@ export function createPermissionRulePolicy(rules, opts) {
             const entry = byTool.get(req.toolName);
             const covering = hasCovering && protocolOf(req.toolName) !== undefined;
             if (entry?.bare.deny) {
-                return { action: "deny", message: ruleMessage("denied", entry.bare.deny.ruleText, entry.bare.deny.source) };
+                return { action: "deny", message: ruleDenial(req, entry.bare.deny.ruleText, entry.bare.deny.source) };
             }
             if (covering) {
                 const coveringDeny = coveringHit(namespacedCovering.deny, req.toolName);
                 if (coveringDeny)
-                    return { action: "deny", message: ruleMessage("denied", coveringDeny.ruleText, coveringDeny.source) };
+                    return { action: "deny", message: ruleDenial(req, coveringDeny.ruleText, coveringDeny.source) };
             }
             const contentDeny = entry !== undefined ? contentHit(entry.content.deny, req) : undefined;
             if (contentDeny !== undefined && contentDeny.unreadable === undefined) {
-                return { action: "deny", message: ruleMessage("denied", contentDeny.rule.ruleText, contentDeny.rule.source) };
+                return { action: "deny", message: ruleDenial(req, contentDeny.rule.ruleText, contentDeny.rule.source) };
             }
             if (entry) {
                 const paramDeny = matchParamRules(entry.param.deny, req.args, caps.maxScalarValueChars);
                 if (paramDeny) {
-                    return { action: "deny", message: ruleMessage("denied", paramDeny.ruleText, paramDeny.source) };
+                    return { action: "deny", message: ruleDenial(req, paramDeny.ruleText, paramDeny.source) };
                 }
             }
             if (contentDeny?.unreadable !== undefined)
                 return unreadableAsk({ rule: contentDeny.rule, unreadable: contentDeny.unreadable }, req);
             if (entry) {
                 if (entry.bare.ask) {
-                    return { action: "ask", message: ruleMessage("flagged", entry.bare.ask.ruleText, entry.bare.ask.source), matchedAskRule: entry.bare.ask.ruleText };
+                    return { action: "ask", message: ruleAskMessage(entry.bare.ask.ruleText, entry.bare.ask.source), matchedAskRule: entry.bare.ask.ruleText };
                 }
             }
             if (covering) {
                 const coveringAsk = coveringHit(namespacedCovering.ask, req.toolName);
                 if (coveringAsk)
-                    return { action: "ask", message: ruleMessage("flagged", coveringAsk.ruleText, coveringAsk.source), matchedAskRule: coveringAsk.ruleText };
+                    return { action: "ask", message: ruleAskMessage(coveringAsk.ruleText, coveringAsk.source), matchedAskRule: coveringAsk.ruleText };
             }
             if (entry) {
                 const contentAsk = contentHit(entry.content.ask, req);
                 if (contentAsk !== undefined) {
                     if (contentAsk.unreadable !== undefined)
                         return unreadableAsk({ rule: contentAsk.rule, unreadable: contentAsk.unreadable }, req);
-                    return { action: "ask", message: ruleMessage("flagged", contentAsk.rule.ruleText, contentAsk.rule.source), matchedAskRule: contentAsk.rule.ruleText };
+                    return { action: "ask", message: ruleAskMessage(contentAsk.rule.ruleText, contentAsk.rule.source), matchedAskRule: contentAsk.rule.ruleText };
                 }
                 const paramAsk = matchParamRules(entry.param.ask, req.args, caps.maxScalarValueChars);
                 if (paramAsk) {
-                    return { action: "ask", message: ruleMessage("flagged", paramAsk.ruleText, paramAsk.source), matchedAskRule: paramAsk.ruleText };
+                    return { action: "ask", message: ruleAskMessage(paramAsk.ruleText, paramAsk.source), matchedAskRule: paramAsk.ruleText };
                 }
                 if (entry.bare.allow) {
                     return { action: "allow" };

package/dist/core/rule-denial-sentence.d.ts

@@ -0,0 +1,75 @@
+/**
+ * The ONE mint for "a rule refused this call".
+ *
+ * WHY IT EXISTS. The engine has two rule stores that can refuse a tool call — the per-session policy rows
+ * a deployment writes against a session id, and the declarative permission rules compiled from a settings
+ * layer — and each used to spell its refusal in its own grammar at its own site: `tool "X" is denied by a
+ * session rule` beside `denied by permission rule "R" (layer)`, with the session lane's four containment
+ * arms in three further shapes and the resumed-execution re-check asserting a source ("a session rule")
+ * that was only ever one of the narrowing layers it speaks for. A consumer reading those strings could not
+ * tell WHICH store had spoken, which is precisely the confusion that produced the wrong answer to "is the
+ * rule store re-read at every gate?" — the two stores were being described as one.
+ *
+ * So: one grammar, one vocabulary of sources, one place to change either.
+ */
+/**
+ * The closed vocabulary of rule sources a refusal may name, each with the two spellings the sentence needs:
+ * `bare` when the source has no rule text to quote, `named` when it does. The type is DERIVED from this
+ * table, so a source without its spellings is not expressible and no fence is needed to say so.
+ *
+ * The words are the ENGINE'S rule-bearing faces, not a settings layer's (`source`/`origin` are different
+ * questions: WHICH STORE spoke, versus WHERE in that store's layering the row was written — the second
+ * rides `origin`).
+ */
+declare const RULE_SOURCE_PHRASE: {
+    /** The per-session policy rows (`SessionPolicyStore`), folded in as a deny-narrowing layer. */
+    readonly session: {
+        readonly bare: "a session rule";
+        readonly named: "session rule";
+    };
+    /** The declarative permission rules compiled from a deployment's settings layers. */
+    readonly permission: {
+        readonly bare: "a permission rule";
+        readonly named: "permission rule";
+    };
+    /**
+     * The deny-narrowing fold as a WHOLE — session rules, inherited ancestor rules, the frozen constraint
+     * projections and the active skill scope. Used where the refusing layer's own sentence is carried as the
+     * detail and the wrapper must not claim to know which of them spoke.
+     */
+    readonly narrowing: {
+        readonly bare: "a narrowing policy layer";
+        readonly named: "narrowing policy layer";
+    };
+};
+/** A rule-bearing face that can refuse a call ({@link RULE_SOURCE_PHRASE} holds the whole vocabulary). */
+export type RuleDenialSource = keyof typeof RULE_SOURCE_PHRASE;
+/** How a refusal names `source` in prose, with no rule text to quote — for a sentence this module does not
+ *  mint whole (a wrapper that carries the refusing layer's own sentence as its body). */
+export declare function ruleSourcePhrase(source: RuleDenialSource): string;
+/**
+ * Mint the refusal.
+ *
+ * @contract rule_denial.one_sentence — every refusal a RULE STORE mints reads
+ * `[tool "<tool>" is ]denied by <source>[ "<rule>"][ (<origin>)][: <detail>]`, composed here and nowhere
+ * else: the call is named first, then WHICH rule-bearing face refused (from the closed source vocabulary),
+ * then the rule's own text and the layer it was written in where the source has them, and last the reason
+ * this call failed the rule. A consumer reading a refusal can therefore always tell the session-policy
+ * store's answer from the permission rules' — and a carrier sentence that already named the call omits the
+ * head rather than spelling a second grammar.
+ *
+ * - `tool` — named when the sentence stands alone; omitted when a carrier sentence already named the call.
+ * - `rule` — the rule's own text, when the source has one to quote (a permission rule does; a session
+ *   policy row is structured fields, not a rule DSL, so it does not).
+ * - `origin` — where in that store's layering the row was written (e.g. a settings layer's key path).
+ * - `detail` — WHY this call failed the rule, when the source word alone does not say it (an allowlist
+ *   miss, a write the confinement cannot place, the refusing layer's own sentence).
+ */
+export declare function ruleDenialSentence(spec: {
+    source: RuleDenialSource;
+    tool?: string;
+    rule?: string;
+    origin?: string;
+    detail?: string;
+}): string;
+export {};

package/dist/core/rule-denial-sentence.js

@@ -0,0 +1,16 @@
+const RULE_SOURCE_PHRASE = {
+    session: { bare: "a session rule", named: "session rule" },
+    permission: { bare: "a permission rule", named: "permission rule" },
+    narrowing: { bare: "a narrowing policy layer", named: "narrowing policy layer" },
+};
+export function ruleSourcePhrase(source) {
+    return RULE_SOURCE_PHRASE[source].bare;
+}
+export function ruleDenialSentence(spec) {
+    const phrase = RULE_SOURCE_PHRASE[spec.source];
+    const by = spec.rule === undefined ? phrase.bare : `${phrase.named} ${JSON.stringify(spec.rule)}`;
+    const head = spec.tool === undefined ? "" : `tool ${JSON.stringify(spec.tool)} is `;
+    const origin = spec.origin === undefined ? "" : ` (${spec.origin})`;
+    const detail = spec.detail === undefined ? "" : `: ${spec.detail}`;
+    return `${head}denied by ${by}${origin}${detail}`;
+}

package/dist/core/runner/prepare-policy-chain.js

@@ -14,7 +14,7 @@ import { probeMandatedAsk } from "../ask-origin.js";
 import { headlessDenyAtFold, headlessDenyAtRecheck, inheritedAskCarry, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
 import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
-import { createSessionRulePolicy } from "./session-rule-policy.js";
+import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-policy.js";
 import { thrownText } from "../thrown-value.js";
 export async function preparePolicyChain(input) {
     const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
@@ -69,32 +69,42 @@ export async function preparePolicyChain(input) {
         }
     };
     auditPolicyNames(policy);
+    const announceSessionRulesUnreadable = (reason) => {
+        try {
+            const e = new Error(`session permission rules: ${reason} — the snapshot this leg already enforces stays in force (a failed read never loosens it)`);
+            e.code = "config.session_rules_unreadable";
+            deps.onError?.(e, { phase: "config", sessionId });
+        }
+        catch {
+        }
+    };
     let sessionRulePolicy;
     if (deps.sessionPolicyStore && spec.sessionId) {
-        const rules = await deps.sessionPolicyStore.getRules(spec.sessionId, spec.principal);
-        if (rules) {
-            sessionRulePolicy = createSessionRulePolicy(rules, { env: executionEnv, rootPath: taskRootFinal, toolEffects });
+        const store = deps.sessionPolicyStore;
+        const sessionRuleKey = { sessionId: spec.sessionId, ...(spec.principal !== undefined ? { principal: spec.principal } : {}) };
+        const rules = await store.getRules(spec.sessionId, spec.principal);
+        const seed = rules ?? { rev: 0 };
+        const publishOwnRules = (row) => {
             ownSessionRulesRef.current = {
-                sessionId: spec.sessionId,
-                ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
-                rev: rules.rev,
-                rules,
+                sessionId: sessionRuleKey.sessionId,
+                ...(sessionRuleKey.principal !== undefined ? { principal: sessionRuleKey.principal } : {}),
+                rev: row.rev,
+                rules: row,
             };
-        }
+        };
+        sessionRulePolicy = createSessionRulePolicy({ seed, read: createLiveSessionRules(store, { ...sessionRuleKey, seed }, { onUnreadable: announceSessionRulesUnreadable, onEnforced: publishOwnRules }) }, { env: executionEnv, rootPath: taskRootFinal, toolEffects });
+        if (rules)
+            publishOwnRules(rules);
     }
     const ancestorRulePolicies = [];
     for (const snap of inheritedAncestorRules ?? []) {
-        let ancestorRules = snap.rules;
-        if (deps.sessionPolicyStore) {
-            try {
-                const live = await deps.sessionPolicyStore.getRules(snap.sessionId, snap.principal);
-                if (live !== null && live.rev >= snap.rev)
-                    ancestorRules = live;
-            }
-            catch {
-            }
-        }
-        ancestorRulePolicies.push(createSessionRulePolicy(ancestorRules, { env: executionEnv, rootPath: taskRootFinal, toolEffects }));
+        const seed = { ...snap.rules, rev: snap.rev };
+        ancestorRulePolicies.push(createSessionRulePolicy({
+            seed,
+            ...(deps.sessionPolicyStore
+                ? { read: createLiveSessionRules(deps.sessionPolicyStore, { sessionId: snap.sessionId, ...(snap.principal !== undefined ? { principal: snap.principal } : {}), seed }, { onUnreadable: announceSessionRulesUnreadable }) }
+                : {}),
+        }, { env: executionEnv, rootPath: taskRootFinal, toolEffects }));
     }
     const skillScopePolicy = hasSkillManifest
         ? createActiveSkillScopePolicy({