@sema-agent/core 7.51.2 → 7.52.0

package/dist/core/runner/side-call-account.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The run's usage account for the model calls made BESIDE the main loop — the compaction summarizer, the permission
+ * classifier, a mod's `$.model.complete`: the lanes, what a reply tells the account, the one door a lane books through, and the
+ * ONE function behind it. The lane table says which `Stats` line keeps a lane's cost besides `costMicroUsd` (every lane folds
+ * into the total — it is the budget coordinate and the reported figure); it is total over the lanes by its fence, so a fourth
+ * lane is a row here, not a second accounting function.
+ */
+import type { AssistantMessageDiagnostic, Model, Usage } from "../../internal/llm.js";
+import { type ModelPricing } from "../pricing.js";
+import type { AssertAllKeysHandled } from "../ask-origin.js";
+import type { RunnerDeps, TaskSpec } from "../types.js";
+import type { Stats } from "./assemble-result.js";
+/** Whose model call it is: the compaction summarizer, the permission classifier, a mod's `$.model.complete`. */
+export type SideCallLane = "compaction" | "classifier" | "mod";
+/** The `Stats` line a lane's cost is also kept in: compaction is its own partition line; the classifier and the mods share the side-call line. */
+export declare const SIDE_CALL_LANE_TOTAL: {
+    readonly compaction: "compactionMicroUsd";
+    readonly classifier: "sideCallMicroUsd";
+    readonly mod: "sideCallMicroUsd";
+};
+export type LaneTotalCoversEverySideCallLane = AssertAllKeysHandled<Exclude<SideCallLane, keyof typeof SIDE_CALL_LANE_TOTAL>>;
+/** A side call's reply as the account reads it: the provider's usage (absent ⇒ none reported), the marks of what is unknown,
+ *  and the diagnostics that say a degrading brain served it from its fallback (the model that ANSWERED is the one priced). */
+export interface SideCallReply {
+    readonly usage?: Usage;
+    readonly usageMissing?: true;
+    readonly stopReason?: string;
+    readonly diagnostics?: AssistantMessageDiagnostic[];
+}
+/** The leg's one door onto the run's usage account: every side call's reply is booked through it, once. */
+export type SideCallBook = (lane: SideCallLane, model: Model, reply: SideCallReply | undefined) => void;
+/** The leg's seats a side call is priced and traced on — everything the call needs that `stats` does not carry. */
+export interface SideCallAccount {
+    /** The run's telemetry: a call on an unpriced model taints `unpricedSpend`; the trace row goes to its tracer. */
+    telemetry: {
+        unpricedSpend: boolean;
+        readonly tracer: TaskSpec["tracer"];
+        readonly taskId: string;
+    };
+    /** The deployment's price table, read at the call (a swapped deps seat reaches legs already running). */
+    pricing: () => RunnerDeps["pricing"];
+    /** The telemetry lane's price-table door, consulted for every table a side call adopts. */
+    noteUnevaluablePriceTable: (p: ModelPricing) => void;
+    /** The deployment's model catalog: where the fallback model of a degraded reply is looked up. */
+    catalog: RunnerDeps["models"];
+}
+/** What one side call tells the account beyond its usage: the model it asked, the marks of what is unknown, and — when a
+ *  degrading brain served the reply from another model — that model's id. */
+export interface SideCallCall {
+    model: Model;
+    account: SideCallAccount;
+    usageMissing?: true;
+    stopReason?: string;
+    servedBy?: string;
+}
+/**
+ * THE one place a model call made beside the main loop reaches the run's account: the compaction summarizer, the
+ * permission classifier and a mod's `$.model.complete` all land here, each with its lane. The call is accounted exactly
+ * like a main-loop call (re-priced in core from the deployment's table and the model's cache family, integer
+ * micro-USD, never the brain's own `usage.cost`), so the reported total, the budget gate at the next turn end and the
+ * trace agree about what the run spent. Latency and first-token time are not modeled (there are no per-delta hooks here).
+ *
+ * `usage` absent — the reply reported none — marks the leg's stats `usageMissing` (the totals are then a lower bound:
+ * unknown is not free). A reply the brain itself marked `usageMissing` does the same for its zero-filled usage.
+ */
+export declare function recordSideCallUsage(stats: Stats, usage: Usage | undefined, lane: SideCallLane, call: SideCallCall): void;
+/** The leg's door: `recordSideCallUsage` bound to the leg's `stats` and account, reading what the reply itself says (its marks, and who served it). */
+export declare function sideCallBookOf(stats: Stats, account: SideCallAccount): SideCallBook;

package/dist/core/runner/side-call-account.js

@@ -0,0 +1,61 @@
+import { readDegradation } from "../../brain/degrading.js";
+import { isModelPriced, modelCostToPricing } from "../pricing.js";
+import { emitTrace } from "../trace.js";
+import { cacheFamilyOf, usageCostMicroUsd } from "./usage-accounting.js";
+export const SIDE_CALL_LANE_TOTAL = {
+    compaction: "compactionMicroUsd",
+    classifier: "sideCallMicroUsd",
+    mod: "sideCallMicroUsd",
+};
+function catalogModel(id, catalog) {
+    if (catalog === undefined)
+        return undefined;
+    for (const m of Object.values(catalog))
+        if (m.id === id)
+            return m;
+    return Object.hasOwn(catalog, id) ? catalog[id] : undefined;
+}
+export function recordSideCallUsage(stats, usage, lane, call) {
+    if (usage === undefined || call.usageMissing === true)
+        stats.usageMissing = true;
+    if (usage === undefined)
+        return;
+    const { model: requested, account } = call;
+    const pricing = account.pricing();
+    const served = call.servedBy === undefined ? requested : catalogModel(call.servedBy, account.catalog);
+    const modelId = served?.id ?? call.servedBy ?? requested.id;
+    const price = pricing?.[modelId] ?? modelCostToPricing(served?.cost);
+    const priced = served !== undefined ? isModelPriced(served, pricing) : pricing?.[modelId] !== undefined;
+    if (!priced)
+        account.telemetry.unpricedSpend = true;
+    account.noteUnevaluablePriceTable(price);
+    const family = served !== undefined ? cacheFamilyOf(served) : "input-excludes-cached";
+    const { totalInputTokens, uncachedInputTokens, costMicroUsd } = usageCostMicroUsd(family, usage, price);
+    stats.tokens += usage.totalTokens || 0;
+    stats.promptTokens += uncachedInputTokens;
+    stats.totalInputTokens += totalInputTokens;
+    stats.cachedTokens += usage.cacheRead || 0;
+    stats.cacheWriteTokens += usage.cacheWrite || 0;
+    stats.outputTokens += usage.output || 0;
+    stats.costMicroUsd += costMicroUsd;
+    const total = SIDE_CALL_LANE_TOTAL[lane];
+    stats[total] = (stats[total] ?? 0) + costMicroUsd;
+    emitTrace(account.telemetry.tracer, () => ({
+        kind: "brain.call", version: 1, taskId: account.telemetry.taskId, model: modelId, ...(served !== undefined ? { provider: served.provider } : {}),
+        promptTokens: uncachedInputTokens, totalInputTokens, completionTokens: usage.output || 0,
+        cacheRead: usage.cacheRead || 0, cacheWrite: usage.cacheWrite || 0,
+        latencyMs: 0, ...(priced ? { costMicroUsd } : {}), ...(call.stopReason !== undefined ? { stopReason: call.stopReason } : {}), ts: Date.now(),
+    }));
+}
+export function sideCallBookOf(stats, account) {
+    return (lane, model, reply) => {
+        const degradedTo = readDegradation(reply)?.to;
+        recordSideCallUsage(stats, reply?.usage, lane, {
+            model,
+            account,
+            ...(reply?.usageMissing === true ? { usageMissing: true } : {}),
+            ...(typeof reply?.stopReason === "string" ? { stopReason: reply.stopReason } : {}),
+            ...(degradedTo !== undefined && degradedTo !== model.id ? { servedBy: degradedTo } : {}),
+        });
+    };
+}

package/dist/core/runner/stream-halt-verbs.js

@@ -15,15 +15,16 @@ export function streamHaltVerbs(input) {
             throw haltRefused("the task is not running");
         const apply = () => {
             const abortOwnedBeforeHalt = h.abortController.signal.aborted;
-            const receipt = h.harness.halt();
+            const receipt = h.loop.ended ? { turnCut: false, accepted: false } : h.harness.halt();
+            h.loop.callerStop.stop();
             if (receipt.accepted && !abortOwnedBeforeHalt) {
                 h.loop.userHalted = true;
             }
             else if (!h.loop.userHalted) {
                 deliverEngineNotice(runner.deps.onNotice, {
                     code: "task.halt_unconsumed",
-                    message: "a user halt arrived while the run was already ending for its own reason: nothing was cut or stopped " +
-                        "by it — the run's own ending stands, and the result will not carry haltedByUser for this halt.",
+                    message: "a user halt arrived while the run was already ending for its own reason: it cut no turn and stopped no " +
+                        "boundary — the run's own ending stands, and the result will not carry haltedByUser for this halt.",
                     detail: {
                         sessionId: h.sessionId,
                         runId: h.runId,
@@ -47,33 +48,27 @@ export function streamHaltVerbs(input) {
             }
             return { turnCut: receipt.turnCut };
         };
-        try {
-            if (live.resultValue !== undefined || h.loop.ended)
-                throw haltRefused("the task is no longer running");
-            return apply();
-        }
-        catch (e) {
-            if (!(e instanceof Error && e.code === "invalid_state"))
-                throw e;
-        }
         const birthDeadline = Date.now() + READY_TIMEOUT_MS;
-        while (live.resultValue === undefined && !h.loop.ended && Date.now() < birthDeadline) {
+        while (live.resultValue === undefined) {
             try {
                 return apply();
             }
-            catch (e2) {
-                if (!(e2 instanceof Error && e2.code === "invalid_state"))
-                    throw e2;
+            catch (e) {
+                if (!(e instanceof Error && e.code === "invalid_state"))
+                    throw e;
             }
+            if (Date.now() >= birthDeadline)
+                throw haltRefused("the task is no longer running");
             await new Promise((r) => setTimeout(r, 10));
         }
-        throw haltRefused("the task is no longer running");
+        throw haltRefused("the task has already finished");
     };
     const destroy = () => (destroyOnce ??= (async () => {
         const h = live.handle ?? (await orTimeout(ready));
         if (h) {
             h.abortController.abort();
             void h.harness.abort();
+            h.loop.callerStop.stop();
         }
         await orTimeout(run.catch(() => { }));
         await reapSuspended();

package/dist/core/runner/stream-lifecycle-verbs.js

@@ -145,12 +145,15 @@ export function streamLifecycleVerbs(input) {
         const h = live.handle ?? (await orTimeout(ready));
         if (!h)
             throw interruptRefused("the task is not running");
-        if (live.resultValue !== undefined || h.loop.ended)
-            throw interruptRefused("the task is no longer running");
-        if (!h.abortController.signal.aborted)
+        if (live.resultValue !== undefined)
+            throw interruptRefused("the task has already finished");
+        if (!h.loop.ended && !h.abortController.signal.aborted)
             h.loop.userInterrupted = true;
-        h.abortController.abort();
-        void h.harness.abort();
+        if (!h.loop.ended) {
+            h.abortController.abort();
+            void h.harness.abort();
+        }
+        h.loop.callerStop.stop();
     };
     return { notify, optOutMemoryCapture, reconnectMcpServer, compact, detach, interrupt };
 }

package/dist/core/runner/stream-steer-verb.d.ts

@@ -3,7 +3,7 @@ import { type TaskEvent, type TaskSpec, type TaskStream } from "../types.js";
 import type { LiveHandle, RunInternals, RunnerDepsSeat, TaskStreamLiveSeat } from "./contracts.js";
 import { type SteerReplayRecord, type SteerReplayRefusalDetail } from "../steer-replay.js";
 export interface StreamSteerVerbInput {
-    /** borrowed-readonly — the task spec (the hooks seat, `principal`, `taskId`). */
+    /** borrowed-readonly — the task spec (`principal`, `taskId`). */
     spec: TaskSpec;
     /** borrowed-readonly — the trusted run-internals channel (the spawning tool id the ledger frame carries). */
     internals: RunInternals | undefined;

package/dist/core/runner/stream-steer-verb.js

@@ -1,14 +1,14 @@
 import { uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
 import { MAX_STEER_INPUT_ID_CHARS } from "../checkpoint-store.js";
-import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
+import { formatHookFeedback } from "../hooks.js";
+import { classicEventBase, failedHandlerClause, screenUserPrompt } from "../mods/stations.js";
 import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
 import { injectionLaneOf, isSystemInjectionPriority, steerPriorityOf, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
 import { announceAcceptance, armAcceptance, nextHumanInputSeq } from "./steer-admission.js";
 import { steerReplayRefusal } from "../steer-replay.js";
-import { asThrownError } from "../thrown-value.js";
 export function streamSteerVerb(input) {
     const { spec, internals, queue, acceptedSteerInputs, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, steeringError, runner } = input;
     let steerChain = Promise.resolve();
@@ -94,42 +94,24 @@ export function streamSteerVerb(input) {
             if (live.resultValue !== undefined || h.loop.ended)
                 throw steeringError("the task is no longer running");
             if (mintsAFrame) {
-                const screen = (spec.hooks ?? runner.deps.hooks)?.userPromptSubmit;
-                if (screen !== undefined) {
-                    let decision;
-                    try {
-                        const seat = await runHookSeat("userPromptSubmit", { timeoutMs: h.hookTimeoutMs, signal: h.abortController.signal, abortEnds: true }, (sig) => screen(text, { identity: h.hookIdentity, permissionMode: h.permissionMode.observed, signal: sig, source: "steer", inputId: effectiveInputId, ...(actor !== undefined ? { actor: snapshotActorAssertion(actor) } : {}) }));
-                        if (seat.expired) {
-                            if (seat.cause === "timeout") {
-                                try {
-                                    runner.deps.onError?.(hookSeatExpiredError("userPromptSubmit", h.hookTimeoutMs, seat.cause, "the steering input was NOT accepted (fail-closed) and the caller was refused typed"), { phase: "hook", sessionId: h.sessionId });
-                                }
-                                catch {
-                                }
-                            }
-                            throw steeringError(seat.cause === "timeout"
-                                ? `the deployment's userPromptSubmit hook did not answer within its ${h.hookTimeoutMs}ms bound while screening this steering input; the input was NOT accepted (fail-closed)`
-                                : `the task was cancelled while the deployment's userPromptSubmit hook was still screening this steering input; the input was NOT accepted (fail-closed)`, "steering.blocked_by_hook");
-                        }
-                        decision = seat.value;
-                    }
-                    catch (hookErr) {
-                        if (hookErr instanceof Error && hookErr.code === "steering.blocked_by_hook")
-                            throw hookErr;
-                        const err = asThrownError(hookErr);
-                        try {
-                            runner.deps.onError?.(err, { phase: "hook", sessionId: h.sessionId });
-                        }
-                        catch {
-                        }
-                        throw steeringError(`the deployment's userPromptSubmit hook crashed while screening this steering input (${inlineUntrusted(err.message)}); the input was NOT accepted (fail-closed)`, "steering.blocked_by_hook");
-                    }
-                    if (decision?.block !== undefined && decision.block !== "") {
-                        throw steeringError(`the deployment's userPromptSubmit hook blocked this steering input: ${inlineUntrusted(decision.block)}`, "steering.blocked_by_hook");
-                    }
-                    if (decision?.additionalContext !== undefined && decision.additionalContext !== "") {
-                        payload = `${formatHookFeedback(decision.additionalContext, h.reminderMark)}\n\n${payload}`;
-                    }
+                const screen = await screenUserPrompt(h.modBus, {
+                    ...classicEventBase(h.hookIdentity, h.permissionMode.observed),
+                    prompt: text,
+                    source: "steer",
+                    inputId: effectiveInputId,
+                    ...(actor !== undefined ? { actor: snapshotActorAssertion(actor) } : {}),
+                }, h.abortController.signal);
+                if (screen?.kind === "aborted") {
+                    throw steeringError(`the task was cancelled while the deployment's userPromptSubmit hook was still screening this steering input; the input was NOT accepted (fail-closed)`, "steering.blocked_by_hook");
+                }
+                if (screen?.kind === "failed") {
+                    throw steeringError(`the deployment's userPromptSubmit hook ${failedHandlerClause(screen)} while screening this steering input; the input was NOT accepted (fail-closed)`, "steering.blocked_by_hook");
+                }
+                if (screen?.block !== undefined && screen.block !== "") {
+                    throw steeringError(`the deployment's userPromptSubmit hook blocked this steering input: ${inlineUntrusted(screen.block)}`, "steering.blocked_by_hook");
+                }
+                if (screen?.additionalContext !== undefined && screen.additionalContext !== "") {
+                    payload = `${formatHookFeedback(screen.additionalContext, h.reminderMark)}\n\n${payload}`;
                 }
             }
             const injectFramed = async () => {

package/dist/core/runner/sub-agent-deny-lists.d.ts

@@ -1,29 +1,82 @@
 /**
  * THE judgment of every tool-name list one prepared task receives — the run's own selector lists (`TaskSpec.allowTools` /
- * `TaskSpec.excludeTools`, unless the delegation lane spawned it — its spawning run judged them where they were mounted), the definitions it
- * carries (`TaskSpec.agents`), and the definitions and tool-level lists a mounted delegation tool carries (the `authored` faces
- * — the engine's built-ins are not judged; only a tool a deployment mounted (depth 0) publishes them). One rule for both sides:
- * a value that is not a list, an entry that is not a string and a spelling that can name no tool are REFUSED; an entry whose
- * name no tool of the universe answers to (a server this deployment does not declare, a stale or misspelt name) is KEPT as
- * written — the selector reads every entry by name, so a denied one hides a tool of that name whenever one is mounted and an
- * allowed one admits it — and told to the host, one account per entry. And one contradiction, judged on every leg: a
- * denylist (the run's own or one of its ceiling) that reaches a tool the leg's kind relies on (the catalog's protocol column)
- * is refused — neither a silently ignored deny nor a silently crippled leg.
+ * `TaskSpec.excludeTools`; when the delegation lane spawned it, its spawning run judged them where they were mounted, and the evidence
+ * it handed down spares them here), the definitions it carries (`TaskSpec.agents`), and the definitions and tool-level lists a mounted
+ * delegation tool carries (the `authored` faces — the engine's built-ins are not judged; only a tool a deployment mounted (depth 0)
+ * publishes them). One rule for both sides: a value that is not a list, an entry that is not a string, a spelling that can name no tool
+ * and a spelling that is another spelling of a tool the list's universe carries (`BASH` beside `Bash`) are REFUSED; an entry whose
+ * name no tool of the universe answers to (a server this deployment does not declare, a misspelt name) is KEPT as written — the
+ * selector reads every entry by name, so a denied one hides a tool of that name whenever one is mounted and an allowed one admits
+ * it — and told to the host, one account per entry. And one contradiction, judged on every leg: a denylist (the run's own or one
+ * of its ceiling) that reaches a tool the leg's kind relies on (the catalog's protocol column) is refused — neither a silently
+ * ignored deny nor a silently crippled leg.
  *
- * Universe = the task's assembled roster before the valve, every tool the catalog describes, every mounted delegation tool's
- * pool and the caller's own tools (names and aliases), and the protocol peers the task declares (a namespaced spelling under a
- * declared peer names a tool of it — the peer's tool list is runtime data, so the peer is what is checked). A delegation tool
- * whose factory injects tools per spawn with no declared roster (`extraTools`) lists none of them here; a kept entry reaches
- * its products by name like any other later-mounted tool.
+ * Two kinds of list, two universes. A ROOT-facing list bounds the tools of the run that holds it: the run's own lists (also the
+ * ceiling of every child), the policy name audit and the session-rules write gate ask the same question of it. Its universe is the
+ * run's roster before the valve, the caller's own tools, every tool the catalog describes (`rootFacingToolNames`) and the exact
+ * names of the pools its reachable delegation tools declare and can list — and another spelling of a carried name is always refused,
+ * whatever a delegation tool injects per spawn. A CHILD-facing list bounds a child that does not exist yet: a definition's two
+ * lists and a delegation tool's two lists. Its universe is the pool the delegation tool that hands the child declares (names, aliases, the
+ * declared `extraToolNames`, and the tool's own name: the child is handed the tool again, rebuilt, while its depth allows) and the catalog — not the
+ * spawning run's roster, which the child is not handed; every definition is judged against each reachable delegation tool's own pool; a delegation tool whose factory
+ * injects tools per spawn with no declared roster lists none of its pool, so there another spelling is kept and told (it may be one
+ * of that pool's own). Only the delegation tools the run's own selector leaves are read, in both: a tool it takes out hands nobody
+ * anything. A layer a run inherits (its ceiling) is not asked again: the run that wrote it asked its own universe, and a layer a
+ * checkpoint row restored is read for its spelling before the claim. The same goes for the lists a delegation tool hands its child
+ * (the child's own): when the spawning run read them against a pool it could list, its evidence spares them in the child. When it
+ * could not (the keep above), the child is the run whose roster can answer — it refuses another spelling of a tool of its own
+ * universe (its roster, the catalog, the pools it can list, and the delegation tool that spawned it, under its exact mounted name: a name
+ * of the child's lineage, mounted at its depth or not — an exact hit of that name is the tool's own, whatever else reads as a twin of it),
+ * and the spawning run already told what it kept, so nothing is told a second time.
  *
  * Throws `config.tool_face_control` for the run's own lists and the protocol contradiction, `config.agent.unknown_tool` for a
- * definition's or a delegation tool's lists — synchronous, like the phase that calls it.
+ * definition's or a delegation tool's lists (`detail.reason`: `unknown_name` for a spelling no tool name can have, `near_miss` for
+ * another spelling of a tool of the universe) — synchronous, like the phase that calls it.
  */
 import type { AgentTool } from "../../internal/harness.js";
 import { type ProtocolId } from "../protocol-table.js";
-import type { ToolLegKind, ToolSelectorLayer } from "../tool-face.js";
+import type { ToolLegKind, ToolSelector, ToolSelectorLayer } from "../tool-face.js";
+import { type ConstraintChainEntry } from "../tool-policy.js";
 import type { TaskSpec } from "../types.js";
-import type { AnnounceOnceSink } from "./contracts.js";
+import type { CheckpointErrorReason } from "../checkpoint-store.js";
+import type { AnnounceOnceSink, RunInternals } from "./contracts.js";
+/** What the delegation tools a run mounts hand their children (the pools of {@link delegationPoolReading}). */
+interface DelegationPoolReading {
+    readonly tools: NonNullable<TaskSpec["tools"]>;
+    readonly names: Set<string>;
+    readonly complete: boolean;
+}
+/**
+ * THE judgment of the name a delegation tool is mounted under: the name it declares for itself (`createSubagentTool({ name })`, the default
+ * name when none is given), which the factory binds to the `execute` that carries the delegation out ({@link declaredDelegationNameOf}) —
+ * so a copy of the tool, a product of it, a stripped or shell copy all still say it. A delegation tool is ONE tool with ONE name: the lists
+ * of its agent definitions, the copy of it a child is handed, the rebuilt copy a run's own definitions produce and the prompt text it speaks
+ * all say the declared name, while the roster, the pool reading and the model's call say the mounted one. A mount whose `name` differs from
+ * the declared one makes the tool answer to two names — a denied list that names one of them is read against the other — so it is REFUSED,
+ * naming both names and the two ways to one name. This is the sentence of that refusal for the first such entry of the rosters given — or
+ * `undefined`; it never throws (an entry whose members cannot be read is not judged here: the roster snapshot refuses it). A tool the
+ * factory did not make, and a roster that is no list (the doors' to judge), are not read.
+ */
+export declare function renamedDelegationMountSentence(...rosters: unknown[]): string | undefined;
+/**
+ * The refusal of a renamed delegation mount at prepare (`config.tool_face_control`, `detail.reason: "renamed_mount"`), asked of every roster
+ * the run holds: the one the caller mounted and the one the per-task rebuild (a function the caller's tool supplies) handed back. A resume
+ * asks the roster it is handed once more before the claim (this same function, through the resume screen's config-refusal channel), so the row stays pending.
+ */
+export declare function refuseRenamedDelegationMounts(...rosters: unknown[]): void;
+/**
+ * THE reading of what the delegation tools a run mounts hand their children, read after the run's own selector: only a delegation
+ * tool the selector leaves (`selector.admits`) counts — one it takes out hands nobody anything, and neither its pool names nor an
+ * unlistable pool of it belong to any universe. The tools themselves, every pool tool's name and alias (a declared `extraToolNames`
+ * roster included), and whether every one of those pools can be listed: a delegation tool whose factory injects tools per spawn with no
+ * declared roster has no listable pool (the static `tools` it was given included), so a name outside the listed ones may be one of its
+ * own. This is the one place the pool side of both universes is defined; the list judgment below and the policy name audit ask it.
+ */
+export declare function delegationPoolReading(callerTools: NonNullable<TaskSpec["tools"]>, selector: Pick<ToolSelector, "admits">): DelegationPoolReading;
+/** The arms of this module's `config.tool_face_control` refusal that a resume carries before the claim as `detail.reason` of a `checkpoint.config_refused` — the same words
+ *  ({@link CheckpointErrorReason}): a list the row recorded that is not a list / has a member that is not a string / has a spelling no tool name can have / is not in the
+ *  spelling a row records, a record that is not one, a renamed delegation mount, an occupied table of declared names. */
+export type PersistedToolFaceReason = Extract<CheckpointErrorReason, "not_a_list" | "not_a_string" | "unknown_name" | "unsupported_pattern" | "invalid_record" | "renamed_mount" | "registry_occupied">;
 /**
  * The names a definition's denied-tools entries stand for, for a lane that has neither a roster nor a notice sink at the point
  * it builds its own policy (a workflow leg's agentType): each entry is read by the one reading, so `Tool(content)` denies the
@@ -32,6 +85,22 @@ import type { AnnounceOnceSink } from "./contracts.js";
  * leg's roster and a sink; the leg's own policy-name audit is what reads them.
  */
 export declare function deniedToolNamesOf(where: string, value: unknown): string[];
+/**
+ * THE read-back of the tool names a checkpoint row carries, before the claim: the ceiling the resumed leg will run under when it is
+ * the row's (`ceiling`: absent when a live seat hands one) — each layer read by {@link readSelectorLayer} as a recorded layer — and
+ * the frozen policy chain (`inheritedGate.constraintChain`; each component's members {@link projectionToolNames} names), whose
+ * replay matches a name as recorded, which is the rule syntax's reading only for a name in its canonical spelling. The refusal
+ * sentence of the first entry neither reading may be applied to, naming it and where it sits, or `undefined`; a member that is not
+ * a list, or an entry that is not a string, is named by its type only. And the delegation tool the row records as having written the
+ * leg's own lists (`ownLists`, absent when a live seat hands one): it joins the universe those lists are asked of, so it must be a name.
+ * The refusal is its sentence and the arm it is ({@link CheckpointErrorReason}); {@link refusePersistedToolNames} throws it as prepare's own refusal.
+ */
+export declare function persistedToolNamesRefusal(ceiling: unknown, chain: readonly ConstraintChainEntry[] | undefined, ownLists?: unknown): {
+    readonly message: string;
+    readonly reason: PersistedToolFaceReason;
+} | undefined;
+/** {@link persistedToolNamesRefusal} as prepare's own refusal (`config.tool_face_control`, the arm as `detail.reason`): what a resume's pre-claim screen throws through the resume's one refusal channel. */
+export declare function refusePersistedToolNames(ceiling: unknown, chain: readonly ConstraintChainEntry[] | undefined, ownLists?: unknown): void;
 /**
  * The upstream judgment of a run's own lists, when it holds: the evidence digest the spawning run handed down (live) or the resumed row
  * recorded, returned only when it equals the digest of the lists this prepare read — the evidence is bound to the lists it was minted
@@ -41,6 +110,18 @@ export declare function boundToolListsJudgment(evidence: string | undefined, own
     readonly allow: readonly string[] | undefined;
     readonly exclude: readonly string[] | undefined;
 }): string | undefined;
+/**
+ * The record of the delegation tool that wrote a leg's own lists, held only for the lists it wrote: the live seat's (the delegation lane
+ * mints it with the digest of exactly the lists it handed the child) or, with none, the resumed row's. A prepare whose own lists digest to
+ * the record's `lists` keeps it — they are the lists that tool wrote, so their refusals name it and its name is a name of the leg's
+ * lineage; any other lists (a resume whose host handed another table) are the host's own `TaskSpec` seats, and the leg asks them as such
+ * with no lineage name cleared. A record that is not one (a host that set the live seat itself) refuses the leg, as a row's does before the
+ * claim: `config.tool_face_control`, `detail.reason: "invalid_record"`.
+ */
+export declare function boundOwnToolLists(record: unknown, own: {
+    readonly allow: readonly string[] | undefined;
+    readonly exclude: readonly string[] | undefined;
+}): RunInternals["ownToolLists"];
 export interface RunToolListsInput {
     /** borrowed-readonly — the REBOUND spec: `agents` (the task's definitions) and `tools` (the caller's tools and the mounted delegation tools). */
     spec: Pick<TaskSpec, "agents" | "tools">;
@@ -61,15 +142,33 @@ export interface RunToolListsInput {
     /** borrowed-readonly — every layer of the run's selector (the ceiling, then its own) and the kinds of leg it is. */
     layers: readonly ToolSelectorLayer[];
     legs: readonly ToolLegKind[];
-    /** True ⇔ the spawning run's prepare judged exactly these own lists where they were mounted — the evidence digest it handed down
-     *  (live, or recorded on the resumed row) equals the digest of the lists this prepare read ({@link boundToolListsJudgment}). */
+    /** True ⇔ the spawning run's prepare judged exactly these own lists where they were mounted, against a pool it could list (as the
+     *  child-facing lists of the delegation tool or definition that wrote them) — the evidence digest it handed down (live, or recorded
+     *  on the resumed row) equals the digest of the lists this prepare read ({@link boundToolListsJudgment}). They are then not judged
+     *  again: neither told nor refused. */
     judgedUpstream: boolean;
-    /** Whose lists the run's own are, when the run that spawned it wrote them ({@link delegationListWhere}); absent ⇒ the run's own
-     *  `TaskSpec` seats. */
-    ownWhere: string | undefined;
+    /** True ⇔ a delegation lane spawned this leg inside a prepared run, which read these own lists against a pool it could not list: it
+     *  kept what it could not judge and told it (no evidence digest was handed down). They are judged here, against this leg's roster,
+     *  and refused as any own list is — but nothing is told a second time. Absent ⇒ nobody told. */
+    toldUpstream?: boolean;
+    /** The delegation tool (and the agent definition) whose lists the run's own are, when the run that spawned it wrote them
+     *  (`RunInternals.ownToolLists`); absent ⇒ the run's own `TaskSpec` seats. Its sentence is {@link delegationListWhere}; its tool name is
+     *  a name of the leg's lineage, so the run's own lists are asked of a universe that carries it. */
+    ownBy: RunInternals["ownToolLists"];
     /** borrowed-readonly — the once-per-session ledger whose operator sink carries the notices. */
     onceLedger: Pick<AnnounceOnceSink, "onError">;
     /** borrowed-readonly — the acquired session's id (operator-line context). */
     sessionId: string;
 }
 export declare function judgeRunToolLists(input: RunToolListsInput): void;
+/**
+ * THE judgment of a tool ceiling a HOST wrote (`RunWorkflowOptions.toolCeiling`), asked of one workflow agent's spec before it launches.
+ * A ceiling a prepared run hands down was judged where it was written and is not asked again; one a host wrote was judged nowhere, and
+ * it bounds the tools of every agent that holds it — a root-facing list: it is read against the catalog, the agent's caller tools and the
+ * listable pools of the delegation tools the agent's own selector leaves (the layers above the host's — a launching run's —, the host's
+ * and the agent's own lists together: a tool they take out hands nobody anything), and another spelling of one of those is refused (`config.tool_face_control`,
+ * `detail.reason: "near_miss"`) rather than kept as a deny that hides nothing. A name no tool answers to stays kept (a tool of that
+ * name may be mounted later), unannounced: the host wrote no spec this leg could name the list of.
+ */
+export declare function judgeHostToolCeiling(layers: readonly ToolSelectorLayer[], agent: Pick<TaskSpec, "tools" | "allowTools" | "excludeTools">, above?: readonly ToolSelectorLayer[]): void;
+export {};