@sema-agent/core 7.51.2 → 7.53.0

package/dist/core/runner/gate-exit.d.ts

@@ -26,7 +26,7 @@ import type { AutoModeClassifierRound } from "../auto-mode.js";
 import { type Arbitration, type AskClassification, type AskFace, type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import type { SafeNotifier } from "../safe-notify.js";
-import type { HookSeatOutcome, PermissionDeniedPayload, PreToolUseResult, ToolGateInput, ToolGateResult } from "../hooks.js";
+import type { PermissionDeniedPayload, PreToolUseResult, ToolGateInput, ToolGateResult } from "../hooks.js";
 /** The ask a gate pass settled, as the gate captured it at its resolution site: the settlement the
  *  resolver composed and the origin word the ask carried. Both or neither (invariant I1). `licensed` is the engine record's
  *  digest of the bytes the settlement licensed: the allow exit keeps a settlement only for the bytes that run. */
@@ -126,32 +126,31 @@ export declare function cloneObserverInput(input: unknown): unknown;
  * freeze the call's input under the tool.
  */
 export declare function frozenInputSnapshot(input: unknown): unknown;
+/** What one `classic.PreToolUse` screening came to: an answer the receipt took (`undefined` = no opinion), or the
+ *  engine's fail-closed refusal of the call with its sentence (a handler that failed or broke the site's contract,
+ *  or a cancel). */
+/** A screen's outcome; an answer names the registration whose answer the chain returned (`answeredBy`, absent when no
+ *  handler spoke). */
+export type PreToolUseScreen = {
+    readonly kind: "answered";
+    readonly answer: PreToolUseResult | undefined;
+    readonly answeredBy?: string;
+} | {
+    readonly kind: "refused";
+    readonly reason: string;
+};
 /**
- * The PreToolUse screening face as the gate's stations see it — the hook machinery of `runToolGate` (the seat
- * runner, the per-call seat bound, the fresh per-screening context, the result screen, the two fail-closed
- * reason texts) behind three methods, so the approved-edit re-screen in the lanes runs the SAME screening the
- * phase-1 pass ran without the lanes module reaching into the hook machinery. Present on the pass exactly when
- * a `preToolUse` face is wired.
+ * The PreToolUse screening face as the gate's stations see it — `classic.PreToolUse` raised on the leg's bus, the
+ * per-screening e, the answer receipt and the fail-closed sentences behind one method, so the approved-edit re-screen
+ * in the lanes runs the SAME screening the phase-1 pass ran. Present on the pass exactly when a handler hangs on the
+ * event (an observe handler runs inside the screening too; it never decides).
  */
 export interface PreToolUseScreening {
-    /** Run the deployment's PreToolUse face over `args` under the seat bound. The answer is the SEAT's, unscreened —
-     *  the caller passes it through {@link PreToolUseScreening.screened} in the seat's own continuation. The seat
-     *  promise is returned as is (no wrapping `async`): what the gate does after the face answers — the policy in
-     *  phase 1, the re-check in the edit chain — runs on the tick the seat settles, as it did when this call was the
-     *  seat runner's own; a wrapper that screened the answer inside a second `async` cost one more tick there. An
-     *  expired seat is reported, not thrown; a crashing face rejects. */
-    screen(args: unknown): Promise<HookSeatOutcome<PreToolUseResult | undefined>>;
-    /** The result screen over an answered seat's value: an out-of-contract decision becomes the ordinary hook deny. */
-    screened(answer: PreToolUseResult | undefined): PreToolUseResult | undefined;
-    /** The model-facing text for a face that THREW while screening `subject`. */
-    crashReason(subject: string, err: unknown): string;
-    /** The model-facing text for a face that never ANSWERED while screening `subject` (the timeout arm also
-     *  reports on the deployment lane; a task-abort expiry does not). */
-    unansweredReason(subject: string, cause: "timeout" | "aborted"): Promise<string>;
-    /** The model-facing text for the face's OWN deny of this call (unwrapped; every exit wraps it with the leg's mark). */
+    /** Raise `classic.PreToolUse` over `args`; `subject` names what is screened in a fail-closed sentence. What the gate
+     *  does after the screen answers runs in the screen's own continuation. */
+    screen(args: unknown, subject: string): Promise<PreToolUseScreen>;
+    /** The model-facing text for the screen's OWN deny of this call (unwrapped; every exit wraps it with the leg's mark). */
     deniedReason(answer: PreToolUseResult): string;
-    /** The model-facing text for an answer the decision receipt refused (an ENGINE fail-closed, not the face's deny). */
-    refusedReason(answer: PreToolUseResult): string;
 }
 /** The FACE a pass's questions are put on ({@link askFaceOf} of the call's wire name) — the one reading of it the
  *  write-protection tighten (the fold) and every class derivation (the lanes) make. */
@@ -198,9 +197,9 @@ export interface GatePass {
     readonly ledger: SettlementLedger;
     /** borrowed-readonly — the ONE emission seat of the deny observer for this pass, bounded and contained like
      *  every other seat (the hook machinery owns the seat runner; the exits call this). */
-    readonly notifyPermissionDenied: (payload: Omit<PermissionDeniedPayload, "signal">) => Promise<void>;
-    /** borrowed-readonly — the PreToolUse screening face ({@link PreToolUseScreening}), or undefined when no
-     *  `preToolUse` face is wired (the edit chain then re-screens nothing, as before). */
+    readonly notifyPermissionDenied: (payload: PermissionDeniedPayload) => Promise<void>;
+    /** borrowed-readonly — the PreToolUse screening face ({@link PreToolUseScreening}), or undefined when no handler hangs
+     *  on `classic.PreToolUse` (the edit chain then re-screens nothing). */
     readonly screening: PreToolUseScreening | undefined;
     /** borrowed-readonly — the station group that runs AFTER the fold (the lanes: org layer, rule lane, classifier,
      *  parks, resolution, edit chain, and the exit they end in), handed the pass by the fold's LAST station on the
@@ -212,14 +211,14 @@ export interface GatePass {
      *  behind the policy's answer could not land in between. Returns the gate result (a park's suspension or the
      *  exit's record). Writer: the dispatch (`runToolGate`, which wires `runGateLanes`). Reader: the fold's tail. */
     readonly afterFold: (pass: GatePass) => Promise<ToolGateResult>;
-    /** borrowed-mutable — the FINAL args: the model's input, rewritten by the phase-1 hook, by the policy
-     *  rewrite on the ask path, by the content-ask lane's presented snapshot and by the exits' rewrite fold.
+    /** borrowed-mutable — the FINAL args, always the pass's own immutable value (`ownArgs`): the model's input as taken at
+     *  the entry, rewritten by the phase-1 hook, by the policy rewrite on the ask path and by the exits' rewrite fold.
      *  Writers: the dispatch (phase 1), the lanes, the exits. */
     currentInput: unknown;
-    /** borrowed-mutable — the adjudication request. Minted over the model's input so the record is whole from
+    /** borrowed-mutable — the adjudication request. Minted over the pass's args so the record is whole from
      *  the first station, and RE-MINTED by the adjudication station over the FINAL post-screen args (the
-     *  pre-existing `const req` site); `args` is re-pointed at the policy rewrite on the ask path and at the
-     *  content-ask lane's presented snapshot. Writers: the fold (mint), the lanes (`args`). */
+     *  pre-existing `const req` site); `args` is re-pointed at the policy rewrite on the ask path. Writers: the
+     *  fold (mint), the lanes (`args`). */
     req: ToolCallRequest;
     /** borrowed-mutable — the PreToolUse `additionalContext` collected for this call (pushed into; the binding
      *  is fixed). Writers: the dispatch (phase 1), the lanes (sandbox admission note, the edit re-screen). */
@@ -231,10 +230,14 @@ export interface GatePass {
     hookAsk: Extract<PermissionResult, {
         action: "ask";
     }> | undefined;
-    /** borrowed-mutable — the phase-1 hook answered its own `allow` (the exact word): the allow layer's hook member, which
-     *  speaks only while no policy rewrote the arguments after the hook saw them. Writer: the dispatch (phase 1). Reader: the
-     *  lanes' allow layer (its one reader). */
-    hookAllowed?: true;
+    /** borrowed-mutable — the phase-1 screen answered its own `allow` (the exact word), naming the registration that answered
+     *  it: the allow layer's hook member (its `entries`), which speaks only while no policy rewrote the arguments after the
+     *  screen saw them. Writer: the dispatch (phase 1). Reader: the lanes' allow layer (its one reader). */
+    hookAllowedBy?: readonly string[];
+    /** borrowed-mutable — `tool.check` was raised in this pass's first adjudication, which raises it once: set by the
+     *  raise in front of the ask branch, read by the raise behind the read-only arm (it then raises nothing). Writer and
+     *  reader: the lanes. */
+    toolCheckRaised?: true;
     /** borrowed-mutable — set by a park attempt that FAILED (see `ParkAttemptFailed`). Read at the single deny
      *  exit — whatever the fallback chain then decides to say, it says it knowing the park was tried first.
      *  Writers: the three park sites. */
@@ -335,8 +338,16 @@ export interface GatePass {
  * deployment's only evidence of a broken hook is a tool that mysteriously stops working.
  */
 export declare function engineFailClosedExit(pass: GatePass, reason: string): Promise<ToolGateResult>;
+/** The refusal sentence for args the gate could not take into its own copy (`ownArgs` refused them), naming what. */
+export declare const unownedArgsMessage: (subject: string, reason: string) => string;
+/**
+ * The model's args could not be taken into the pass's own copy (a function, a shared buffer, a typed array): nobody judged
+ * them, so nothing may run them. The single deny exit (the observer fires), in the policy layer's word — the value is the
+ * deployment's own (a host driving the gate; the runner's calls are always clonable).
+ */
+export declare function unownedArgsExit(pass: GatePass, reason: string): Promise<ToolGateResult>;
 /** The hook's OWN deny in phase 1. A PreToolUse hook deny does NOT fire `permissionDenied`
- *  (the exclusion recorded on `Hooks.permissionDenied`) — this return stays observer-free. */
+ *  (the exclusion recorded on `PermissionDeniedPayload`) — this return stays observer-free. */
 export declare function hookDenyExit(pass: GatePass, deniedReason: string): ToolGateResult;
 /**
  * The exit of the adjudicate chain — the pass has a standing `deny` or `allow` (every ask was resolved or

package/dist/core/runner/gate-exit.js

@@ -5,6 +5,7 @@ import { isProtectedWrite } from "../tool-registry.js";
 import { attestationOf, decisionText } from "../tool-policy.js";
 import { pathDenialCardOf } from "../../tools/fs/safety.js";
 import { boundInputHashOf } from "../canonical-json.js";
+import { argsAsTheToolReads, argsReadFrom } from "../effective-path-target.js";
 import { askUnresolvableRemedySeat } from "../ask-unresolvable-notice.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
@@ -127,7 +128,7 @@ export function createSettlementLedger(call) {
             return { decision, deniedBy: refusal ? "ask_resolution" : "policy" };
         },
         keepForBytes(runs) {
-            if (settled !== undefined && settled.licensed !== boundInputHashOf(runs))
+            if (settled !== undefined && settled.licensed !== boundInputHashOf(runs) && settled.licensed !== boundInputHashOf(argsReadFrom(runs)))
                 settled = undefined;
         },
         causeOf(decision) {
@@ -190,6 +191,12 @@ export async function engineFailClosedExit(pass, reason) {
     await notifyPermissionDenied({ toolName, input: cloneObserverInput(finalInput), toolCallId, reason, gate, ...(input.identity !== undefined ? { identity: input.identity } : {}) });
     return { block: true, reason: formatHookFeedback(reason, input.reminderMark), gate, finalInput, preToolContext: pass.preToolContext };
 }
+export const unownedArgsMessage = (subject, reason) => `${subject} could not be taken into the gate's own copy (${reason}) — denied fail-closed`;
+export async function unownedArgsExit(pass, reason) {
+    pass.decision = { action: "deny", message: unownedArgsMessage(`the arguments of "${pass.toolName}"`, reason) };
+    pass.deniedBy = "policy";
+    return await exitGate(pass);
+}
 export function hookDenyExit(pass, deniedReason) {
     const { input } = pass;
     return {
@@ -211,10 +218,10 @@ function unresolvableCauseOfSettlement(gate) {
     return undefined;
 }
 export async function exitGate(pass) {
-    const { input, event, toolName, toolCallId, ledger, notifyPermissionDenied } = pass;
+    const { input, toolName, toolCallId, ledger, notifyPermissionDenied } = pass;
     if (pass.decision.action === "deny") {
         if (pass.decision.updatedInput !== undefined) {
-            pass.currentInput = pass.decision.updatedInput;
+            pass.currentInput = argsAsTheToolReads(pass.req, pass.decision.updatedInput);
         }
         if (pass.deniedBy === undefined)
             throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
@@ -259,13 +266,13 @@ export async function exitGate(pass) {
     if (pass.decision.action === "allow") {
         const rw = pass.decision.updatedInput !== undefined ? pass.decision.updatedInput : pass.policyRewrite;
         if (rw !== undefined)
-            pass.currentInput = rw;
+            pass.currentInput = argsAsTheToolReads(pass.req, rw);
     }
     ledger.keepForBytes(pass.currentInput);
     const release = pass.arbitration?.kind === "released" ? pass.arbitration : (() => { if (ledger.settled !== undefined)
         return undefined; const a = pass.arbitration === undefined ? input.ancestorArbitrationOf?.(toolCallId) : undefined; return a?.kind === "released" ? a : undefined; })();
     return {
-        updatedInput: pass.currentInput === event.input ? undefined : pass.currentInput,
+        updatedInput: pass.currentInput,
         gate: mintGateOutcome({ ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}), ...(release !== undefined ? { released: releaseRecordOf(release) } : {}) }),
         finalInput: frozenInputSnapshot(pass.currentInput),
         preToolContext: pass.preToolContext,

package/dist/core/runner/image.js

@@ -1,6 +1,5 @@
 import { isIP } from "node:net";
-import { imageMagicMatches } from "../../tools/fs/safety.js";
-import { ADMITTED_IMAGE_MIME_TYPES } from "../../tools/fs/image-admission.js";
+import { ADMITTED_IMAGE_MIME_TYPES, imageMagicMatches } from "../image-admission.js";
 import { admitInlineImage } from "./inline-image.js";
 function sniffImageMime(bytes) {
     return ADMITTED_IMAGE_MIME_TYPES.find((mime) => imageMagicMatches(bytes, mime));

package/dist/core/runner/inline-image.js

@@ -1,4 +1,4 @@
-import { admitImageBytes, ADMITTED_IMAGE_MIME_TYPES } from "../../tools/fs/image-admission.js";
+import { admitImageBytes, ADMITTED_IMAGE_MIME_TYPES } from "../image-admission.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../image-downsample.js";
 function inlineImageRefusal(detail) {
     const e = new Error(`TaskSpec.images: ${detail}`);

package/dist/core/runner/mcp-redial.d.ts

@@ -15,22 +15,28 @@
  */
 import type { AgentTool } from "../../internal/harness.js";
 import type { McpDroppedTool, McpReconnectResult, MaterializedMcp, McpToolAxis } from "../mcp.js";
-import type { RunnerDeps, ToolEffect } from "../types.js";
+import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
 import type { IrreversibilityTier, ToolFaceSnapshot } from "./contracts.js";
 import type { RosterBuilder, ToolRosterDeltaSeat } from "../tool-roster.js";
+import type { McpInstructionsEntry } from "../prompt-section-seat.js";
 /** One server's assertion about its own prefix domain — the shape both faces reduce to. `tools` is
  *  the roster the domain must END UP with (empty withdraws it); `added`/`removed` are the reporting
- *  half and never drive the swap. */
+ *  half and never drive the swap. `instructions`: the server's current connection's instructions entry, when the face that produced
+ *  the delta hands it back (a refresh does; a re-dial queues its new text itself). */
 export interface McpRosterDelta {
     server: string;
     prefix: string;
     tools: AgentTool[];
     axes: McpToolAxis[];
     dropped: McpDroppedTool[];
+    instructions?: McpInstructionsEntry;
 }
 /** The seats a roster application writes through. Every one of them is borrowed from the phase that
  *  minted it — this module owns nothing. */
 export interface McpRosterApplyInput {
+    /** borrowed-readonly — the run's spec; only `excludeAllTools` is read: the valve's whole-face switch decides what a live roster
+     *  change may mount, beside the selector (`valveLeaves`). */
+    spec: Pick<TaskSpec, "excludeAllTools">;
     /** borrowed-readonly — the frozen tool face; its selector keeps a tool the leg may not use from ever
      *  being mounted by a face the model or a host can trigger. */
     toolFaceSnapshot: Pick<ToolFaceSnapshot, "selector">;
@@ -48,20 +54,53 @@ export interface McpRosterApplyInput {
     }>;
     /** borrowed-mutable — the run's shared roster. */
     roster: RosterBuilder;
+    /** borrowed-readonly — the run's frozen MCP server declarations: a roster reading is of a declared server, and a name none is declared under holds nothing. */
+    declared: ReadonlyArray<{
+        readonly name: string;
+    }>;
+    /** borrowed-mutable — the materialization's instructions delta lane; a roster change settles the server's adds on it. */
+    instructionsDelta: MaterializedMcp["instructionsDelta"];
+}
+/** What one application did to the server's domain on the roster — read off the roster before and after the swap, the ONE source of
+ *  "how many of this server's tools are mounted" for the re-dial's notice and receipt and the refresh tool's receipt. A name the
+ *  valve left out, a name the deployment's `toolFaces` overlay refused and a name the server listed but the roster did not take are
+ *  all simply absent from `mounted`. */
+export interface McpRosterReading {
+    /** The names of the server's tools the roster holds after the application, in wire order. */
+    mounted: string[];
+    /** The names `mounted` holds that the roster did not hold before. */
+    added: string[];
+    /** The names the roster held before that `mounted` no longer holds. */
+    removed: string[];
+    /** The names the server listed that the roster did not take (the valve's, the overlay's). */
+    excluded: string[];
 }
 /** What one application did, for the caller's receipt. `applied:false` means the axis fold refused
- *  and the domain was left exactly as it was (the tables restored) — no roster write happened. */
-export type McpRosterApplyOutcome = {
+ *  and the domain was left exactly as it was (the tables restored) — no roster write happened, so `mounted` is what it held. */
+export type McpRosterApplyOutcome = ({
     applied: true;
-    pushed: number;
-    excluded: string[];
-} | {
+} & McpRosterReading) | ({
     applied: false;
     foldError: string;
-};
+} & McpRosterReading);
+/** What the roster holds of one server with no swap made — the reading of an arm that asserted no roster (a failed refresh, a refused re-dial, a fold refusal).
+ *  A name no server is declared under holds nothing, even when it mints a declared server's prefix. */
+export declare function rosterHolding(input: Pick<McpRosterApplyInput, "roster" | "declared">, serverName: string): McpRosterReading;
+/** A refresh or re-dial result read off the roster instead of the server's own listing: `toolCount` is the tools mounted, `added` /
+ *  `removed` the names that came onto / left the roster, and — on a result that asserts a roster — `tools` the roster's tools of the
+ *  server (with `axes` cut to them), so `toolCount === tools.length`. One meaning, the one `MaterializedMcp.refresh` / `reconnect` give
+ *  for their own handles. */
+export declare function settledOnRoster<T extends {
+    toolCount: number;
+    added: string[];
+    removed: string[];
+    tools?: AgentTool[];
+    axes?: McpToolAxis[];
+}>(result: T, reading: McpRosterReading, roster: Pick<RosterBuilder, "tools">): T;
 /**
- * Apply one server's delta to the live roster. Behavior-identical to the body this was extracted
- * from; the comments are the extracted reasoning, not new claims.
+ * Apply one server's delta to the live roster, and settle the server's instruction adds on the delta lane: the teaching answer over the
+ * roster after the swap, against the lane's ledger of what the model holds (both faces — the model's refresh and the host's re-dial —
+ * through this one step).
  */
 export declare function applyMcpRosterDelta(input: McpRosterApplyInput, delta: McpRosterDelta): McpRosterApplyOutcome;
 /** The seats the post-application commit writes through. */
@@ -105,5 +144,8 @@ export interface McpRedialInput extends McpRosterApplyInput, McpRosterCommitInpu
  * leave the model holding tools that can only fail), and an arm that never touched the connection —
  * unknown name, revoked server, re-dial already in flight, disposed materialization — asserts nothing
  * and the mounted roster is left alone.
+ *
+ * The result it hands back counts what the ROSTER took: `toolCount` is the server's tools mounted after the swap, `added` /
+ * `removed` the names that came onto / left the roster, and the notice reads the same three — one source for "how many are mounted".
  */
 export declare function redialMcpServer(input: McpRedialInput, server: string): Promise<McpReconnectResult>;

package/dist/core/runner/mcp-redial.js

@@ -1,9 +1,31 @@
+import { valveLeaves } from "../../agents/tool-filter.js";
+import { instructionsTaught, instructionsTold, tellInstructions, toolNamesOfServer, withdrawInstructionAdds } from "../mounted-mcp.js";
 import { deliverEngineNotice } from "../types.js";
 import { thrownText } from "../thrown-value.js";
+export function rosterHolding(input, serverName) {
+    const mounted = input.declared.some((d) => d.name === serverName) ? toolNamesOfServer(input.roster.tools.map((t) => t.name), serverName) : [];
+    return { mounted, added: [], removed: [], excluded: [] };
+}
+export function settledOnRoster(result, reading, roster) {
+    const settled = { ...result, toolCount: reading.mounted.length, added: reading.added, removed: reading.removed };
+    if (result.tools === undefined)
+        return settled;
+    const held = new Set(reading.mounted);
+    return { ...settled, tools: roster.tools.filter((t) => held.has(t.name)), ...(result.axes !== undefined ? { axes: result.axes.filter((a) => held.has(a.name)) } : {}) };
+}
+function settleInstructions(lane, delta, taught) {
+    if (!taught)
+        return withdrawInstructionAdds(lane, delta.server);
+    if (delta.instructions !== undefined && !instructionsTold(lane, delta.server) && !lane.pendingAdds.some((e) => e.server === delta.server))
+        tellInstructions(lane, delta.instructions);
+}
 export function applyMcpRosterDelta(input, delta) {
-    const { toolFaceSnapshot, withFaces, remoteToolOffload, foldProtocolAxes, toolEffects, axisExplicitNegatives, roster } = input;
-    const pushable = delta.tools.filter((t) => toolFaceSnapshot.selector.admits(t));
-    const excluded = delta.tools.filter((t) => !toolFaceSnapshot.selector.admits(t)).map((t) => t.name);
+    const { spec, toolFaceSnapshot, withFaces, remoteToolOffload, foldProtocolAxes, toolEffects, axisExplicitNegatives, roster } = input;
+    const domainNow = () => toolNamesOfServer(roster.tools.map((t) => t.name), delta.server);
+    const before = domainNow();
+    const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
+    const pushable = delta.tools.filter(leaves);
+    const valveExcluded = delta.tools.filter((t) => !leaves(t)).map((t) => t.name);
     const domainSnapshot = (m) => new Map([...m].filter(([name]) => name.startsWith(delta.prefix)));
     const restoreDomain = (m, snap) => {
         for (const name of [...m.keys()])
@@ -19,15 +41,20 @@ export function applyMcpRosterDelta(input, delta) {
     for (const name of priorDomainNegatives.keys())
         axisExplicitNegatives.delete(name);
     try {
-        foldProtocolAxes(delta.axes.filter((a) => !excluded.includes(a.name)), "MCP");
+        foldProtocolAxes(delta.axes.filter((a) => !valveExcluded.includes(a.name)), "MCP");
     }
     catch (foldErr) {
         restoreDomain(toolEffects, priorDomainEffects);
         restoreDomain(axisExplicitNegatives, priorDomainNegatives);
-        return { applied: false, foldError: thrownText(foldErr) };
+        settleInstructions(input.instructionsDelta, delta, instructionsTaught(leaves, delta.server, roster.tools, delta.tools));
+        return { applied: false, foldError: thrownText(foldErr), ...rosterHolding(input, delta.server) };
     }
     roster.replaceDomain(delta.prefix, withFaces(pushable, delta.server).map((t) => remoteToolOffload(t)), { source: "mcp", mountedBy: "optional", origin: { peer: delta.server } });
-    return { applied: true, pushed: pushable.length, excluded };
+    const mounted = domainNow();
+    const heldNow = new Set(mounted);
+    const heldBefore = new Set(before);
+    settleInstructions(input.instructionsDelta, delta, instructionsTaught(leaves, delta.server, roster.tools, delta.tools));
+    return { applied: true, mounted, added: mounted.filter((n) => !heldBefore.has(n)), removed: before.filter((n) => !heldNow.has(n)), excluded: delta.tools.map((t) => t.name).filter((n) => !heldNow.has(n)) };
 }
 export async function commitMcpRosterChanges(input) {
     await input.rebuildHarnessToolsRef.current?.();
@@ -38,9 +65,11 @@ export async function commitMcpRosterChanges(input) {
     return undefined;
 }
 export async function redialMcpServer(input, server) {
-    const result = await input.mcp.reconnect(server);
-    if (result.tools !== undefined) {
-        const outcome = applyMcpRosterDelta(input, { server: result.server, prefix: result.prefix, tools: result.tools, axes: result.axes ?? [], dropped: result.dropped ?? [] });
+    const listed = await input.mcp.reconnect(server);
+    let result = settledOnRoster(listed, rosterHolding(input, listed.server), input.roster);
+    if (listed.tools !== undefined) {
+        const outcome = applyMcpRosterDelta(input, { server: listed.server, prefix: listed.prefix, tools: listed.tools, axes: listed.axes ?? [], dropped: listed.dropped ?? [] });
+        result = settledOnRoster(listed, outcome, input.roster);
         if (!outcome.applied)
             input.deps.onError?.(Object.assign(new Error(`MCP re-dial of "${server}" connected but its safety-axis fold refused, so its tools were not mounted: ${outcome.foldError}`), { code: "mcp.server_unavailable" }), { phase: "mcp", sessionId: input.sessionId });
         const ungated = await commitMcpRosterChanges(input);

package/dist/core/runner/notice-seat-input.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The input a once-per-run NOTICE SEAT takes: the run's notice sink and the two ids a notice is attributed to. One shape, defined
+ * once, below every seat that takes it (the extra-body strip account, the per-model credential-origin refusal account) — a seat
+ * importing a sibling seat's type was a sideways edge on a stratum that allows none.
+ */
+import type { EngineNotice } from "../engine-notice.js";
+export interface NoticeSeatInput {
+    onNotice: ((notice: EngineNotice) => void) | undefined;
+    sessionId: string;
+    runId: string;
+}

package/dist/core/runner/notice-seat-input.js

@@ -0,0 +1 @@
+export {};

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -117,12 +117,15 @@ export interface PermissionRuleLanes {
     } | undefined;
 }
 /** The ORG lane: the org's verdict about one call, off the store view `read` supplies — the gate's `orgRules` face over the
- *  call's pinned read ({@link createPermissionRuleLanes}), and {@link orgVerdictBeforeClaim} over a view of its own. */
+ *  call's pinned read ({@link createPermissionRuleLanes}), and {@link orgVerdictBeforeClaim} over a view of its own.
+ *  `onDegraded` receives the snapshot's degraded line ({@link describeUnreadableOrgRows}) on every adjudication over a
+ *  snapshot carrying a row this layer cannot read. */
 export declare function orgRuleLane(cfg: {
     read: (toolCallId: string) => Promise<Pick<EffectivePermissionRules, "org">>;
     questionToolMounted: boolean;
     questionToolName: string;
     onRevisionDefect: (message: string) => void;
+    onDegraded: (message: string) => void;
 }): NonNullable<PermissionRuleLanes["org"]>;
 /** The org's CURRENT verdict about a parked call, read by the resume entry before the claim (the row's session and principal,
  *  bounded like the gate's wait; unreadable ⇒ unavailable). The mount and a revision defect are the resumed leg's facts, so
@@ -172,7 +175,7 @@ export declare function createPermissionRuleLanes(cfg: {
     questionToolMounted: boolean;
     questionToolName: string;
     onRevisionDefect: (message: string) => void;
-    /** Sink for a judgment against the rows that threw. */
+    /** Sink for a judgment against the rows that threw, and for the org lane's degraded-snapshot line. */
     onDisclosure: (message: string) => void;
     /** The run's one reader of the person's rules: the call's ONE read, pinned, that the read station, the org lane and the
      *  personal lane all take (the lanes consume a reader; they do not make one). */

package/dist/core/runner/permission-rule-lanes.js

@@ -1,10 +1,10 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, domainRuleSubjectOf, faceRowsSpeakFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
+import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, domainRuleSubjectOf, escapeForDisclosure, faceRowsSpeakFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
 import { callTargetViewsOf, validatePath } from "../effective-path-target.js";
 import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
 import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
-import { orgRuleVerdictFor, settleOrgVerdictWithin } from "../permission-rule-org.js";
+import { describeUnreadableOrgRows, readOrgRules, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { ownerStoreOf } from "../permission-rule-provider.js";
 import { thrownText } from "../thrown-value.js";
@@ -18,12 +18,19 @@ export function inheritedAskRuleEvidence(provider) {
     return Object.freeze({ orgRevisionAbsent: org, orgRuleAbsent: org, personalRuleDotsAbsent: personal });
 }
 export function orgRevisionEvidenceOf(resolution, onDefect) {
-    const reported = resolution.revision;
+    let reported;
+    try {
+        reported = resolution.revision;
+    }
+    catch (err) {
+        onDefect(`the org rule partition's revision could not be read (${thrownText(err)}) — the adjudication stands, but the ask carries no revision evidence for this call`);
+        return {};
+    }
     if (reported === undefined)
         return {};
     if (typeof reported === "number" && Number.isFinite(reported))
         return { revision: reported };
-    onDefect(`the org rule partition reported revision ${JSON.stringify(reported)} — a snapshot revision is a finite number; ` +
+    onDefect(`the org rule partition reported revision ${typeof reported === "string" ? `"${escapeForDisclosure(reported)}"` : escapeForDisclosure(reported)} — a snapshot revision is a finite number; ` +
         `the adjudication stands, but the ask carries no revision evidence for this call`);
     return {};
 }
@@ -59,11 +66,16 @@ export function orgRuleLane(cfg) {
             if (resolution.status === "unavailable" || resolution.status === "ungoverned") {
                 return { status: "unavailable", disclosures: resolution.status === "ungoverned" ? ["the store reports no org partition while the provider declares one — unreadable governance, never an empty one"] : resolution.disclosures };
             }
-            const revisionCell = orgRevisionEvidenceOf(resolution, cfg.onRevisionDefect);
+            const reading = readOrgRules(resolution.rules);
+            if ("refused" in reading)
+                return { status: "unavailable", disclosures: [`the store's org resolution cannot be read (${reading.refused}) — unreadable governance, never an empty one`] };
             const command = req.args?.command;
-            if (!laneToolNamesOf(req).includes(PERSISTED_RULE_TOOL) || typeof command !== "string")
-                return { status: "available", ...revisionCell };
-            const verdict = orgRuleVerdictFor(resolution.rules, { tool: PERSISTED_RULE_TOOL, command });
+            const face = callPathFaceOf(req);
+            const verdict = reading.verdictFor({ tool: laneToolNamesOf(req), ...(typeof command === "string" ? { command } : {}), ...(face !== undefined ? { face } : {}) });
+            const revisionCell = orgRevisionEvidenceOf(resolution, cfg.onRevisionDefect);
+            const degraded = describeUnreadableOrgRows(reading.unreadable, revisionCell.revision);
+            if (degraded !== undefined)
+                cfg.onDegraded(degraded);
             return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
         },
     };
@@ -72,7 +84,7 @@ export function orgVerdictBeforeClaim(cfg, req) {
     const unreadable = { status: "unavailable", disclosures: [] };
     const read = () => {
         const store = ownerStoreOf(cfg.provider, cfg.principal, cfg.localOwnerDeclared);
-        return orgRuleLane({ read: () => store.effective({ sessionId: cfg.sessionId }), questionToolMounted: true, questionToolName: ASK_USER_QUESTION_TOOL_NAME, onRevisionDefect: () => undefined }).adjudicate(req);
+        return orgRuleLane({ read: () => store.effective({ sessionId: cfg.sessionId }), questionToolMounted: true, questionToolName: ASK_USER_QUESTION_TOOL_NAME, onRevisionDefect: () => undefined, onDegraded: () => undefined }).adjudicate(req);
     };
     return settleOrgVerdictWithin(Promise.resolve().then(read).catch(() => unreadable), unreadable, { timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS, ...(cfg.signal !== undefined ? { signal: cfg.signal } : {}) });
 }
@@ -101,7 +113,7 @@ export function createPermissionRuleLanes(cfg) {
             throw new Error(read.unreadable ?? "the store did not answer");
         return { org: read.org };
     };
-    const org = provider.partitions.org ? orgRuleLane({ read: orgViewOf, questionToolMounted: cfg.questionToolMounted, questionToolName: cfg.questionToolName, onRevisionDefect: cfg.onRevisionDefect }) : undefined;
+    const org = provider.partitions.org ? orgRuleLane({ read: orgViewOf, questionToolMounted: cfg.questionToolMounted, questionToolName: cfg.questionToolName, onRevisionDefect: cfg.onRevisionDefect, onDegraded: cfg.onDisclosure }) : undefined;
     const personalAdjudicate = async (req) => {
         if (anonymous && !cfg.localOwnerDeclared)
             return undefined;

package/dist/core/runner/person-path-rows.d.ts

@@ -237,7 +237,9 @@ export declare function ruleStoreUnreadableNotice(onNotice: RunnerDeps["onNotice
 /**
  * The run's ONE `permission.rule_row_dropped` notice (audience user): the person's store served project-scoped rows whose
  * scope root is not a complete absolute path, left out of the checks; minted by whichever read met them first, once per
- * run. The sentence names no path; the rows (bounded) ride the detail. The trace keeps every read's line.
+ * run. The sentence names no path; the rows ride the detail: `rule` is the rule text as the store served it, through the one
+ * reading ({@link noticeRuleText}) that `permission.allowed_tool_not_granted`'s `entries[].entry` uses too — the machine-read side carries the
+ * original, the sentence spells — and `scopeRoot` neutralized and bounded. The trace keeps every read's line.
  */
 export declare function ruleRowsDroppedNotice(onNotice: RunnerDeps["onNotice"], ids: {
     readonly sessionId: string;

package/dist/core/runner/person-path-rows.js

@@ -1,6 +1,6 @@
 import { ownerStoreOf } from "../permission-rule-provider.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
-import { PATH_RULE_FACES, READ_RULE_TOOL, eligiblePersisted } from "../permission-rule-model.js";
+import { PATH_RULE_FACES, READ_RULE_TOOL, eligiblePersisted, noticeRuleText } from "../permission-rule-model.js";
 import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { thrownText } from "../thrown-value.js";
@@ -258,6 +258,7 @@ export function createPersonPathRows(cfg) {
                 matchPath: (path, opts) => judging().readDeny.matchPath(path, opts),
                 matchTarget: (canonicalKey, lexicalView, opts) => judging().readDeny.matchTarget(canonicalKey, lexicalView, opts),
                 unexcludableUnder: (scope) => judging().readDeny.unexcludableUnder?.(scope) ?? false,
+                rowUnderRoot: (scope) => judging().readDeny.rowUnderRoot?.(scope) ?? null,
                 rowAtOrBelow: (path) => judging().readDeny.rowAtOrBelow?.(path) ?? null,
                 forCall: (id) => tablesFor(id).readDeny,
             });
@@ -381,7 +382,7 @@ export function ruleRowsDroppedNotice(onNotice, ids) {
         deliverEngineNotice(onNotice, {
             code: "permission.rule_row_dropped",
             message: `${rows.length} of your persisted permission rule rows ${one ? "is" : "are"} scoped to a project directory that is not written as a complete absolute path, so ${one ? "it takes" : "they take"} no part in this run's checks — a deny or ask row among them protects nothing. Rewrite ${one ? "it" : "them"} with the project's full path, or remove ${one ? "it" : "them"} (this notice's detail names ${one ? "it" : "them"}).`,
-            detail: { rows: rows.slice(0, 8).map((r) => ({ rule: inlineUntrusted(r.rule, 200), scopeRoot: inlineUntrusted(r.scopeRoot, 200) })), count: rows.length, sessionId: ids.sessionId, runId: ids.runId },
+            detail: { rows: rows.slice(0, 8).map((r) => ({ rule: noticeRuleText(r.rule), scopeRoot: inlineUntrusted(r.scopeRoot, 200) })), count: rows.length, sessionId: ids.sessionId, runId: ids.runId },
         });
     };
 }

package/dist/core/runner/prepare-acquire-reconcile.js

@@ -1,4 +1,6 @@
 import { StoredSession, isSessionConflict } from "../session.js";
+import { SessionError } from "../../internal/harness.js";
+import { readMember } from "../thrown-value.js";
 import { userAttachmentOf } from "../../internal/llm.js";
 import { lastAttachmentFrameOf } from "../user-attachment.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
@@ -33,7 +35,9 @@ export async function prepareAcquireReconcile(input) {
         }
         try {
             if (resume) {
-                await session.getStorage().setLeafId(resume.leafId);
+                await session.getStorage().setLeafId(resume.leafId).catch((cut) => {
+                    throw readMember(cut, "code") === "not_found" ? new SessionError("invalid_session", `session "${spec.sessionId}" no longer holds the entry its checkpoint was cut at ("${resume.leafId}")`, cut) : cut;
+                });
             }
             else if (spec.resumeAt !== undefined) {
                 const entry = await session.getEntry(spec.resumeAt);

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -2,7 +2,7 @@ import type { CallTargetStamp } from "../effective-path-target.js";
 import type { AgentTool } from "../../internal/harness.js";
 import type { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import type { AutoModeDenialTracker } from "../auto-mode.js";
-import { type Hooks } from "../hooks.js";
+import { type LegModBus } from "../mods/stations.js";
 import { type OnAsk, type ToolCallRequest, type ToolPolicy } from "../tool-policy.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
@@ -89,12 +89,10 @@ export interface PrepareAskLaneInput {
     sessionId: string;
     /** borrowed-readonly — the run's invocation id (the observer's tag). */
     runId: string;
-    /** borrowed-readonly — the resolved hook record; only `permissionDenied` is read (the deny observer's seat). */
-    hooks: Hooks | undefined;
-    /** borrowed-readonly — the validated per-prepare hook seat bound (the deny observer's timeout). */
-    hookTimeoutMs: number;
-    /** borrowed-readonly — the own hook-failure lane (`onError`, phase `hook`, swallow-guarded): the deny observer's report sink,
-     *  the gate's crashing-PreToolUse sink and the adjudicate seat's report of a policy chain that threw. */
+    /** borrowed-readonly — the leg's mods bus (the deny observer raises `classic.PermissionDenied` on it). */
+    modBus: LegModBus;
+    /** borrowed-readonly — the leg's own failure lane (`onError`, phase `hook`, swallow-guarded): the adjudicate seat's report
+     *  of a policy chain that threw. */
     notifyOwnHookCrash: (err: unknown) => void;
     /** borrowed-readonly — the hands phase's in-flight read-root widening (an approver's accepted `readRootGrant`), or undefined (hands-less). */
     grantReadRoot: GrantReadRoot | undefined;