@sema-agent/core 7.51.2 → 7.53.0

package/dist/core/runner/prepare-defer-classify.js

@@ -3,11 +3,13 @@ import { FULL_SHELL_CONTRACT_ID } from "../../tools/fs/index.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
 import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
+import { announceMemoryNotMounted } from "./announce-once-ledger.js";
 import { protocolOf } from "../protocol-table.js";
 import { classifyDeferredWithGate } from "./tool-defer-gate.js";
 import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
 import { resolveToolSearch, toolSearchSettingOf } from "../tool-search-setting.js";
 import { RosterBuilder } from "../tool-roster.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 function explicitlyDeferredMemoryTrio(mounted, roster, callerDeferNames) {
     return mounted ? MEMORY_ENGINE_TOOL_NAMES.filter((n) => roster.some((t) => t.name === n) && (callerDeferNames ?? []).includes(n)) : [];
 }
@@ -18,12 +20,8 @@ export function prepareDeferClassify(input) {
     const { spec, deps, roster, toolFaceSnapshot, handsEnabled, fullShellReachable, promptProfile, model, mcp, a2a, sharedMemoryPairMounted, memoryEnginePairMounted, memoryRecallSegment, onceLedger, sessionId } = input;
     const tools = roster.tools;
     let memoryBlock = input.memoryBlock;
-    if (spec.excludeAllTools === true) {
-        roster.unmountWhere(() => true);
-    }
-    else {
-        roster.unmountWhere((t) => !toolFaceSnapshot.selector.admits(t));
-    }
+    const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
+    roster.unmountWhere((t) => !leaves(t));
     if (handsEnabled) {
         const fullShellOnRoster = tools.some((t) => t.name === "Bash" && getToolContract(t, "core").contractId === FULL_SHELL_CONTRACT_ID);
         if (fullShellOnRoster !== fullShellReachable) {
@@ -47,7 +45,7 @@ export function prepareDeferClassify(input) {
         .map((t) => t.name);
     const resolvedToolSearch = resolveToolSearch(deps.toolSearch);
     const toolSearchSeat = toolSearchSettingOf(resolvedToolSearch);
-    const toolSearchAdmitted = toolFaceSnapshot.selector.admits({ name: TOOL_SEARCH_NAME });
+    const toolSearchAdmitted = leaves({ name: TOOL_SEARCH_NAME });
     const classifyDeferredOverFace = (face, builtinDeferNames) => {
         const mounted = new Set(face.map((t) => t.name));
         const classified = classifyDeferredWithGate({
@@ -87,8 +85,7 @@ export function prepareDeferClassify(input) {
             const retractNames = memoryGroupRetractionSet(builtinDeferPairNames, memoryEnginePair.length > 0);
             roster.unmountWhere((t) => retractNames.has(t.name));
             if (sharedMemoryPair.length > 0) {
-                onceLedger.onError(new Error(`Shared memory tools ${SHARED_MEMORY_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
-                    `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — the pair mounts together or not at all.`), { phase: "config", sessionId, classification: "shared-memory-not-mounted" });
+                announceMemoryNotMounted(onceLedger, sessionId, "shared", SHARED_MEMORY_TOOL_NAMES, `mounting them would inject the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares`);
             }
             if (memoryEnginePair.length > 0) {
                 if (memoryBlock !== undefined && memoryRecallSegment !== undefined) {
@@ -100,8 +97,7 @@ export function prepareDeferClassify(input) {
                     else if (memoryBlock.startsWith(`${segment}\n\n`))
                         memoryBlock = memoryBlock.slice(segment.length + 2);
                 }
-                onceLedger.onError(new Error(`Memory tools ${MEMORY_ENGINE_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
-                    `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — these tools mount together or not at all.`), { phase: "config", sessionId, classification: "memory-tools-not-mounted" });
+                announceMemoryNotMounted(onceLedger, sessionId, "engine", MEMORY_ENGINE_TOOL_NAMES, `mounting them would inject the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares`);
             }
             deferred = d0;
         }

package/dist/core/runner/prepare-delegation-surface.d.ts

@@ -30,11 +30,11 @@ export interface PrepareDelegationSurfaceInput {
     /** borrowed-readonly — the REBOUND spec. Read: `tools` (the shadow checks and the revival spawner's delegation-tool
      *  lookup), `oneShot` (the read/kill faces' completion promises), `retainBackgroundProcesses` (the Monitor receipt),
      *  `handsReadOnly` is NOT read here (the hands mount decided the surface). Never mutated. */
-    spec: Pick<TaskSpec, "tools" | "oneShot" | "retainBackgroundProcesses">;
+    spec: Pick<TaskSpec, "tools" | "oneShot" | "retainBackgroundProcesses" | "excludeAllTools">;
     /** borrowed-readonly — the deployment seats the mounts read: `workflowRunStore` / `backgroundAgentStore` / `mailboxStore` (the
      *  read/kill faces and the tier-3 revival seams), `rosterStore`, `peerLane`, `peerDirectory`, `onNotice`,
      *  `onBackgroundChildEvent`, `tracer`. */
-    deps: Pick<RunnerDeps, "workflowRunStore" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "peerLane" | "peerDirectory" | "onNotice" | "onBackgroundChildEvent" | "tracer">;
+    deps: Pick<RunnerDeps, "workflowRunStore" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "peerLane" | "peerDirectory" | "principalInboxConsumer" | "onNotice" | "onBackgroundChildEvent" | "tracer">;
     /** borrowed-readonly — the trusted spawn-side channel: `parentNotify` (the delegated-child door), the uplink / sibling /
      *  identity seats the SendMessage mount forwards, `onTaskNotification`, `onSubagentSpawn`. Never mutated. */
     internals: Pick<RunInternals, "parentNotify" | "parentPeerRef" | "uplinkSessionId" | "parentRetainLedger" | "explicitAgentName" | "parentTaskId" | "parentSessionId" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn"> | undefined;

package/dist/core/runner/prepare-delegation-surface.js

@@ -1,8 +1,9 @@
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
-import { listAgentsMountable, mountListAgents, peerLaneSendMessageSeats } from "../../agents/peer-session-drain.js";
+import { listAgentsMountable, mountListAgents, peerLaneSendMessageSeats, terminalsDrainPrincipalInbox } from "../../agents/peer-session-drain.js";
 import { resolvePeerLaneConfig } from "../../agents/peer-admission.js";
 import { createReadInboxTool, READ_INBOX_TOOL_NAME } from "../../agents/read-inbox-tool.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 import { createMonitorTool } from "../../tools/monitor.js";
 import { createWorktreeTools } from "../../tools/worktree.js";
 import { createTaskOutputTool, createTaskStopTool, defaultTaskRegistry } from "../task-registry.js";
@@ -15,6 +16,7 @@ export function prepareDelegationSurface(input) {
     const { spec, deps, internals, resume, sessionId, hostTaskId, taskScope, taskRootFinal, taskRootCanonical, executionEnv, runnerSelf, backgroundTaskToolsActive, workflowToolsActive, peerLaneActive, peerSendMessageBuiltIn, peerLaneRefs, sessionBox, roster, toolEffects, axisExplicitNegatives, envHandToolNames, toolFaceSnapshot, firstPartyOffload, offloadStore, subagentRetain, enrichSpecToolCtx, checkpointSeat, handsCwdRef, wsSnapshot, rebaseWsPath, rebaseRestoredPath, workspaceStateSettle } = input;
     let worktreeSessionRef;
     const delegationSurfaceActive = backgroundTaskToolsActive || workflowToolsActive;
+    const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
     let sendMessageTier;
     if (delegationSurfaceActive || internals?.parentNotify !== undefined || peerLaneActive) {
         if (delegationSurfaceActive) {
@@ -54,7 +56,7 @@ export function prepareDelegationSurface(input) {
                 ...(deps.backgroundAgentStore !== undefined ? { agentStore: deps.backgroundAgentStore } : {}),
                 ...(deps.mailboxStore !== undefined ? { mailbox: deps.mailboxStore } : {}),
                 ...(reviveSpawn !== undefined ? { reviveSpawn } : {}),
-                ...(peerLaneActive ? peerLaneSendMessageSeats({ peerDirectory: deps.peerDirectory, sessionId, scope: taskScope, ...(internals?.explicitAgentName !== undefined ? { name: internals.explicitAgentName } : {}), refs: peerLaneRefs, listingMounted: listAgentsMountable({ selector: toolFaceSnapshot.selector, specTools: spec.tools ?? [] }) }) : {}),
+                ...(peerLaneActive ? peerLaneSendMessageSeats({ peerDirectory: deps.peerDirectory, sessionId, scope: taskScope, ...(internals?.explicitAgentName !== undefined ? { name: internals.explicitAgentName } : {}), refs: peerLaneRefs, listingMounted: listAgentsMountable({ leaves, specTools: spec.tools ?? [] }) }) : {}),
                 onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
                 onTranscriptIntegrityGap: (handle, scope) => deliverEngineNotice(deps.onNotice, {
                     code: "delegation.transcript_integrity",
@@ -80,11 +82,11 @@ export function prepareDelegationSurface(input) {
             }
         }
     }
-    if (sessionBox !== undefined && internals?.onTaskNotification !== undefined && toolFaceSnapshot.selector.admits({ name: READ_INBOX_TOOL_NAME }) && !(spec.tools ?? []).some((t) => t.name === READ_INBOX_TOOL_NAME)) {
+    if (sessionBox !== undefined && internals?.onTaskNotification !== undefined && leaves({ name: READ_INBOX_TOOL_NAME }) && !(spec.tools ?? []).some((t) => t.name === READ_INBOX_TOOL_NAME)) {
         toolEffects.set(READ_INBOX_TOOL_NAME, "read");
-        roster.mount(firstPartyOffload(createReadInboxTool({ pull: () => peerLaneRefs.pull })), { source: "builtin", mountedBy: "peerLane" });
+        roster.mount(firstPartyOffload(createReadInboxTool({ pull: () => peerLaneRefs.pull, ...(terminalsDrainPrincipalInbox(deps) ? { coversPrincipalInbox: true } : {}) })), { source: "builtin", mountedBy: "peerLane" });
     }
-    const listAgents = (peerLaneActive || delegationSurfaceActive) && peerSendMessageBuiltIn && listAgentsMountable({ selector: toolFaceSnapshot.selector, specTools: spec.tools ?? [] }) ? mountListAgents({ ...(peerLaneActive ? { peerDirectory: deps.peerDirectory } : {}), freshWindowMs: resolvePeerLaneConfig(deps.peerLane, deps.onNotice).listingFreshWindowMs, sessionId, scope: taskScope, hostTaskId, ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}), ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}), registry: defaultTaskRegistry, ...(deps.rosterStore !== undefined ? { roster: deps.rosterStore } : {}), ...(sendMessageTier !== undefined ? { continuationTier: sendMessageTier } : {}), ...(checkpointSeat !== undefined ? { readSeats: { checkpointSeat } } : {}), specTools: spec.tools ?? [], toolEffects }) : undefined;
+    const listAgents = (peerLaneActive || delegationSurfaceActive) && peerSendMessageBuiltIn && listAgentsMountable({ leaves, specTools: spec.tools ?? [] }) ? mountListAgents({ ...(peerLaneActive ? { peerDirectory: deps.peerDirectory } : {}), freshWindowMs: resolvePeerLaneConfig(deps.peerLane, deps.onNotice).listingFreshWindowMs, sessionId, scope: taskScope, hostTaskId, ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}), ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}), registry: defaultTaskRegistry, ...(deps.rosterStore !== undefined ? { roster: deps.rosterStore } : {}), ...(sendMessageTier !== undefined ? { continuationTier: sendMessageTier } : {}), ...(checkpointSeat !== undefined ? { readSeats: { checkpointSeat } } : {}), specTools: spec.tools ?? [], toolEffects }) : undefined;
     if (listAgents !== undefined)
         roster.mount(firstPartyOffload(listAgents), { source: "builtin", mountedBy: "peerLane" });
     if (backgroundTaskToolsActive) {

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -30,7 +30,8 @@ import type { Arbitration, ToolMarkSource } from "../ask-origin.js";
 import { type PermissionModeController } from "../mode-policy.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type ComplianceCapability } from "../compliance.js";
-import { type HookEnvCapabilities, type HookInvocationIdentity, type Hooks } from "../hooks.js";
+import type { InheritedToolCheck, LegModBus } from "../mods/stations.js";
+import { type HookEnvCapabilities, type HookInvocationIdentity } from "../hooks.js";
 import type { ToolPolicy } from "../tool-policy.js";
 import { type GateOutcome } from "../gate-outcome.js";
 import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
@@ -95,9 +96,11 @@ export interface PrepareGateStationsInput {
     };
     /** borrowed-readonly — the policy chain's effective policy, or undefined; presence only (the arming predicate). */
     effectivePolicy: ToolPolicy | undefined;
-    /** borrowed-readonly — the resolved hook record: `preToolUse` presence (arming), the two post seats and the failure seat
-     *  (the `tool_result` station), called through the record so a class-instance keeps its receiver. */
-    hooks: Hooks | undefined;
+    /** borrowed-readonly — the leg's mods bus: `classic.PreToolUse` presence arms the gate; the screenings and the post-call
+     *  events are raised on it. */
+    modBus: LegModBus;
+    /** borrowed-readonly — the inherited installations the gate raises `tool.check` on after `modBus` (the inherited-gate phase's). */
+    inheritedToolChecks: readonly InheritedToolCheck[];
     /** borrowed-readonly — the egress vocabulary: arming, and the per-call `egress` flag handed to the gate. */
     egressTools: ReadonlySet<string>;
     /** borrowed-readonly — the irreversible vocabulary: arming only. */
@@ -138,7 +141,7 @@ export interface PrepareGateStationsInput {
     batchHaltRef: Prepared["batchHaltRef"];
     /** borrowed-readonly — whether blocked/suspended ids are tracked at all (the post-tool callbacks exist). */
     blockedTracked: boolean;
-    /** borrowed-readonly — the leg's identity envelope every HookToolContext and PermissionDeniedPayload carries. */
+    /** borrowed-readonly — the leg's identity envelope every classic event and PermissionDeniedPayload carries. */
     hookIdentity: HookInvocationIdentity;
     /** borrowed-readonly — the leg's reminder provenance mark (every model-facing deny reason and hook context carries it). */
     reminderMark: string;
@@ -146,10 +149,6 @@ export interface PrepareGateStationsInput {
     hostTaskId: string;
     /** borrowed-readonly — the acquired session id (the settlement defects' error tag). */
     sessionId: string;
-    /** borrowed-readonly — the screening face as the gate must see it (the observational wrapper or the face itself). */
-    ownGatePreToolUse: Hooks["preToolUse"] | undefined;
-    /** borrowed-readonly — the validated per-prepare hook seat bound. */
-    hookTimeoutMs: number;
     /** borrowed-readonly — the hand's live tracked cwd, or undefined; `current` is read per screening / per post seat. Not
      *  written here. */
     handsCwdRef: CwdRef | undefined;
@@ -237,8 +236,6 @@ export interface PrepareGateStationsInput {
     delegation: {
         isDelegatedChild: boolean;
     };
-    /** borrowed-readonly — the own hook-crash reporter (an expired post seat is reported through it). */
-    notifyOwnHookCrash: (err: unknown) => void;
     /** borrowed-mutable — the leg's settlement seam. Writer here: the `tool_result` station marks a carrier whose output
      *  a host hook rewrote (`noteHostRewrite`), so a frame the rewrite removed settles as the host's decision. */
     frameSettlement: FrameSettlement;

package/dist/core/runner/prepare-gate-stations.js

@@ -1,9 +1,9 @@
 import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { mountedToolRequiresUserInteraction } from "../mode-policy.js";
 import { complianceCallDenial } from "../compliance.js";
-import { cloneObserverInput, formatHookFeedback, runToolGate } from "../hooks.js";
+import { formatHookFeedback, runToolGate } from "../hooks.js";
 import { screenGateOutcome } from "../gate-outcome.js";
-import { directDeny, frozenInputSnapshot } from "./gate-exit.js";
+import { cloneObserverInput, directDeny, frozenInputSnapshot } from "./gate-exit.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
@@ -46,8 +46,7 @@ export function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, stampCallTarget, hookEnvFace, writeProtectionCheck, shellReadCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement, seatInputsFor } = input;
-    const gatePreToolUse = ownGatePreToolUse !== undefined ? (name, args, ctx) => ownGatePreToolUse(name, args, { ...ctx, permissionMode: permissionMode.observed }) : undefined;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, handsCwdRef, stampCallTarget, hookEnvFace, writeProtectionCheck, shellReadCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, frameSettlement, seatInputsFor, modBus, inheritedToolChecks } = input;
     const releasesAnnounced = new Map();
     const onModeReleased = (info) => {
         const table = info.readUnestablished === true ? input.readDenyInForce(info.toolCallId) : undefined;
@@ -81,7 +80,7 @@ export function prepareGateStations(input) {
         const writeProtectionArmed = writeProtectionCheck !== undefined && tools.some((t) => PATH_CONFINABLE_WRITE_TOOLS.has(t.name));
         toolCallGateArmedRef.armed =
             effectivePolicy !== undefined ||
-                hooks?.preToolUse !== undefined ||
+                modBus.hasHandlers("classic.PreToolUse") ||
                 egressTools.size > 0 ||
                 irreversibleTools.size > 0 ||
                 spec.enablePlanMode === true ||
@@ -119,8 +118,9 @@ export function prepareGateStations(input) {
                         ...(e.signal !== undefined ? { callSignal: e.signal } : {}),
                         identity: hookIdentity,
                         reminderMark,
-                        ...(gatePreToolUse !== undefined ? { preToolUse: gatePreToolUse } : {}),
-                        hookTimeoutMs,
+                        modBus,
+                        ...(inheritedToolChecks.length > 0 ? { inheritedToolChecks } : {}),
+                        observedPermissionMode: () => permissionMode.observed,
                         ...(handsCwdRef !== undefined ? { trackedCwd: () => handsCwdRef.current } : {}),
                         ...(stampCallTarget !== undefined ? { stampCallTarget } : {}),
                         ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
@@ -137,7 +137,6 @@ export function prepareGateStations(input) {
                         irreversibility: tierSeat?.value,
                         reversibilityProbe: tierSeat?.read(reversibilityProbes),
                         abortSignal: abortController.signal,
-                        ...(notifyPermissionDenied ? { permissionDenied: (p) => notifyPermissionDenied({ ...p, permissionMode: permissionMode.observed }) } : {}),
                         onHookError: notifyHookError,
                         shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
                         ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), route: approvalRouteOf(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
@@ -241,13 +240,15 @@ export function prepareGateStations(input) {
                     }
                     return { block: true, reason: result.reason, ...details };
                 }
+                if (result.suspend === undefined)
+                    toolOccurrences.release(e.toolCallId);
                 return result.updatedInput !== undefined ? { updatedInput: result.updatedInput } : undefined;
             });
         }
     }
-    const toolResultStation = createToolResultStation({ hooks, blockedToolCalls, toolRosterDeltas, preToolContexts, hookTimeoutMs, abortController, spec, handsCwdRef, hookEnvFace, hookIdentity, permissionMode, notifyOwnHookCrash, reminderMark, frameSettlement });
+    const toolResultStation = createToolResultStation({ modBus, blockedToolCalls, toolRosterDeltas, preToolContexts, abortController, spec, handsCwdRef, hookEnvFace, hookIdentity, permissionMode, reminderMark, frameSettlement });
     if (toolResultStation !== undefined)
         harness.on("tool_result", toolResultStation);
-    const approvedCallScreen = createApprovedCallScreen({ preToolUse: gatePreToolUse, hookTimeoutMs, abortController, handsCwdRef, hookEnvFace, hookIdentity, notifyOwnHookCrash, preToolContexts });
+    const approvedCallScreen = createApprovedCallScreen({ modBus, permissionMode, abortController, handsCwdRef, hookEnvFace, hookIdentity, preToolContexts });
     return { toolCallStationArmed: toolCallGateArmedRef.armed, toolResultStationArmed: toolResultStation !== undefined, ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}) };
 }

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -88,7 +88,7 @@ export interface PrepareHandsReadFaceInput {
     /** borrowed-readonly — the task-spec seats this phase reads, as a Pick over the SAME spec object
      *  (R-4). `tools` feeds only the band shadow check; `envFacts` only the advertised scratchpad;
      *  `retainBackgroundProcesses` only the band's retain lane (Bash's lifetime sentence + row stamp). */
-    spec: Pick<TaskSpec, "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "handsReadOnly" | "readDenyPatterns" | "readFace" | "writeFace" | "oneShot" | "resumeAt" | "retainBackgroundProcesses" | "sessionId" | "tools">;
+    spec: Pick<TaskSpec, "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "handsReadOnly" | "readDenyPatterns" | "readFace" | "writeFace" | "oneShot" | "resumeAt" | "retainBackgroundProcesses" | "sessionId" | "tools" | "excludeAllTools">;
     /** borrowed-readonly — the deployment seats this phase reads, as a Pick over the SAME deps
      *  object (R-4: `deps.onError?.()` keeps its receiver; a new deps read must widen this Pick).
      *  `readDenyBuiltinTiers`/`readDenyBuiltinExclude` are SNAPSHOTTED before the first await that

package/dist/core/runner/prepare-hands-readface.js

@@ -21,6 +21,7 @@ import { RosterBuilder } from "../tool-roster.js";
 import { unionAddOnly } from "../child-clamp-seats.js";
 import { assertStringArraySeat } from "../read-face-seats.js";
 import { modePolicyOf } from "../mode-policy.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 const faceClampAnnouncedSinks = { read: new WeakSet(), write: new WeakSet() };
 const faceClampConsoleAnnounced = { read: false, write: false };
 function announceDeploymentFaceClamp(kind, sink) {
@@ -370,7 +371,7 @@ export async function prepareHandsMount(input) {
                 return memoryWriteGate?.(w);
             },
             mountBackgroundTaskTools: false,
-            monitorToolActive: backgroundTaskToolsActive && toolFaceSnapshot.selector.admits({ name: "Monitor" }),
+            monitorToolActive: backgroundTaskToolsActive && valveLeaves(spec, toolFaceSnapshot.selector)({ name: "Monitor" }),
         });
         {
             const bandNames = new Set(band.flatMap((t) => [t.name, ...(t.aliases ?? [])]));

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -31,14 +31,15 @@ import type { AgentHarness, ExecutionEnv } from "../../internal/harness.js";
 import type { SubagentWorktreeIsolation } from "../../agents/subagent.js";
 import { forkGovernanceDenial } from "../../agents/subagent.js";
 import type { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import type { PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
+import type { PromptArtifact } from "../../prompt-assembly/artifact.js";
 import type { ContainmentFace } from "../../tools/fs/index.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type OnQuestion } from "../ask-question.js";
 import { type ParentSpecSeat } from "../parent-spec-seat.js";
+import { type HookEnvCapabilities } from "../hooks.js";
+import { type LegModBus, type ModChainLink } from "../mods/stations.js";
 import { type ChildClampSource } from "../child-clamp-seats.js";
-import { type HookEnvCapabilities, type Hooks } from "../hooks.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { OwnOrgAdmissionVerdict } from "../memory-admission.js";
 import type { DelegationContentSafety } from "../memory-engine/delegation-provenance.js";
@@ -157,13 +158,10 @@ export interface PrepareInheritedGateInput {
     /** borrowed-readonly — LATE-BOUND: the per-principal entitlements the caps phase resolves after this one; read only inside
      *  `inheritedGateForChildren` (the two mandate tests), at spawn time. */
     runtimeCaps: () => RuntimeCaps | undefined;
-    /** borrowed-readonly — LATE-BOUND: the resolved hook record (`spec.hooks ?? deps.hooks`), read inside the chain assembly for
-     *  this task's own screening face. */
-    hooks: () => Hooks | undefined;
-    /** borrowed-readonly — LATE-BOUND: whether the deployment declared its screening face observational (then it rides no entry). */
-    preToolUseObservational: () => boolean;
-    /** borrowed-readonly — LATE-BOUND: the validated per-invocation hook bound the screening-face entry's policy runs under. */
-    hookTimeoutMs: () => number;
+    /** borrowed-readonly — the leg's mods bus: the chain assembly mints this leg's screening entry over its `classic.PreToolUse` chain. */
+    modBus: LegModBus;
+    /** borrowed-readonly — this leg's chain identity as its admission recorded it (`chainOfBus`) — the installation identity's chain term. */
+    ownModChain: readonly ModChainLink[];
     /** borrowed-readonly — LATE-BOUND: the hook-env capability face the screening-face entry's policy resolves paths in. */
     hookEnvFace: () => HookEnvCapabilities | undefined;
     /** borrowed-readonly — LATE-BOUND: the armed classifier (undefined = not armed), read where the chain freezes it onto both
@@ -192,7 +190,7 @@ export interface PrepareInheritedGateInput {
     handsLessResolvedWriteFace: () => WriteFaceSeat | undefined;
     /** borrowed-readonly — LATE-BOUND: the adopted center artifact (ctx `centerArtifactDigest` / `centerSourceRevision`). */
     centerAdoption: () => {
-        artifact: PromptEpochArtifact;
+        artifact: PromptArtifact;
         sourceRevision?: string;
     } | undefined;
     /** borrowed-readonly — LATE-BOUND: the memory-engine session (the ctx's capture-floor getters read it at THEIR call time). */
@@ -296,8 +294,6 @@ export interface PrepareInheritedGateResult {
     /** owned — the env the screening face sees through `ctx.env` (identity half of a chain entry's `hookEnv`); the policy-chain
      *  station's pass-through arm compares against it. */
     hookEnvSource: unknown;
-    /** owned — the deployment lane for a screening face that crashes while screening a descendant's call (phase "hook"). */
-    notifyOwnHookCrash: (err: unknown) => void;
     /** owned — the FROZEN question seat (spec over deps), the content-ask twin of `frozenOnAsk`. */
     frozenOnQuestion: OnQuestion | undefined;
     /** owned — the parent SPEC seat this run hands its children (`parentSpecSeatOf(spec, frozenOnQuestion)`): the ctx seat and the Workflow mount dep are this one value; both lanes apply it with `applyParentSpecSeat` (one law). */

package/dist/core/runner/prepare-inherited-gate.js

@@ -1,11 +1,12 @@
 import { forkGovernanceDenial, resolveDelegationEntryCaps } from "../../agents/subagent.js";
 import { isLiveQuestionFace } from "../ask-question.js";
 import { parentSpecSeatOf } from "../parent-spec-seat.js";
-import { childClampSeats, clampSourceOf } from "../child-clamp-seats.js";
 import { createPreToolUseConstraintPolicy } from "../hooks.js";
+import { chainJudges, sameInstallation } from "../mods/stations.js";
+import { childClampSeats, clampSourceOf } from "../child-clamp-seats.js";
 import { continuesLineage } from "../session-policy-store.js";
 import { StubExecutionEnv } from "../stub-env.js";
-import { askApproverIdentity, durableMandateSourceOf } from "../tool-policy.js";
+import { durableMandateSourceOf } from "../tool-policy.js";
 import { chainAnchorRecords } from "./child-tree.js";
 import { deliverEngineNotice } from "../types.js";
 import { PermissionModeController, autoModeFaceOf, modeRequestAfterResume } from "../mode-policy.js";
@@ -13,7 +14,7 @@ import { SessionModeSeats } from "./session-mode-seats.js";
 import { recordedModeSeed } from "../checkpoint-store.js";
 import { frozenSkillGrants } from "../skill-grant.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
-import { asThrownError } from "../thrown-value.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 export function prepareInheritedGate(input) {
     const { spec, deps, askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, pathRuleAnchors, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
     const liveInheritedGate = internals?.inheritedGate;
@@ -117,13 +118,6 @@ export function prepareInheritedGate(input) {
     const skillGrantCheckpointSection = () => frozenSkillGrants(skillGrants);
     const frozenOnAsk = askSeat.value;
     const hookEnvSource = (ownedEnv ?? deps.executionEnv) != null ? executionEnv : undefined;
-    const notifyOwnHookCrash = (err) => {
-        try {
-            deps.onError?.(asThrownError(err), { phase: "hook", sessionId });
-        }
-        catch {
-        }
-    };
     const frozenOnQuestion = spec.onQuestion ?? deps.onQuestion;
     const parentSpecSeat = parentSpecSeatOf(spec, frozenOnQuestion);
     const provenanceForChildrenRef = {};
@@ -142,18 +136,12 @@ export function prepareInheritedGate(input) {
         const durableMandate = durableMandateSourceOf({ forceDurableGate: input.runtimeCaps()?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined, onAsk: frozenOnAsk }) !== undefined;
         const contentMandate = input.runtimeCaps()?.forceDurableGate === true ||
             (spec.durableApproval !== undefined && !isLiveQuestionFace(frozenOnQuestion));
-        const ownPreToolUse = input.preToolUseObservational() ? undefined : input.hooks()?.preToolUse;
-        const hookConstraint = ownPreToolUse !== undefined &&
-            !(inheritedParentConstraints ?? []).some((pc) => pc.preToolUse === ownPreToolUse &&
-                askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
-                (pc.durableMandate === true) === durableMandate &&
-                (pc.contentMandate === true) === contentMandate &&
-                pc.hookEnv === hookEnvSource &&
-                pc.autoMode?.decider === autoModeDecider)
+        const ownInstallation = { chain: input.ownModChain, onAsk: frozenOnAsk, durableMandate, contentMandate, hookEnv: hookEnvSource, decider: autoModeDecider };
+        const hookConstraint = chainJudges(input.modBus) && !(inheritedParentConstraints ?? []).some((pc) => sameInstallation(pc, ownInstallation))
             ? [
                 {
-                    policy: createPreToolUseConstraintPolicy(ownPreToolUse, input.hookEnvFace(), notifyOwnHookCrash, input.hookTimeoutMs()),
-                    preToolUse: ownPreToolUse,
+                    policy: createPreToolUseConstraintPolicy(input.modBus, input.hookEnvFace()),
+                    mods: input.ownModChain,
                     ...(hookEnvSource !== undefined ? { hookEnv: hookEnvSource } : {}),
                     ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
                     ...(durableMandate ? { durableMandate: true } : {}),
@@ -205,8 +193,7 @@ export function prepareInheritedGate(input) {
     const fullShellReachable = handsEnabled &&
         !(executionEnv instanceof StubExecutionEnv) &&
         spec.handsReadOnly !== true &&
-        spec.excludeAllTools !== true &&
-        toolFaceSnapshot.selector.admits({ name: "Bash" });
+        valveLeaves(spec, toolFaceSnapshot.selector)({ name: "Bash" });
     const { gateStopRef, stopForDenialLimit } = createDenialLimitStop({ sessionId, runId, onNotice: deps.onNotice, abort: abortRun });
     const delegationEntryCapsResolved = resolveDelegationEntryCaps(deps.delegationEntryCaps);
     const enrichSpecToolCtx = (ctx) => {
@@ -305,5 +292,5 @@ export function prepareInheritedGate(input) {
             ...(spec.enablePlanMode === true ? { enterPlanMode } : {}),
         };
     };
-    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, runClampSource, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
+    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, runClampSource, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, frozenOnAsk, hookEnvSource, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
 }

package/dist/core/runner/prepare-listings.d.ts

@@ -5,7 +5,7 @@ import type { ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 export interface PrepareListingsInput {
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `tools` (the roster-bearing delegation tool, by its `agentListing`
      *  marker), `sessionId` (continuation ⇒ seeded/removal projections), `attachments` (the two opt-outs). Never mutated. */
-    spec: Pick<TaskSpec, "agents" | "tools" | "sessionId" | "attachments">;
+    spec: Pick<TaskSpec, "agents" | "tools" | "sessionId" | "attachments" | "excludeAllTools">;
     /** borrowed-readonly — the once-per-session ledger: its deduplicated operator sink (`onError`) and
      *  the whole announced snapshot (`arms()`) the mirror is seeded from. */
     onceLedger: AnnounceOnceSink & {

package/dist/core/runner/prepare-listings.js

@@ -1,17 +1,19 @@
 import { formatLocalDate } from "../../prompts/default.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { renderAgentListingDelta } from "./turn-attachments.js";
 export function prepareListings(input) {
     const { spec, onceLedger, sessionId, toolFaceSnapshot, activeTools, deferred, resume, skillsListing, listingBudget, listingRideRef, renderWithDate, envFacts, tzValid, userTz, dateAnchor } = input;
     const rosterBearingSpec = (spec.tools ?? []).find((t) => t.agentListing !== undefined && t.agentListing.length > 0);
+    const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
     const rosterFaceDeferred = rosterBearingSpec !== undefined &&
-        toolFaceSnapshot.selector.admits(rosterBearingSpec) &&
+        leaves(rosterBearingSpec) &&
         (toolFaceSnapshot.defer?.includes(rosterBearingSpec.name) ?? false) &&
         deferred.has(rosterBearingSpec.name) &&
         !activeTools.has(rosterBearingSpec.name);
     const agentListingSpec = rosterBearingSpec !== undefined &&
         !rosterFaceDeferred &&
-        toolFaceSnapshot.selector.admits(rosterBearingSpec)
+        leaves(rosterBearingSpec)
         ? rosterBearingSpec
         : undefined;
     const agentListing = agentListingSpec

package/dist/core/runner/prepare-memory-engine-session.d.ts

@@ -12,12 +12,8 @@
  * installs, which run at tool-call time), so the phase adds no yield between the deferred classification before it
  * and the prompt assembly after it (a stretch with no await is extracted as a sync function).
  * Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
- *
- * One read changed spelling and nothing else: the declared-class announcement read `mcp?.statuses` while `mcp` had
- * long been the protocol-tools phase's non-null handle; the optional chain was dead and is now the plain member read.
  */
 import type { LockedPreflight } from "../locked-config.js";
-import type { MaterializedMcp } from "../mcp.js";
 import { type DelegationContentSafety } from "../memory-engine/delegation-provenance.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { Prepared, RunInternals } from "./contracts.js";
@@ -40,8 +36,6 @@ export interface PrepareMemoryEngineSessionInput {
     lockedPreflight: Pick<LockedPreflight, "mcp">;
     /** borrowed-readonly — the run's MCP mount, read at call time (present iff the run declared a server): the children a delegation tool spawns inherit it, so its tools are rows of their pool. */
     mountedMcp?: () => import("../mounted-mcp.js").MountedMcp;
-    /** borrowed-readonly — the materialized MCP handle; only `statuses` (the announcement's mounted-tool count). */
-    mcp: Pick<MaterializedMcp, "statuses">;
     /** borrowed-readonly — the acquired session id (notice detail). */
     sessionId: string;
     /** borrowed-readonly — the run's invocation id (notice detail; the once-per-leg claims are per-RUN claims). */

package/dist/core/runner/prepare-memory-engine-session.js

@@ -1,15 +1,16 @@
 import { classifyToolContentOrigin, contentOriginPollutes, delegationCallIsExternal } from "../memory-engine/content-origin.js";
-import { mountedMcpPoolRows } from "../mounted-mcp.js";
+import { mountedMcpPoolRows, toolNamesOfServer } from "../mounted-mcp.js";
 import { narrowContentSafety, readCardAttestation } from "../memory-engine/delegation-provenance.js";
 import { recordSyncUnattestable, sessionSettlements } from "../memory-engine/delegation-settlement.js";
 import { protocolOf } from "../protocol-table.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { fileArgPath } from "../../tools/fs/safety.js";
+import { fileArgPath } from "../tool-registry.js";
 import { RosterBuilder } from "../tool-roster.js";
+import { isNotStartedDelegationResult } from "../../agents/subagent.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareMemoryEngineSession(input) {
-    const { memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mcp, mountedMcp, sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef } = input;
+    const { memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mountedMcp, sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef } = input;
     const tools = roster.tools;
     const delegationProvenanceChannel = internals?.delegationProvenance;
     if (memoryEngineSession !== undefined || delegationProvenanceChannel !== undefined) {
@@ -22,7 +23,7 @@ export function prepareMemoryEngineSession(input) {
         provenanceForChildrenRef.current = { trustedTools: [...trustedTools], execIsExternalContent };
         announceDeclaredMcpContentClasses({
             entries: lockedPreflight.mcp,
-            statuses: mcp.statuses,
+            mountedNames: roster.tools.map((t) => t.name),
             execIsExternalContent,
             sessionId,
             runId,
@@ -133,6 +134,9 @@ export function prepareMemoryEngineSession(input) {
                             isPolluting: poolToolPollutes,
                         });
                         const result = await inner(toolCallId, params, signal, onUpdate);
+                        const delivery = delegationDeliveryOf(result);
+                        if (delivery === "none")
+                            return result;
                         const att = readCardAttestation(result?.details);
                         if (att === "external") {
                             mark(`tool "${t.name}" returned the output of a delegated agent that invoked an external-content-class tool at runtime` +
@@ -141,8 +145,11 @@ export function prepareMemoryEngineSession(input) {
                         }
                         else if (att !== "clean") {
                             if (external) {
-                                const staticFaceReason = `tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
-                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)");
+                                const staticFaceReason = (delivery === "launched"
+                                    ? `tool "${t.name}" launched a background delegated agent whose tool face can reach external content`
+                                    : `tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content`) +
+                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)") +
+                                    (delivery === "launched" ? " — its output enters this session when it finishes" : "");
                                 if (!delegationEvidenceAttestedOnly) {
                                     mark(staticFaceReason, "static");
                                 }
@@ -207,13 +214,19 @@ export function prepareMemoryEngineSession(input) {
     }
     return { armed: memoryEngineSession !== undefined || delegationProvenanceChannel !== undefined };
 }
+function delegationDeliveryOf(result) {
+    if (isNotStartedDelegationResult(result))
+        return "none";
+    const details = typeof result === "object" && result !== null ? result.details : undefined;
+    return typeof details === "object" && details !== null && details.status === "async_launched" ? "launched" : "report";
+}
 function announceDeclaredMcpContentClasses(args) {
     for (const entry of args.entries ?? []) {
         const declaredClass = entry.contentOrigin;
         if (declaredClass === undefined)
             continue;
         const server = inlineUntrusted(String(entry.name), 160);
-        const toolCount = args.statuses?.find((s) => s.name === entry.name)?.toolNames?.length ?? 0;
+        const toolCount = toolNamesOfServer(args.mountedNames, entry.name).length;
         const resourceFaceCaveat = " (Not covered: the cross-server resource faces — ListMcpResourcesTool/ReadMcpResourceTool/ReadMcpResourceDirTool — stay externally classified and still mark.)";
         const posture = declaredClass === "local"
             ? `this server's mounted tools' invocations will not mark this session's memory as externally exposed.${resourceFaceCaveat}`

package/dist/core/runner/prepare-memory.d.ts

@@ -208,11 +208,12 @@ export interface PrepareMemoryResult {
      * BEFORE it). It performs the one destructive read this phase has — `inject()` drains the announcement queue —
      * so a hands-phase refusal cannot consume announcements a later prepare should deliver, and it takes the
      * roster-wide persistence verdict the driver can only read off the MOUNTED roster (`rosterCanPersist`: the
-     * `TaskSpec.memoryPersistenceCapable` declaration when set, else the known-store-path inference over the
-     * assembled tools). Call exactly once per prepare.
+     * `memoryPersistenceCapable` declaration when set, else the store-path inference over the assembled tools) and
+     * `isSubagent` (a non-fork delegated child — no user conversation, no not-mounted notice). Call once per prepare.
      */
     composeInjection: (facts: {
         rosterCanPersist: boolean;
+        isSubagent: boolean;
     }) => MemoryInjectionComposition;
     /**
      * The FROZEN org-admission verdict of this prepare: every org scope the task actually mounts

package/dist/core/runner/prepare-memory.js

@@ -6,7 +6,7 @@ import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir,
 import { memoryProjectScopeAbsentNotice, normalizeMemorySpec } from "../memory.js";
 import { deriveSupersededSet } from "../memory-engine/consolidation.js";
 import { shadowNamesOf } from "../memory-engine/shadowing.js";
-import { MEMORY_ANNOUNCEMENT_CAPTURE_OPTOUT_CODA, MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_CAPTURE_INDETERMINATE_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MemoryEngine, entryFileHeadCarriesOrigin, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, memoryConsolidationRecommendedNotice, memoryHarvestQuarantinedNotice, memoryHoldNotices, memoryRecallDisciplineSegment, memoryRestoreWithheldNotice, memorySessionPollutedNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
+import { MEMORY_ANNOUNCEMENT_CAPTURE_OPTOUT_CODA, MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_CAPTURE_OPTOUT_NOTICE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MemoryEngine, entryFileHeadCarriesOrigin, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, memoryConsolidationRecommendedNotice, memoryHarvestQuarantinedNotice, memoryHoldNotices, memoryRecallDisciplineSegment, memoryRestoreWithheldNotice, memorySessionPollutedNotice, memoryUnavailableNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
 import { adjudicateCaptureOptOut, captureOptOutDeniedError, captureOptOutUnpersistedError } from "./memory-capture-optout.js";
 import { readSessionCaptureOptOut } from "../memory-engine/layout.js";
 import { sessionIncarnationResolver } from "../memory-engine/session-incarnation.js";
@@ -14,6 +14,7 @@ import { createMemoryEngineTools } from "../memory-engine/tools.js";
 import { assertScopeContractPlacement, parseScopeKey, resolveProjectId } from "../memory-engine/scope-contract.js";
 import { FileMemoryEngineBackend } from "../memory-engine/file-backend.js";
 import { writableRootOf } from "../memory-engine/types.js";
+import { catalogText } from "../../prompt-assembly/catalog/index.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
 let undeclaredCapturePostureAnnounced = false;
 export async function prepareMemory(input) {
@@ -781,7 +782,7 @@ export async function prepareMemory(input) {
                 blockBody = [MEMORY_CAPTURE_OPTOUT_NOTICE, injection.index, injection.announceBlock].filter((s) => Boolean(s && s.trim())).join("\n\n");
             }
             else if (captureIndeterminate && facts.rosterCanPersist) {
-                blockBody = [MEMORY_CAPTURE_INDETERMINATE_NOTICE, injection.index, injection.announceBlock].filter((s) => Boolean(s && s.trim())).join("\n\n");
+                blockBody = [memoryUnavailableNotice({ what: "capture-record-unreadable", notesReadable: true }), injection.index, injection.announceBlock].filter((s) => Boolean(s && s.trim())).join("\n\n");
             }
             else if (!facts.rosterCanPersist && injection.instruction === "" && injection.readOnlyNotice === undefined) {
                 blockBody = blockBody.trim() ? `${MEMORY_READONLY_NOTICE}\n\n${blockBody}` : MEMORY_READONLY_NOTICE;
@@ -817,6 +818,9 @@ export async function prepareMemory(input) {
             if (memoryBlock !== undefined && injection.indexSeed !== undefined && facts.rosterCanPersist && !captureOptedOut && !captureIndeterminate)
                 seedFiles = [injection.indexSeed];
         }
+        else if (!facts.rosterCanPersist && !facts.isSubagent) {
+            memoryBlock = effectiveMemoryScopes?.reason === "mount-failed" ? memoryUnavailableNotice({ what: "mount-failed", notesReadable: false }) : catalogText("core/memory.no-persistent-store");
+        }
         return {
             memoryBlock,
             ...(recallDisciplineSegment !== undefined ? { recallDisciplineSegment } : {}),