@sema-agent/core 7.52.0 → 7.53.0

package/dist/core/runner/prepare-question-face.d.ts

@@ -20,7 +20,7 @@ import type { AgentTool } from "../../internal/harness.js";
 import { type OnQuestion } from "../ask-question.js";
 import type { CheckpointStore } from "../checkpoint-store.js";
 import type { RunnerDeps, RuntimeCaps, TaskSpec } from "../types.js";
-import type { PrepareResume } from "./contracts.js";
+import type { PrepareResume, ToolFaceSnapshot } from "./contracts.js";
 import { type ContentAskBinding } from "./content-ask-bindings.js";
 import { RosterBuilder } from "../tool-roster.js";
 export { CONTENT_ASK_BINDING_CAP, type ContentAskBinding } from "./content-ask-bindings.js";
@@ -31,7 +31,9 @@ export interface PrepareQuestionFaceInput {
     /** borrowed-readonly — the REBOUND spec. Read: `durableApproval` (the durable face's opt-in), `interactiveTools`
      *  (the override), `principal` (the tool's source identity), `interactiveQuestionFallback` (restores the
      *  continuation under a resolved posture). Never mutated. */
-    spec: Pick<TaskSpec, "durableApproval" | "interactiveTools" | "principal" | "interactiveQuestionFallback">;
+    spec: Pick<TaskSpec, "durableApproval" | "interactiveTools" | "principal" | "interactiveQuestionFallback" | "excludeAllTools">;
+    /** borrowed-readonly — the frozen tool face; its selector with the spec's `excludeAllTools` is the valve's reading: the tool mounts only if the valve leaves it. */
+    toolFaceSnapshot: Pick<ToolFaceSnapshot, "selector">;
     /** borrowed-readonly — the deployment seat `onError` (the stranded-answer and synthetic-continuation operator
      *  lines; swallow-guarded). */
     deps: Pick<RunnerDeps, "onError">;

package/dist/core/runner/prepare-question-face.js

@@ -1,11 +1,12 @@
-import { createAskUserQuestionTool, isLiveQuestionFace } from "../ask-question.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
+import { ASK_USER_QUESTION_TOOL_NAME, createAskUserQuestionTool, isLiveQuestionFace } from "../ask-question.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { durableParkOptInDeclared } from "../tool-policy.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { RosterBuilder } from "../tool-roster.js";
 export { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 export function prepareQuestionFace(input) {
-    const { frozenOnQuestion, spec, deps, checkpointStore, runtimeCaps, resolvedInteractionPosture, resume, sessionId, roster, inheritedUnavailableAsks } = input;
+    const { frozenOnQuestion, spec, deps, checkpointStore, runtimeCaps, resolvedInteractionPosture, resume, sessionId, roster, toolFaceSnapshot, inheritedUnavailableAsks } = input;
     const tools = roster.tools;
     const onQuestion = frozenOnQuestion;
     const liveQuestionFace = isLiveQuestionFace(onQuestion) ? onQuestion : undefined;
@@ -58,7 +59,7 @@ export function prepareQuestionFace(input) {
             return liveQuestionFace(req, signal);
         }
         : onQuestion;
-    const questionToolMounted = spec.interactiveTools === true || (spec.interactiveTools !== false && (onQuestion !== undefined || durableQuestionFace));
+    const questionToolMounted = (spec.interactiveTools === true || (spec.interactiveTools !== false && (onQuestion !== undefined || durableQuestionFace))) && valveLeaves(spec, toolFaceSnapshot.selector)({ name: ASK_USER_QUESTION_TOOL_NAME });
     let mountedQuestionTool;
     if (questionToolMounted)
         roster.mount((mountedQuestionTool =

package/dist/core/runner/prepare-task.js

@@ -86,7 +86,7 @@ import { announcePeerLaneMount, judgeSessionBoxDrain } from "../../agents/peer-s
 import { createFrameSettlement } from "../frame-settlement.js";
 import { createSchedulerTools } from "../../tools/scheduler-tools.js";
 import { selfOrchestrationFailClosedReason } from "../../orchestration/workflow-script-runner.js";
-import { compileToolSelector } from "../../agents/tool-filter.js";
+import { compileToolSelector, valveLeaves } from "../../agents/tool-filter.js";
 import { boundOwnToolLists, boundToolListsJudgment, judgeRunToolLists } from "./sub-agent-deny-lists.js";
 import { remainingBudgetMicroUsd, resolveCheckpointStore } from "../checkpoint-store.js";
 import { checkpointSeatOf } from "../checkpoint-seat.js";
@@ -355,7 +355,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
     const sessionBox = judgeSessionBoxDrain(deps, { sessionId, scope: taskScope, isDelegatedChild: delegation.isDelegatedChild });
     const peerLaneRefs = {};
     const frameSettlement = createFrameSettlement();
-    const peerSendMessageBuiltIn = runnerSelf !== undefined && toolFaceSnapshot.selector.admits({ name: SEND_MESSAGE_TOOL_NAME }) && !(spec.tools ?? []).some((t) => t.name === SEND_MESSAGE_TOOL_NAME);
+    const peerSendMessageBuiltIn = runnerSelf !== undefined && valveLeaves(spec, toolFaceSnapshot.selector)({ name: SEND_MESSAGE_TOOL_NAME }) && !(spec.tools ?? []).some((t) => t.name === SEND_MESSAGE_TOOL_NAME);
     const { reminderMark, reminderDisclosureCounts } = await adoptReminderMark(session, sessionId, resume?.seed.reminderMark, internals?.reminderMark, deps.onError);
     const offloadScope = spec.principal ?? "default";
     if (internals?.registryScope !== undefined && internals.registryScope !== offloadScope) {
@@ -549,7 +549,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
             for (const alias of t.aliases ?? [])
                 memoryPairNameDomain.add(alias);
         }
-        const memoryPairExcludedName = MEMORY_ENGINE_TOOL_NAMES.find((n) => !toolFaceSnapshot.selector.admits({ name: n }));
+        const memoryPairExcludedName = MEMORY_ENGINE_TOOL_NAMES.find((n) => !valveLeaves(spec, toolFaceSnapshot.selector)({ name: n }));
         const memoryPairOccupiedName = MEMORY_ENGINE_TOOL_NAMES.find((n) => memoryPairNameDomain.has(n));
         const memorySearchToolsPlanned = memoryPairExcludedName === undefined && memoryPairOccupiedName === undefined;
         const captureLineage = await (async () => {
@@ -569,7 +569,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
             taskRootPath: taskRootFinal,
             reminderMark,
             writeToolsMounted: (handsWriteHalfPlanned || tools.some((t) => t.name === "Write")) &&
-                toolFaceSnapshot.selector.admits({ name: "Write" }) &&
+                valveLeaves(spec, toolFaceSnapshot.selector)({ name: "Write" }) &&
                 !(handsEnabled && isRemoteExecutionEnv(executionEnv) && spec.memoryPersistenceCapable !== true),
             memoryProvenance,
             memoryCapturePolicy,
@@ -626,7 +626,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         shellGatedTools = handsReadFace.shellGatedTools;
         await armAutoMode();
         const { worktreeSessionRef } = prepareDelegationSurface({ spec, deps, internals, resume, sessionId, hostTaskId, taskScope, taskRootFinal, taskRootCanonical, executionEnv, runnerSelf, backgroundTaskToolsActive, shellReadAdmission, workflowToolsActive, peerLaneActive, peerSendMessageBuiltIn, peerLaneRefs, sessionBox, roster, toolEffects, axisExplicitNegatives, envHandToolNames, toolFaceSnapshot, firstPartyOffload, offloadStore, subagentRetain, enrichSpecToolCtx, checkpointSeat, handsCwdRef, wsSnapshot, rebaseWsPath, rebaseRestoredPath, workspaceStateSettle });
-        const { liveQuestionFace, contentAskBindings, contentAskRoutable, lateStrandedAnswers, discloseStrandedAnswers, settleContentAskBindings, durableQuestionFace, questionToolMounted, mountedQuestionTool } = prepareQuestionFace({ frozenOnQuestion, spec, deps, checkpointStore, runtimeCaps, resolvedInteractionPosture, resume, sessionId, roster, inheritedUnavailableAsks: () => inheritedUnavailableAsks });
+        const { liveQuestionFace, contentAskBindings, contentAskRoutable, lateStrandedAnswers, discloseStrandedAnswers, settleContentAskBindings, durableQuestionFace, questionToolMounted, mountedQuestionTool } = prepareQuestionFace({ frozenOnQuestion, spec, deps, checkpointStore, runtimeCaps, resolvedInteractionPosture, resume, sessionId, roster, toolFaceSnapshot, inheritedUnavailableAsks: () => inheritedUnavailableAsks });
         if (spec.handsReadOnly !== true) {
             const sessionScope = sessionId ?? spec.principal ?? spec.taskId ?? "default";
             roster.mountAll(createSchedulerTools(executionEnv, {
@@ -659,8 +659,8 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
                     live.incomplete = true;
             }
         }
-        const rosterCanPersist = rosterCanPersistMemory(tools.filter((t) => toolFaceSnapshot.selector.admits(t)), { effects: toolEffects, remoteHands: handsEnabled && isRemoteExecutionEnv(executionEnv) }, spec.memoryPersistenceCapable);
-        const { memoryBlock: memoryBlockFromEngine, recallDisciplineSegment: memoryRecallSegment, seedFiles: memorySeedFiles } = composeMemoryInjection({ rosterCanPersist });
+        const rosterCanPersist = rosterCanPersistMemory(tools.filter(valveLeaves(spec, toolFaceSnapshot.selector)), { effects: toolEffects, remoteHands: handsEnabled && isRemoteExecutionEnv(executionEnv) }, spec.memoryPersistenceCapable);
+        const { memoryBlock: memoryBlockFromEngine, recallDisciplineSegment: memoryRecallSegment, seedFiles: memorySeedFiles } = composeMemoryInjection({ rosterCanPersist, isSubagent: delegation.isNonForkChild });
         if (memorySeedFiles?.length && seedContextFiles) {
             try {
                 await seedContextFiles(memorySeedFiles);
@@ -671,10 +671,10 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         }
         const projectContext = await prepareProjectContext({ deps, spec, internals, session, sessionId, runId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, allowedTools, allowedToolTables, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget: doors.skillListingBudget });
         const { memoryBlock: memoryBlockWithProject, instructionSources, projectInstructionContent, skillSpecs, skillSeatOf, skillsListing, sharedMemoryPairMounted, memoryEnginePairMounted } = projectContext;
-        const { featureFlags, sugar, mcpInstructionsBlock, envFacts, tzValid, userTz, dateAnchor, gitStatusRef } = await preparePromptInputs({ modBus: legMods.bus, spec, deps, contextOverlay: legContextOverlay(), failClosedReason: selfOrchestrationFailClosedReason(spec, deps), lockedPreflight, selfOrchestrationActive, executionEnv, reminderMark, resolvedReadFace, resolvedWriteFace: resolvedWriteFace?.inForce(), toolFaceSnapshot, promptProfile, fableMitigations, internals, thinking, ownedEnv, delegation, resolvedRole, mcp, model, externalContentTargetActive, resume, handsEnabled, taskRootFinal, additionalRootsCanonical, additionalReadRootsCanonical: (await readRoots.ready().then(readRoots)).filter((r) => !additionalRootsCanonical.includes(r)), sessionId, session, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}) });
+        const { featureFlags, sugar, mcpInstructionsBlock, envFacts, tzValid, userTz, dateAnchor, gitStatusRef } = await preparePromptInputs({ modBus: legMods.bus, spec, deps, contextOverlay: legContextOverlay(), failClosedReason: selfOrchestrationFailClosedReason(spec, deps), lockedPreflight, selfOrchestrationActive, executionEnv, reminderMark, resolvedReadFace, resolvedWriteFace: resolvedWriteFace?.inForce(), toolFaceSnapshot, promptProfile, fableMitigations, internals, thinking, ownedEnv, delegation, resolvedRole, mcp, roster, model, externalContentTargetActive, resume, handsEnabled, taskRootFinal, additionalRootsCanonical, additionalReadRootsCanonical: (await readRoots.ready().then(readRoots)).filter((r) => !additionalRootsCanonical.includes(r)), sessionId, session, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}) });
         judgeRunToolLists({ spec, tools: roster.tools, declaredPeers: { mcp: lockedPreflight.mcp, a2a: a2a.statuses }, own: { allow: toolFaceLists.allow, exclude: toolFaceLists.exclude }, layers: toolFaceSnapshot.selector.layers, legs: toolLegs, judgedUpstream: toolListsJudged !== undefined, toldUpstream: internals?.ownToolLists !== undefined && ownToolLists !== undefined && toolCeiling !== undefined, ownBy: ownToolLists, onceLedger, sessionId });
         const { deferred, memoryBlock, toolSearch: toolSearchPolicy } = prepareDeferClassify({ spec, deps, roster, toolFaceSnapshot, handsEnabled, fullShellReachable, promptProfile, model, mcp, a2a, sharedMemoryPairMounted, memoryEnginePairMounted, memoryBlock: memoryBlockWithProject, memoryRecallSegment, onceLedger, sessionId });
-        prepareMemoryEngineSession({ memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mcp, ...(mountedMcpNow !== undefined ? { mountedMcp: mountedMcpNow } : {}), sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef });
+        prepareMemoryEngineSession({ memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, ...(mountedMcpNow !== undefined ? { mountedMcp: mountedMcpNow } : {}), sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef });
         const { systemPromptSeat, renderWithDate, systemBlocks, promptManifest, promptIdentity, buildAssembleInputs, identityFor, adoptsCandidates, centerAdoptionRef } = await preparePromptAssembly({ session, deps, internals, resume, sugar, host: promptHost, binding: promptBinding, modBus: legMods.bus, signal: abortController.signal, featureFlags, mcpInstructionsBlock, memoryBlock, envFacts, promptProfile, fableMitigations, tools, model, sessionId, onceLedger });
         const { activeTools, fpRef, turnSnapshotRef, harnessTools, toolsDeltaRef, toolMaterializeStatic, deferDirectCall, staticFaceForRef, listingRideRef, toolSearch, toolDisclosureSeat } = await prepareToolDisclosureMount({ spec, deps, session, resume, deferred, tools, onceLedger, mcp, promptManifest, toolSearchPolicy, offloadReachableToolsRef, contentOriginWrapRef, rebuildHarnessToolsRef, harnessRef });
         if (toolSearch !== undefined)
@@ -786,7 +786,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
             }
         }
         const { basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, ruleLaneFacts, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations, inheritedToolChecks } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight: installedPreflight, pathRuleAnchors: { leg: legAnchors, chainTop }, headLeads, tools, harnessTools, selector: toolFaceSnapshot.selector, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, modBus: legMods.bus, ownModChain, autoModeDecider: () => autoModeDeciderRef.current, readFace: () => resolvedReadFace, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
-        const { onAsk, preToolContexts, blockedToolCalls, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, askSeat: doors.askSeat, internals, resume, sessionId, runId, hostTaskId, taskScope, modBus: legMods.bus, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox, checkpointScope });
+        const { onAsk, preToolContexts, blockedToolCalls, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, askSeat: doors.askSeat, internals, resume, sessionId, runId, hostTaskId, taskScope, modBus: legMods.bus, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox, checkpointScope, memoryPollution: () => memoryEngineSession?.pollution });
         const writeProtectionCheck = writeProtection.mount?.check;
         writeTargetJudgeRef.current = writeProtection.judgeWriteTarget;
         if (fileHistoryBoundary !== undefined) {

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -114,7 +114,8 @@ export interface PrepareWiringManifestInput {
     /** borrowed-readonly — the model gate's per-leg read face, or undefined. */
     modelGateManifest: WiringManifest["modelGate"];
     /** borrowed-readonly — the leg's minted tool roster: rides the manifest's `tools` section and is the
-     *  source of the hand band's write-capable names for the ungated-write warning (what actually MOUNTED). */
+     *  source of the hand band's write-capable names for the ungated-write warning (what actually MOUNTED) and of each MCP server's
+     *  `toolCount` (its tools among the roster's names). */
     toolRoster: ToolRoster;
     /** borrowed-readonly — from the read-face phase: the built-in read-deny TIERS that leg's own
      *  resolution materially activated; relayed onto the manifest (present iff non-empty), never
@@ -140,6 +141,9 @@ export interface PrepareWiringManifestInput {
     frameSettlement: import("../frame-settlement.js").FrameSettlement;
     /** borrowed-readonly — the session-box drain's mount verdict (prepare-task's one judgment): present ⇒ this leg drains its own box. */
     sessionBox: SessionBoxBinding | undefined;
+    /** borrowed-readonly, read late — the memory session's one-way pollution face (absent with no memory session). The drain marks
+     *  it when it INJECTS a letter from another principal (the injection path; the tool path is accounted by `ReadInbox`'s class). */
+    memoryPollution?: () => Pick<NonNullable<Prepared["memoryEngineSession"]>["pollution"], "markPolluted"> | undefined;
     /** borrowed-readonly — the built harness the peer drain binds to. */
     harness: AgentHarness;
     /** borrowed-readonly — the durable-suspend holder; the drain's parked predicate reads `token` at run time. Not written here. */
@@ -202,7 +206,8 @@ export interface PrepareWiringManifestResult {
  * The wiring manifest's per-server MCP read face for one leg ({@link WiringManifest.mcp}): every
  * server the leg's FROZEN entry snapshot declared, in declaration order, joined by name to this leg's
  * materialization statuses. Pure projection — no connection logic, no second look at any transport:
- *  · a status `connected` ⇒ `connected` with the mounted roster size (the intake's post-filter count);
+ *  · a status `connected` ⇒ `connected` with the server's tools among `rosterNames` — the names of the roster the row is read
+ *    against: a run's (the valve and the deployment's overlay applied), or the no-run probe's own dials (no run, so no lists apply);
  *  · a status `failed` ⇒ `failed` with the failure record the materialization stamped (`errorCode`/`delivered`/
  *    `httpStatus` = the MCP vocabulary's `McpFailure` spread flat) and the remote text SECRET-REDACTED (an HTTP endpoint's error body rides the SDK's message
  *    verbatim, and a body that echoes the bearer it rejected must not reach a stream consumer),
@@ -213,6 +218,6 @@ export interface PrepareWiringManifestResult {
  * `liveness` is the status record's own observation deep-copied (see {@link WiringManifestMcpEntry.liveness}).
  * The entries are fresh objects so the manifest never aliases the status records the refresh face mutates.
  */
-export declare function mcpManifestEntries(entries: ReadonlyArray<import("../types.js").McpServerSpec> | undefined, statuses: ReadonlyArray<import("../mcp.js").McpServerStatus>): WiringManifestMcpEntry[];
+export declare function mcpManifestEntries(entries: ReadonlyArray<import("../types.js").McpServerSpec> | undefined, statuses: ReadonlyArray<import("../mcp.js").McpServerStatus>, rosterNames: ReadonlyArray<string>): WiringManifestMcpEntry[];
 /** The M18 phase body — prepareTask's wiring-manifest stretch, verbatim (see the module header). */
 export declare function prepareWiringManifest(input: PrepareWiringManifestInput): PrepareWiringManifestResult;

package/dist/core/runner/prepare-wiring-manifest.js

@@ -3,6 +3,7 @@ import { teamRoleOf } from "../../agents/team-role.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { createHookEnvCapabilities, mintHookInvocationIdentity } from "../hooks.js";
 import { chainJudges } from "../mods/stations.js";
+import { toolNamesOfServer } from "../mounted-mcp.js";
 import { isRemoteExecutionEnv, missingRestoreSurface } from "../remote-env.js";
 import { isVolatileOffloadStore } from "../tool-result-store.js";
 import { durableMandateSourceOf, isLiveApproverSeat } from "../tool-policy.js";
@@ -13,7 +14,7 @@ import { autoRunOnRecommendationEffective } from "./memory-consolidation-driver.
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs, windowsGovernCost } from "../usage-window-store.js";
 import { LSP_CONTRACT_ID, askSeatEffective, countElicitOptIns, deriveHandsSeam, deriveLspSeam, deriveWiringManifest, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
 import { modePolicyOf } from "../mode-policy.js";
-export function mcpManifestEntries(entries, statuses) {
+export function mcpManifestEntries(entries, statuses, rosterNames) {
     return (entries ?? []).map((entry) => {
         const status = statuses.find((s) => s.name === entry.name);
         const source = typeof entry.source === "string" && entry.source.length > 0 ? { source: inlineUntrusted(entry.source, 80) } : {};
@@ -21,7 +22,7 @@ export function mcpManifestEntries(entries, statuses) {
         if (status === undefined)
             return { name: entry.name, ...source, status: "skipped", toolCount: 0 };
         if (status.status === "connected")
-            return { name: entry.name, ...source, status: "connected", toolCount: status.toolNames?.length ?? 0, ...liveness };
+            return { name: entry.name, ...source, status: "connected", toolCount: toolNamesOfServer(rosterNames, entry.name).length, ...liveness };
         return {
             name: entry.name,
             ...source,
@@ -116,13 +117,14 @@ function announceDurableGateUnavailable(args) {
     });
 }
 export function prepareWiringManifest(input) {
-    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, modBus, checkpointScope, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, sessionBox, harness, pausedRef, askSeat, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, lspDiagnosticsLive, fileHistoryFact } = input;
+    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, modBus, checkpointScope, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, sessionBox, harness, pausedRef, askSeat, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, lspDiagnosticsLive, fileHistoryFact, memoryPollution } = input;
     const onAsk = askSeat.value;
     const handWriteTools = toolRoster.entries.filter((e) => e.mountedBy === "hands" && (e.effect === "write" || e.effect === "idempotent")).map((e) => e.name);
     const hasEffectAwareGate = policyLayers.length > 0 || chainJudges(modBus);
+    const rosterHolds = new Set(toolRoster.entries.map((e) => e.name));
     const peerWriteUngated = modePolicyOf(permissionMode.current).unstated === "ask"
         ? []
-        : mcp.tools.filter((t) => t.permissionSeat === "passthrough" && !irreversibleTools.has(t.name) && !egressTools.has(t.name) && (toolEffects.get(t.name) ?? "write") !== "read").map((t) => t.name);
+        : mcp.tools.filter((t) => rosterHolds.has(t.name) && t.permissionSeat === "passthrough" && !irreversibleTools.has(t.name) && !egressTools.has(t.name) && (toolEffects.get(t.name) ?? "write") !== "read").map((t) => t.name);
     const firstPartyWriteUngated = (spec.tools ?? [])
         .map((t) => t.name)
         .filter((name) => !irreversibleTools.has(name) && !egressTools.has(name) && toolEffects.get(name) === "write");
@@ -213,7 +215,7 @@ export function prepareWiringManifest(input) {
         ...(modelGateManifest !== undefined ? { modelGate: modelGateManifest } : {}),
         autoMode: { ...autoModeArmReason() },
         permissionMode: permissionMode.receipt(),
-        mcp: mcpManifestEntries(lockedPreflight.mcp, mcp.statuses),
+        mcp: mcpManifestEntries(lockedPreflight.mcp, mcp.statuses, toolRoster.entries.map((e) => e.name)),
         ...(writeProtection.mount !== undefined ? { writeProtectionTargetView: writeProtection.mount.targetView } : {}),
         readDenyBuiltinTiersActive,
         autoConsolidationOnRecommendation: autoRunOnRecommendationEffective(deps),
@@ -238,6 +240,7 @@ export function prepareWiringManifest(input) {
             settlement: frameSettlement,
             selfName: () => internals?.explicitAgentName,
             parked: () => pausedRef.current !== undefined,
+            markExternalContent: (reason) => memoryPollution?.()?.markPolluted(reason, "observed"),
         });
         frameSettlement.boxBacked = (payload) => peerLaneRefs.isBoxBacked?.(payload) ?? false;
     }

package/dist/core/runner/resume-admission.d.ts

@@ -12,6 +12,7 @@
  */
 import { type Checkpoint, type CheckpointStore, type CheckpointToken, type PendingSteerEntry, type ResumeOutcome } from "../checkpoint-store.js";
 import type { InheritedGate, ResumeTaskConfig, RunInternals, RunnerDepsSeat } from "./contracts.js";
+import type { SessionStore } from "../session.js";
 /** What the admission rung was called with. */
 export interface ResumeAdmissionInput<R> {
     /** borrowed-readonly — the checkpoint token the caller is redeeming. */
@@ -28,6 +29,8 @@ export interface ResumeAdmissionInput<R> {
     /** borrowed-readonly — the Runner's deployment deps, read LIVE through the Runner (the store resolution reads `checkpointStore`); the one home of why it is a
      *  seat and not a captured object is {@link RunnerDepsSeat}. */
     runner: RunnerDepsSeat;
+    /** borrowed-readonly — the Runner's session store, fixed at its construction (unlike its deps): the retention capability door judges it. */
+    sessions: SessionStore;
     /** borrowed-readonly — the Runner's same-process parked-constraint registry; read for this token (never written here). */
     parentConstraintRegistry: ReadonlyMap<CheckpointToken, NonNullable<InheritedGate["parentConstraints"]>>;
     /** borrowed-readonly — the rung after admission, entered in this rung's last continuation with what it admitted. */
@@ -35,7 +38,7 @@ export interface ResumeAdmissionInput<R> {
 }
 /** What admission established — the constants every later rung reads. */
 export interface ResumeAdmissionResult {
-    /** The caller's config, snapshotted once (own enumerable fields). */
+    /** The caller's config, snapshotted once (own enumerable fields), its MCP / A2A entries the frozen ones the doors judged. */
     config: ResumeTaskConfig;
     /** The trusted internals snapshot, with the parked parent chain re-supplied when this Runner spawned the leg. */
     internals: RunInternals | undefined;

package/dist/core/runner/resume-admission.js

@@ -1,16 +1,18 @@
 import { CheckpointError, readPendingSteerQueue, refuseRetiredModeSeed, resolveCheckpointStore, validatePendingSteer } from "../checkpoint-store.js";
-import { refuseResumeDoors } from "../mode-policy.js";
+import { assertResumeConfigRecord, checkpointStoreSeat, refuseResumeDoors } from "./prepare-config-doors.js";
+import { asResumeConfigRefusal } from "../mode-policy.js";
 import { describeSuppliedValue } from "./decide-continuation.js";
 import { detachSkillLists } from "../skill-grant.js";
 export async function resumeAdmission(input) {
-    const { token, outcome, taskConfig, runner, parentConstraintRegistry } = input;
+    const { token, outcome, taskConfig, runner, sessions, parentConstraintRegistry } = input;
     let internals = input.internals;
     if (outcome === null || typeof outcome !== "object") {
         throw new CheckpointError("checkpoint.invalid_outcome", `resume outcome must be an object naming its gate (got ${outcome === null ? "null" : typeof outcome})`);
     }
-    const config = typeof taskConfig === "object" && taskConfig !== null ? { ...taskConfig, ...(Array.isArray(taskConfig.skills) ? { skills: detachSkillLists(taskConfig.skills) } : {}) } : taskConfig;
+    asResumeConfigRefusal("taskConfig", () => assertResumeConfigRecord(taskConfig));
+    let config = { ...taskConfig, ...(Array.isArray(taskConfig.skills) ? { skills: detachSkillLists(taskConfig.skills) } : {}) };
     internals = internals !== undefined ? { ...internals } : undefined;
-    const store = resolveCheckpointStore(config, runner.deps);
+    const store = asResumeConfigRefusal(checkpointStoreSeat(config), () => resolveCheckpointStore(config, runner.deps));
     if (!store) {
         throw new CheckpointError("checkpoint.not_found", "no CheckpointStore wired — cannot resume (set RunnerDeps.checkpointStore or taskConfig.checkpointStore)");
     }
@@ -39,7 +41,7 @@ export async function resumeAdmission(input) {
     const resumeSignal = config.signal;
     let suppliedMessage;
     refuseRetiredModeSeed(cp.state);
-    refuseResumeDoors(config, cp.state.inheritedGate);
+    config = refuseResumeDoors(config, cp.state.inheritedGate, runner.deps, sessions);
     const parkedSteers = readPendingSteerQueue(cp.state);
     if (outcomeGate === "wake") {
         suppliedMessage = outcome.message;

package/dist/core/runner/resume-internals-and-config.d.ts

@@ -1,6 +1,6 @@
 /**
  * The resume ladder's INTERNALS-AND-CONFIG rung (E7), verbatim from `Runner.resumeStream`:
- * the locked-policy guard on the resume-edit seat, the principal and placement identity-continuity rungs,
+ * the inherited constraints' retired-member door, the principal and placement identity-continuity rungs,
  * and the governance-window ENTRANCE check for a row that still owes a delivery.
  *
  * Synchronous by construction, with the ladder's ONE await at this rung handed back instead of taken: the
@@ -14,13 +14,13 @@ import type { ResumeTaskConfig, RunInternals, RunnerDepsSeat } from "./contracts
 export interface ResumeInternalsAndConfigInput {
     /** borrowed-readonly — the pending row (recorded principal, placement root, parked steers, background tasks). */
     cp: Checkpoint;
-    /** borrowed-readonly — the config snapshot (`basePolicyForResumeEdit`, `principal`). */
+    /** borrowed-readonly — the config snapshot (`principal`). */
     config: ResumeTaskConfig;
     /** borrowed-readonly — the internals snapshot (`placementRoot`). */
     internals: RunInternals | undefined;
     /** borrowed-readonly — the ONE read of the outcome discriminant (a bare resource_limit continue owes nothing). */
     outcomeGate: ResumeOutcome["gate"];
-    /** borrowed-readonly — the Runner's deployment deps, read LIVE through the Runner (reads `lockedConfig`, `usageWindowStore`, `usageWindows`); the one home of why it is a
+    /** borrowed-readonly — the Runner's deployment deps, read LIVE through the Runner (reads `usageWindowStore`, `usageWindows`); the one home of why it is a
      *  seat and not a captured object is {@link RunnerDepsSeat}. */
     runner: RunnerDepsSeat;
 }

package/dist/core/runner/resume-internals-and-config.js

@@ -1,17 +1,12 @@
 import { CheckpointError, readPendingSteerQueue } from "../checkpoint-store.js";
+import { asResumeConfigRefusal } from "../mode-policy.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
 import { placementValueOrAbsent } from "./checkpoint-scope.js";
-import { assertNoRetiredResumeSeats } from "./retired-runner-deps.js";
-import { resolveMicroCompactKnob } from "./prepare-config-doors.js";
+import { assertNoRetiredInheritedConstraints } from "./retired-runner-deps.js";
 export function resumeInternalsAndConfig(input) {
     const { cp, config, internals, outcomeGate, runner } = input;
     let windowEntrance;
-    assertNoRetiredResumeSeats(runner.deps, config, internals);
-    resolveMicroCompactKnob(runner.deps.microCompact);
-    if (runner.deps.lockedConfig?.keys?.includes("toolPolicy") === true && config.basePolicyForResumeEdit !== undefined) {
-        throw new CheckpointError("checkpoint.invalid_outcome", "TaskSpec.basePolicyForResumeEdit is administratively locked by this deployment (locked key \"toolPolicy\") — a task-supplied " +
-            "resume-edit policy is refused pre-CAS (the checkpoint stays pending); remove the field or change the deployment's lock configuration");
-    }
+    asResumeConfigRefusal("deps", () => assertNoRetiredInheritedConstraints(internals));
     let recheckGovernanceWindow;
     {
         const rowPrincipal = cp.principal || undefined;

package/dist/core/runner/retired-runner-deps.d.ts

@@ -1,11 +1,10 @@
 import type { RunnerDeps } from "../types.js";
-import type { ResumeTaskConfig, RunInternals } from "./contracts.js";
+import type { RunInternals } from "./contracts.js";
 /** Runs on the caller's own argument at `new Runner` (the only point that still sees an inherited seat — construction then
  *  reads every own seat once into the plain copy the Runner keeps, `retainRunnerDeps`), and again in the pre-first-await
  *  config-doors phase and pre-CAS on a resume. */
 export declare function assertNoRetiredRunnerDeps(deps: RunnerDeps): void;
-/** The resume ladder's pre-claim door: the retired seats of the deps, then the retired members of the caller policies this
- *  resume installs (the prepare's own resolution, `callerPolicySeats`) and of the inherited constraints it is handed. The edit
- *  re-check runs the resume-edit policy before the claim, and a refusal after the claim would burn the token on a store
- *  without `reopen`. */
-export declare function assertNoRetiredResumeSeats(deps: RunnerDeps, config: ResumeTaskConfig, internals: RunInternals | undefined): void;
+/** The resume ladder's pre-claim door over the inherited constraints a resume is handed: a retired member of one refuses before
+ *  the claim (a refusal after it would burn the token on a store without `reopen`). The deps' retired seats and the caller
+ *  policies' retired members are the config-door phase's, which a resume enters before the claim (`refuseResumeDoors`). */
+export declare function assertNoRetiredInheritedConstraints(internals: RunInternals | undefined): void;

package/dist/core/runner/retired-runner-deps.js

@@ -1,5 +1,4 @@
 import { assertNoRetiredKeys, assertNoRetiredToolPolicyKeys, RETIRED_HOOKS_REPLACEMENT } from "../retired-keys.js";
-import { assertCallerPoliciesCurrent, callerPolicySeats } from "../locked-config.js";
 const RETIRED_RUNNER_DEPS_KEYS = {
     hooks: RETIRED_HOOKS_REPLACEMENT,
     legacyRewindBoundaryProbe: "the rewind refusal always names both possibilities (never existed / retired whole-tree era); a deployment that holds that era's table answers the question on its own surface",
@@ -13,9 +12,7 @@ const RETIRED_RUNNER_DEPS_KEYS = {
 export function assertNoRetiredRunnerDeps(deps) {
     assertNoRetiredKeys(deps, RETIRED_RUNNER_DEPS_KEYS, "RunnerDeps");
 }
-export function assertNoRetiredResumeSeats(deps, config, internals) {
-    assertNoRetiredRunnerDeps(deps);
-    assertCallerPoliciesCurrent(callerPolicySeats(config, deps, deps.lockedConfig?.keys?.includes("toolPolicy") === true));
+export function assertNoRetiredInheritedConstraints(internals) {
     for (const constraint of internals?.inheritedGate?.parentConstraints ?? [])
         assertNoRetiredToolPolicyKeys(constraint.policy);
 }

package/dist/core/runner/run-leg.js

@@ -8,15 +8,17 @@ import { formatHookFeedback } from "../hooks.js";
 import { classicEventBase, failedHandlerClause, screenUserPrompt } from "../mods/stations.js";
 import { buildAppliedHumanInputEvent, buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
 import { humanInputAttachmentsOf, readObjectiveAttachments, userAttachmentDeclarations } from "../user-attachment.js";
-import { uuidv7 } from "../../internal/harness.js";
+import { readToolCallArguments, uuidv7 } from "../../internal/harness.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { applyPersistedTightening, disclosedRuleSet } from "../persisted-rule-arms.js";
+import { argsReadBy, stampArgsReading } from "../effective-path-target.js";
 import { parkedSkillApprovalRefusal, skillRowRefusal } from "../skill-grant.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { computeCostMicroUsd } from "../pricing.js";
 import { mintSystemReminder } from "../reminder-mint.js";
 import { hasDestroy } from "../remote-env.js";
-import { advertisedWritableRootsSeat, attestationOf, exemptRootsSeat, humanRefusalSentence, policyCannotAnswer, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, attestationOf, exemptRootsSeat, humanRefusalSentence, ownedReading, policyCannotAnswer, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
+import { failedJudgmentDeny } from "./policy-throw.js";
 import { pathDenialCardOf } from "../../tools/fs/safety.js";
 import { callFaceSeat, judgeParkedToolIdentity, parkedRowLiveFace, rosterEntryNamed } from "../tool-roster.js";
 import { deliverEngineNotice } from "../types.js";
@@ -554,7 +556,18 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         throw new CheckpointError("checkpoint.invalid_outcome", "pending action reached the resolver with no settlement record on its decision (gateOutcome) — refusing to execute or settle a decision that carries no record");
     }
     const humanRewrite = wireOf("resume.questionArgsShown", pendingAction) === ASK_USER_QUESTION_TOOL_NAME ? undefined : outcome.updatedInput;
-    const resolvedArgs = humanRewrite !== undefined ? humanRewrite : pendingAction.args;
+    const liveTool = prepared.tools.find((x) => x.name === pendingAction.toolName);
+    const reading = liveTool === undefined ? undefined : ownedReading((a) => readToolCallArguments(liveTool, { type: "toolCall", id: pendingAction.toolCallId, name: pendingAction.toolName, arguments: {} }, a));
+    const beltFace = () => { const f = parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction); if (f !== undefined && reading !== undefined)
+        stampArgsReading(f, reading); return f; };
+    const tryRead = (v) => { try {
+        return { args: reading === undefined ? v : argsReadBy(reading, v) };
+    }
+    catch (error) {
+        return { args: v, unread: { error } };
+    } };
+    const decided = outcome.decision === "allow" ? tryRead(humanRewrite !== undefined ? humanRewrite : pendingAction.args) : { args: humanRewrite !== undefined ? humanRewrite : pendingAction.args };
+    const resolvedArgs = decided.args;
     const pendingLabel = (() => { const l = prepared.tools.find((t) => t.name === pendingAction.toolName)?.label; return l !== undefined && l !== pendingAction.toolName ? { label: l } : {}; })();
     const spelledName = pendingAction.names?.[0] ?? pendingAction.toolName;
     const occurrences = prepared.toolOccurrences;
@@ -563,15 +576,21 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     occurrences.gateRound(pendingAction.toolCallId, decidedGate, frozenInputSnapshot(resolvedArgs));
     let notExecuted = false;
     const resultRow = (text, isError) => withRowNotExecuted(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, text, isError), notExecuted);
-    const settleEnd = async (isError, result, refusedBy) => {
+    const settleEnd = async (isError, result, refusedBy, neverRan) => {
         if (refusedBy !== undefined)
             occurrences.refuse(pendingAction.toolCallId, refusedBy);
-        const settled = emitSettled(occurrences, callStart, { result, isError }, { push: emit, structured: prepared.structuredProjector, mediaByteCapBytes: runner.deps.mediaByteCapBytes });
+        const settled = emitSettled(occurrences, callStart, { result, isError, ...(neverRan ? { notExecuted: true } : {}) }, { push: emit, structured: prepared.structuredProjector, mediaByteCapBytes: runner.deps.mediaByteCapBytes });
         notExecuted = settled.notExecuted === true;
         const gate = settled.gate ?? decidedGate;
         const word = await resume.recordExecutionOutcome(gate);
         settleExecutionRecord(runner.deps.onNotice, word, { toolName: pendingAction.toolName, gate, sessionId: prepared.sessionId, runId: prepared.runId, scope: resume.cp.scope, ...(resume.cp.checkpointId !== undefined ? { checkpointId: resume.cp.checkpointId } : {}) });
     };
+    const settleUnreadable = async (error, which) => {
+        const marks = egressValue("same-principal", thrownMarksOf(error));
+        const text = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: the tool could not read ${which} — its argument preparation failed (${egressThrownText("same-principal", error)}). This approval is spent — the call has to be re-issued.`, prepared.reminderMark);
+        await settleEnd(true, { content: text, ...(marks !== undefined ? { details: marks } : {}) }, undefined, true);
+        emitCommitted(await prepared.session.appendMessage(resultRow(text, true)), "toolResult", pendingAction.toolCallId);
+    };
     if (outcome.decision === "deny") {
         const settlementKind = outcome.gateOutcome?.settlement?.kind;
         const reason = settlementKind === "policy_refused"
@@ -593,6 +612,8 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     if (outcome.decision !== "allow") {
         throw new CheckpointError("checkpoint.invalid_outcome", `pending action reached the resolver with decision "${String(outcome.decision)}" — only "allow" executes and only "deny" injects a denial; refusing to execute`);
     }
+    if (decided.unread !== undefined)
+        return settleUnreadable(decided.unread.error, humanRewrite !== undefined ? "the arguments the decision edited it to" : "its arguments");
     const screened = await prepared.approvedCallScreen?.({ toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, args: structuredClone(resolvedArgs), decidedBy: outcome.hostDecision.decidedBy });
     if (screened !== undefined && "refused" in screened) {
         const hookDenial = formatHookFeedback(screened.refused, prepared.reminderMark);
@@ -600,10 +621,13 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         emitCommitted(await prepared.session.appendMessage(resultRow(hookDenial, true)), "toolResult", pendingAction.toolCallId);
         return;
     }
-    const executedArgs = humanRewrite !== undefined ? resolvedArgs : screened !== undefined ? screened.args : resolvedArgs;
+    const rescreened = humanRewrite === undefined && screened !== undefined ? tryRead(screened.args) : undefined;
+    if (rescreened?.unread !== undefined)
+        return settleUnreadable(rescreened.unread.error, "the arguments a PreToolUse hook rewrote it to");
+    const executedArgs = rescreened !== undefined ? rescreened.args : resolvedArgs;
     const unseen = !deepJsonEqual(executedArgs, pendingAction.args);
     let beltReading;
-    const beltReq = () => ({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)), budget: beltBudget, ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}), ...(prepared.handsRoot !== undefined ? { root: prepared.handsRoot } : {}), ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs), ...exemptRootsSeat(prepared.exemptRoots), ...(beltReading !== undefined ? { targetReading: beltReading } : {}) });
+    const beltReq = () => ({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(beltFace()), budget: beltBudget, ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}), ...(prepared.handsRoot !== undefined ? { root: prepared.handsRoot } : {}), ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs), ...exemptRootsSeat(prepared.exemptRoots), ...(beltReading !== undefined ? { targetReading: beltReading } : {}) });
     const unjudgeable = unseen ? chainCannotJudge(resume.cp.state.inheritedGate) : undefined;
     if (unjudgeable !== undefined) {
         const chainDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: its input changed after the approval and the inherited ancestor chain cannot judge the changed input (${unjudgeable}). This approval is spent — the call has to be re-issued.`, prepared.reminderMark);
@@ -620,14 +644,20 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         const card = pathDenialCardOf(attestationOf(d, { toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName })?.pathDenial);
         return card !== undefined ? { details: card } : {};
     };
+    const beltCheck = async (judge, seat) => { const signal = prepared.abortController.signal; try {
+        return await judge(signal);
+    }
+    catch (err) {
+        return failedJudgmentDeny(err, signal, (e) => runner.deps.onError?.(e, { phase: "hook", sessionId: prepared.sessionId }), seat, pendingAction);
+    } };
     const beltStamped = prepared.stampCallTarget?.(beltReq(), prepared.abortController.signal);
     if (beltStamped !== undefined)
         beltReading = (await beltStamped).targetReading;
     if (unseen && prepared.basePolicyForResumeEdit) {
-        const rechecked = refuseOutOfContractDecision(await prepared.basePolicyForResumeEdit.check(beltReq(), prepared.abortController.signal));
+        const rechecked = refuseOutOfContractDecision(await beltCheck((signal) => prepared.basePolicyForResumeEdit.check(beltReq(), signal), "the deployment's tool policy re-checking a resumed call"));
         const personUnanswered = policyCannotAnswer(rechecked, outcome.hostDecision.decidedBy);
         const beltUnsafe = rechecked.action === "deny" ||
-            (rechecked.updatedInput !== undefined && !deepJsonEqual(rechecked.updatedInput, executedArgs)) ||
+            (rechecked.updatedInput !== undefined && ((read) => read.unread !== undefined || !deepJsonEqual(read.args, executedArgs))(tryRead(rechecked.updatedInput))) ||
             personUnanswered;
         if (beltUnsafe) {
             const why = rechecked.action === "deny"
@@ -653,7 +683,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     }
     if (prepared.permissionRuleOrg !== undefined) {
         const orgVerdict = prepared.permissionRuleOrg
-            .adjudicate({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)) })
+            .adjudicate({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(beltFace()) })
             .catch(() => ({ status: "unavailable", disclosures: ["the org adjudication face threw on resume"] }));
         let orgWaitCancelled = false;
         const org = await settleOrgVerdictWithin(orgVerdict, { status: "unavailable", disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`] }, {
@@ -687,7 +717,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         }
     }
     if (prepared.denyNarrowingPolicy) {
-        const narrowed = refuseOutOfContractDecision(await prepared.denyNarrowingPolicy.check(beltReq(), prepared.abortController.signal));
+        const narrowed = refuseOutOfContractDecision(await beltCheck((signal) => prepared.denyNarrowingPolicy.check(beltReq(), signal), "the narrowing rules re-checking a resumed call"));
         if (narrowed.action === "deny") {
             const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by ${ruleSourcePhrase("narrowing")} and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`, prepared.reminderMark);
             await settleEnd(true, { content: narrowedDenial, ...denialCard(narrowed) }, "policy");
@@ -729,7 +759,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         }
     }
     if (prepared.shellReadCheck !== undefined) {
-        const readCall = { toolName: pendingAction.toolName, ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)) };
+        const readCall = { toolName: pendingAction.toolName, ...callFaceSeat(beltFace()) };
         const judged = prepared.shellReadCheck.judge(readCall, executedArgs, prepared.cwdRef?.current, prepared.abortController.signal, {
             toolCallId: pendingAction.toolCallId,
             ...(unseen ? { seat: "rejudge" } : {}),

package/dist/core/runner/run-recovery-lanes.js

@@ -2,7 +2,7 @@ import { compactionKindOf } from "../task-notification.js";
 import { planRejectionClears } from "../context-edit.js";
 import { rosterToolName } from "../tool-roster.js";
 import { landStaleResultClears } from "./prepare-context-lane.js";
-import { DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact, mintCompactedEvent } from "../auto-compaction.js";
+import { compactionPassReport, DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact, mintCompactedEvent } from "../auto-compaction.js";
 import { emitTrace } from "../trace.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { rebaseCadenceWindows } from "./turn-attachments.js";
@@ -22,6 +22,7 @@ export function runRecoveryLanes(input) {
         if (callerStop.signal.aborted)
             return false;
         const passSignal = AbortSignal.any([prepared.abortController.signal, callerStop.signal, ...(turnSignal !== undefined ? [turnSignal] : [])]);
+        const passReport = compactionPassReport(queue, ident);
         try {
             const comp = await maybeCompact({
                 session: prepared.session,
@@ -50,6 +51,7 @@ export function runRecoveryLanes(input) {
                 ...compactionRestateOptions(prepared),
                 ...windowSafetyOptions(prepared.harness.getModel()),
                 ...compactionHookOptions(runner, prepared, "forced", passSignal),
+                onStarted: passReport.onStarted,
             });
             if (comp.compacted) {
                 compactionBreaker.failures = 0;
@@ -95,13 +97,13 @@ export function runRecoveryLanes(input) {
         catch (err) {
             if (isCompactionManualCancel(err) || (turnSignal?.aborted === true && !prepared.abortController.signal.aborted)) {
                 emitTrace(rs.telemetry.tracer, () => ({ kind: "compaction.mooted", version: 1, taskId: rs.telemetry.taskId, reason: "cancelled", ts: Date.now() }));
-                queue.push({ type: "compaction_outcome", outcome: "mooted", trigger: "forced", reason: "cancelled", ...ident() });
+                queue.push({ type: "compaction_outcome", outcome: "mooted", trigger: "forced", reason: "cancelled", ...passReport.end, ...ident() });
                 return false;
             }
             compactionBreaker.failures += 1;
             runner.deps.onError?.(asThrownError(err), { phase: "compaction", sessionId: prepared.sessionId });
             const msg = thrownText(err);
-            queue.push({ type: "compaction_outcome", outcome: "failed", trigger: "forced", reason: msg.length > 512 ? `${msg.slice(0, 512)}…` : msg, ...ident() });
+            queue.push({ type: "compaction_outcome", outcome: "failed", trigger: "forced", reason: msg.length > 512 ? `${msg.slice(0, 512)}…` : msg, ...passReport.end, ...ident() });
             return false;
         }
     };