@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/runner/gate-exit.js

@@ -2,12 +2,15 @@ import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
 import { askFaceOf, classifyAsk, headlessApprovalRemedy } from "../ask-origin.js";
 import { wireOf } from "../tool-name-readings.js";
 import { isProtectedWrite } from "../tool-registry.js";
-import { attestationOf, decisionText } from "../tool-policy.js";
+import { attestationOf, decisionText, licenseCovers } from "../tool-policy.js";
 import { pathDenialCardOf } from "../../tools/fs/safety.js";
-import { boundInputHashOf } from "../canonical-json.js";
+import { argsAsTheToolReads } from "../effective-path-target.js";
 import { askUnresolvableRemedySeat } from "../ask-unresolvable-notice.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
+import { types } from "node:util";
+import { receive } from "../mods/kernel/receive.js";
+import { describeBindingFault, MAX_DEPTH } from "../canonical-json.js";
 export function mintGateOutcome(facts) {
     const settlement = facts.settled !== undefined ? Object.freeze({ ...facts.settled.settlement, who: Object.freeze({ ...facts.settled.settlement.who }) }) : undefined;
     const attribution = facts.classifier !== undefined ? Object.freeze({ ...facts.classifier, ...(facts.classifier.fallback !== undefined ? { fallback: Object.freeze({ ...facts.classifier.fallback }) } : {}) }) : undefined;
@@ -81,12 +84,7 @@ export function createSettlementLedger(call) {
                     `(\`attestation\`), never a resolver's member; denied fail-closed rather than recording a settlement nobody can attribute`, contractRefusal(origin));
             }
             const edited = resolved.action === "allow" && resolved.updatedInput !== undefined;
-            const licensed = () => {
-                if (edited)
-                    return record.inputDigest === boundInputHashOf(resolved.updatedInput);
-                const askedDigest = boundInputHashOf(req.args);
-                return record.inputDigest === askedDigest && (resolved.presentedInput === undefined || boundInputHashOf(resolved.presentedInput) === askedDigest);
-            };
+            const licensed = () => edited ? licenseCovers(record.inputDigest, resolved.updatedInput) : licenseCovers(record.inputDigest, req.args) && (resolved.presentedInput === undefined || licenseCovers(record.inputDigest, resolved.presentedInput));
             const bound = record?.settlement !== undefined && record.origin === origin && sameClasses(record.classes, asked.classes) ? record.settlement : undefined;
             const refusal = bound !== undefined && SETTLEMENT_IS_REFUSAL[bound.kind] ? bound : undefined;
             if (resolved.action === "allow") {
@@ -127,7 +125,7 @@ export function createSettlementLedger(call) {
             return { decision, deniedBy: refusal ? "ask_resolution" : "policy" };
         },
         keepForBytes(runs) {
-            if (settled !== undefined && settled.licensed !== boundInputHashOf(runs))
+            if (settled !== undefined && !licenseCovers(settled.licensed, runs))
                 settled = undefined;
         },
         causeOf(decision) {
@@ -153,32 +151,63 @@ export function cloneObserverInput(input) {
         return input;
     }
 }
+const RECORD_RECEIPT = Object.freeze({ accessors: "refuse", depth: MAX_DEPTH, others: "refuse", contain: true, isProxy: (v) => types.isProxy(v) });
 export function frozenInputSnapshot(input) {
-    try {
-        return deepFreeze(structuredClone(input));
+    const received = receive(input, RECORD_RECEIPT);
+    if (!received.ok)
+        return notRecorded(input, received.fault);
+    const record = received.value;
+    const symbolMarkers = new Map();
+    for (const fault of received.faults ?? []) {
+        const above = fault.path.slice(0, -1);
+        const holder = memberAt(record, above);
+        const last = fault.path[fault.path.length - 1];
+        if (typeof holder !== "object" || holder === null || last === undefined)
+            continue;
+        const rawHolder = memberAt(input, above);
+        const symbolKeyed = fault.kind === "hidden" && (Object.hasOwn(holder, last) || typeof rawHolder !== "object" || rawHolder === null || !Object.hasOwn(rawHolder, last));
+        if (symbolKeyed) {
+            const listed = symbolMarkers.get(holder);
+            if (listed === undefined)
+                symbolMarkers.set(holder, [notRecorded(input, fault)]);
+            else
+                listed.push(notRecorded(input, fault));
+        }
+        else
+            Object.defineProperty(holder, last, { value: notRecorded(input, fault), enumerable: true, writable: true, configurable: true });
     }
-    catch {
-        return Object.freeze(Array.isArray(input) ? [...input] : input !== null && typeof input === "object" ? { ...input } : input);
+    for (const [holder, markers] of symbolMarkers) {
+        let key = "[not recorded: symbol-keyed members]";
+        while (Object.hasOwn(holder, key))
+            key += "'";
+        Object.defineProperty(holder, key, { value: markers, enumerable: true, writable: true, configurable: true });
     }
+    return freezeRecord(record);
 }
-function deepFreeze(value) {
-    if (value === null || typeof value !== "object" || Object.isFrozen(value))
-        return value;
-    Object.freeze(value);
-    for (const key of Reflect.ownKeys(value)) {
-        const d = Object.getOwnPropertyDescriptor(value, key);
-        if (d !== undefined && "value" in d)
-            deepFreeze(d.value);
+function freezeRecord(record) {
+    const pending = [record];
+    for (let at = pending.pop(); at !== undefined || pending.length > 0; at = pending.pop()) {
+        if (typeof at !== "object" || at === null || Object.isFrozen(at))
+            continue;
+        Object.freeze(at);
+        for (const member of Object.values(at))
+            pending.push(member);
     }
-    return value;
+    return record;
+}
+const notRecorded = (input, fault) => `[not recorded: ${describeBindingFault(input, fault)}]`;
+function memberAt(value, path) {
+    let at = value;
+    for (const key of path)
+        at = typeof at === "object" && at !== null ? at[key] : undefined;
+    return at;
 }
 const PARK_FAILURE_CAUSE_MAX = 600;
-function withParkFailureCause(reason, parkFailed) {
+function withParkFailureCause(reason, parkFailed, nobodyJudged) {
     if (parkFailed === undefined)
         return reason;
-    return (`${reason} — note: a durable approval park was attempted for this call FIRST and could not be minted ` +
-        `(${inlineUntrusted(parkFailed, PARK_FAILURE_CAUSE_MAX)}), so the refusal above is what the fallback had ` +
-        `left to say, not the reason the call stopped.`);
+    const note = `${reason} — note: a durable approval park was attempted for this call and could not be minted (${inlineUntrusted(parkFailed, PARK_FAILURE_CAUSE_MAX)})`;
+    return nobodyJudged ? `${note}; with nobody to judge the call, that is why it stopped — it can be issued again once its park can be minted.` : `${note}.`;
 }
 export function passAskFace(pass) {
     return askFaceOf(wireOf("gate.askFace", pass.req));
@@ -191,11 +220,15 @@ export async function engineFailClosedExit(pass, reason) {
     return { block: true, reason: formatHookFeedback(reason, input.reminderMark), gate, finalInput, preToolContext: pass.preToolContext };
 }
 export const unownedArgsMessage = (subject, reason) => `${subject} could not be taken into the gate's own copy (${reason}) — denied fail-closed`;
-export async function unownedArgsExit(pass, reason) {
-    pass.decision = { action: "deny", message: unownedArgsMessage(`the arguments of "${pass.toolName}"`, reason) };
-    pass.deniedBy = "policy";
+export async function untakenValueExit(pass, untaken) {
+    pass.currentInput = untaken.value;
+    pass.decision = { action: "deny", message: untaken.message };
+    pass.deniedBy = untaken.deniedBy;
     return await exitGate(pass);
 }
+export async function unownedArgsExit(pass, reason) {
+    return await untakenValueExit(pass, { value: pass.currentInput, message: unownedArgsMessage(`the arguments of "${pass.toolName}"`, reason), deniedBy: "policy" });
+}
 export function hookDenyExit(pass, deniedReason) {
     const { input } = pass;
     return {
@@ -220,7 +253,7 @@ export async function exitGate(pass) {
     const { input, toolName, toolCallId, ledger, notifyPermissionDenied } = pass;
     if (pass.decision.action === "deny") {
         if (pass.decision.updatedInput !== undefined) {
-            pass.currentInput = pass.decision.updatedInput;
+            pass.currentInput = argsAsTheToolReads(pass.req, pass.decision.updatedInput);
         }
         if (pass.deniedBy === undefined)
             throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
@@ -235,11 +268,13 @@ export async function exitGate(pass) {
         const unresolvable = foldCause ?? unresolvableCauseOfSettlement(gate);
         const tableSeat = unresolvable !== undefined ? askUnresolvableRemedySeat(unresolvable) : undefined;
         const remedySeat = tableSeat === "absent" && input.askSeatForm === "declared_none" && pass.askClassification?.classes.has("content_question") !== true ? "declared_none" : tableSeat;
-        const remedy = remedySeat !== undefined ? headlessApprovalRemedy({ mode: input.permissionMode?.(), classification: foldCause !== undefined ? ANCESTOR_UNRESOLVED_CLASSIFICATION : pass.askClassification, approverSeat: remedySeat, coveredWrite: isProtectedWrite(pass.req), ...(pass.shellUnplacedOptions !== undefined ? { unplacedOptions: pass.shellUnplacedOptions } : {}) }) : undefined;
-        const denyReason = withParkFailureCause(`${decisionText(pass.decision) ?? `tool "${toolName}" denied by policy`}${remedy !== undefined ? ` — ${remedy}` : ""}`, pass.parkFailed);
+        const bindingRefusal = attestationOf(pass.decision, { toolCallId, toolName })?.bindingRefusal;
+        const remedy = bindingRefusal !== undefined ? undefined : remedySeat !== undefined ? headlessApprovalRemedy({ mode: input.permissionMode?.(), classification: foldCause !== undefined ? ANCESTOR_UNRESOLVED_CLASSIFICATION : pass.askClassification, approverSeat: remedySeat, coveredWrite: isProtectedWrite(pass.req), ...(pass.shellUnplacedOptions !== undefined ? { unplacedOptions: pass.shellUnplacedOptions } : {}) }) : undefined;
+        const denyReason = withParkFailureCause(`${decisionText(pass.decision) ?? `tool "${toolName}" denied by policy`}${remedy !== undefined ? ` — ${remedy}` : ""}`, pass.parkFailed, unresolvable !== undefined);
         if (unresolvable !== undefined) {
             const cause = unresolvable;
-            pass.notifier.notify(() => input.onAskUnresolvable?.({ toolName, toolCallId, cause, parkLaneExisted: pass.suspendAsk !== undefined, ...(remedy !== undefined ? { remedy } : {}) }), "toolGate.onAskUnresolvable");
+            const noticeRemedy = bindingRefusal ?? remedy;
+            pass.notifier.notify(() => input.onAskUnresolvable?.({ toolName, toolCallId, cause, parkLaneExisted: pass.suspendAsk !== undefined, ...(noticeRemedy !== undefined ? { remedy: noticeRemedy } : {}) }), "toolGate.onAskUnresolvable");
         }
         const finalInput = frozenInputSnapshot(pass.currentInput);
         await notifyPermissionDenied({
@@ -265,9 +300,17 @@ export async function exitGate(pass) {
     if (pass.decision.action === "allow") {
         const rw = pass.decision.updatedInput !== undefined ? pass.decision.updatedInput : pass.policyRewrite;
         if (rw !== undefined)
-            pass.currentInput = rw;
+            pass.currentInput = argsAsTheToolReads(pass.req, rw);
     }
     ledger.keepForBytes(pass.currentInput);
+    const crossBoundary = await input.crossBoundaryCheck?.exit({ toolName, args: pass.currentInput, toolCallId }, ledger.settled?.settlement.who.party === "person" ? "person" : "policy");
+    if (crossBoundary !== undefined) {
+        pass.decision = { action: "deny", message: crossBoundary.message, decisionReason: "safety" };
+        pass.deniedBy = crossBoundary.kind === "unconfirmed" ? "ask_resolution" : "policy";
+        if (crossBoundary.kind === "unconfirmed")
+            ledger.set({ settlement: { kind: "blanket_allow_refused", who: { party: "none" }, when: Date.now() }, origin: ledger.settled?.origin ?? "safety_tighten" });
+        return exitGate(pass);
+    }
     const release = pass.arbitration?.kind === "released" ? pass.arbitration : (() => { if (ledger.settled !== undefined)
         return undefined; const a = pass.arbitration === undefined ? input.ancestorArbitrationOf?.(toolCallId) : undefined; return a?.kind === "released" ? a : undefined; })();
     return {

package/dist/core/runner/inherited-ask-grants.js

@@ -1,6 +1,6 @@
 import { primaryActivityArg } from "../arg-summary.js";
 import { askApproverIdentity, attest, attestationOf } from "../tool-policy.js";
-import { boundInputHashOf } from "../canonical-json.js";
+import { exactBoundInputHashOf } from "../canonical-json.js";
 export function askGrantCovers(granted, asked) {
     return asked !== undefined && asked.length > 0 && granted.length > 0 && asked.every((c) => c === "ordinary" || granted.includes(c));
 }
@@ -34,5 +34,5 @@ export function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision
     const settlement = attestationOf(grant.settled, req)?.settlement;
     if (settlement === undefined || decision.action !== "ask")
         return reused;
-    return attest(reused, req, { settlement, ...(decision.origin !== undefined ? { origin: decision.origin } : {}), ...(decision.classes !== undefined ? { classes: decision.classes } : {}), inputDigest: boundInputHashOf(grant.presented) });
+    return attest(reused, req, { settlement, ...(decision.origin !== undefined ? { origin: decision.origin } : {}), ...(decision.classes !== undefined ? { classes: decision.classes } : {}), inputDigest: exactBoundInputHashOf(grant.presented) });
 }

package/dist/core/runner/mcp-redial.d.ts

@@ -15,22 +15,28 @@
  */
 import type { AgentTool } from "../../internal/harness.js";
 import type { McpDroppedTool, McpReconnectResult, MaterializedMcp, McpToolAxis } from "../mcp.js";
-import type { RunnerDeps, ToolEffect } from "../types.js";
+import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
 import type { IrreversibilityTier, ToolFaceSnapshot } from "./contracts.js";
 import type { RosterBuilder, ToolRosterDeltaSeat } from "../tool-roster.js";
+import type { McpInstructionsEntry } from "../prompt-section-seat.js";
 /** One server's assertion about its own prefix domain — the shape both faces reduce to. `tools` is
  *  the roster the domain must END UP with (empty withdraws it); `added`/`removed` are the reporting
- *  half and never drive the swap. */
+ *  half and never drive the swap. `instructions`: the server's current connection's instructions entry, when the face that produced
+ *  the delta hands it back (a refresh does; a re-dial queues its new text itself). */
 export interface McpRosterDelta {
     server: string;
     prefix: string;
     tools: AgentTool[];
     axes: McpToolAxis[];
     dropped: McpDroppedTool[];
+    instructions?: McpInstructionsEntry;
 }
 /** The seats a roster application writes through. Every one of them is borrowed from the phase that
  *  minted it — this module owns nothing. */
 export interface McpRosterApplyInput {
+    /** borrowed-readonly — the run's spec; only `excludeAllTools` is read: the valve's whole-face switch decides what a live roster
+     *  change may mount, beside the selector (`valveLeaves`). */
+    spec: Pick<TaskSpec, "excludeAllTools">;
     /** borrowed-readonly — the frozen tool face; its selector keeps a tool the leg may not use from ever
      *  being mounted by a face the model or a host can trigger. */
     toolFaceSnapshot: Pick<ToolFaceSnapshot, "selector">;
@@ -48,20 +54,53 @@ export interface McpRosterApplyInput {
     }>;
     /** borrowed-mutable — the run's shared roster. */
     roster: RosterBuilder;
+    /** borrowed-readonly — the run's frozen MCP server declarations: a roster reading is of a declared server, and a name none is declared under holds nothing. */
+    declared: ReadonlyArray<{
+        readonly name: string;
+    }>;
+    /** borrowed-mutable — the materialization's instructions delta lane; a roster change settles the server's adds on it. */
+    instructionsDelta: MaterializedMcp["instructionsDelta"];
+}
+/** What one application did to the server's domain on the roster — read off the roster before and after the swap, the ONE source of
+ *  "how many of this server's tools are mounted" for the re-dial's notice and receipt and the refresh tool's receipt. A name the
+ *  valve left out, a name the deployment's `toolFaces` overlay refused and a name the server listed but the roster did not take are
+ *  all simply absent from `mounted`. */
+export interface McpRosterReading {
+    /** The names of the server's tools the roster holds after the application, in wire order. */
+    mounted: string[];
+    /** The names `mounted` holds that the roster did not hold before. */
+    added: string[];
+    /** The names the roster held before that `mounted` no longer holds. */
+    removed: string[];
+    /** The names the server listed that the roster did not take (the valve's, the overlay's). */
+    excluded: string[];
 }
 /** What one application did, for the caller's receipt. `applied:false` means the axis fold refused
- *  and the domain was left exactly as it was (the tables restored) — no roster write happened. */
-export type McpRosterApplyOutcome = {
+ *  and the domain was left exactly as it was (the tables restored) — no roster write happened, so `mounted` is what it held. */
+export type McpRosterApplyOutcome = ({
     applied: true;
-    pushed: number;
-    excluded: string[];
-} | {
+} & McpRosterReading) | ({
     applied: false;
     foldError: string;
-};
+} & McpRosterReading);
+/** What the roster holds of one server with no swap made — the reading of an arm that asserted no roster (a failed refresh, a refused re-dial, a fold refusal).
+ *  A name no server is declared under holds nothing, even when it mints a declared server's prefix. */
+export declare function rosterHolding(input: Pick<McpRosterApplyInput, "roster" | "declared">, serverName: string): McpRosterReading;
+/** A refresh or re-dial result read off the roster instead of the server's own listing: `toolCount` is the tools mounted, `added` /
+ *  `removed` the names that came onto / left the roster, and — on a result that asserts a roster — `tools` the roster's tools of the
+ *  server (with `axes` cut to them), so `toolCount === tools.length`. One meaning, the one `MaterializedMcp.refresh` / `reconnect` give
+ *  for their own handles. */
+export declare function settledOnRoster<T extends {
+    toolCount: number;
+    added: string[];
+    removed: string[];
+    tools?: AgentTool[];
+    axes?: McpToolAxis[];
+}>(result: T, reading: McpRosterReading, roster: Pick<RosterBuilder, "tools">): T;
 /**
- * Apply one server's delta to the live roster. Behavior-identical to the body this was extracted
- * from; the comments are the extracted reasoning, not new claims.
+ * Apply one server's delta to the live roster, and settle the server's instruction adds on the delta lane: the teaching answer over the
+ * roster after the swap, against the lane's ledger of what the model holds (both faces — the model's refresh and the host's re-dial —
+ * through this one step).
  */
 export declare function applyMcpRosterDelta(input: McpRosterApplyInput, delta: McpRosterDelta): McpRosterApplyOutcome;
 /** The seats the post-application commit writes through. */
@@ -105,5 +144,8 @@ export interface McpRedialInput extends McpRosterApplyInput, McpRosterCommitInpu
  * leave the model holding tools that can only fail), and an arm that never touched the connection —
  * unknown name, revoked server, re-dial already in flight, disposed materialization — asserts nothing
  * and the mounted roster is left alone.
+ *
+ * The result it hands back counts what the ROSTER took: `toolCount` is the server's tools mounted after the swap, `added` /
+ * `removed` the names that came onto / left the roster, and the notice reads the same three — one source for "how many are mounted".
  */
 export declare function redialMcpServer(input: McpRedialInput, server: string): Promise<McpReconnectResult>;

package/dist/core/runner/mcp-redial.js

@@ -1,9 +1,31 @@
+import { valveLeaves } from "../../agents/tool-filter.js";
+import { instructionsTaught, instructionsTold, tellInstructions, toolNamesOfServer, withdrawInstructionAdds } from "../mounted-mcp.js";
 import { deliverEngineNotice } from "../types.js";
 import { thrownText } from "../thrown-value.js";
+export function rosterHolding(input, serverName) {
+    const mounted = input.declared.some((d) => d.name === serverName) ? toolNamesOfServer(input.roster.tools.map((t) => t.name), serverName) : [];
+    return { mounted, added: [], removed: [], excluded: [] };
+}
+export function settledOnRoster(result, reading, roster) {
+    const settled = { ...result, toolCount: reading.mounted.length, added: reading.added, removed: reading.removed };
+    if (result.tools === undefined)
+        return settled;
+    const held = new Set(reading.mounted);
+    return { ...settled, tools: roster.tools.filter((t) => held.has(t.name)), ...(result.axes !== undefined ? { axes: result.axes.filter((a) => held.has(a.name)) } : {}) };
+}
+function settleInstructions(lane, delta, taught) {
+    if (!taught)
+        return withdrawInstructionAdds(lane, delta.server);
+    if (delta.instructions !== undefined && !instructionsTold(lane, delta.server) && !lane.pendingAdds.some((e) => e.server === delta.server))
+        tellInstructions(lane, delta.instructions);
+}
 export function applyMcpRosterDelta(input, delta) {
-    const { toolFaceSnapshot, withFaces, remoteToolOffload, foldProtocolAxes, toolEffects, axisExplicitNegatives, roster } = input;
-    const pushable = delta.tools.filter((t) => toolFaceSnapshot.selector.admits(t));
-    const excluded = delta.tools.filter((t) => !toolFaceSnapshot.selector.admits(t)).map((t) => t.name);
+    const { spec, toolFaceSnapshot, withFaces, remoteToolOffload, foldProtocolAxes, toolEffects, axisExplicitNegatives, roster } = input;
+    const domainNow = () => toolNamesOfServer(roster.tools.map((t) => t.name), delta.server);
+    const before = domainNow();
+    const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
+    const pushable = delta.tools.filter(leaves);
+    const valveExcluded = delta.tools.filter((t) => !leaves(t)).map((t) => t.name);
     const domainSnapshot = (m) => new Map([...m].filter(([name]) => name.startsWith(delta.prefix)));
     const restoreDomain = (m, snap) => {
         for (const name of [...m.keys()])
@@ -19,15 +41,20 @@ export function applyMcpRosterDelta(input, delta) {
     for (const name of priorDomainNegatives.keys())
         axisExplicitNegatives.delete(name);
     try {
-        foldProtocolAxes(delta.axes.filter((a) => !excluded.includes(a.name)), "MCP");
+        foldProtocolAxes(delta.axes.filter((a) => !valveExcluded.includes(a.name)), "MCP");
     }
     catch (foldErr) {
         restoreDomain(toolEffects, priorDomainEffects);
         restoreDomain(axisExplicitNegatives, priorDomainNegatives);
-        return { applied: false, foldError: thrownText(foldErr) };
+        settleInstructions(input.instructionsDelta, delta, instructionsTaught(leaves, delta.server, roster.tools, delta.tools));
+        return { applied: false, foldError: thrownText(foldErr), ...rosterHolding(input, delta.server) };
     }
     roster.replaceDomain(delta.prefix, withFaces(pushable, delta.server).map((t) => remoteToolOffload(t)), { source: "mcp", mountedBy: "optional", origin: { peer: delta.server } });
-    return { applied: true, pushed: pushable.length, excluded };
+    const mounted = domainNow();
+    const heldNow = new Set(mounted);
+    const heldBefore = new Set(before);
+    settleInstructions(input.instructionsDelta, delta, instructionsTaught(leaves, delta.server, roster.tools, delta.tools));
+    return { applied: true, mounted, added: mounted.filter((n) => !heldBefore.has(n)), removed: before.filter((n) => !heldNow.has(n)), excluded: delta.tools.map((t) => t.name).filter((n) => !heldNow.has(n)) };
 }
 export async function commitMcpRosterChanges(input) {
     await input.rebuildHarnessToolsRef.current?.();
@@ -38,9 +65,11 @@ export async function commitMcpRosterChanges(input) {
     return undefined;
 }
 export async function redialMcpServer(input, server) {
-    const result = await input.mcp.reconnect(server);
-    if (result.tools !== undefined) {
-        const outcome = applyMcpRosterDelta(input, { server: result.server, prefix: result.prefix, tools: result.tools, axes: result.axes ?? [], dropped: result.dropped ?? [] });
+    const listed = await input.mcp.reconnect(server);
+    let result = settledOnRoster(listed, rosterHolding(input, listed.server), input.roster);
+    if (listed.tools !== undefined) {
+        const outcome = applyMcpRosterDelta(input, { server: listed.server, prefix: listed.prefix, tools: listed.tools, axes: listed.axes ?? [], dropped: listed.dropped ?? [] });
+        result = settledOnRoster(listed, outcome, input.roster);
         if (!outcome.applied)
             input.deps.onError?.(Object.assign(new Error(`MCP re-dial of "${server}" connected but its safety-axis fold refused, so its tools were not mounted: ${outcome.foldError}`), { code: "mcp.server_unavailable" }), { phase: "mcp", sessionId: input.sessionId });
         const ungated = await commitMcpRosterChanges(input);

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -117,12 +117,15 @@ export interface PermissionRuleLanes {
     } | undefined;
 }
 /** The ORG lane: the org's verdict about one call, off the store view `read` supplies — the gate's `orgRules` face over the
- *  call's pinned read ({@link createPermissionRuleLanes}), and {@link orgVerdictBeforeClaim} over a view of its own. */
+ *  call's pinned read ({@link createPermissionRuleLanes}), and {@link orgVerdictBeforeClaim} over a view of its own.
+ *  `onDegraded` receives the snapshot's degraded line ({@link describeUnreadableOrgRows}) on every adjudication over a
+ *  snapshot carrying a row this layer cannot read. */
 export declare function orgRuleLane(cfg: {
     read: (toolCallId: string) => Promise<Pick<EffectivePermissionRules, "org">>;
     questionToolMounted: boolean;
     questionToolName: string;
     onRevisionDefect: (message: string) => void;
+    onDegraded: (message: string) => void;
 }): NonNullable<PermissionRuleLanes["org"]>;
 /** The org's CURRENT verdict about a parked call, read by the resume entry before the claim (the row's session and principal,
  *  bounded like the gate's wait; unreadable ⇒ unavailable). The mount and a revision defect are the resumed leg's facts, so
@@ -172,7 +175,7 @@ export declare function createPermissionRuleLanes(cfg: {
     questionToolMounted: boolean;
     questionToolName: string;
     onRevisionDefect: (message: string) => void;
-    /** Sink for a judgment against the rows that threw. */
+    /** Sink for a judgment against the rows that threw, and for the org lane's degraded-snapshot line. */
     onDisclosure: (message: string) => void;
     /** The run's one reader of the person's rules: the call's ONE read, pinned, that the read station, the org lane and the
      *  personal lane all take (the lanes consume a reader; they do not make one). */

package/dist/core/runner/permission-rule-lanes.js

@@ -1,10 +1,10 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, domainRuleSubjectOf, faceRowsSpeakFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
+import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, domainRuleSubjectOf, escapeForDisclosure, faceRowsSpeakFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
 import { callTargetViewsOf, validatePath } from "../effective-path-target.js";
 import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
 import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
-import { orgRuleVerdictFor, settleOrgVerdictWithin } from "../permission-rule-org.js";
+import { describeUnreadableOrgRows, readOrgRules, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { ownerStoreOf } from "../permission-rule-provider.js";
 import { thrownText } from "../thrown-value.js";
@@ -18,12 +18,19 @@ export function inheritedAskRuleEvidence(provider) {
     return Object.freeze({ orgRevisionAbsent: org, orgRuleAbsent: org, personalRuleDotsAbsent: personal });
 }
 export function orgRevisionEvidenceOf(resolution, onDefect) {
-    const reported = resolution.revision;
+    let reported;
+    try {
+        reported = resolution.revision;
+    }
+    catch (err) {
+        onDefect(`the org rule partition's revision could not be read (${thrownText(err)}) — the adjudication stands, but the ask carries no revision evidence for this call`);
+        return {};
+    }
     if (reported === undefined)
         return {};
     if (typeof reported === "number" && Number.isFinite(reported))
         return { revision: reported };
-    onDefect(`the org rule partition reported revision ${JSON.stringify(reported)} — a snapshot revision is a finite number; ` +
+    onDefect(`the org rule partition reported revision ${typeof reported === "string" ? `"${escapeForDisclosure(reported)}"` : escapeForDisclosure(reported)} — a snapshot revision is a finite number; ` +
         `the adjudication stands, but the ask carries no revision evidence for this call`);
     return {};
 }
@@ -59,11 +66,16 @@ export function orgRuleLane(cfg) {
             if (resolution.status === "unavailable" || resolution.status === "ungoverned") {
                 return { status: "unavailable", disclosures: resolution.status === "ungoverned" ? ["the store reports no org partition while the provider declares one — unreadable governance, never an empty one"] : resolution.disclosures };
             }
-            const revisionCell = orgRevisionEvidenceOf(resolution, cfg.onRevisionDefect);
+            const reading = readOrgRules(resolution.rules);
+            if ("refused" in reading)
+                return { status: "unavailable", disclosures: [`the store's org resolution cannot be read (${reading.refused}) — unreadable governance, never an empty one`] };
             const command = req.args?.command;
-            if (!laneToolNamesOf(req).includes(PERSISTED_RULE_TOOL) || typeof command !== "string")
-                return { status: "available", ...revisionCell };
-            const verdict = orgRuleVerdictFor(resolution.rules, { tool: PERSISTED_RULE_TOOL, command });
+            const face = callPathFaceOf(req);
+            const verdict = reading.verdictFor({ tool: laneToolNamesOf(req), ...(typeof command === "string" ? { command } : {}), ...(face !== undefined ? { face } : {}) });
+            const revisionCell = orgRevisionEvidenceOf(resolution, cfg.onRevisionDefect);
+            const degraded = describeUnreadableOrgRows(reading.unreadable, revisionCell.revision);
+            if (degraded !== undefined)
+                cfg.onDegraded(degraded);
             return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
         },
     };
@@ -72,7 +84,7 @@ export function orgVerdictBeforeClaim(cfg, req) {
     const unreadable = { status: "unavailable", disclosures: [] };
     const read = () => {
         const store = ownerStoreOf(cfg.provider, cfg.principal, cfg.localOwnerDeclared);
-        return orgRuleLane({ read: () => store.effective({ sessionId: cfg.sessionId }), questionToolMounted: true, questionToolName: ASK_USER_QUESTION_TOOL_NAME, onRevisionDefect: () => undefined }).adjudicate(req);
+        return orgRuleLane({ read: () => store.effective({ sessionId: cfg.sessionId }), questionToolMounted: true, questionToolName: ASK_USER_QUESTION_TOOL_NAME, onRevisionDefect: () => undefined, onDegraded: () => undefined }).adjudicate(req);
     };
     return settleOrgVerdictWithin(Promise.resolve().then(read).catch(() => unreadable), unreadable, { timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS, ...(cfg.signal !== undefined ? { signal: cfg.signal } : {}) });
 }
@@ -101,7 +113,7 @@ export function createPermissionRuleLanes(cfg) {
             throw new Error(read.unreadable ?? "the store did not answer");
         return { org: read.org };
     };
-    const org = provider.partitions.org ? orgRuleLane({ read: orgViewOf, questionToolMounted: cfg.questionToolMounted, questionToolName: cfg.questionToolName, onRevisionDefect: cfg.onRevisionDefect }) : undefined;
+    const org = provider.partitions.org ? orgRuleLane({ read: orgViewOf, questionToolMounted: cfg.questionToolMounted, questionToolName: cfg.questionToolName, onRevisionDefect: cfg.onRevisionDefect, onDegraded: cfg.onDisclosure }) : undefined;
     const personalAdjudicate = async (req) => {
         if (anonymous && !cfg.localOwnerDeclared)
             return undefined;

package/dist/core/runner/person-path-rows.d.ts

@@ -14,8 +14,8 @@
  *
  * Every read's outcome lands in the run's unit, per personal partition (the durable one — its user and project rows — and
  * the session one), and only where it is newer, by the order the reads STARTED: a read that answers late never replaces
- * a later one. The prepare read is the unit's first write. A reader that is not a call (the compaction summary's working-file
- * reader, the user-attachment seat's reader, the Artifact tool's local read, a read root's grant eligibility, the classifier's table, a language server's session read)
+ * a later one. The prepare read is the unit's first write. A reader that is not a call (the compaction's kept-tail
+ * normalizer, the user-attachment seat's reader (the compaction restore's too), the Artifact tool's local read, a read root's grant eligibility, the classifier's table, a language server's session read)
  * reads the unit's newest tables: while the rows the unit last took are compiling it waits for them (within
  * {@link PATH_TABLES_READY_BOUND_MS}), and a read of tables still compiling, or that could not be compiled, refuses —
  * never the tables of rows the unit has since replaced.
@@ -237,7 +237,9 @@ export declare function ruleStoreUnreadableNotice(onNotice: RunnerDeps["onNotice
 /**
  * The run's ONE `permission.rule_row_dropped` notice (audience user): the person's store served project-scoped rows whose
  * scope root is not a complete absolute path, left out of the checks; minted by whichever read met them first, once per
- * run. The sentence names no path; the rows (bounded) ride the detail. The trace keeps every read's line.
+ * run. The sentence names no path; the rows ride the detail: `rule` is the rule text as the store served it, through the one
+ * reading ({@link noticeRuleText}) that `permission.allowed_tool_not_granted`'s `entries[].entry` uses too — the machine-read side carries the
+ * original, the sentence spells — and `scopeRoot` neutralized and bounded. The trace keeps every read's line.
  */
 export declare function ruleRowsDroppedNotice(onNotice: RunnerDeps["onNotice"], ids: {
     readonly sessionId: string;

package/dist/core/runner/person-path-rows.js

@@ -1,6 +1,6 @@
 import { ownerStoreOf } from "../permission-rule-provider.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
-import { PATH_RULE_FACES, READ_RULE_TOOL, eligiblePersisted } from "../permission-rule-model.js";
+import { PATH_RULE_FACES, READ_RULE_TOOL, eligiblePersisted, noticeRuleText } from "../permission-rule-model.js";
 import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { thrownText } from "../thrown-value.js";
@@ -382,7 +382,7 @@ export function ruleRowsDroppedNotice(onNotice, ids) {
         deliverEngineNotice(onNotice, {
             code: "permission.rule_row_dropped",
             message: `${rows.length} of your persisted permission rule rows ${one ? "is" : "are"} scoped to a project directory that is not written as a complete absolute path, so ${one ? "it takes" : "they take"} no part in this run's checks — a deny or ask row among them protects nothing. Rewrite ${one ? "it" : "them"} with the project's full path, or remove ${one ? "it" : "them"} (this notice's detail names ${one ? "it" : "them"}).`,
-            detail: { rows: rows.slice(0, 8).map((r) => ({ rule: inlineUntrusted(r.rule, 200), scopeRoot: inlineUntrusted(r.scopeRoot, 200) })), count: rows.length, sessionId: ids.sessionId, runId: ids.runId },
+            detail: { rows: rows.slice(0, 8).map((r) => ({ rule: noticeRuleText(r.rule), scopeRoot: inlineUntrusted(r.scopeRoot, 200) })), count: rows.length, sessionId: ids.sessionId, runId: ids.runId },
         });
     };
 }

package/dist/core/runner/prepare-acquire-reconcile.d.ts

@@ -38,10 +38,9 @@ export interface PrepareAcquireReconcileInput {
      *  suspension point BEFORE reconcile) and `suspendedBatch` (wake-reconcile SKIPS those calls —
      *  they are resumed, not crash-interrupted). Absent for a fresh/non-durable run. */
     resume: Pick<PrepareResume, "leafId" | "suspendedBatch"> | undefined;
-    /** borrowed-readonly here — the safety scan's effect registry (its mutation-owner table lives on
-     *  {@link import("./prepare-safety-scan.js").PrepareSafetyScanResult}); reconcile classifies an
-     *  orphaned call's retry-safety by it. */
-    toolEffects: Map<string, ToolEffect>;
+    /** borrowed-readonly — the safety scan's pre-mount reading ({@link import("./prepare-safety-scan.js").PrepareSafetyScanResult.wakeEffects}):
+     *  this reconcile runs before any tool mounts, so a contested name reads its least repeat-safe member; it classifies an orphan's retry-safety. */
+    wakeEffects: Map<string, ToolEffect>;
     /** borrowed-readonly — subagent transcript persistence: the trusted spawner's placement
      *  declaration for THIS run's session ({@link RunInternals.sessionPlacement}), forwarded verbatim
      *  into the create-form acquire so the store creates the child's transcript into its subagent

package/dist/core/runner/prepare-acquire-reconcile.js

@@ -8,7 +8,7 @@ import { detectConflicts, settleBranchWriteBack } from "./branch-writeback.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 const RECONCILE_MAX_RETRIES = 3;
 export async function prepareAcquireReconcile(input) {
-    const { sessions, spec, resume, toolEffects } = input;
+    const { sessions, spec, resume, wakeEffects } = input;
     let acquired;
     let session;
     let conflictRef;
@@ -64,7 +64,7 @@ export async function prepareAcquireReconcile(input) {
                         throw e;
                     }
                     if (userAttachmentOf(msg) !== undefined) {
-                        const e = new Error(`resumeAt entry "${spec.resumeAt}" is an attachment frame that trails a user message; resume at that user message instead`);
+                        const e = new Error(`resumeAt entry "${spec.resumeAt}" is an attachment frame — a file the engine delivered, not a turn boundary; resume at the user message it belongs to, or at another user message or finished assistant turn`);
                         e.code = "resume_at.not_a_message";
                         throw e;
                     }
@@ -100,7 +100,7 @@ export async function prepareAcquireReconcile(input) {
                 own.ids = new Set();
                 branch = { storage, leafBefore, leafSet, own };
             }
-            wakeRecovered = (await reconcileInterruptedSession(session, toolEffects, resume?.suspendedBatch)).recovered;
+            wakeRecovered = (await reconcileInterruptedSession(session, wakeEffects, resume?.suspendedBatch)).recovered;
             break;
         }
         catch (err) {

package/dist/core/runner/prepare-ask-lane.js

@@ -2,7 +2,7 @@ import { cardDisclosureOf } from "../allow-entry.js";
 import { primaryActivityArg } from "../arg-summary.js";
 import { classicEventBase, observeClassic } from "../mods/stations.js";
 import { advertisedWritableRootsSeat, exemptRootsSeat, attest, attestationOf, isLiveApproverSeat, resolveAsk } from "../tool-policy.js";
-import { boundInputHashOf } from "../canonical-json.js";
+import { exactBoundInputHashOf } from "../canonical-json.js";
 import { composeCallSignal, raceSettlementAgainstSignal } from "./abort-race.js";
 import { failedJudgmentDeny, policyCheckAbortedDeny } from "./policy-throw.js";
 import { askMandateMember } from "../ask-origin.js";
@@ -85,8 +85,8 @@ export function prepareAskLane(input) {
             };
             const settlement = { kind: "approver_unavailable", who: { party: "none" }, when: now() };
             return decision.action === "ask"
-                ? attest(intercepted, req, { settlement, ...(decision.origin !== undefined ? { origin: decision.origin } : {}), ...(decision.classes !== undefined ? { classes: decision.classes } : {}), inputDigest: boundInputHashOf(req.args) })
-                : attest(intercepted, req, { settlement, inputDigest: boundInputHashOf(req.args) });
+                ? attest(intercepted, req, { settlement, ...(decision.origin !== undefined ? { origin: decision.origin } : {}), ...(decision.classes !== undefined ? { classes: decision.classes } : {}), inputDigest: exactBoundInputHashOf(req.args) })
+                : attest(intercepted, req, { settlement, inputDigest: exactBoundInputHashOf(req.args) });
         }
         const grantReuse = consumeInheritedAskGrant(inheritedAskGrants, onAsk, humanReviewRef, decision, req);
         if (grantReuse !== undefined)