@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/runner/prepare-context-lane.js

@@ -1,5 +1,6 @@
 import { DEFAULT_CHARS_PER_TOKEN, estimateContextTokens } from "../../internal/harness.js";
 import { TOOL_TURN_REPAIR_DROPS } from "../../internal/llm.js";
+import { droppedTransmissions } from "../user-attachment.js";
 import { clearStaleToolResults, createClearedProjectionLedger, dropEmptyFailureAssistants, editBudget, replayClearedProjection, resolveTriggerWindow } from "../context-edit.js";
 import { guardBudget, insertTrimNotice, protectGitFrame, trimToBudget } from "../context-guard.js";
 import { capAggregateMediaBytes, mediaBudgetBytes } from "../media-byte-cap.js";
@@ -155,14 +156,14 @@ function buildMicroCompactState(deps, model, sessionId, runId, offloadStore, kno
     };
 }
 export function landStaleResultClears(args) {
-    const clearedToolCallIds = [];
+    const transmissions = [];
     for (const c of args.cleared) {
         args.ledger.entries.set(c.key, { marker: c.marker, groupCount: c.groupCount, fp: c.fp });
         if (c.toolCallId !== undefined)
-            clearedToolCallIds.push(c.toolCallId);
+            transmissions.push(c.toolCallId);
     }
     if (args.readFileState !== undefined) {
-        applyContextShrinkToReadFileState(args.readFileState, { kind: "tool-results-cleared", clearedToolCallIds });
+        applyContextShrinkToReadFileState(args.readFileState, { kind: "transmissions-gone", transmissions });
     }
 }
 function recordFrontierClears(args) {
@@ -209,6 +210,8 @@ export async function runGuardChain(args) {
         if (dropped) {
             args.trimPressureRef.droppedMessages = true;
             const droppedCount = view.length - trimmed.length;
+            if (args.readFileState !== undefined)
+                applyContextShrinkToReadFileState(args.readFileState, { kind: "transmissions-gone", transmissions: droppedTransmissions(view, trimmed) });
             trimmed = insertTrimNotice(trimmed);
             emitTrace(deps.tracer, () => ({
                 kind: "context.trim",

package/dist/core/runner/prepare-defer-classify.js

@@ -9,6 +9,7 @@ import { classifyDeferredWithGate } from "./tool-defer-gate.js";
 import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
 import { resolveToolSearch, toolSearchSettingOf } from "../tool-search-setting.js";
 import { RosterBuilder } from "../tool-roster.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 function explicitlyDeferredMemoryTrio(mounted, roster, callerDeferNames) {
     return mounted ? MEMORY_ENGINE_TOOL_NAMES.filter((n) => roster.some((t) => t.name === n) && (callerDeferNames ?? []).includes(n)) : [];
 }
@@ -19,12 +20,8 @@ export function prepareDeferClassify(input) {
     const { spec, deps, roster, toolFaceSnapshot, handsEnabled, fullShellReachable, promptProfile, model, mcp, a2a, sharedMemoryPairMounted, memoryEnginePairMounted, memoryRecallSegment, onceLedger, sessionId } = input;
     const tools = roster.tools;
     let memoryBlock = input.memoryBlock;
-    if (spec.excludeAllTools === true) {
-        roster.unmountWhere(() => true);
-    }
-    else {
-        roster.unmountWhere((t) => !toolFaceSnapshot.selector.admits(t));
-    }
+    const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
+    roster.unmountWhere((t) => !leaves(t));
     if (handsEnabled) {
         const fullShellOnRoster = tools.some((t) => t.name === "Bash" && getToolContract(t, "core").contractId === FULL_SHELL_CONTRACT_ID);
         if (fullShellOnRoster !== fullShellReachable) {
@@ -48,7 +45,7 @@ export function prepareDeferClassify(input) {
         .map((t) => t.name);
     const resolvedToolSearch = resolveToolSearch(deps.toolSearch);
     const toolSearchSeat = toolSearchSettingOf(resolvedToolSearch);
-    const toolSearchAdmitted = toolFaceSnapshot.selector.admits({ name: TOOL_SEARCH_NAME });
+    const toolSearchAdmitted = leaves({ name: TOOL_SEARCH_NAME });
     const classifyDeferredOverFace = (face, builtinDeferNames) => {
         const mounted = new Set(face.map((t) => t.name));
         const classified = classifyDeferredWithGate({

package/dist/core/runner/prepare-delegation-surface.d.ts

@@ -30,11 +30,11 @@ export interface PrepareDelegationSurfaceInput {
     /** borrowed-readonly — the REBOUND spec. Read: `tools` (the shadow checks and the revival spawner's delegation-tool
      *  lookup), `oneShot` (the read/kill faces' completion promises), `retainBackgroundProcesses` (the Monitor receipt),
      *  `handsReadOnly` is NOT read here (the hands mount decided the surface). Never mutated. */
-    spec: Pick<TaskSpec, "tools" | "oneShot" | "retainBackgroundProcesses">;
+    spec: Pick<TaskSpec, "tools" | "oneShot" | "retainBackgroundProcesses" | "excludeAllTools">;
     /** borrowed-readonly — the deployment seats the mounts read: `workflowRunStore` / `backgroundAgentStore` / `mailboxStore` (the
      *  read/kill faces and the tier-3 revival seams), `rosterStore`, `peerLane`, `peerDirectory`, `onNotice`,
      *  `onBackgroundChildEvent`, `tracer`. */
-    deps: Pick<RunnerDeps, "workflowRunStore" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "peerLane" | "peerDirectory" | "onNotice" | "onBackgroundChildEvent" | "tracer">;
+    deps: Pick<RunnerDeps, "workflowRunStore" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "peerLane" | "peerDirectory" | "principalInboxConsumer" | "onNotice" | "onBackgroundChildEvent" | "tracer">;
     /** borrowed-readonly — the trusted spawn-side channel: `parentNotify` (the delegated-child door), the uplink / sibling /
      *  identity seats the SendMessage mount forwards, `onTaskNotification`, `onSubagentSpawn`. Never mutated. */
     internals: Pick<RunInternals, "parentNotify" | "parentPeerRef" | "uplinkSessionId" | "parentRetainLedger" | "explicitAgentName" | "parentTaskId" | "parentSessionId" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn"> | undefined;
@@ -75,8 +75,9 @@ export interface PrepareDelegationSurfaceInput {
      *  Writers here: the eight mounts (TaskOutput, TaskStop, SendMessage, AgentTranscript, ListAgents, Monitor, the worktree
      *  pair, the offload reader), every one a `mount`. */
     roster: RosterBuilder;
-    /** borrowed-mutable — the effect collection (`Prepared.toolEffects`). Writers here: TaskOutput → read, TaskStop / SendMessage
-     *  (built-in mount only) / Monitor / EnterWorktree / ExitWorktree → write. */
+    /** borrowed-readonly — not read by this phase: the effect collection (`Prepared.toolEffects`), the same map `roster` writes at each mount
+     *  (TaskOutput → read, TaskStop / SendMessage / Monitor / EnterWorktree / ExitWorktree → write, ReadInbox / ListAgents and its
+     *  alias → read), each from the mounted tool's own declaration; this phase writes nothing into it by name. */
     toolEffects: Map<string, ToolEffect>;
     /** borrowed-mutable — the explicit-negative axis declarations. Writer here: the built-in SendMessage mount's `egress: false`
      *  (report-face only). */

package/dist/core/runner/prepare-delegation-surface.js

@@ -1,8 +1,9 @@
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
-import { listAgentsMountable, mountListAgents, peerLaneSendMessageSeats } from "../../agents/peer-session-drain.js";
+import { listAgentsMountable, mountListAgents, peerLaneSendMessageSeats, terminalsDrainPrincipalInbox } from "../../agents/peer-session-drain.js";
 import { resolvePeerLaneConfig } from "../../agents/peer-admission.js";
 import { createReadInboxTool, READ_INBOX_TOOL_NAME } from "../../agents/read-inbox-tool.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 import { createMonitorTool } from "../../tools/monitor.js";
 import { createWorktreeTools } from "../../tools/worktree.js";
 import { createTaskOutputTool, createTaskStopTool, defaultTaskRegistry } from "../task-registry.js";
@@ -12,9 +13,10 @@ import { deliverEngineNotice } from "../types.js";
 import { RosterBuilder } from "../tool-roster.js";
 import { sendMessageContinuationSeats } from "./send-message-continuation.js";
 export function prepareDelegationSurface(input) {
-    const { spec, deps, internals, resume, sessionId, hostTaskId, taskScope, taskRootFinal, taskRootCanonical, executionEnv, runnerSelf, backgroundTaskToolsActive, workflowToolsActive, peerLaneActive, peerSendMessageBuiltIn, peerLaneRefs, sessionBox, roster, toolEffects, axisExplicitNegatives, envHandToolNames, toolFaceSnapshot, firstPartyOffload, offloadStore, subagentRetain, enrichSpecToolCtx, checkpointSeat, handsCwdRef, wsSnapshot, rebaseWsPath, rebaseRestoredPath, workspaceStateSettle } = input;
+    const { spec, deps, internals, resume, sessionId, hostTaskId, taskScope, taskRootFinal, taskRootCanonical, executionEnv, runnerSelf, backgroundTaskToolsActive, workflowToolsActive, peerLaneActive, peerSendMessageBuiltIn, peerLaneRefs, sessionBox, roster, axisExplicitNegatives, envHandToolNames, toolFaceSnapshot, firstPartyOffload, offloadStore, subagentRetain, enrichSpecToolCtx, checkpointSeat, handsCwdRef, wsSnapshot, rebaseWsPath, rebaseRestoredPath, workspaceStateSettle } = input;
     let worktreeSessionRef;
     const delegationSurfaceActive = backgroundTaskToolsActive || workflowToolsActive;
+    const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
     let sendMessageTier;
     if (delegationSurfaceActive || internals?.parentNotify !== undefined || peerLaneActive) {
         if (delegationSurfaceActive) {
@@ -54,7 +56,7 @@ export function prepareDelegationSurface(input) {
                 ...(deps.backgroundAgentStore !== undefined ? { agentStore: deps.backgroundAgentStore } : {}),
                 ...(deps.mailboxStore !== undefined ? { mailbox: deps.mailboxStore } : {}),
                 ...(reviveSpawn !== undefined ? { reviveSpawn } : {}),
-                ...(peerLaneActive ? peerLaneSendMessageSeats({ peerDirectory: deps.peerDirectory, sessionId, scope: taskScope, ...(internals?.explicitAgentName !== undefined ? { name: internals.explicitAgentName } : {}), refs: peerLaneRefs, listingMounted: listAgentsMountable({ selector: toolFaceSnapshot.selector, specTools: spec.tools ?? [] }) }) : {}),
+                ...(peerLaneActive ? peerLaneSendMessageSeats({ peerDirectory: deps.peerDirectory, sessionId, scope: taskScope, ...(internals?.explicitAgentName !== undefined ? { name: internals.explicitAgentName } : {}), refs: peerLaneRefs, listingMounted: listAgentsMountable({ leaves, specTools: spec.tools ?? [] }) }) : {}),
                 onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
                 onTranscriptIntegrityGap: (handle, scope) => deliverEngineNotice(deps.onNotice, {
                     code: "delegation.transcript_integrity",
@@ -80,11 +82,10 @@ export function prepareDelegationSurface(input) {
             }
         }
     }
-    if (sessionBox !== undefined && internals?.onTaskNotification !== undefined && toolFaceSnapshot.selector.admits({ name: READ_INBOX_TOOL_NAME }) && !(spec.tools ?? []).some((t) => t.name === READ_INBOX_TOOL_NAME)) {
-        toolEffects.set(READ_INBOX_TOOL_NAME, "read");
-        roster.mount(firstPartyOffload(createReadInboxTool({ pull: () => peerLaneRefs.pull })), { source: "builtin", mountedBy: "peerLane" });
+    if (sessionBox !== undefined && internals?.onTaskNotification !== undefined && leaves({ name: READ_INBOX_TOOL_NAME }) && !(spec.tools ?? []).some((t) => t.name === READ_INBOX_TOOL_NAME)) {
+        roster.mount(firstPartyOffload(createReadInboxTool({ pull: () => peerLaneRefs.pull, ...(terminalsDrainPrincipalInbox(deps) ? { coversPrincipalInbox: true } : {}) })), { source: "builtin", mountedBy: "peerLane" });
     }
-    const listAgents = (peerLaneActive || delegationSurfaceActive) && peerSendMessageBuiltIn && listAgentsMountable({ selector: toolFaceSnapshot.selector, specTools: spec.tools ?? [] }) ? mountListAgents({ ...(peerLaneActive ? { peerDirectory: deps.peerDirectory } : {}), freshWindowMs: resolvePeerLaneConfig(deps.peerLane, deps.onNotice).listingFreshWindowMs, sessionId, scope: taskScope, hostTaskId, ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}), ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}), registry: defaultTaskRegistry, ...(deps.rosterStore !== undefined ? { roster: deps.rosterStore } : {}), ...(sendMessageTier !== undefined ? { continuationTier: sendMessageTier } : {}), ...(checkpointSeat !== undefined ? { readSeats: { checkpointSeat } } : {}), specTools: spec.tools ?? [], toolEffects }) : undefined;
+    const listAgents = (peerLaneActive || delegationSurfaceActive) && peerSendMessageBuiltIn && listAgentsMountable({ leaves, specTools: spec.tools ?? [] }) ? mountListAgents({ ...(peerLaneActive ? { peerDirectory: deps.peerDirectory } : {}), freshWindowMs: resolvePeerLaneConfig(deps.peerLane, deps.onNotice).listingFreshWindowMs, sessionId, scope: taskScope, hostTaskId, ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}), ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}), registry: defaultTaskRegistry, ...(deps.rosterStore !== undefined ? { roster: deps.rosterStore } : {}), ...(sendMessageTier !== undefined ? { continuationTier: sendMessageTier } : {}), ...(checkpointSeat !== undefined ? { readSeats: { checkpointSeat } } : {}), specTools: spec.tools ?? [] }) : undefined;
     if (listAgents !== undefined)
         roster.mount(firstPartyOffload(listAgents), { source: "builtin", mountedBy: "peerLane" });
     if (backgroundTaskToolsActive) {

package/dist/core/runner/prepare-execution-env.d.ts

@@ -20,8 +20,7 @@ export interface PrepareExecutionEnvInput {
     /** borrowed-readonly — the trusted spawn-side requests: the explicit cwd (a contract), the isolation
      *  request and the parent's cwd (both threaded to the factory ctx). */
     internals: Pick<RunInternals, "requestedCwd" | "isolation" | "parentCwd" | "callerRoot" | "worktreeOffered"> | undefined;
-    /** borrowed-readonly — the resume leg, read only to refuse an explicit cwd that a checkpoint workspace
-     *  restore would overrule. */
+    /** borrowed-readonly — the resume leg: read to refuse an explicit cwd a checkpoint restore would overrule, and to tell the factory which workspace it rebuilds. */
     resume: Pick<PrepareResume, "workspaceHandle"> | undefined;
     /** borrowed-readonly — the run tree's placement fixed point, resolved ONCE by the driver; the factory
      *  door refuses an empty value loudly before the factory is asked. */

package/dist/core/runner/prepare-execution-env.js

@@ -1,5 +1,5 @@
 import { StubExecutionEnv } from "../stub-env.js";
-import { hasDestroy } from "../remote-env.js";
+import { frozenHandleCopy, hasDestroy } from "../remote-env.js";
 import { announceMalformedCapabilities } from "./env-capability-census.js";
 import { childPlacementOnLeg, deploymentCanRerootChild, worktreeNotHonored } from "./child-tree.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
@@ -24,6 +24,7 @@ export async function prepareExecutionEnv(input) {
                 taskId: spec.taskId,
                 ...(internals?.isolation ? { isolation: internals.isolation } : {}),
                 ...(internals?.parentCwd ? { parentCwd: internals.parentCwd } : {}),
+                ...(resume?.workspaceHandle !== undefined ? { resumeWorkspace: frozenHandleCopy(resume.workspaceHandle) } : {}),
             })
             : undefined;
         if (ownedEnv !== undefined)

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -170,6 +170,8 @@ export interface PrepareGateStationsInput {
     /** borrowed-readonly — the leg's shell READ STATION (`ToolGateInput.shellReadCheck`), mounted by the hands phase, or
      *  undefined with no real shell: no station, nothing judged. */
     shellReadCheck: ShellReadCheck | undefined;
+    /** borrowed-readonly — the leg's cross-boundary seat (`ToolGateInput.crossBoundaryCheck`), or undefined on a leg whose station is not engaged. */
+    crossBoundaryCheck: import("../cross-boundary-taint.js").CrossBoundaryCheck | undefined;
     /** borrowed-readonly — the leg's resolved read face (`undefined` with no hands), read per call into the class derivation. */
     readFace: () => ContainmentFace | undefined;
     /** borrowed-readonly — the per-tool irreversibility tier handed to the gate per call. */

package/dist/core/runner/prepare-gate-stations.js

@@ -46,7 +46,7 @@ export function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, handsCwdRef, stampCallTarget, hookEnvFace, writeProtectionCheck, shellReadCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, frameSettlement, seatInputsFor, modBus, inheritedToolChecks } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, handsCwdRef, stampCallTarget, hookEnvFace, writeProtectionCheck, shellReadCheck, crossBoundaryCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, frameSettlement, seatInputsFor, modBus, inheritedToolChecks } = input;
     const releasesAnnounced = new Map();
     const onModeReleased = (info) => {
         const table = info.readUnestablished === true ? input.readDenyInForce(info.toolCallId) : undefined;
@@ -86,7 +86,8 @@ export function prepareGateStations(input) {
                 spec.enablePlanMode === true ||
                 complianceDenies.has("web_fetch") ||
                 writeProtectionArmed ||
-                shellReadCheck !== undefined;
+                shellReadCheck !== undefined ||
+                crossBoundaryCheck !== undefined;
         if (toolCallGateArmedRef.armed) {
             harness.on("tool_call", async (called) => {
                 const e = { ...called, toolName: rosterToolName(toolRosterDeltas.current, called.toolName) };
@@ -132,7 +133,7 @@ export function prepareGateStations(input) {
                         egress: heldBy("gate.egress", egressTools, call),
                         peerMessage: heldBy("gate.peerMessage", PEER_MESSAGE_NAMES, call),
                         ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
-                        ...(shellReadCheck !== undefined ? { shellReadCheck } : {}),
+                        ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(crossBoundaryCheck !== undefined ? { crossBoundaryCheck } : {}),
                         readFace,
                         irreversibility: tierSeat?.value,
                         reversibilityProbe: tierSeat?.read(reversibilityProbes),

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -88,7 +88,7 @@ export interface PrepareHandsReadFaceInput {
     /** borrowed-readonly — the task-spec seats this phase reads, as a Pick over the SAME spec object
      *  (R-4). `tools` feeds only the band shadow check; `envFacts` only the advertised scratchpad;
      *  `retainBackgroundProcesses` only the band's retain lane (Bash's lifetime sentence + row stamp). */
-    spec: Pick<TaskSpec, "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "handsReadOnly" | "readDenyPatterns" | "readFace" | "writeFace" | "oneShot" | "resumeAt" | "retainBackgroundProcesses" | "sessionId" | "tools">;
+    spec: Pick<TaskSpec, "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "handsReadOnly" | "readDenyPatterns" | "readFace" | "writeFace" | "oneShot" | "resumeAt" | "retainBackgroundProcesses" | "sessionId" | "tools" | "excludeAllTools">;
     /** borrowed-readonly — the deployment seats this phase reads, as a Pick over the SAME deps
      *  object (R-4: `deps.onError?.()` keeps its receiver; a new deps read must widen this Pick).
      *  `readDenyBuiltinTiers`/`readDenyBuiltinExclude` are SNAPSHOTTED before the first await that
@@ -260,8 +260,8 @@ export interface PrepareHandsReadFaceResult {
     grantReadRoot: GrantReadRoot | undefined;
     /** owned — the store cell {@link grantReadRoot} judges against; the driver threads it to its one writer, the Artifact phase. */
     artifactStoreRef: ArtifactStoreRef | undefined;
-    /** owned — the canonical containment root, published so the working-file ATTACHMENT
-     *  reader applies the same containment the hands tools do. Undefined ⇔ hands-less. */
+    /** owned — the canonical containment root, published so the compaction's kept-tail path
+     *  normalizer resolves the way the hands tools do. Undefined ⇔ hands-less. */
     attachmentRootCanonical: string | undefined;
     /** owned — the run's read deny table ({@link pathTables}' facade: the run's latest, `forCall` a call's own). Undefined ⇔
      *  hands-less (its consumers only exist with hands). */

package/dist/core/runner/prepare-hands-readface.js

@@ -21,6 +21,7 @@ import { RosterBuilder } from "../tool-roster.js";
 import { unionAddOnly } from "../child-clamp-seats.js";
 import { assertStringArraySeat } from "../read-face-seats.js";
 import { modePolicyOf } from "../mode-policy.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 const faceClampAnnouncedSinks = { read: new WeakSet(), write: new WeakSet() };
 const faceClampConsoleAnnounced = { read: false, write: false };
 function announceDeploymentFaceClamp(kind, sink) {
@@ -253,7 +254,7 @@ export async function prepareHandsMount(input) {
                     if (rk === undefined)
                         continue;
                     if ("content" in rec)
-                        seedReadFileStateFromTranscript(readFileState, rk, rec.content, rec.at);
+                        seedReadFileStateFromTranscript(readFileState, rk, rec.content, rec.at, rec.transmittedByToolCallId);
                     else
                         readFileState.set(rk, { ...rec.observation, lastReadAt: rec.at });
                 }
@@ -370,7 +371,7 @@ export async function prepareHandsMount(input) {
                 return memoryWriteGate?.(w);
             },
             mountBackgroundTaskTools: false,
-            monitorToolActive: backgroundTaskToolsActive && toolFaceSnapshot.selector.admits({ name: "Monitor" }),
+            monitorToolActive: backgroundTaskToolsActive && valveLeaves(spec, toolFaceSnapshot.selector)({ name: "Monitor" }),
         });
         {
             const bandNames = new Set(band.flatMap((t) => [t.name, ...(t.aliases ?? [])]));

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -70,6 +70,8 @@ export interface PrepareInheritedGateInput {
     deps: Pick<RunnerDeps, "autoMode" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "compliancePostureResolver" | "onError" | "onNotice" | "executionEnv" | "delegationEntryCaps" | "rosterStore" | "onBackgroundChildEvent" | "onQuestion">;
     /** borrowed-readonly — the run's approval seat as the config doors froze it: the frozen approver, and this leg's chain view. */
     askSeat: import("../wiring-manifest.js").AskSeat;
+    /** borrowed-readonly — the tree's cross-boundary token (the leg's lane: inherited, or minted by a root leg), handed to children. */
+    crossBoundaryTree: import("../cross-boundary-taint.js").CrossBoundaryTreeToken;
     /** borrowed-readonly — the trusted spawn-side channel: `inheritedGate` (the LIVE half of the chain fold), `ownOrgAdmissionRef`
      *  (the same-session continuation's freeze), `delegationProvenance` (the F-012 stamp), and the identity / peer / notification
      *  seats the ctx enrichment forwards. Never mutated. */

package/dist/core/runner/prepare-inherited-gate.js

@@ -14,6 +14,7 @@ import { SessionModeSeats } from "./session-mode-seats.js";
 import { recordedModeSeed } from "../checkpoint-store.js";
 import { frozenSkillGrants } from "../skill-grant.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 export function prepareInheritedGate(input) {
     const { spec, deps, askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, pathRuleAnchors, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
     const liveInheritedGate = internals?.inheritedGate;
@@ -192,8 +193,7 @@ export function prepareInheritedGate(input) {
     const fullShellReachable = handsEnabled &&
         !(executionEnv instanceof StubExecutionEnv) &&
         spec.handsReadOnly !== true &&
-        spec.excludeAllTools !== true &&
-        toolFaceSnapshot.selector.admits({ name: "Bash" });
+        valveLeaves(spec, toolFaceSnapshot.selector)({ name: "Bash" });
     const { gateStopRef, stopForDenialLimit } = createDenialLimitStop({ sessionId, runId, onNotice: deps.onNotice, abort: abortRun });
     const delegationEntryCapsResolved = resolveDelegationEntryCaps(deps.delegationEntryCaps);
     const enrichSpecToolCtx = (ctx) => {
@@ -246,6 +246,7 @@ export function prepareInheritedGate(input) {
             activeSkillGrants: () => skillGrants.records(),
             activeRequestAllowedTools: () => input.requestAllowedTools.entries(),
             inheritedGateForChildren,
+            crossBoundaryTreeForChildren: input.crossBoundaryTree,
             delegationProvenanceForChildren,
             delegationSettlement: delegationSettlementForChildren,
             ...(autoModeDecider ? { autoModeReview: { decider: autoModeDecider } } : {}),

package/dist/core/runner/prepare-listings.d.ts

@@ -5,7 +5,7 @@ import type { ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 export interface PrepareListingsInput {
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `tools` (the roster-bearing delegation tool, by its `agentListing`
      *  marker), `sessionId` (continuation ⇒ seeded/removal projections), `attachments` (the two opt-outs). Never mutated. */
-    spec: Pick<TaskSpec, "agents" | "tools" | "sessionId" | "attachments">;
+    spec: Pick<TaskSpec, "agents" | "tools" | "sessionId" | "attachments" | "excludeAllTools">;
     /** borrowed-readonly — the once-per-session ledger: its deduplicated operator sink (`onError`) and
      *  the whole announced snapshot (`arms()`) the mirror is seeded from. */
     onceLedger: AnnounceOnceSink & {

package/dist/core/runner/prepare-listings.js

@@ -1,17 +1,19 @@
 import { formatLocalDate } from "../../prompts/default.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { renderAgentListingDelta } from "./turn-attachments.js";
 export function prepareListings(input) {
     const { spec, onceLedger, sessionId, toolFaceSnapshot, activeTools, deferred, resume, skillsListing, listingBudget, listingRideRef, renderWithDate, envFacts, tzValid, userTz, dateAnchor } = input;
     const rosterBearingSpec = (spec.tools ?? []).find((t) => t.agentListing !== undefined && t.agentListing.length > 0);
+    const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
     const rosterFaceDeferred = rosterBearingSpec !== undefined &&
-        toolFaceSnapshot.selector.admits(rosterBearingSpec) &&
+        leaves(rosterBearingSpec) &&
         (toolFaceSnapshot.defer?.includes(rosterBearingSpec.name) ?? false) &&
         deferred.has(rosterBearingSpec.name) &&
         !activeTools.has(rosterBearingSpec.name);
     const agentListingSpec = rosterBearingSpec !== undefined &&
         !rosterFaceDeferred &&
-        toolFaceSnapshot.selector.admits(rosterBearingSpec)
+        leaves(rosterBearingSpec)
         ? rosterBearingSpec
         : undefined;
     const agentListing = agentListingSpec

package/dist/core/runner/prepare-memory-engine-session.d.ts

@@ -12,12 +12,8 @@
  * installs, which run at tool-call time), so the phase adds no yield between the deferred classification before it
  * and the prompt assembly after it (a stretch with no await is extracted as a sync function).
  * Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
- *
- * One read changed spelling and nothing else: the declared-class announcement read `mcp?.statuses` while `mcp` had
- * long been the protocol-tools phase's non-null handle; the optional chain was dead and is now the plain member read.
  */
 import type { LockedPreflight } from "../locked-config.js";
-import type { MaterializedMcp } from "../mcp.js";
 import { type DelegationContentSafety } from "../memory-engine/delegation-provenance.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { Prepared, RunInternals } from "./contracts.js";
@@ -40,8 +36,6 @@ export interface PrepareMemoryEngineSessionInput {
     lockedPreflight: Pick<LockedPreflight, "mcp">;
     /** borrowed-readonly — the run's MCP mount, read at call time (present iff the run declared a server): the children a delegation tool spawns inherit it, so its tools are rows of their pool. */
     mountedMcp?: () => import("../mounted-mcp.js").MountedMcp;
-    /** borrowed-readonly — the materialized MCP handle; only `statuses` (the announcement's mounted-tool count). */
-    mcp: Pick<MaterializedMcp, "statuses">;
     /** borrowed-readonly — the acquired session id (notice detail). */
     sessionId: string;
     /** borrowed-readonly — the run's invocation id (notice detail; the once-per-leg claims are per-RUN claims). */

package/dist/core/runner/prepare-memory-engine-session.js

@@ -1,5 +1,5 @@
 import { classifyToolContentOrigin, contentOriginPollutes, delegationCallIsExternal } from "../memory-engine/content-origin.js";
-import { mountedMcpPoolRows } from "../mounted-mcp.js";
+import { mountedMcpPoolRows, toolNamesOfServer } from "../mounted-mcp.js";
 import { narrowContentSafety, readCardAttestation } from "../memory-engine/delegation-provenance.js";
 import { recordSyncUnattestable, sessionSettlements } from "../memory-engine/delegation-settlement.js";
 import { protocolOf } from "../protocol-table.js";
@@ -7,9 +7,10 @@ import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { fileArgPath } from "../tool-registry.js";
 import { RosterBuilder } from "../tool-roster.js";
+import { isNotStartedDelegationResult } from "../../agents/subagent.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareMemoryEngineSession(input) {
-    const { memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mcp, mountedMcp, sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef } = input;
+    const { memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mountedMcp, sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef } = input;
     const tools = roster.tools;
     const delegationProvenanceChannel = internals?.delegationProvenance;
     if (memoryEngineSession !== undefined || delegationProvenanceChannel !== undefined) {
@@ -22,7 +23,7 @@ export function prepareMemoryEngineSession(input) {
         provenanceForChildrenRef.current = { trustedTools: [...trustedTools], execIsExternalContent };
         announceDeclaredMcpContentClasses({
             entries: lockedPreflight.mcp,
-            statuses: mcp.statuses,
+            mountedNames: roster.tools.map((t) => t.name),
             execIsExternalContent,
             sessionId,
             runId,
@@ -133,6 +134,9 @@ export function prepareMemoryEngineSession(input) {
                             isPolluting: poolToolPollutes,
                         });
                         const result = await inner(toolCallId, params, signal, onUpdate);
+                        const delivery = delegationDeliveryOf(result);
+                        if (delivery === "none")
+                            return result;
                         const att = readCardAttestation(result?.details);
                         if (att === "external") {
                             mark(`tool "${t.name}" returned the output of a delegated agent that invoked an external-content-class tool at runtime` +
@@ -141,8 +145,11 @@ export function prepareMemoryEngineSession(input) {
                         }
                         else if (att !== "clean") {
                             if (external) {
-                                const staticFaceReason = `tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
-                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)");
+                                const staticFaceReason = (delivery === "launched"
+                                    ? `tool "${t.name}" launched a background delegated agent whose tool face can reach external content`
+                                    : `tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content`) +
+                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)") +
+                                    (delivery === "launched" ? " — its output enters this session when it finishes" : "");
                                 if (!delegationEvidenceAttestedOnly) {
                                     mark(staticFaceReason, "static");
                                 }
@@ -207,13 +214,19 @@ export function prepareMemoryEngineSession(input) {
     }
     return { armed: memoryEngineSession !== undefined || delegationProvenanceChannel !== undefined };
 }
+function delegationDeliveryOf(result) {
+    if (isNotStartedDelegationResult(result))
+        return "none";
+    const details = typeof result === "object" && result !== null ? result.details : undefined;
+    return typeof details === "object" && details !== null && details.status === "async_launched" ? "launched" : "report";
+}
 function announceDeclaredMcpContentClasses(args) {
     for (const entry of args.entries ?? []) {
         const declaredClass = entry.contentOrigin;
         if (declaredClass === undefined)
             continue;
         const server = inlineUntrusted(String(entry.name), 160);
-        const toolCount = args.statuses?.find((s) => s.name === entry.name)?.toolNames?.length ?? 0;
+        const toolCount = toolNamesOfServer(args.mountedNames, entry.name).length;
         const resourceFaceCaveat = " (Not covered: the cross-server resource faces — ListMcpResourcesTool/ReadMcpResourceTool/ReadMcpResourceDirTool — stay externally classified and still mark.)";
         const posture = declaredClass === "local"
             ? `this server's mounted tools' invocations will not mark this session's memory as externally exposed.${resourceFaceCaveat}`

package/dist/core/runner/prepare-memory.d.ts

@@ -208,11 +208,12 @@ export interface PrepareMemoryResult {
      * BEFORE it). It performs the one destructive read this phase has — `inject()` drains the announcement queue —
      * so a hands-phase refusal cannot consume announcements a later prepare should deliver, and it takes the
      * roster-wide persistence verdict the driver can only read off the MOUNTED roster (`rosterCanPersist`: the
-     * `TaskSpec.memoryPersistenceCapable` declaration when set, else the known-store-path inference over the
-     * assembled tools). Call exactly once per prepare.
+     * `memoryPersistenceCapable` declaration when set, else the store-path inference over the assembled tools) and
+     * `isSubagent` (a non-fork delegated child — no user conversation, no not-mounted notice). Call once per prepare.
      */
     composeInjection: (facts: {
         rosterCanPersist: boolean;
+        isSubagent: boolean;
     }) => MemoryInjectionComposition;
     /**
      * The FROZEN org-admission verdict of this prepare: every org scope the task actually mounts

package/dist/core/runner/prepare-memory.js

@@ -6,7 +6,7 @@ import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir,
 import { memoryProjectScopeAbsentNotice, normalizeMemorySpec } from "../memory.js";
 import { deriveSupersededSet } from "../memory-engine/consolidation.js";
 import { shadowNamesOf } from "../memory-engine/shadowing.js";
-import { MEMORY_ANNOUNCEMENT_CAPTURE_OPTOUT_CODA, MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_CAPTURE_INDETERMINATE_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MemoryEngine, entryFileHeadCarriesOrigin, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, memoryConsolidationRecommendedNotice, memoryHarvestQuarantinedNotice, memoryHoldNotices, memoryRecallDisciplineSegment, memoryRestoreWithheldNotice, memorySessionPollutedNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
+import { MEMORY_ANNOUNCEMENT_CAPTURE_OPTOUT_CODA, MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_CAPTURE_OPTOUT_NOTICE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MemoryEngine, entryFileHeadCarriesOrigin, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, memoryConsolidationRecommendedNotice, memoryHarvestQuarantinedNotice, memoryHoldNotices, memoryRecallDisciplineSegment, memoryRestoreWithheldNotice, memorySessionPollutedNotice, memoryUnavailableNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
 import { adjudicateCaptureOptOut, captureOptOutDeniedError, captureOptOutUnpersistedError } from "./memory-capture-optout.js";
 import { readSessionCaptureOptOut } from "../memory-engine/layout.js";
 import { sessionIncarnationResolver } from "../memory-engine/session-incarnation.js";
@@ -14,6 +14,7 @@ import { createMemoryEngineTools } from "../memory-engine/tools.js";
 import { assertScopeContractPlacement, parseScopeKey, resolveProjectId } from "../memory-engine/scope-contract.js";
 import { FileMemoryEngineBackend } from "../memory-engine/file-backend.js";
 import { writableRootOf } from "../memory-engine/types.js";
+import { catalogText } from "../../prompt-assembly/catalog/index.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
 let undeclaredCapturePostureAnnounced = false;
 export async function prepareMemory(input) {
@@ -781,7 +782,7 @@ export async function prepareMemory(input) {
                 blockBody = [MEMORY_CAPTURE_OPTOUT_NOTICE, injection.index, injection.announceBlock].filter((s) => Boolean(s && s.trim())).join("\n\n");
             }
             else if (captureIndeterminate && facts.rosterCanPersist) {
-                blockBody = [MEMORY_CAPTURE_INDETERMINATE_NOTICE, injection.index, injection.announceBlock].filter((s) => Boolean(s && s.trim())).join("\n\n");
+                blockBody = [memoryUnavailableNotice({ what: "capture-record-unreadable", notesReadable: true }), injection.index, injection.announceBlock].filter((s) => Boolean(s && s.trim())).join("\n\n");
             }
             else if (!facts.rosterCanPersist && injection.instruction === "" && injection.readOnlyNotice === undefined) {
                 blockBody = blockBody.trim() ? `${MEMORY_READONLY_NOTICE}\n\n${blockBody}` : MEMORY_READONLY_NOTICE;
@@ -817,6 +818,9 @@ export async function prepareMemory(input) {
             if (memoryBlock !== undefined && injection.indexSeed !== undefined && facts.rosterCanPersist && !captureOptedOut && !captureIndeterminate)
                 seedFiles = [injection.indexSeed];
         }
+        else if (!facts.rosterCanPersist && !facts.isSubagent) {
+            memoryBlock = effectiveMemoryScopes?.reason === "mount-failed" ? memoryUnavailableNotice({ what: "mount-failed", notesReadable: false }) : catalogText("core/memory.no-persistent-store");
+        }
         return {
             memoryBlock,
             ...(recallDisciplineSegment !== undefined ? { recallDisciplineSegment } : {}),

package/dist/core/runner/prepare-offload-wrappers.d.ts

@@ -20,10 +20,10 @@ import type { ToolSelector } from "../tool-face.js";
 export interface PrepareOffloadWrappersInput {
     /** borrowed-readonly — the REBOUND spec (the config-doors result); read for the per-task coarse
      *  offload knob only. */
-    spec: Pick<TaskSpec, "toolResultThresholdChars">;
-    /** borrowed-readonly — the leg's compiled selector: an offloaded result is read back through the reader tool, so a leg whose selector
-     *  does not admit the reader (a sub-agent whose lists leave it out, a deployment that excludes it) offloads nothing — a preview that
-     *  sends the model to a tool it does not have is a dead end. */
+    spec: Pick<TaskSpec, "toolResultThresholdChars" | "excludeAllTools">;
+    /** borrowed-readonly — the leg's compiled selector, read through the valve (`valveLeaves`): an offloaded result is read back through the
+     *  reader tool, so a leg whose valve does not leave the reader (a sub-agent whose lists leave it out, a deployment that excludes it, a
+     *  run whose whole face is switched off) offloads nothing — a preview that sends the model to a tool it does not have is a dead end. */
     selector: Pick<ToolSelector, "admits">;
     /** borrowed-readonly — the deployment's coarse offload knob and its injected store (used AS-IS when
      *  present; a Runner-shared instance is viewed per task, see the body). */

package/dist/core/runner/prepare-offload-wrappers.js

@@ -1,5 +1,6 @@
 import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, InMemoryToolResultStore, OFFLOAD_TOOL_NAME, RunnerSharedToolResultStore, ScopedToolResultStore, withToolResultOffload, } from "../tool-result-store.js";
 import { faceOf } from "../tool-roster.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 const FIRST_PARTY_OFFLOAD_THRESHOLD_CHARS = 50_000;
 export function prepareOffloadWrappers(input) {
     const { spec, deps, resume, offloadScope, sessionId, selector } = input;
@@ -21,7 +22,7 @@ export function prepareOffloadWrappers(input) {
     };
     const explicitGlobalThreshold = spec.toolResultThresholdChars ?? deps.toolResultThresholdChars;
     const offloadThreshold = explicitGlobalThreshold ?? DEFAULT_TOOL_RESULT_THRESHOLD_CHARS;
-    const offloadEnabled = Number.isFinite(offloadThreshold) && offloadThreshold > 0 && selector.admits({ name: OFFLOAD_TOOL_NAME });
+    const offloadEnabled = Number.isFinite(offloadThreshold) && offloadThreshold > 0 && valveLeaves(spec, selector)({ name: OFFLOAD_TOOL_NAME });
     const rawOffloadStore = offloadEnabled ? (deps.toolResultStore ?? new InMemoryToolResultStore()) : undefined;
     const offloadStore = rawOffloadStore instanceof RunnerSharedToolResultStore
         ? new ScopedToolResultStore(rawOffloadStore, offloadScope)

package/dist/core/runner/prepare-park-ask.d.ts

@@ -20,7 +20,7 @@
  * closures, so the orchestrator grows no branch.
  */
 import type { AgentHarness, AgentMessage, AgentTool, ExecutionEnv } from "../../internal/harness.js";
-import type { CallTargetStamp } from "../effective-path-target.js";
+import { type CallTargetStamp } from "../effective-path-target.js";
 import { type OnQuestion } from "../ask-question.js";
 import { type CheckpointStore } from "../checkpoint-store.js";
 import type { GrantBindingOf } from "../skill-grant-binding.js";

package/dist/core/runner/prepare-park-ask.js

@@ -1,15 +1,17 @@
+import { callTargetReadingOf } from "../effective-path-target.js";
+import { approvalTargetsOf } from "../approval-object.js";
 import { uuidv7 } from "../../engine/session/uuid.js";
 import { Value } from "typebox/value";
 import { classifyQuestionOutcome, validateAskQuestions } from "../ask-question.js";
 import { hasBackgroundShell, sweepBackgroundShells, sweepRunBoundaryBackgroundShells } from "../background-shell.js";
-import { boundInputHashOf } from "../canonical-json.js";
+import { boundInputHashOf, exactBoundInputHashOf } from "../canonical-json.js";
 import { unencodableIn } from "../checkpoint-requirements.js";
 import { buildRiskDescriptor, debitLedger, encodeAtFidelity, mintCheckpointId, mintCheckpointToken, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { pauseOf } from "../pause-registry.js";
 import { askCarryRowMembers } from "../hooks.js";
 import { askMandateMember, ownedClearanceFacts } from "../ask-origin.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { advertisedWritableRootsSeat, exemptRootsSeat, isLiveApproverSeat, carriesBidiControls, describeThrown, ownArgs, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, exemptRootsSeat, isLiveApproverSeat, licenseCovers, carriesBidiControls, describeThrown, ownArgs, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
 import { InMemoryToolResultStore, ScopedToolResultStore, isVolatileOffloadStore } from "../tool-result-store.js";
 import { raceAbort, raceSettlementAgainstSignal } from "./abort-race.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
@@ -147,6 +149,9 @@ export function prepareParkAsk(input) {
                 const unencodable = unencodableIn(parkedArgs, "pendingAction.args");
                 if (unencodable !== undefined)
                     throw new ParkRefusal(`the arguments of "${req.toolName}" cannot be bound into the approval row's digest (${unencodable.kind} at ${unencodable.path}) — a durable approval row must hold an inert snapshot of exactly what a human approves and a resume executes`);
+                const parkedHash = exactBoundInputHashOf(parkedArgs);
+                if (parkedHash === undefined)
+                    throw new ParkRefusal(`the arguments of "${req.toolName}" hold a value no exact digest binds — no approval row can be bound to them`);
                 const projectionMovedArgs = backendFidelity !== "structured-clone" && !samePlainValue(parked.value, parkedArgs);
                 if (projectionMovedArgs && basePolicyForResumeEdit === undefined) {
                     throw new ParkRefusal(`the arguments of "${req.toolName}" change shape when stored by this checkpoint backend, and no policy is wired to re-adjudicate the stored shape ` +
@@ -306,6 +311,7 @@ export function prepareParkAsk(input) {
                         toolCallId: req.toolCallId,
                         toolName: req.toolName,
                         ...parkedToolIdentity(toolRosterDeltas.current, req.toolName), ...parkedToolFace(toolRosterDeltas.current, req),
+                        ...approvalTargetsOf(licenseCovers(parkedHash, req.args) ? callTargetReadingOf(req) : undefined),
                         args: parkedArgs,
                         ...(() => {
                             const p = approvalPreviewOf(req.toolName, parkedArgs);
@@ -320,7 +326,7 @@ export function prepareParkAsk(input) {
                         ...askMandateMember(clearanceFacts),
                         ...askCarryRowMembers(carry),
                         ...ruleOffersOf(req, parkedArgs, clearanceFacts),
-                        boundInputHash: boundInputHashOf(parkedArgs),
+                        boundInputHash: parkedHash,
                         ...grantBindingOf(req, parkedArgs),
                         batchToolCallIds,
                         completedCallIds,

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -46,7 +46,7 @@ export interface PreparePolicyChainInput {
     /** borrowed-readonly — the REBOUND spec. Read: `sessionId` / `principal` (the session-rule read and the lanes' identity),
      *  `durableApproval` / `checkpointStore` (the mandate-park facility test and the sandbox arming's park prerequisites), `taskId` (the late-ask observer's detail),
      *  `tools` (the names the caller mounted, for the name audit). Never mutated. */
-    spec: Pick<TaskSpec, "sessionId" | "principal" | "durableApproval" | "taskId" | "checkpointStore" | "tools">;
+    spec: Pick<TaskSpec, "sessionId" | "principal" | "durableApproval" | "taskId" | "checkpointStore" | "tools" | "excludeAllTools">;
     /** borrowed-readonly — the deployment seats: `sessionPolicyStore` (the rule reads),
      *  `permissionRuleStore` / `localOwnerRules` (the lanes and the offer factory), `onError` / `onNotice` (the advisories,
      *  the refusal disclosures, the late-ask observer), `tracer` (the admission and rule-store frames), `checkpointStore` (the park facility). Receiver preserved;