@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/runner/stream-settle-backstop.js

@@ -1,5 +1,5 @@
-import { errorCodeOf, thrownFailureOf } from "./terminal-account.js";
-import { reopenReasonOf, resumeStartupCauseOf } from "../resume-startup-cause.js";
+import { thrownFailureOf } from "./terminal-account.js";
+import { compensateUnstarted, reopenReasonOf, resumeStartupCauseOf, unstartedRowSentence } from "../resume-startup-cause.js";
 import { resumeDecisionWasNegative } from "./decide-continuation.js";
 import { drainForwardedFramesBeforeDone, forwardsSubagentEvents } from "./prepare-run-refs.js";
 import { hasDestroy } from "../remote-env.js";
@@ -13,23 +13,20 @@ export function streamSettleBackstop(input) {
     const onRunRejected = async (err) => {
         let { code, message, detail } = thrownFailureOf(err, thrownText(err));
         const reopenReason = reopenReasonOf(resumeStartupCauseOf(code));
-        const reopenable = resume !== undefined && resume.pendingActionStarted !== true && reopenReason !== undefined && !(resumeDecisionWasNegative(resume) && resume.decisionDelivered === true);
+        const reopenable = resume !== undefined && live.resultValue === undefined && resume.pendingActionStarted !== true && !(resumeDecisionWasNegative(resume) && resume.decisionDelivered === true);
         let reopenCommitted = false;
         let reopenStateUnknown = false;
-        if (reopenable && resume?.onEnvRestoreFailed) {
-            try {
-                await resume.onEnvRestoreFailed(reopenReason);
+        if (reopenable && resume !== undefined) {
+            const row = await compensateUnstarted(resume.reopenUnstarted, reopenReason);
+            if (row.kind === "reopened") {
                 reopenCommitted = true;
+                message = `${message} — ${unstartedRowSentence(row)}`;
             }
-            catch (reopenErr) {
+            else {
                 parentConstraintRegistry.delete(resume.cp.token);
                 const original = asThrownError(err);
-                const reopenMsg = thrownText(reopenErr);
-                const definitive = errorCodeOf(reopenErr) === "checkpoint.reopen_failed";
-                reopenStateUnknown = !definitive;
-                err = Object.assign(new Error(definitive
-                    ? `${reopenMsg} (original resume failure: ${original.message})`
-                    : `checkpoint reopen threw mid-flight — state UNKNOWN, confirm via the checkpoint store before retrying: ${reopenMsg} (original resume failure: ${original.message})`, { cause: original }), { code: "checkpoint.reopen_failed" });
+                reopenStateUnknown = row.kind === "unknown";
+                err = Object.assign(new Error(`${original.message} — ${unstartedRowSentence(row)}`, { cause: original }), { code: "checkpoint.reopen_failed" });
                 const replacement = thrownFailureOf(err, thrownText(err));
                 code = replacement.code;
                 message = replacement.message;
@@ -38,7 +35,7 @@ export function streamSettleBackstop(input) {
         }
         if (resume)
             locallyClaimedTokens.delete(resume.cp.token);
-        if (resume && !reopenCommitted) {
+        if (resume && !reopenCommitted && live.resultValue === undefined) {
             parentConstraintRegistry.delete(resume.cp.token);
             await settleTeardownLeg(() => sessions.unpin?.(resume.cp.sessionId), "sessions.unpin (resume-failure leg)", (e) => runner.deps.onError?.(e, { phase: "config", sessionId: resume.cp.sessionId }));
             if (!reopenStateUnknown) {
@@ -74,7 +71,7 @@ export function streamSettleBackstop(input) {
             sessionId: taskIdRef.sessionId ?? "unknown",
             ...(taskIdRef.runId !== undefined ? { runId: taskIdRef.runId } : {}),
             terminal: { kind: "failed", ...(code !== undefined ? { code } : {}), message, ...(detail !== undefined ? { detail } : {}) },
-            result: "",
+            result: "", resultEntryIds: [],
             ...(remoteEnvFailure !== undefined ? { remoteEnvFailures: remoteEnvFailure } : {}),
             ...(taskIdRef.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: taskIdRef.effectiveMemoryScopes } : {}),
             ...(taskIdRef.effectiveReasoning !== undefined ? { effectiveReasoning: taskIdRef.effectiveReasoning } : {}),

package/dist/core/runner/sub-agent-deny-lists.d.ts

@@ -36,7 +36,7 @@
 import type { AgentTool } from "../../internal/harness.js";
 import { valveLeaves } from "../../agents/tool-filter.js";
 import { type ProtocolId } from "../protocol-table.js";
-import type { ToolLegKind, ToolSelectorLayer } from "../tool-face.js";
+import type { ToolLegKind, ToolSelector, ToolSelectorLayer } from "../tool-face.js";
 import { type ConstraintChainEntry } from "../tool-policy.js";
 import type { TaskSpec } from "../types.js";
 import type { CheckpointErrorReason } from "../checkpoint-store.js";
@@ -87,6 +87,27 @@ export type PersistedToolFaceReason = Extract<CheckpointErrorReason, "not_a_list
  * leg's roster and a sink; the leg's own policy-name audit is what reads them.
  */
 export declare function deniedToolNamesOf(where: string, value: unknown): string[];
+/**
+ * Whose lists a run's own layer are, in the words every sentence about them uses: the delegation tool (and agent definition) that wrote
+ * them when the run records one (`RunInternals.ownToolLists`), else `undefined` — the run's own `TaskSpec` seats.
+ */
+export declare function ownListsWhereOf(ownBy: RunInternals["ownToolLists"]): string | undefined;
+/**
+ * THE build of a leg's tool selector: `layers` are the ceiling it was spawned under, then its own lists (the last is its own), and
+ * `legs` the kinds of leg it is. Every layer is read by the one layer reader ({@link readSelectorLayer}), once, whoever judged it and
+ * whatever evidence the run carries — a live ceiling and the run's own lists were judged by the engine that wrote them, which may have
+ * read what this one cannot (a list that is not one, a member that is not a string, an entry no rule syntax reads), so the leg does not
+ * start without a layer that says something. The selector is compiled from what was read, never from the layers again: a getter that
+ * answers differently the second time is not asked a second time, and the selector's layers (handed to the leg's children as their
+ * ceiling) are the frozen product. Built before anything reads it, and before the session is acquired, so a refusal needs nothing given
+ * back. `where` is whose lists the own layer is ({@link ownListsWhereOf}). (A ceiling a resumed row restored was read by the same reader
+ * before the claim — `persistedToolNamesRefusal`.)
+ */
+export declare function readToolSelector(input: {
+    readonly layers: readonly unknown[];
+    readonly where: string | undefined;
+    readonly legs: readonly ToolLegKind[];
+}): ToolSelector;
 /**
  * THE read-back of the tool names a checkpoint row carries, before the claim: the ceiling the resumed leg will run under when it is
  * the row's (`ceiling`: absent when a live seat hands one) — each layer read by {@link readSelectorLayer} as a recorded layer — and
@@ -141,8 +162,9 @@ export interface RunToolListsInput {
         readonly allow: readonly string[] | undefined;
         readonly exclude: readonly string[] | undefined;
     };
-    /** borrowed-readonly — every layer of the run's selector (the ceiling, then its own) and the kinds of leg it is. */
-    layers: readonly ToolSelectorLayer[];
+    /** borrowed-readonly — the run's selector, as {@link readToolSelector} built it: every layer of it (the ceiling, then its own) already read, and judged here as read. */
+    selector: ToolSelector;
+    /** The kinds of leg the run is (the ones the selector was built for). */
     legs: readonly ToolLegKind[];
     /** True ⇔ the spawning run's prepare judged exactly these own lists where they were mounted, against a pool it could list (as the
      *  child-facing lists of the delegation tool or definition that wrote them) — the evidence digest it handed down (live, or recorded

package/dist/core/runner/sub-agent-deny-lists.js

@@ -6,7 +6,7 @@ import { ENGINE_TOOLS } from "../tool-catalog-entries.js";
 import { callerToolNameProblem } from "../caller-tool-name.js";
 import { mintNamespacePrefix } from "../protocol-naming.js";
 import { PROTOCOL_TABLE, protocolOf } from "../protocol-table.js";
-import { mountedToolNames, splitNamespacedName, wholeProtocolOf } from "../tool-name-aliases.js";
+import { grantWildcardRefusalOf, mountedToolNames, splitNamespacedName } from "../tool-name-aliases.js";
 import { projectionToolNames } from "../tool-policy.js";
 import { declaredDelegationNameOf } from "../delegation-name.js";
 export function renamedDelegationMountSentence(...rosters) {
@@ -97,9 +97,6 @@ function readableToolNameList(where, side, value, code) {
             throw refused(notAStringSentence(where, side, index, read.type), code, "not_a_string");
         if (read.kind === "unreadable")
             throw grammarRefusal(where, side, { entry: read.entry, reason: "grammar" }, code);
-        if (side === "denied" && read.name === "*") {
-            throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: a denied list has no wildcard — the entry would hide nothing. To give the agent no tools, write an empty allowed list.`, code, "unsupported_pattern");
-        }
         return { entry: entry, name: read.name, content: read.content };
     });
 }
@@ -117,11 +114,11 @@ function judgeToolNameList(where, side, value, universe, advise, code) {
         const content = side === "denied" && written;
         const reach = side === "denied" ? readDeniedToolList([entry]) : (readAllowedToolList([entry]) ?? readDeniedToolList([]));
         const split = splitNamespacedName(name);
-        const whole = wholeProtocolOf(name);
-        if (whole !== undefined) {
+        const toolSplit = splitNamespacedName(toolName);
+        if (toolName.includes("*") && (toolSplit === undefined || toolSplit.peer.includes("*"))) {
             if (side === "denied")
                 continue;
-            throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: an allowed list has no protocol-wide form — name a peer (\`${whole.prefix}<peer>\`) or one of its tools (\`${whole.prefix}<peer>__<tool>\`).`, code, "unsupported_pattern");
+            throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: ${grantWildcardRefusalOf(name)}.`, code, "unsupported_pattern");
         }
         const { inert } = compileAllowList([toolName], "deny", universe.known);
         const flaw = inert[0] === undefined ? undefined : { ...inert[0], entry, ...(inert[0].reason === "near_miss" && inert[0].currentName !== undefined ? { carriedBy: universe.carrierOf(inert[0].currentName) } : {}) };
@@ -153,14 +150,31 @@ function readSelectorLayer(layer, layerWhere, listWhere, recorded) {
     if (!isToolSelectorLayer(layer)) {
         throw refused(`${layerWhere} are a value that is ${valueTypeLabel(layer)}, not a pair of tool-name lists (an allowed and a denied list) — the leg does not start. Fix the layer.`, "config.tool_face_control", "not_a_list");
     }
+    const lists = {};
     for (const side of ["allowed", "denied"]) {
         const where = listWhere(side);
-        const entries = readableToolNameList(where, side, side === "allowed" ? layer.allow : layer.deny, "config.tool_face_control");
+        const value = side === "allowed" ? layer.allow : layer.deny;
+        const entries = readableToolNameList(where, side, value, "config.tool_face_control");
         const written = recorded ? entries.find((read) => !isCanonicalToolName(read.entry)) : undefined;
         if (written !== undefined) {
             throw refused(`${where} declares ${renderListEntry(written.entry)} in its ${LIST_WORD[side]}: a row records each tool name in its bare spelling (\`Read\`, never \`Read()\`, \`Read(*)\` or \`Read(…)\`), and this entry was recorded by an engine that read the list otherwise — it is read here neither as that engine read it nor as this one would`, "config.tool_face_control", "unsupported_pattern");
         }
+        if (value !== undefined && value !== null)
+            lists[side] = Object.freeze(entries.map((read) => read.entry));
     }
+    return Object.freeze({ ...(lists.allowed !== undefined ? { allow: lists.allowed } : {}), deny: lists.denied ?? Object.freeze([]) });
+}
+export function ownListsWhereOf(ownBy) {
+    return ownBy !== undefined ? delegationListWhere(ownBy.toolName, ownBy.definition) : undefined;
+}
+export function readToolSelector(input) {
+    const layers = [...input.layers];
+    const ceilings = layers.length - 1;
+    const read = layers.map((layer, i) => {
+        const inherited = i === ceilings ? undefined : inheritedListsWhere(ceilings, i);
+        return readSelectorLayer(layer, inherited ?? "this run's own tool lists", (side) => inherited ?? input.where ?? (side === "allowed" ? "TaskSpec.allowTools" : "TaskSpec.excludeTools"), false);
+    });
+    return compileToolSelector(read, input.legs);
 }
 function ownToolListsFlaw(value) {
     try {
@@ -258,14 +272,9 @@ export function judgeRunToolLists(input) {
         catch {
         }
     };
-    const ownWhere = input.ownBy !== undefined ? delegationListWhere(input.ownBy.toolName, input.ownBy.definition) : undefined;
-    const ceilings = input.layers.length - 1;
-    input.layers.forEach((layer, i) => {
-        const own = i === ceilings;
-        const inherited = own ? undefined : inheritedListsWhere(ceilings, i);
-        readSelectorLayer(layer, inherited ?? "this run's own tool lists", (side) => inherited ?? ownWhere ?? (side === "allowed" ? "TaskSpec.allowTools" : "TaskSpec.excludeTools"), false);
-    });
-    const denied = deniedProtocolTools(input.layers, input.legs);
+    const ownWhere = ownListsWhereOf(input.ownBy);
+    const selector = input.selector;
+    const denied = deniedProtocolTools(selector.layers, input.legs);
     if (denied.length > 0) {
         const names = [...new Set(denied.map((h) => `"${h.name}"`))];
         const one = names.length === 1;
@@ -276,7 +285,6 @@ export function judgeRunToolLists(input) {
         const by = [...deniedBy(true, ownWhere ?? "this run's own excludeTools"), ...deniedBy(false, "an inherited list (the spawning run's excludeTools, or one it inherits)")];
         throw refused(`This kind of leg (${input.legs.join(", ")}) relies on ${names.join(", ")}, but ${by.join(" and ")} — the leg cannot work without ${one ? "it" : "them"}. Remove the entry from the list that names it.`, "config.tool_face_control", "protocol_denied");
     }
-    const selector = compileToolSelector(input.layers, input.legs);
     const pool = delegationPoolReading(spec.tools ?? [], valveLeaves(spec, selector));
     const mounted = mountedToolNames([...tools, ...(spec.tools ?? [])]);
     if (!input.judgedUpstream) {

package/dist/core/runner/synthetic-tools.d.ts

@@ -58,6 +58,12 @@ export declare const SKILL_TOOL_NAME = "Skill";
  *  an oversized skill is excluded from the disclosure block and the tool, with an operator-visible config error. The compaction-time retention caps are a
  *  different door, deliberately. */
 export declare const SKILL_CONTENT_MAX_CHARS: number;
+/** The skills a leg LOADS — those the load gate above passes ({@link skillLoadReading}, the one predicate): the skills whose
+ *  hooks the leg's mods admission takes, as the roster's filter (which also reports each one it excludes) takes the same. */
+export declare function skillsThatLoad<T extends {
+    readonly content: string;
+    readonly baseDir?: unknown;
+}>(skills: readonly T[] | undefined): T[];
 /** Total per-invoke cap for a skill's inlined attachments (`SkillSpec.files`) — an ATTACHMENT-face budget, distinct from the (gone) body truncation door:
  *  the body is delivered untruncated at invoke time (CC parity), while attachments ride along bounded and truncation-disclosed. */
 export declare const SKILL_ATTACHMENTS_MAX_CHARS = 50000;

package/dist/core/runner/synthetic-tools.js

@@ -4,7 +4,7 @@ import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-
 import { SKILL_LISTING_DEFAULT_BUDGET, SKILL_LISTING_DESC_MAX_CHARS_DEFAULT } from "../skill-listing-budget.js";
 import { readSkillTable, skillNamedBy } from "../skill-grant.js";
 import { OUTPUT_TOOL_NAME, mountRuleFace, toolFace } from "../tool-catalog-entries.js";
-import { substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
+import { skillLoadReading, substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
 import { readSkillsSeat } from "./skills-seat.js";
 import { foldListingWithin } from "./listing-fold.js";
 export const REPORT_BLOCKED_TOOL_NAME = "ReportBlocked";
@@ -90,6 +90,9 @@ export function createReportFindingsTool() {
 }
 export const SKILL_TOOL_NAME = "Skill";
 export const SKILL_CONTENT_MAX_CHARS = 1024 * 1024;
+export function skillsThatLoad(skills) {
+    return (skills ?? []).filter((s) => skillLoadReading(s, SKILL_CONTENT_MAX_CHARS).loads);
+}
 export const SKILL_ATTACHMENTS_MAX_CHARS = 50_000;
 export const SKILL_ATTACHMENT_PATH_MAX_CHARS = 512;
 const SKILL_FILES_LIST_MAX_CHARS = 200;

package/dist/core/runner/teardown-bounded.d.ts

@@ -27,6 +27,7 @@
 export declare const TEARDOWN_LEG_MAX_MS = 15000;
 /** Test hook (fs-atomic TxnLockTimings precedent): shrink the budget so wedge pins need no real 15s. */
 export declare function setTeardownLegBudgetForTests(ms: number | undefined): void;
+export declare const teardownLegBudget: () => number;
 /** The typed timeout incident — `leg` names the site so a leak is attributable from the report alone. */
 export declare class TeardownLegTimeoutError extends Error {
     readonly leg: string;

package/dist/core/runner/teardown-bounded.js

@@ -4,6 +4,7 @@ let teardownLegBudgetMs = TEARDOWN_LEG_MAX_MS;
 export function setTeardownLegBudgetForTests(ms) {
     teardownLegBudgetMs = ms ?? TEARDOWN_LEG_MAX_MS;
 }
+export const teardownLegBudget = () => teardownLegBudgetMs;
 export class TeardownLegTimeoutError extends Error {
     leg;
     constructor(leg, budgetMs) {

package/dist/core/runner/tool-disclosure.d.ts

@@ -64,20 +64,18 @@ export declare function buildDeferredRegistry(deferred: ReadonlySet<string>, too
  * validation, not activation state: a call whose arguments validate against the REAL tool's
  * declared schema runs the real tool directly (activation is only about whether the model has
  * been SHOWN the schema, never an execution gate). Governance cannot be laundered through this
- * lane: policy/effect/irreversibility gates key on the tool NAME maps built from the real
- * declarations, and the engine's approval pipeline runs before any execute — the placeholder
- * object on the harness list plays no part in adjudication.
+ * lane: the gate judges the call before any execute, and the call runs the one mounted instance its
+ * placeholder stands for — the harness resolves a call to its placeholder before the gate, as it
+ * resolves any call to its tool, so what runs is fixed before anything is judged.
  */
 export interface PlaceholderDirectCall {
     /**
-     * Resolve the real tool AT CALL TIME, never from a prepare-time snapshot. The mounted
-     * roster is a LIVE array: an MCP refresh splices a server's name domain out and pushes freshly
-     * materialized tool objects back in, so a Map captured when the placeholder was built would hand
-     * this lane the WITHDRAWN object (stale schema shape gate, stale transport client) long after the
-     * roster moved on. Returns `undefined` when the name no longer resolves — a withdrawn name has no
-     * direct lane, and the caller falls back to the teaching rejection.
+     * The mounted instance this placeholder stands for, bound when the placeholder is minted for it (one
+     * placeholder per instance; a refresh that replaces the instance mints a new placeholder for the new
+     * one). Never re-resolved by name: a call the gate judged while a refresh landed runs the instance it
+     * was resolved to, whose own checks answer a declaration that changed meanwhile.
      */
-    resolveReal: () => PlaceholderDirectTarget | undefined;
+    real: PlaceholderDirectTarget;
     /**
      * The scheduling declaration this placeholder carries while it stands in for the real
      * tool. Mirrors the REAL tool's own `executionMode` (see the mirror rationale in
@@ -91,7 +89,7 @@ export interface PlaceholderDirectCall {
      * schema it hands back actually lives (this result only, versus this result AND every later
      * request's tools block). Absent ⇒ the swap posture.
      *
-   * A FUNCTION, evaluated per call, for the same reason `resolveReal` is: the answer is not
+   * A FUNCTION, evaluated per call: the answer is not
      * a prepare-time constant. The run-wide strategy is, but the per-tool exemption on top of it reads
      * the LIVE roster — an MCP refresh can replace a tool with a declaration that no longer fits the
      * result-text carrier (or one that now does), and a boolean captured when the placeholder was built
@@ -113,7 +111,7 @@ export interface PlaceholderDirectCall {
      */
     activate: () => Promise<string | undefined>;
 }
-/** The live view of the real tool behind a placeholder, resolved per call (see {@link PlaceholderDirectCall.resolveReal}). */
+/** The real tool behind a placeholder (see {@link PlaceholderDirectCall.real}). */
 export interface PlaceholderDirectTarget {
     /** The REAL tool's declared parameter schema — the shape gate for a direct call. */
     parameters: TSchema;

package/dist/core/runner/tool-disclosure.js

@@ -93,9 +93,7 @@ export function createPlaceholderTool(info, direct) {
             parameters: EMPTY_PARAMS,
             ...(direct.executionMode !== undefined ? { executionMode: direct.executionMode } : {}),
             execute: async (toolCallId, params, signal, onUpdate) => {
-                const real = direct.resolveReal();
-                if (real === undefined)
-                    return teachingRejection();
+                const { real } = direct;
                 if (Value.Check(real.parameters, params)) {
                     lastFailureShape = undefined;
                     repeats = 0;

package/dist/core/runner/tool-end-body.d.ts

@@ -95,7 +95,7 @@ export interface SettledOccurrence extends Pick<OccurrenceEnd, "notExecuted"> {
  * The END projection — the ONE mint of `tool_end`, for every station that closes a call: the live loop's
  * `tool_execution_end`, the resumed leg's resolution, an interrupted run's reconcile and the reconcile replayed at
  * the next process start. It reads the occurrence and nothing else: `gate` is its latest gate record, `isError` is
- * the tool's bit or the refusal that record names, and `notExecuted` rides on positive evidence only: the station's own or `refusedBeforeRelease` (returned for the rows).
+ * the tool's bit or the refusal that record names, and `notExecuted` rides on positive evidence only: the station's own or `neverExecuted` (returned for the rows).
  *
  * A call whose start never went out on this stream (a call the loop never reached, a call announced by a dead
  * process) gets its start minted here first, marked `recovered` and carrying the input the closing station holds —

package/dist/core/runner/tool-end-body.js

@@ -1,6 +1,6 @@
 import {} from "../../internal/harness.js";
-import { readMember } from "../thrown-value.js";
-import { refusedBeforeRelease } from "./tool-not-executed.js";
+import { isPlainRecord } from "../mods/kernel/receive.js";
+import { neverExecuted } from "./tool-not-executed.js";
 import { MCP_DELIVERY_VERDICTS } from "../mcp-failure.js";
 import { closeNeverExecuted } from "../session-reconcile.js";
 import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
@@ -38,11 +38,12 @@ export function batchResponseDigest(result) {
 export function toolEndBodyFrom(result, isError, leg, gate, gatedCallIdOfRun) {
     const o = toolOutputFrom(result, leg.mediaByteCapBytes);
     const st = leg.structured(result);
-    const det = isError ? readMember(result, "details") : undefined;
-    const codeRaw = readMember(det, "code");
-    const kindRaw = readMember(det, "errorKind");
+    const det = isError ? result?.details : undefined;
+    const card = isPlainRecord(det) ? det : undefined;
+    const codeRaw = card?.code;
+    const kindRaw = card?.errorKind;
     const code = typeof codeRaw === "string" ? codeRaw : typeof kindRaw === "string" ? kindRaw : undefined;
-    const deliveredRaw = readMember(det, "delivered");
+    const deliveredRaw = card?.delivered;
     const delivered = typeof deliveredRaw === "string" && MCP_DELIVERY_VERDICTS.includes(deliveredRaw) ? deliveredRaw : undefined;
     const gatedCallId = code === "gate.parked" ? gatedCallIdOfRun : undefined;
     return {
@@ -54,7 +55,7 @@ export function toolEndBodyFrom(result, isError, leg, gate, gatedCallIdOfRun) {
         ...(gate !== undefined ? { gate } : {}),
     };
 }
-const startFrameOf = (o, recovered) => ({ type: "tool_start", toolCallId: o.toolCallId, toolName: o.spelledName, ...(o.label !== undefined ? { label: o.label } : {}), args: o.args, ...(recovered ? { recovered: true } : {}) });
+const startFrameOf = (o, recovered) => ({ type: "tool_start", toolCallId: o.toolCallId, toolName: o.spelledName, ...(o.label !== undefined ? { label: o.label } : {}), args: o.args, ...(recovered ? { recovered: true } : {}), ...(o.requestedBy !== undefined ? { requestedBy: o.requestedBy } : {}) });
 export function announceToolCall(table, start, frames) {
     table.open(start);
     frames.push(startFrameOf(start, false));
@@ -65,7 +66,7 @@ export function emitSettled(table, start, end, frames) {
     if (!occ.startEmitted)
         frames.push(startFrameOf(occ, true));
     const gate = occ.gateRounds.at(-1);
-    const isError = end.isError || gate?.disposition.kind === "denied", notExecuted = end.notExecuted === true || refusedBeforeRelease(occ);
+    const isError = end.isError || gate?.disposition.kind === "denied", notExecuted = end.notExecuted === true || neverExecuted(occ);
     table.close(occ.toolCallId, end.interrupted === true ? "interrupted" : "settled");
     frames.push({
         type: "tool_end",
@@ -75,7 +76,7 @@ export function emitSettled(table, start, end, frames) {
         isError,
         ...toolEndBodyFrom(end.result, isError, frames, gate, end.gatedCallIdOfRun),
         ...(gate?.disposition.kind === "denied" && occ.wireName !== undefined ? { wireName: occ.wireName } : {}),
-        ...(notExecuted ? { notExecuted: true } : {}),
+        ...(notExecuted ? { notExecuted: true } : {}), ...(occ.answeredInPlaceBy !== undefined ? { answeredBy: occ.answeredInPlaceBy } : {}), ...(occ.requestedBy !== undefined ? { requestedBy: occ.requestedBy } : {}),
     });
     return { ...(gate !== undefined ? { gate } : {}), isError, ...(notExecuted ? { notExecuted: true } : {}) };
 }

package/dist/core/runner/tool-not-executed.d.ts

@@ -4,9 +4,14 @@ import type { ToolOccurrence } from "./tool-occurrence.js";
  *  release, by a station inside the execution, is not). A call whose start this stream never carried (a recovered
  *  one, closed by a station that knows only its own class) is not read here. */
 export declare function refusedBeforeRelease(occ: Pick<ToolOccurrence, "life" | "gateRounds" | "startEmitted">): boolean;
+/** The one reading of the engine's positive evidence that a call never ran: refused before it was let go
+ *  ({@link refusedBeforeRelease}), or answered in place of its body by an extension at `tool.call` (the body was never called). */
+export declare function neverExecuted(occ: Pick<ToolOccurrence, "life" | "gateRounds" | "startEmitted" | "answeredInPlaceBy">): boolean;
 /** `details` as a persisted `toolResult` row carries it: `notExecuted` is the ENGINE's key — the settlement's fact when it holds,
  *  absent otherwise, whatever a tool wrote under that name. Returns `details` itself unless the key has to move; never mutates it. */
 export declare function rowDetailsOf(details: unknown, notExecuted: boolean): unknown;
+/** The persisted row's mark: the call this `toolResult` row closes never ran (the key {@link rowDetailsOf} writes). */
+export declare function rowNotExecuted(details: unknown): boolean;
 /** A row the resumed leg mints (`toolResultMsg`) with the settlement's fact on it. */
 export declare function withRowNotExecuted<T extends object>(row: T, notExecuted: boolean): T;
 /** Write the end projection's one `notExecuted` onto the result the live loop persists as the call's row: the loop builds that message

package/dist/core/runner/tool-not-executed.js

@@ -2,6 +2,9 @@ import { readOwnMembers } from "../thrown-value.js";
 export function refusedBeforeRelease(occ) {
     return occ.life === "announced" && occ.startEmitted && occ.gateRounds.at(-1)?.disposition.kind === "denied";
 }
+export function neverExecuted(occ) {
+    return refusedBeforeRelease(occ) || occ.answeredInPlaceBy !== undefined;
+}
 export function rowDetailsOf(details, notExecuted) {
     const carries = (() => { try {
         return details !== null && typeof details === "object" && !Array.isArray(details) && Object.keys(details).includes("notExecuted");
@@ -18,6 +21,14 @@ export function rowDetailsOf(details, notExecuted) {
         delete bag["notExecuted"];
     return bag;
 }
+export function rowNotExecuted(details) {
+    try {
+        return details !== null && typeof details === "object" && details.notExecuted === true;
+    }
+    catch {
+        return false;
+    }
+}
 export function withRowNotExecuted(row, notExecuted) {
     return notExecuted ? { ...row, details: rowDetailsOf(undefined, true) } : row;
 }

package/dist/core/runner/tool-occurrence.d.ts

@@ -42,6 +42,8 @@ export interface OccurrenceStart {
     readonly label?: string;
     /** The arguments the start frame carries (for a recovered start: the call's own input as the transcript holds it). */
     readonly args: unknown;
+    /** An extension's own call (`$.tool.call`): who asked for it — the frames carry it. Absent for a call a model message carried. */
+    readonly requestedBy?: import("../task-event.js").ExtensionRequester;
 }
 /** The record, as its readers see it. Written only through {@link ToolOccurrenceTable}. */
 export interface ToolOccurrence extends OccurrenceStart {
@@ -63,6 +65,9 @@ export interface ToolOccurrence extends OccurrenceStart {
     /** The heartbeat covers it. Cleared when the loop leaves the call behind at a turn end with no end of its own:
      *  the record stays (a later settlement must still know its start frame went out) but no beat describes it. */
     readonly beating: boolean;
+    /** An extension at `tool.call` answered for the call in place of its body — its result, or its refusal — and named here:
+     *  the body was never called (positive evidence the call did not run). Absent: no station answered in its place. */
+    readonly answeredInPlaceBy?: string;
 }
 /** The table of one leg's occurrences — the record's only writer. */
 export interface ToolOccurrenceTable {
@@ -86,6 +91,9 @@ export interface ToolOccurrenceTable {
     /** A station after the gate refused the call: one more gate record, minted as a veto of whatever the latest one
      *  settled (a person's yes stays on the settlement; the refusing layer is the disposition). Returns the record. */
     refuse(toolCallId: string, layer: DeniedBy): GateOutcome;
+    /** An extension at `tool.call` answered for the call before its body was called (the kernel's record says the body had
+     *  not started): the body is never called for this attempt. Once per attempt; a second is an engine defect. */
+    answeredInPlace(toolCallId: string, by: string): void;
     /** An ask for this call is put to the person: the count rises, and the returned `resumeFromUser` lowers it once
      *  (a second call is a no-op). The pair is bound to THIS attempt — a return after the call ended, or after a
      *  reused id re-opened, touches nothing — and an ask for a call this leg does not hold counts nothing: the wait

package/dist/core/runner/tool-occurrence.js

@@ -21,6 +21,7 @@ export function createToolOccurrenceTable() {
             ...(start.wireName !== undefined ? { wireName: start.wireName } : {}),
             ...(start.label !== undefined ? { label: start.label } : {}),
             args: start.args,
+            ...(start.requestedBy !== undefined ? { requestedBy: start.requestedBy } : {}),
             attempt,
             life: "announced",
             awaitingUser: 0,
@@ -96,6 +97,12 @@ export function createToolOccurrenceTable() {
             occ.gateRounds.push(round);
             return round;
         },
+        answeredInPlace(toolCallId, by) {
+            const occ = held(toolCallId, "an answer in place of the body");
+            if (occ.answeredInPlaceBy !== undefined)
+                throw new Error(`tool occurrence: call "${toolCallId}" (attempt ${occ.attempt}) was already answered in place`);
+            occ.answeredInPlaceBy = by;
+        },
         heard(toolCallId) {
             const occ = byId.get(toolCallId);
             if (occ !== undefined)

package/dist/core/runner/turn-attachments.d.ts

@@ -1,4 +1,5 @@
 import type { McpDroppedTool } from "../mcp.js";
+import type { AnnouncedMcpFailure } from "../../internal/harness.js";
 import type { McpInstructionsEntry } from "../prompt-section-seat.js";
 import type { TaskSpec } from "../types.js";
 import { type SkillListingEntry, type SkillsBlockRender } from "./synthetic-tools.js";
@@ -75,7 +76,7 @@ export declare const CHANGED_FILES_MTIME_EPS_MS = 2000;
 /** Per-boundary byte cap over the bundle's CLIPPABLE frames (weak-model context economics). Intact-class
  *  frames ride outside it — see {@link ATTACHMENT_DELIVERY_CLASS}. */
 export declare const ATTACHMENT_BYTE_CAP: number;
-export type AttachmentSource = "todo_reminder" | "task_reminder" | "tool_search_usage_reminder" | "changed_files" | "output_style" | "date_change" | "instructions_change" | "workflow_size_guideline_change" | "budget_usd" | "total_tokens_reminder" | "background_tasks" | "tools_delta" | "agent_listing" | "skills_listing" | "mcp_instructions" | "mcp_dropped_tools";
+export type AttachmentSource = "todo_reminder" | "task_reminder" | "tool_search_usage_reminder" | "changed_files" | "output_style" | "date_change" | "instructions_change" | "workflow_size_guideline_change" | "budget_usd" | "total_tokens_reminder" | "background_tasks" | "tools_delta" | "mcp_unavailable" | "agent_listing" | "skills_listing" | "mcp_instructions" | "mcp_dropped_tools";
 /** How the bundle cap treats a source — see {@link ATTACHMENT_DELIVERY_CLASS}. */
 export type AttachmentDeliveryClass = {
     readonly class: "clippable";
@@ -125,6 +126,10 @@ export declare const ATTACHMENT_DELIVERY_CLASS: {
         readonly class: "intact";
         readonly bound: (inp: AttachmentInputs) => number;
     };
+    readonly mcp_unavailable: {
+        readonly class: "intact";
+        readonly bound: () => number;
+    };
     readonly agent_listing: {
         readonly class: "intact";
         readonly bound: (inp: AttachmentInputs) => number;
@@ -548,7 +553,7 @@ export interface AttachmentInputs {
         path: string;
         mtimeMs: number;
     }>;
-    /** G1 backgroundTasks: registry snapshot (pending/running only, filtered by the runtask getter).
+    /** G1 backgroundTasks: the leg's live background tasks, every one (`Prepared.listBackgroundTasks`); the renderer caps the list.
      *  Only fetched when opted in AND `state.postCompactPending` — OFF means zero registry reads. */
     backgroundTasks?: ReadonlyArray<BackgroundTaskSnapshot>;
     /** G1 toolsDelta: deferred tools MATERIALIZED since the last announcement (prepare-task's
@@ -565,7 +570,7 @@ export interface AttachmentInputs {
     newToolsSwappedUnderStatic?: readonly string[];
     /** The same fact for the READDED arm. See {@link renderToolsDelta}. */
     readdedToolsSwappedUnderStatic?: readonly string[];
-    /** The MCP-driven arms of the SAME tools_delta frame (removed / readded / failed servers).
+    /** The MCP-driven arms of the SAME tools_delta frame (removed / readded).
      *  Same pre-diffed input + CALLER-owned intact-survival consumption discipline as `newTools`; only
      *  passed when `config.toolsDelta` is opted in. See {@link McpToolsDeltaFacts} for reachability. */
     mcpToolsDelta?: McpToolsDeltaFacts;
@@ -740,14 +745,30 @@ export interface McpToolsDeltaFacts {
     removed?: readonly string[];
     /** Previously-announced-then-withdrawn deferred tools that came BACK. */
     readded?: readonly string[];
-    /** Declared MCP servers that failed to connect at materialize (`MaterializedMcp.statuses`, status
-     *  `"failed"`). `error` is REMOTE/transport text — the producer neutralizes + bounds it at intake.
-     *  */
-    failedServers?: ReadonlyArray<{
-        name: string;
-        error?: string;
-    }>;
 }
+/**
+ * The `mcp_unavailable` frame — the declared MCP servers that did not connect for this message, each the once-per-session ledger's
+ * pair (`name` and the REMOTE `error` text, neutralized and bounded at intake). The reference's failed-servers arm
+ * (cli296.js:250575) "configured but failed to connect", with its duration clause made true of this engine: a server that stays declared is tried again by the
+ * next run that prepares, so it is unavailable "for now", not "for this session", and whether it connects then depends on the error.
+ */
+export declare function renderMcpUnavailable(failed: ReadonlyArray<AnnouncedMcpFailure>): string | undefined;
+/** Whether the `mcp_unavailable` lane is on for a task's attachments config — the one reading, asked by the config door (so a switch
+ *  nobody can read refuses the task before any resource is acquired) and by the leg's first request: absent is the registry's
+ *  default, a boolean is itself (an explicit `true` is not vetoed by a registry flip), anything else is refused by name
+ *  (`config.invalid_argument`, `detail.field`), never read as either state. */
+export declare function mcpUnavailableOn(cfg: TaskSpec["attachments"] | null): boolean;
+/** The `mcp_unavailable` frame a leg's first request owes — a fresh leg's first message or a resumed leg's continuation, the one
+ *  request every leg makes — or undefined (the lane is off, or nothing is pending). `entries` is what the frame names; the
+ *  carrying message's receipt settles exactly those. */
+export declare function owedMcpUnavailable(prepared: {
+    readonly mcpUnavailable?: {
+        pending: AnnouncedMcpFailure[];
+    };
+}, cfg: TaskSpec["attachments"] | null): {
+    body: string;
+    entries: AnnouncedMcpFailure[];
+} | undefined;
 /**
  * G1 — deferred-tool materialization announce (boundary notice). The reference's template (cli296.js:128211): "The following deferred tools are now available via", in full:
  * "The following deferred
@@ -766,15 +787,12 @@ export interface McpToolsDeltaFacts {
  *   listing back, so a withdrawn tool genuinely leaves (and a re-advertised one genuinely returns)
  *   the roster mid-task. CC's trailing "Load via ToolSearch as before" / "Do not search for them —
  *   ToolSearch will return no match" clauses are kept, because sema mounts the SAME ToolSearch name.
- * - `failed`: reachable from `MaterializedMcp.statuses` (`status: "failed"`, fail-open
- *   connect skip). CC additionally splits a MANAGED-POLICY sub-arm off this list (`jlr`/`Oy_` error
- *   codes @626575) — sema has no managed-policy error taxonomy, so only the connection-failure form
- *   is rendered.
+ * The reference's `failed` arm is its own frame here ({@link renderMcpUnavailable}): it must reach the leg's first request.
  * DELIBERATELY ABSENT (state unreachable — announcing them would be a §25 honesty breach):
  * - `needs-auth` (@626543): sema's MCP auth surface is STATIC deployment-supplied headers
  *   (`McpServerSpec.transport.headers` / `principalHeader`) with no OAuth flow and no
  *   authorization-required status — an auth rejection surfaces as an ordinary connect failure and is
- *   covered by the `failed` arm above.
+ *   covered by the `mcp_unavailable` frame.
  * - `pending`: `materializeMcpTools` is fully AWAITED inside prepareTask (one
  *   `Promise.allSettled` over every server) before the run loop's first turn, so "still connecting"
  *   does not exist at any turn boundary — `McpServerStatus.status` is `connected | failed` only.