@sema-agent/core 7.7.0 → 7.9.0

package/CHANGELOG.md

@@ -1,5 +1,93 @@
 # Changelog
 
+## 7.9.0 — 2026-09-08
+
+The resume decision ladder leaves runtask.ts, and the two `runtask.ts` seams design/388 slice 1 shipped unwired in 7.8.0 are wired.
+
+### BREAKING — content-form deny/ask rules get their engine lane (#625; cli B-043 root cause)
+- **One three-state rule model.** A persisted rule row carries `behavior: "deny" | "ask" | "allow"` (closed set `RULE_BEHAVIORS`, one precedence table `RULE_BEHAVIOR_PRECEDENCE`: deny > ask > allow, read by every adjudication). Identity is the (behavior, text, scope) triple. Renames: `PersistedAllowRule`→`PersistedRule`, `ParsedAllowRule`→`ParsedRule`, `StoredAllowRules`→`StoredRules`; `parseAllowRuleText`→`parseRuleText(text, behavior)` (no default), `formatAllowRuleText`→`formatRuleText`. Removed exports: those five names. Same-name reshapes: `PersistedRuleHit.behavior`; `ToolGateInput.persistedRules.admits`→`adjudicate` (the answer is a verdict; a read failure MUST answer `{ unreadable: true }`); `RuleTombstone` / `RuleAddDelta` / `QuarantinedRuleAdd` / `RuleSyncDrop` / `RuleSyncJoinDelta.quarantine[]` / `SessionRuleAdd` / `RemovedPermissionRule` / `RuleCandidate` / `RedeemResult` / `RedeemedBatchMember` carry `behavior`; `removePersistedRule({ behavior })`; `RuleApprovalRecord.schema` 3→4; `ImportPreview.uncovered.denyAskBuckets` removed; `PermissionRulePolicyOptions.bashPrefixLane` removed, `pathBases` added; `PersistedRuleTool` is `string` (tools derive from the catalog's path targets, `ruleToolGrammarOf`); `PersistedRuleMatch` +`path`; `directoryRuleAdmits` no longer reads the tool.
+- **Store rows (@server two stores + contract kit):** every row / tombstone / quarantine / dropped entry carries `behavior` (required on the wire: a row without it is not shapeable and is skipped with a warning; a tombstone without it withholds this round's add). File store schema 3→4 (`.rule-schema-4`; a schema-3 bucket migrates once with `behavior: "allow"` on every row and tombstone; a behavior word outside the set is left for a person, refused whole). Sync contract kit +3 cases. `RuleSyncResponseBody.dropped[].behavior` required; `PermissionRuleSyncResult.resurrected[].behavior`.
+- **Closed sets (@cli @client-core @server readers):** `DeniedBy` +`persisted_rule` (a person's own standing deny row); `AskOrigin` +`rule_store_unavailable` (a wired persisted-rule store could not be read: the ask is fail-closed, the classifier does not answer it, real-approval derived); `PermissionRuleIssue.code` −`unsupported.bash_prefix_rules_store` +`invalid.command_rule` / `unsupported.path_base`.
+- **The lane.** The persisted-rule lane reads the store once per decision (not only on a surviving ask) and adjudicates: a deny row refuses outright (`deniedBy: "persisted_rule"`, a veto row in the station table); an ask row asks with `matchedAskRule` (origin `ask_rule`, a person's standing "ask me each time" that the classifier never answers, by design); an allow row is the prior predicate. The edit round re-adjudicates. Path family: `Edit(~/.sema/settings.json)` / `Write(//tmp/secret/**)` deny/ask rules judge the call's path target (deny/ask read the protective slot, allow the declared slot: the 7.8.0 two-reader rule); pattern grammar `//abs`, `~/`, `/root-relative`, cwd-relative, `*` within a segment, `**` across (narrower than CC's gitignore semantics: `?` / `[]` / `{}` / `!` refused, disclosed). Precedence across authorities: org deny > org ask > personal deny > personal ask > personal allow > bare ask.
+- **The compiler** (`createPermissionRulePolicy`) no longer refuses a Bash prefix deny/ask (`Bash(rm -r:*)` in `permissions.deny` / `permissions.ask` compiles; the retired re-coding never appears, tripwire pinned); an allow in content form still refuses `unsupported.bash_prefix`. Redirections are stripped on the tighten side before matching (`> file`, `2>`, `>|`, fd duplications; the remaining forms are #631).
+- **@cli:** the shell's escort of content-form ask/deny rules into bare tool-name asks (B-043's amplification) retires whole; `permissions.deny` / `permissions.ask` content rules go up the wire as written. Judgement: `permissions.ask: ["Bash(rm -r:*)"]` + auto ⇒ `date` zero cards and zero classifier calls, `rm -r x` a real card of origin `ask_rule`; deny likewise.
+
+### Fixes over the merged tree (main-tree adversarial round over #625 × 393 S3)
+- **#632 — a deny row imported while a call was PARKED now vetoes the resumed execution.** The resumed execution boundary re-adjudicates the person's persisted-rule lane in the same posture as the deny-narrowing layers: a matching deny row (or an ask row, or an unreadable store — the durable path cannot re-ask) ends the call with `deniedBy: "persisted_rule"`, the approval is spent, the call is re-issued. `Prepared.persistedRuleLane` (internal seat) carries the lane to the driver. Pin: park → import deny → resume ⇒ zero executions; control without the row executes once.
+- **Schema-4 rule buckets are strict on every row's `behavior`.** A correctly checksummed schema-4 file carrying a rule, tombstone or quarantined row whose behavior word is outside deny/ask/allow is refused WHOLE (`list()` rejects, the lane reads `unreadable` ⇒ the ask carries `rule_store_unavailable`), never read as "no rule" beside a live allow row.
+- **Known limits, disclosed (tickets, not this release):** #631 — the tighten-side command reader is a hand-written stripper: `command rm -r x`, `rm "-r" x`, `rm -r x; echo "$HOME"` (expansion makes segmentation fail) do not reach a `Bash(rm -r:*)` deny/ask; direction = a real shell lexer with wrappers, and an unreadable command asks instead of no-match. #635 — the path lane reads the call's path slot, not the search tools' effective target: `Grep(//proj/**)` with the path omitted (tool default = root), `Glob` with an absolute pattern, and a relative Grep path resolved against liveCwd where the tool resolves against root, are not reached; direction = one effective-target resolver shared with tool execution. Both are under-blocking relative to the rule's intent, not wider than 7.8.0 (which had no engine-side deny at all).
+
+### Wire (additive — new frames start being pushed; the vocabulary shipped in 7.8.0)
+- `tool_roster_delta` frames are now PUSHED. The driver subscribes to the leg's roster-delta seat at the point it pushes `wiring_manifest` (the roster on the manifest is the baseline a delta diffs against; a delta the seat buffered before the subscription flushes first, in publish order) and forwards each run-time roster change (the RefreshMcpTools seam) as its own identity-minted frame: `delta.fromDigest` = the digest the consumer holds, `delta.roster` the whole post-change roster, `delta.summary` the added/removed/changed names. One refresh that changes the roster ⇒ exactly one frame; a refresh that changes nothing publishes none. A consumer that adopted 7.8.0's tolerant default (adopt the carried roster, record a skew when `fromDigest` mismatches) needs nothing new. @server (live projection of the roster: the frame is on the wire now), @cli (the two frames `wiring_manifest.manifest.tools` / `tool_roster_delta` parse as already claimed).
+- `tool_end.structured` is projected through the LEG's card projector (`Prepared.structuredProjector`: the engine card set ∪ the caller rows' declared `renderHints.resultCards`) on every arm that mints a tool_end body — the live loop, the resumed batch's executed and refused arms, the deferred-sibling close, the two orphan reconciles. Effect on the wire: a caller tool's DECLARED card now rides its frame (7.8.0 dropped it — only engine cards passed); an undeclared `details.type` is still dropped and is now announced ONCE per leg as `config.tool_card_undeclared` (audience operator), which 7.8.0 minted at the seat but never reached from the loop.
+- 7.8.0's "Not wired" disclosure retires whole: the roster delta frame, the structured projector and the manifest-side subscription are wired; the `resume` identity arm was already wired in 7.8.0.
+
+### Narrowing
+- **design/388 §2.2 ④ — a caller's `renderHints.resultCards` must live under the tool's OWN card namespace** (the row's `cardId`: `caller:<contractId>` — one mint, `rosterCardId`, read by the row and by the prepare door). A declaration naming another contract's namespace, an engine card (`builtin:*` or a bare engine card type) or a bare name is refused at prepare, `config.tool_face_invalid`. Load-bearing now that the leg projector admits every DECLARED card onto the wire (a 7.8.0 tree accepted the declaration and dropped the card at projection; the S3 tree would have shipped it as a foreign card). @cli @server: a caller tool that declared a foreign card namespace now fails prepare instead of mounting.
+
+### Internal (byte-invariant on the runtime — design/393 S3)
+- `Runner.resumeStream`'s pre-CAS ladder (E1–E10 of the decomposition map, 1 918 lines) moved verbatim into eight `resume-*.ts` lanes (layer 3), each behind ONE Input: admission (+ wake shaping), review-outcome (+ gate match, park twins), policy-outcome, checkpoint-screen (+ abort / handle / constraint rungs), internals-and-config, apply (+ settlement mint), preflight, claim. E11 (the post-claim hand-off) stays the driver's. The four async rungs enter their successor in their own last continuation (a `next` seat — the tool gate's fold→lanes shape), and the internals-and-config rung hands the ladder's one window await back as a started promise the driver awaits where the ladder did, so no host read of the ladder moved off its tick. runtask.ts 9 186 → 7 470 lines; dist `runtask.js` −730 / +50 with every moved line accounted for.
+- `toolEndBodyFrom` / `reconciledToolEndBody` (internal machinery, not on the public surface) take the projector as a required parameter; the module-level `structuredFrom` is gone — `createStructuredProjector()` with no options is the engine set alone (the fixture form). `ToolRosterDeltaSeat.unsubscribe()` (additive) closes the lane with the leg.
+
+### Pins
+- `test/design393-s3-resume-lanes.test.ts` (WIRED / Input shape / await boundaries — five in-body mutations red), `test/design393-s3-388-seams.test.ts` (the two seams end to end on a real stdio MCP server and a caller tool with a declared card — three mutations red), the run-lane residents pins, G5's generic-Input pin.
+
+### Gates (#627 — server [6626] door request)
+- **A `checkpoint.unsupported_version` refusal always names its arm (#627).** The word rides an OPTIONAL
+  `detail.reason`, so nothing red when a throw site omitted it — and the file ledger's replay refusal
+  (`FileCheckpointStore`, an event kind written by a newer worker) had omitted it since it was written. It
+  now carries `reason: "ledger_event_unknown"`, the tenth member of the closed set: the one arm that is NOT
+  row-scoped — no row under that data root is readable by this binary, so the host rolls the binary forward
+  rather than routing one token to another worker. **@server**: additive word on an optional member; a
+  consumer holding a total table over `reason` gains a row.
+- The word list leaves the constructor's inline type for a named closed set, `CheckpointErrorReason`
+  (exported from `src/core/checkpoint-store.ts`; the public export surface is unchanged), registered in
+  `docs/CLOSED-SETS.md` with a new **mint-obligation** leg in `gate:closed-sets`: every
+  `new CheckpointError("checkpoint.unsupported_version", …)` under `src/` must pass a detail object literal
+  whose `reason` is spelled AT the site (a literal, or a conditional whose branches are) and is a member of
+  the set — a missing detail, a missing/shorthand/computed word, or a word outside the set reds with
+  `file:line`, and a per-row population floor reds when the walker stops seeing the sites at all. The
+  registry's two G8 floors were re-measured in the same pass (rows 8 → 10, switches 1 → 3; both had drifted
+  below the census, which is the blindness a floor exists to make loud).
+
+
+## 7.8.0 — 2026-09-08
+
+One roster instead of 29 name tables. `ToolSpec` already described a tool completely; the engine, the server and the shells still re-asserted each tool's identity and axes by NAME in hand-kept tables (a retired name lived on as a key in five of them). This version mints ONE effect roster per prepared leg from the mounted instances, derives every remaining table from a static catalog, and closes the mount array behind a builder.
+
+### BREAKING
+- `HAND_TOOL_EFFECTS`, `DEFAULT_BUDGET_EXEMPT_TOOLS`, `COMPACTABLE_TOOLS` leave `src/index.ts` (B1). Replacement: `describeToolCatalog()` — the hand band is `.filter((e) => e.mountedBy.includes("hands"))` (or `handBandEffects()`), the two policy sets `budgetExemptToolNames()` / `compactableToolNames()`. A host deriving its hand band (server `HANDS_BAND_TOOL_NAMES`) derives it over `HANDS_BAND_TAGS`; the derived band equals today's server list plus `ListAgents` (the peer-lane definition the hand-kept list predates) — the server's list is the stale side.
+- `Prepared.tools` is `readonly AgentTool[]` (the builder's read face); a prepare phase that wrote the array takes `roster: RosterBuilder`.
+
+### Narrowings (each a two-arm pin)
+- **B6/B17** — the policy faces read the call's OBJECT face (`ToolCallRequest.face`, stamped at the gate entry off the live roster and carried through the fold's re-mint over the final args). The active-skill `allowPaths` face judges `pathTarget.skillScopeEligible` and confines the DECLARED target's value (`pathTargetValue`: the face's `param` + aliases — an in-fence `file_path` beside an out-of-fence declared param is a decoy, not the write; a declared param absent from the args is denied as unresolvable): a bare request (a policy invoked outside a Runner) or a caller tool that merely took a built-in's name (`Write`) is an unconfirmable write and is denied where it used to pass by name. The transcript-directory gate reads the face and falls back to the catalog's declaration for the name (never wider than 7.7.0).
+- **B15** — the permission-rule lint's diagnostic set is closed: `unsupported.param_unknown` (renamed from `unsupported.unknown_param`), `unsupported.param_non_scalar` (`Edit(edits:…)` and every carried object/array key), `unsupported.tool_unknown` (only under a leg-supplied `ruleFaces` resolver — `ruleFacesFromRoster(prepared.toolRoster)`; without one the catalog alone judges and an unknown tool stays permissive). `RuleFaceView` / `catalogRuleFaceView` / `PermissionRulePolicyOptions.ruleFaces` are the seats.
+- **B14** — the micro-compaction whitelist is derived from the catalog's `compactable` declarations: eight members, no `PowerShell` row (no sema definition ever carried the name).
+- **B20** — a caller tool name / alias over 128 characters, or a contract member over 64, is refused typed at prepare (`config.tool_name_too_long` / `config.tool_contract_too_long`); an MCP assembled name can never exceed the bound — the namespacing helper already budgets it (peer segment absorbs the clamp, digest-suffixed; provider bound 64), so the design's "drop that tool" arm is satisfied by construction and no drop arm exists (design/388 S49's "core has no bound on the synthetic name" premise is stale as of RB-83/RB-107).
+- The compaction file-op summary reads the live names' path access off the catalog and the three pre-rename names off the frozen `DURABLE_HISTORY_NAMES`; a persisted `MultiEdit` block contributes no file-op metadata any more (the retired name is a key nowhere — G3).
+- **Every write fence judges the call's DECLARED slot** — two named readers for the two kinds of fence, shared by all of them (`writeTargetPath(call, target)`): a DENY-LIST (sensitive paths, frozen paths, write protection, the transcript gate, edit tracking) reads `protectivePathTargetOf` — the object face's declaration first, the catalog's declaration for the NAME as the floor (a bare request, or a face that declares none): reading the catalog for an undeclared same-name tool can only tighten a deny-list (the pre-388 posture, never wider). A GRANT that admits a write BY its path (session `allowDirs`, the fs-write gate's accept/exempt dirs, the active-skill allowPaths eligibility) reads `declaredPathTargetOf` — the face's OWN declaration only: a same-name tool that declares no path target is an unconfirmable write and the fence fails closed (allowDirs denies "declares no path target to confine"; the fs-write gate asks; the catalog's slot never buys an admission); a bare request (no face at all — a policy invoked outside a Runner) reads the catalog for the name. `isProtectedWrite` / `isDeclaredWrite` are the two membership predicates. The sensitive-path guard's DEFAULT membership is the same predicate (a caller tool under any name whose face declares a write target is guarded); an explicit `tools` list stays a name list. A decoy `file_path` beside an out-of-fence declared param is not the target; a declared param absent from the args is "no resolvable path" (containment fences deny/ask as they always did for an unresolvable write; the additive deny-lists — sensitive paths, frozen paths — see no target and pass, as their unresolvable arm always did). The cross-slot fallback that once read `notebook_path` for a Write, or `file_path` for a NotebookEdit, is gone (the tool's own schema refuses such a call before any write).
+- **Merge-seam adversarial rounds (codex r1/r2 over the merged 388 × 393 S1/S2 × #602 tree)** — (H1) the durable resume-edit rechecks judge under the call's face: the park row carries `family` + `pathTarget` beside its B18 identity members (additive optional; `parkedToolFace` mints them at the same station, `parkedCallFaceOf` rebuilds the face — present iff face + all four identity members are on the row), the pre-CAS recheck judges the edited args under the ROW face and the two post-CAS rechecks under the live roster face; a decoy in-fence `file_path` beside an out-of-fence declared `destination` is refused `resume.constraint_rejected` pre-CAS (the checkpoint stays pending). **@server**: two additive optional keys on the checkpoint row (JSON rows: zero DDL); the store-contract kit gained a seven-member round-trip run your pg store must pass. (H2) MCP intake keys the overlay's results by tool NAME — a tool the overlay refused is not mounted at all (previously an index pairing mounted it bare and shifted later tools onto a neighbour's face). (F2) the `resume` identity arm is wired (see the disclosure below): a same-name tool whose contract / shape / revision differ from the parked row's is refused `resume.tool_contract_mismatch` through the non-executing reopen path (`tool_unavailable` family), never executed under the new face. (F3) the park-time projection re-adjudication (a JSON-fidelity store moving the args) carries the call face too. Two review proposals were REJECTED on the documented contract (#549 ①, HRD-PRM-1, #286, CLS-C-4): protective fences judge the tool's declared/catalog slot only — no "legacy spelling floor" when the slot is empty and no "judge every candidate" union; a caller whose implementation writes another slot declares its face.
+- **B20 (keys)** — a schema property name is a SEMANTIC key every fence reads by and is never truncated on a roster row: a caller declaration over `TOOL_KEY_MAX_CHARS` (256) or `TOOL_KEYS_MAX` (1024 keys) is refused typed at prepare (`config.tool_schema_bound`); a caller face that does not fit its schema (a `pathTarget.param` outside the top-level keys, a `ruleFace` param outside the derived vocabulary — scalar keys ∪ the declared path target's param + aliases —, an approval card whose required keys are missing, a declared key or display hint over its bound) is refused `config.tool_face_invalid`; no display hint is truncated on a row either — the same validator the MCP `toolFaces` overlay passes; an MCP tool whose schema breaks the key bound is dropped with a disclosed reason (its siblings mount). `writeProtectionCheck(toolName, args, face?)` gains the call's face (additive).
+- The sensitive-path guard / frozen-path deny / edited-file tracking / `allowDirs` all derive their covered set from the catalog's path targets: `MultiEdit` is no longer a member of any of them (it mounts nowhere).
+
+### Added
+- `ToolSpec.family` / `pathTarget` / `ruleFace` / `renderHints` / `compactable` / `budgetExempt` (additive; `defineTool` forwards them + `modelGate` onto the materialized face); `TaskSpec.excludeAllTools: true` (the whole face unmounts; `"*"` stays a legal caller name); `McpServerSpec.toolFaces` (a per-tool face overlay for MCP tools, validated against the materialized schema at every listing).
+- The tool FACE vocabulary (`TOOL_FAMILIES`, `TOOL_MOUNT_TAGS`, `TOOL_APPROVAL_CARDS`, `TOOL_PATH_ACCESSES`, the render-hint bounds, `TOOL_WIRE_NAME_MAX_CHARS` / `TOOL_CONTRACT_MAX_CHARS`, `ToolPathTarget` / `ToolRuleFace` / `ToolRenderHints` / `ToolFaceDeclaration` / `ToolCatalogEntry`), the static catalog (`describeToolCatalog`, `catalogEntriesNamed`, `catalogToolNames`, `catalogRuleFaceOf`, `pathTargetOf`, `pathTargetValue`, the derived predicates, `engineCardTypes`, `predictMountedToolNames`, `HANDS_BAND_TAGS` / `MOUNT_TAG_IN_HANDS_BAND`), the roster (`ToolRosterEntry` / `ToolRoster` / `ToolRosterDelta` / `ToolRosterRenderHints` as typebox schemas AND `Static` types, `ROSTER_SOURCES`, `mintCapabilityId`, `toolIdentityOf`, `diffToolRoster`, `judgeParkedToolIdentity`, `parkedToolIdentity`, `ruleFacesFromRoster`, `toolCallFaceOf`, `inputKeysOf`, `ruleFaceOfInstance`, `ToolRosterDeltaSeat`), `TOOL_CONFORMANCE_VECTORS` / `describeToolConformanceVectors`, `applyMcpToolFaces` / `toolFaceProblem` / `APPROVAL_CARD_REQUIRED_KEYS`, `createStructuredProjector`, `ASK_USER_QUESTION_TOOL_NAME` (B5), `DURABLE_HISTORY_NAMES`.
+- **Wire (@server @cli @client-core @web-admin @desktop)**: `WiringManifest.tools?: ToolRoster` on every effective manifest (OUTSIDE `configFingerprint`; `schemaVersion` unchanged); `TaskEvent` arm `tool_roster_delta { delta: ToolRosterDelta }` (a run-time roster change: the whole post-change roster + a summary usable when the consumer holds `fromDigest`; a mismatch means adopt the snapshot, never reject); `ToolCallRequest.face?: ToolCallFace`; `FsWriteGateWiring.isExempt(toolName, canonicalPath, identity?)` (B22 — the identity triple beside the name for a store keyed on `capabilityId`); `PendingAction{kind:"tool_approval"}` gains `capabilityId? / contractId? / shapeDigest? / implementationRevision? / rosterDigest?` (B18; additive, no checkpoint-version bump; a row without them follows the name-only path); three `engine_notice` codes (B2, audience operator): `config.tool_card_undeclared`, `config.tool_face_undeclared`, `config.tool_face_invalid`.
+- Gates (all in `gate:all`): `gate:tool-catalog` (every core-owned definition spreads its catalog face; a face under another name, a ghost id, a row without family, a card minted by a file that does not list it — red, named), `gate:tool-names` (L1: every retained tool-name table registered in `docs/TOOL-NAME-TABLES.json`, disjoint from the retired names, inside the catalog), `gate:tool-docs` (the `ToolSpec` field reference in docs/sdk/04 is generated from the declaration — `scripts/gen-tool-spec-fields.mjs --check`). `ToolMountTag` registered in `docs/CLOSED-SETS.md`.
+- The catalog is data: every row is deep-frozen at module init and `toolFace(id)` hands out a deep COPY — two factory products never share a `pathTarget`, and a host adapting one instance's face cannot move another run's fences (or the catalog).
+- An MCP `toolFaces` overlay that does not fit the tool's materialized schema (at intake or after a refresh) means the tool is NOT mounted on that leg — announced once (`config.tool_face_invalid`); it never mounts bare (a bare mount would silently drop the write protection the operator declared, and an MCP name has no catalog floor). The approval-edit re-check and the edit ask carry the stamped face (a decoy in an approved edit is confined by the declared slot).
+- A deferred tool's placeholder carries the real tool's `aliases` (dispatch by alias resolves to the same slot before and after activation, the roster's name→row resolution agrees with the dispatcher's — wire name first, then alias, in mount order — and a transcript call under an alias activates the canonical entry on replay). The MCP `toolFaces` overlay binds to the RAW accepted tool name (`Tool.mcpRemoteName`, a typed carry the materializer stamps): two raw spellings folding onto one minted name cannot make a face land on the other tool — the unaccepted spelling is announced undeclared. `TOOL_KEY_MAX_CHARS` / `TOOL_KEYS_MAX`; `ToolCallLike` / `callPathTargetOf` / `isPathConfinableWrite` / `fileOpAccessOf` (the compaction summary records file ops for the FILE families only — a search tool's `path` is a root, not a file read).
+- The roster carries every name the model can call: the ToolSearch instance the deferred lane appends to the harness list rides the roster's ENGINE LANE (`RosterBuilder.mountEngineLane`) as the trailing row, minted after the disclosure lane (which reads the mount array and never writes it) — the prompt manifest's tool rows are the mount array; the roster is that plus the engine lane. The effect map follows the instance the harness dispatches to (a later same-name mount's declared effect is the name's truth). `gate:tool-catalog` rule ②b: a resolvable `defineTool({ name })` with no catalog row is red (per-file `HOST_FACTORY_DEFINITIONS` exemption list, empty today).
+
+### Not wired in 7.8.0 — three runtask.ts seams deferred to design/393 S3 (the seats are minted; the driver does not yet consume them) — RETIRED in 7.9.0: all three are wired there (see that section)
+- **Disclosure**: the three items below are the driver-side half of this slice. In 7.8.0 the roster, its delta seat and the structured projector all exist and are pinned at the seat/function level, but runtask.ts (design/393's domain, being decomposed in parallel) does not yet call them: no `tool_roster_delta` frame is pushed and `tool_end` still projects through the module-level card set. A consumer must not rely on `tool_roster_delta` frames until the version that lands 393 S3. (The `resume` identity arm — `judgeParkedToolIdentity` minting `resume.tool_contract_mismatch` — IS wired in 7.8.0: the merge-seam adversarial round showed a same-name replacement executing under a different face once the rechecks read faces, so it did not wait for S3.)
+- `tool_end`: the body projection reads `prepared.structuredProjector` (the per-leg card set + the once-per-leg announce) in place of the module-level `structuredFrom` (tool-end-body.ts:77 via runtask).
+- `wiring_manifest`: beside the manifest push (runtask.ts ≈:4149) subscribe `prepared.toolRosterDeltas.subscribe((delta) => queue.push({ type: "tool_roster_delta", delta, ...ident() }))`.
+
+### Pins
+- `test/tool-catalog.test.ts` (L5 snapshots + the gate's discriminance), `test/tool-roster.test.ts` (the builder, the row mint, the delta seat, G1 / G5 / G6 / G6c / G6e), `test/tool-conformance.test.ts` (L3 over four vectors on a real NodeExecutionEnv, L6 lockstep + every param matches, L4's once-per-leg announce, G6d), the retired-table tests re-pointed at the catalog.
+
 ## 7.7.0 — 2026-09-07
 
 One version for the first refactor wave and its bug fixes (the 7.6.2 patch folded in: main already carries the store-contract change, so the fix ships with it). #618 / B-040: The classifier request shape changes on the wire; the explicit "off" tier changes on both brain lanes.

package/dist/agents/agent-transcript-tool.js

@@ -6,14 +6,14 @@ import { inlineUntrusted } from "../core/untrusted-text.js";
 import { stepsFromMessages } from "./subagent-steps.js";
 import { REPORT_FIELD_MAX } from "./subagent.js";
 import { getSessionRetainLedger } from "./retain-ledger.js";
+import { toolFace } from "../core/tool-catalog-entries.js";
 export const AGENT_TRANSCRIPT_TOOL_NAME = "AgentTranscript";
 const AGENT_TRANSCRIPT_DEFAULT_N = 20;
 const AGENT_TRANSCRIPT_MAX_N = 50;
 export function createAgentTranscriptTool(opts) {
     return defineTool({
         name: AGENT_TRANSCRIPT_TOOL_NAME,
-        contract: { contractId: "core.agent_transcript@1", implementationRevision: "1" },
-        effect: "read",
+        ...toolFace("agent-transcript"),
         description: `Read the recent tool steps of a background agent you launched (task_id 'a…' from the Agent tool with ` +
             `run_in_background), so you can see precisely where it got to — useful before SendMessage-ing a follow-up, ` +
             `or to inspect a stopped agent's tail. Returns the last N steps (tool, target, outcome); it does not re-run ` +

package/dist/agents/list-agents-tool.js

@@ -4,15 +4,14 @@ import { inlineUntrusted } from "../core/untrusted-text.js";
 import { formatPeerNameRef } from "./cross-session-ref.js";
 import { entryAccessible } from "./roster-store.js";
 import { mintPeerSessionCandidates, peerSessionBoxHandle } from "./peer-directory.js";
+import { toolFace } from "../core/tool-catalog-entries.js";
 export const LIST_AGENTS_TOOL_NAME = "ListAgents";
 export const LIST_AGENTS_TOOL_ALIAS = "ListPeers";
 export const LIST_AGENTS_MAX_RESULT_CHARS = 10_000;
 export function createListAgentsTool(opts) {
     return defineTool({
         name: LIST_AGENTS_TOOL_NAME,
-        aliases: [LIST_AGENTS_TOOL_ALIAS],
-        contract: { contractId: "core.list_agents@1", implementationRevision: "1" },
-        effect: "read",
+        ...toolFace("list-agents"),
         isConcurrencySafe: () => true,
         description: `List the agents and peer sessions you can message with SendMessage. Peer sessions are other sessions of this ` +
             `engine running for the same user on this machine, shown as \`name [ref]\`; send to one with its name (or \`name [ref]\` ` +

package/dist/agents/observer.js

@@ -2,6 +2,7 @@ import { Type } from "typebox";
 import { defineTool } from "../core/tools.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
 import { escapeEnvelopeTag } from "../core/untrusted-text.js";
+import { toolFace } from "../core/tool-catalog-entries.js";
 export const OBSERVER_EVENT_TAGS = ["tool-call", "user-message", "tool-result", "turn-ended"];
 const TAG_ESCAPE_RE = new RegExp(`<(?=/?(?:${OBSERVER_EVENT_TAGS.join("|")})(?:[>\\s/]|$))`, "gi");
 export function escapeObserverTags(text) {
@@ -377,9 +378,8 @@ export function frameObserverReport(observerAgentName, report) {
 export function createObserverReportToolSpec(opts) {
     return {
         name: OBSERVER_REPORT_TOOL_NAME,
-        contract: { contractId: "core.observer_report@1", implementationRevision: "1" },
+        ...toolFace("observer-report"),
         description: OBSERVER_REPORT_DESCRIPTION,
-        effect: "write",
         parameters: Type.Object({
             report: Type.String({
                 minLength: 1,

package/dist/agents/send-message-tool.js

@@ -14,6 +14,7 @@ import { neutralizePeerBody } from "./cross-session-envelope.js";
 import { SUBAGENT_RESUME_CAP, SubagentRetainLedger, getSessionRetainLedger } from "./retain-ledger.js";
 import { createSubagentResume } from "./subagent.js";
 import { appendHopToken, judgePeerAdmission, peerAxisToken, resolvePeerAdmissionConfig, PEER_MESSAGE_NOTICE, } from "./peer-admission.js";
+import { toolFace } from "../core/tool-catalog-entries.js";
 export const SEND_MESSAGE_TOOL_NAME = "SendMessage";
 let uplinkSeqGlobal = Date.now();
 const UPLINK_RESULT_MAX = 8000;
@@ -134,7 +135,7 @@ export function createSendMessageTool(opts) {
     };
     return defineTool({
         name: SEND_MESSAGE_TOOL_NAME,
-        contract: { contractId: "core.send_message@1", implementationRevision: "1" },
+        ...toolFace("send-message"),
         executionMode: "parallel",
         description: `Send a follow-up message to a previously spawned background agent. ` +
             `Your plain text output is NOT visible to other agents — to communicate, you MUST call this tool. Messages addressed to you are delivered automatically; you don't check an inbox. ` +

package/dist/agents/subagent-steps.js

@@ -1,8 +1,9 @@
 import { redactSecrets } from "../core/untrusted-egress.js";
+import { isProtectedWrite } from "../core/tool-registry.js";
+import { writeTargetPath } from "../tools/fs/safety.js";
 export const STEP_CAP = 10;
 const FIELD_MAX = 80;
 const EDITED_FILES_CAP = 32;
-const EDITING_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
 function firstLine(s) {
     const nl = s.indexOf("\n");
     return nl === -1 ? s : s.slice(0, nl);
@@ -57,10 +58,10 @@ export function extractTarget(args) {
     }
 }
 function editTargetPath(toolName, args) {
-    if (!EDITING_TOOLS.has(toolName) || args === null || typeof args !== "object")
+    const call = { toolName, args };
+    if (!isProtectedWrite(call) || args === null || typeof args !== "object")
         return undefined;
-    const a = args;
-    const p = a.file_path ?? a.path ?? a.notebook_path;
+    const p = writeTargetPath(call);
     return typeof p === "string" && p.length > 0 ? p : undefined;
 }
 function outputFirstLine(output) {

package/dist/agents/subagent.d.ts

@@ -248,7 +248,7 @@ export declare function classifySubagentError(terminal: TerminalCause): {
  * delegation's landing report from `structured` and MUST NOT scrape the model-facing text. The
  * `async_launched` receipt honored it (`type:"agent"`, on the allowlist); the **completed** delivery
  * did not: its `details` was `{...child}` — a bare `TaskResult` spread with no `type` key at all — so
- * `structuredFrom`'s allowlist dropped it every time. The one card the contract names by name was the
+ * the card projector's allowlist dropped it every time. The one card the contract names by name was the
  * one card that could never arrive, and the only way to get the child's report was the thing the
  * contract forbids.
  *

package/dist/agents/subagent.js

@@ -60,6 +60,7 @@ import { recordRosterSpawn } from "./roster-store.js";
 import { LAUNCH_RECEIPT_OWN_WORDS_CLAUSE, launchReceiptNoQuoteClause } from "./launch-receipt-contract.js";
 import { ObserverDigestTap, ObserverPairing, createObserverReportToolSpec, markObserverTaskId, unmarkObserverTaskId, isObserverTaskId, ObserverResumeStateError, ObserverStoppedByUserError, observerFramingPrompt, observerSlug, resolveObserverDeclaration, } from "./observer.js";
 import { SubagentStepRecorder } from "./subagent-steps.js";
+import { toolFace } from "../core/tool-catalog-entries.js";
 const BG_AGENT_RESULT_MAX = 4_000;
 const BG_AGENT_RESULT_FULL_MAX = 200_000;
 function resultSettleFields(result) {
@@ -243,7 +244,6 @@ function createToolStatsCounter(delegationToolName) {
                         t.bashCount++;
                         break;
                     case "Edit":
-                    case "MultiEdit":
                         t.editFileCount++;
                         recordEditLines(args);
                         break;
@@ -1392,13 +1392,12 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
         }));
     return {
         name: opts.name ?? DEFAULT_SUBAGENT_TOOL_NAME,
+        ...toolFace("agent"),
         agentListing,
         agentToolFaces,
         ...(agentToolPool !== undefined ? { agentToolPool } : {}),
-        contentOrigin: "local",
         ...(rosterNames !== undefined ? { agentModels: rosterNames } : {}),
         executionMode: "parallel",
-        contract: { contractId: "core.agent@1", implementationRevision: "1" },
         description: `Launch a new agent to handle complex, multi-step tasks. Each agent type has specific capabilities and tools available to it.\n` +
             (opts.purpose ? `\nThis sub-agent is for: ${opts.purpose}.\n` : "") +
             (hasAgents ? `\nAvailable agent types are listed in <system-reminder> messages in the conversation.\n` : "") +

package/dist/core/ask-origin.d.ts

@@ -41,6 +41,10 @@ import type { PermissionResult } from "./tool-policy.js";
  *    lane may answer it).
  *  - `org_rule` — an organization policy rule asked (or stamped an existing ask): "no configuration
  *    clears this, a person nods".
+ *  - `rule_store_unavailable` — the deployment wired a persisted-rule store and could not READ it for
+ *    this call (a read failure, a timeout): the person's own deny/ask rows cannot be enforced, so the
+ *    call fails closed the way an unreadable org snapshot does — an allow tightens to an ask a person
+ *    must clear, and no automatic lane may answer ("does one of my rules forbid this?" is unanswered).
  *  - `hook` — a deployment's PreToolUse screening face raised or co-raised the ask; the word is
  *    engine-stamped at the fold and is the deployment's own per-call adjudication.
  *  - `ask_rule` — an EXPLICIT `ask` permission rule matched: a person's standing "ask me each time",
@@ -61,7 +65,7 @@ import type { PermissionResult } from "./tool-policy.js";
  *    observer or an approval card can say WHICH engine layer raised the question, which one word
  *    could not.
  */
-export declare const ASK_ORIGINS: readonly ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
+export declare const ASK_ORIGINS: readonly ["content_question", "unresolvable", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 export type AskOrigin = (typeof ASK_ORIGINS)[number];
 /** Whether a value is a member of the closed origin set. Exported because the word crosses process
  *  boundaries: a host validating one it received must not hand-roll the set. */
@@ -87,6 +91,9 @@ export interface AskOriginFacts {
      *  read-back off the decision (a policy can put `decisionReason: "org_rule"` on its own ask; the
      *  gate's cell cannot be written by a policy). */
     readonly org: "rule" | "unavailable" | undefined;
+    /** The gate's own record of its persisted-rule lane's READ: `"unavailable"` when the wired store could
+     *  not be read for this call (the lane's deny/ask rows are unenforceable). Written only by the gate. */
+    readonly ruleStore?: "unavailable" | undefined;
     /** Which of the gate's OWN post-fold tightens minted the standing ask, if one did — again the gate's
      *  record of its own layer (a tighten replaces an `allow` wholesale, so at most one fires per pass),
      *  never a read-back of `decisionReason: "safety"` off a decision a policy could have composed. */
@@ -127,6 +134,7 @@ export declare const ORIGIN_IMPLIES_REAL_APPROVAL: {
     readonly unresolvable: false;
     readonly org_unavailable: "at_derivation";
     readonly org_rule: "at_derivation";
+    readonly rule_store_unavailable: "at_derivation";
     readonly hook: false;
     readonly ask_rule: false;
     readonly denial_limit_fallback: "at_mint";
@@ -148,6 +156,8 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  *  - `org_unavailable` / `org_rule`: judgment may clear a `requiresRealApproval` bit a POLICY minted,
  *    but not the org's — while adjudication is unavailable the org's answer is unknown, and an org
  *    ask carries the org's own "a person nods" semantic.
+ *  - `rule_store_unavailable`: the person's own deny/ask rows are unreadable — whether one forbids this
+ *    call is unknown, and a classifier verdict would answer that question in the person's stead.
  *  - `hook`: the deployment's own per-call adjudication; the classifier is its delegate for
  *    hesitation, not an override for its screening face.
  *  - `ask_rule`: a person's standing "ask me each time" — the classifier answering it would decide
@@ -169,6 +179,7 @@ declare const CLASSIFIER_MAY_ANSWER: {
     readonly unresolvable: false;
     readonly org_unavailable: false;
     readonly org_rule: false;
+    readonly rule_store_unavailable: false;
     readonly hook: false;
     readonly ask_rule: false;
     readonly denial_limit_fallback: false;

package/dist/core/ask-origin.js

@@ -1,4 +1,4 @@
-export const ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
+export const ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 const ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
 export function isAskOrigin(v) {
     return ASK_ORIGIN_SET.has(v);
@@ -19,6 +19,8 @@ function originLadder(decision, facts) {
         return "org_unavailable";
     if (facts.org === "rule")
         return "org_rule";
+    if (facts.ruleStore === "unavailable")
+        return "rule_store_unavailable";
     if (decision.decisionReason === "hook")
         return "hook";
     if (decision.matchedAskRule !== undefined)
@@ -36,6 +38,7 @@ export const ORIGIN_IMPLIES_REAL_APPROVAL = {
     unresolvable: false,
     org_unavailable: "at_derivation",
     org_rule: "at_derivation",
+    rule_store_unavailable: "at_derivation",
     hook: false,
     ask_rule: false,
     denial_limit_fallback: "at_mint",
@@ -48,6 +51,7 @@ const CLASSIFIER_MAY_ANSWER = {
     unresolvable: false,
     org_unavailable: false,
     org_rule: false,
+    rule_store_unavailable: false,
     hook: false,
     ask_rule: false,
     denial_limit_fallback: false,

package/dist/core/ask-question.js

@@ -3,6 +3,7 @@ import { uuidv7 } from "../engine/session/uuid.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { defineTool, errorResult } from "./tools.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";
+import { toolFace } from "./tool-catalog-entries.js";
 export const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
 export function classifyQuestionOutcome(outcome) {
     let unavailable;
@@ -170,7 +171,7 @@ export function createAskUserQuestionTool(onQuestion, source, opts) {
     const continuationCard = askQuestionContinuationCard;
     return defineTool({
         name: ASK_USER_QUESTION_TOOL_NAME,
-        contract: { contractId: "core.ask_user_question@1", implementationRevision: "1" },
+        ...toolFace("ask-user-question"),
         description: "Ask the user a structured multiple-choice question when you are genuinely stuck or a decision is " +
             "the user's to make (which approach, which of these). Provide 1-4 questions, each with 2-4 options " +
             "(label + description). Use sparingly — not for anything you can determine yourself from the code or " +
@@ -226,7 +227,6 @@ export function createAskUserQuestionTool(onQuestion, source, opts) {
                 })),
             }), { minItems: 1, maxItems: 4, description: "Questions to ask the user (1-4 questions)" }),
         }),
-        effect: "read",
         executionMode: "sequential",
         execute: async (args, ctx) => {
             const { questions } = args;

package/dist/core/checkpoint-store.d.ts

@@ -822,6 +822,36 @@ export type PendingAction = {
      * pre-1a.2 checkpoint (deserialized without it), in which case the resume skips the hash check.
      */
     boundInputHash: string;
+    /**
+     * design/388 §2.5 boundary ② (B18; additive — no checkpoint-version bump, the `previewWithheld`
+     * precedent: an optional group an older reader ignores): the IDENTITY of the row the park minted
+     * this action against, read off the leg's tool roster at the suspend station — `capabilityId`
+     * (engine-minted over {source, peer, name, contractId}), `contractId`, `shapeDigest`,
+     * `implementationRevision` — plus the roster `digest` of the leg that parked. The resume finds the
+     * same-name row on ITS leg and compares the FOUR identity members (`judgeParkedToolIdentity`): any
+     * mismatch is a replacement wearing the name and the resume refuses it
+     * (`resume.tool_contract_mismatch`, the `tool_unavailable` reopen family). All four ABSENT ⇒ a row
+     * minted before the members existed ⇒ the name-only path, never widened by their absence.
+     */
+    capabilityId?: string;
+    contractId?: string;
+    shapeDigest?: string;
+    implementationRevision?: string;
+    rosterDigest?: string;
+    /**
+     * design/388 B6 × B18 (additive; the identity group's precedent): the FACE the parked call was judged under —
+     * display `family` + declared `pathTarget` — off the same roster row at the same mint. The pre-CAS resume-edit
+     * recheck has no roster yet; it rebuilds the call face from these (`parkedCallFaceOf`) and judges the edit as
+     * the live gate judged the original (merge-seam H1: without them a caller slot fell to the catalog's slot for
+     * the NAME). Any member absent ⇒ pre-388 row ⇒ the recheck falls to the catalog, never a widened grant.
+     */
+    family?: import("./tool-face.js").ToolFamily;
+    pathTarget?: {
+        param: string;
+        aliases: string[];
+        access: "read" | "create" | "edit";
+        skillScopeEligible: boolean;
+    };
     /**
      * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an
      * older reader ignores. Unlike that precedent seat — which resume DOES read, through its
@@ -1937,6 +1967,30 @@ export interface CheckpointSummary {
  * {@link ResourceLedger.spentMicroUsd}. Pure; reads no clock/random.
  */
 export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
+/**
+ * WHICH arm of a multi-arm {@link CheckpointError} `code` fired (requested 2026-08-10: a deployment retry
+ * policy needs to tell "a newer worker can redeem this row" from "this row is damaged/caller-declared and
+ * no worker ever will" — blanket-retriable and gate-shape heuristics were both refuted downstream, so the
+ * throw site carries the fact it always knew).
+ *
+ * A CLOSED SET with one home, registered in `docs/CLOSED-SETS.md`. It is carried in an OPTIONAL member, so
+ * the compiler is silent when a throw site omits it, and a site that omits it hands the host a refusal it
+ * cannot classify — the registry's mint-obligation leg is what makes the omission loud (every
+ * `checkpoint.unsupported_version` construction site must spell one of these words AT the site).
+ *
+ *  · `unsupported_version` arms: `"version_newer"` (the row's format is newer than this worker's —
+ *    retryable on a newer worker), `"env_factory_missing"` (retryable on a factory-wired worker),
+ *    `"governed_unwired"` (retryable on an org-wired worker), `"origin_missing"` (a pending approval row
+ *    minted before the ask's origin was persisted on the park — terminal for the row's bytes; the host
+ *    decides the orphaned card itself, no worker version redeems it), `"ledger_event_unknown"` (a durable
+ *    LEDGER carries an event kind this binary does not know, so the replay is refused rather than served
+ *    incomplete — the one arm that is not row-scoped: NO row in that data directory is readable here, so
+ *    the host rolls the binary forward instead of routing one token elsewhere).
+ *  · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`, `"real_approval_forged"`,
+ *    `"read_face_damaged"`, `"read_face_forged"`, `"constraint_chain_missing"` (all terminal for the row's
+ *    current bytes — no worker version redeems a damaged row).
+ */
+export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */
 export declare class CheckpointError extends Error {
     readonly code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
@@ -2112,18 +2166,11 @@ export declare class CheckpointError extends Error {
          *  gave one (same carrier, same semantics: retry the SAME token after the wait). Absent on
          *  every other code. */
         retryAfterMs?: number;
-        /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
-         *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
-         *  damaged/caller-declared and no worker ever will" — blanket-retriable and gate-shape heuristics were
-         *  both refuted downstream, so the throw site carries the fact it always knew). Closed set;
-         *  additive and optional like `field` — `code` remains the only REQUIRED discriminant.
-         *   · `unsupported_version` arms: `"version_newer"` (retryable on a newer worker),
-         *     `"env_factory_missing"` (retryable on a factory-wired worker), `"governed_unwired"`
-         *     (retryable on an org-wired worker).
-         *   · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`,
-         *     `"real_approval_forged"`, `"constraint_chain_missing"` (all terminal for the row's
-         *     current bytes — no worker version redeems a damaged row). */
-        reason?: "version_newer" | "env_factory_missing" | "governed_unwired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
+        /** WHICH arm fired, where one `code` covers several — the word list and what each word means to a
+         *  host live at {@link CheckpointErrorReason}, its one home. Additive and optional like `field`
+         *  (`code` remains the only REQUIRED discriminant), which is exactly why the obligation to SPELL it
+         *  is a gate rather than a type: see the closed set's own doc. */
+        reason?: CheckpointErrorReason;
     } | undefined;
     constructor(code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
     /** `runner.resume` was handed an {@link ResumeOutcome} whose `gate` arm does not match the
@@ -2298,18 +2345,11 @@ export declare class CheckpointError extends Error {
          *  gave one (same carrier, same semantics: retry the SAME token after the wait). Absent on
          *  every other code. */
         retryAfterMs?: number;
-        /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
-         *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
-         *  damaged/caller-declared and no worker ever will" — blanket-retriable and gate-shape heuristics were
-         *  both refuted downstream, so the throw site carries the fact it always knew). Closed set;
-         *  additive and optional like `field` — `code` remains the only REQUIRED discriminant.
-         *   · `unsupported_version` arms: `"version_newer"` (retryable on a newer worker),
-         *     `"env_factory_missing"` (retryable on a factory-wired worker), `"governed_unwired"`
-         *     (retryable on an org-wired worker).
-         *   · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`,
-         *     `"real_approval_forged"`, `"constraint_chain_missing"` (all terminal for the row's
-         *     current bytes — no worker version redeems a damaged row). */
-        reason?: "version_newer" | "env_factory_missing" | "governed_unwired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
+        /** WHICH arm fired, where one `code` covers several — the word list and what each word means to a
+         *  host live at {@link CheckpointErrorReason}, its one home. Additive and optional like `field`
+         *  (`code` remains the only REQUIRED discriminant), which is exactly why the obligation to SPELL it
+         *  is a gate rather than a type: see the closed set's own doc. */
+        reason?: CheckpointErrorReason;
     } | undefined);
 }
 /**

package/dist/core/context-edit.d.ts

@@ -130,28 +130,6 @@ export declare const MIN_CLEAR_SAVINGS_TOKENS = 20000;
 /** Minimum kept results — CC `EUs` :397710 `Math.max(1, keepRecent)`. See
  *  {@link ContextEditOptions.keepRecentToolResults} for why both degenerate ends are unusable. */
 export declare const MIN_KEEP_RECENT_TOOL_RESULTS = 1;
-/**
- * checklist #54 (CC microCompact.ts:41-50 `COMPACTABLE_TOOLS` parity): the INCLUSION whitelist of
- * tools whose results may be content-cleared by the stale-result pass. CC's set is exactly
- * { Read, Bash, PowerShell (SHELL_TOOL_NAMES), Grep, Glob, WebSearch, WebFetch, Edit, Write } —
- * cheap-to-regenerate I/O.
- *
- * RE-VERIFIED against the 2.1.250 corpus (design/374 slice 4, member-by-member — a set is exactly
- * the shape where "the count still matches" is not evidence): `eQt = new Set([wt, ...VD, Yo, Xo,
- * yO, Yr, tn, er])` at cli250.js:41714, whose aliases resolve to `wt`="Read", `VD`=[`Xe`="Bash",
- * `Nt`="PowerShell"], `Yo`="Grep", `Xo`="Glob", `yO`="WebSearch", `Yr`="WebFetch", `tn`="Edit",
- * `er`="Write" — nine members, byte-identical to the set below, zero drift from the 223 reading.
- * The exclusion side is the load-bearing half and is unchanged too: everything NOT here is
- * PRESERVED (Agent/Task/Skill/ToolSearch/TodoWrite/Monitor/SendMessage/NotebookEdit and ALL MCP
- * tools are never content-cleared by this pass, upstream or here).
- *
- * Everything else is PRESERVED: expensive/decision-bearing results
- * (Agent subagent reports, Task* registry state, TodoWrite acks, Monitor, MCP tools, custom
- * ToolSpecs) survive to the harder defenses (compaction summarizes them instead of blanking them).
- * PowerShell is kept for CC fidelity even though sema does not mount it. Overridable per call via
- * {@link ContextEditOptions.compactableTools} for custom-tool-heavy embedders.
- */
-export declare const COMPACTABLE_TOOLS: ReadonlySet<string>;
 export interface ContextEditOptions {
     /** Start clearing once estimated context tokens exceed this. */
     budgetTokens: number;

package/dist/core/context-edit.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { DEFAULT_CHARS_PER_TOKEN, estimateContextTokens, estimateTokens } from "../internal/harness.js";
 import { isToolResult } from "./message-utils.js";
 import { PERSISTED_OUTPUT_PREFIX, offloadPagebackHint } from "./tool-result-store.js";
+import { compactableToolNames } from "./tool-registry.js";
 const CLEARED_MARKER = "[tool result cleared to save context]";
 const CC_CLEARED_MARKER = "[Old tool result content cleared]";
 const LEGACY_CLEARED_EXTENDED_PREFIX = "[tool result cleared to save context —";
@@ -46,17 +47,7 @@ function resolveKeepRecentToolResults(value, defaultValue) {
     }
     return Math.max(MIN_KEEP_RECENT_TOOL_RESULTS, value);
 }
-export const COMPACTABLE_TOOLS = new Set([
-    "Read",
-    "Bash",
-    "PowerShell",
-    "Grep",
-    "Glob",
-    "WebSearch",
-    "WebFetch",
-    "Edit",
-    "Write",
-]);
+const COMPACTABLE_TOOLS = compactableToolNames();
 function soleMarkerText(m) {
     const content = m.content;
     if (!Array.isArray(content) || content.length !== 1)

package/dist/core/engine-notice.d.ts

@@ -17,6 +17,12 @@ export interface EngineNotice {
      *    the value in force; `detail: { knob, raw, usedMs }`.
      *  - `"config.materialize_env_discarded"` — `SEMA_TOOL_MATERIALIZE_STRATEGY` held a value outside the
      *    closed set in a seat where it is not in force; `detail: { raw, specStrategy? }`.
+     *  - `"config.tool_card_undeclared"` (design/388 L4) — a tool minted a `details.type` card its definition
+     *    (or its caller declaration's `renderHints.resultCards`) never declared; the card was dropped from
+     *    `tool_end.structured`; once per leg per type; `detail: { type, sessionId, runId }`.
+     *  - `"config.tool_face_undeclared"` / `"config.tool_face_invalid"` (design/388 §2.7) — an MCP server's
+     *    `toolFaces` overlay names a tool the listing does not carry / does not fit the tool's materialized
+     *    schema (the tool mounts bare); once per leg per tool; `detail: { server, tool, problem?, sessionId, runId }`.
      *  - `"tool_result.offload_put_failed"` (#167) — a clear-with-offload persist's fire-and-forget put
      *    failed; THIS attempt stored nothing (the failure arm reports, it never re-inserts under the
      *    ref) — an earlier attempt of the same idempotent re-put may already have stored the row, so

package/dist/core/fs-write-gate-policy.d.ts

@@ -1,5 +1,11 @@
 import type { ExecutionEnv } from "../internal/harness-types.js";
 import type { ToolPolicy } from "./tool-policy.js";
+/** design/388 B22 — the identity triple the exemption probe hands the store beside the name. */
+export interface ToolCallIdentity {
+    capabilityId: string;
+    contractId: string;
+    shapeDigest: string;
+}
 /** Options for {@link createFsWriteGatePolicy}. */
 export interface FsWriteGatePolicyOptions {
     /** The task's real execution env (the one the hands run against) — canonicalization must see the
@@ -37,7 +43,7 @@ export interface FsWriteGatePolicyOptions {
      *    `combinePolicies` outranks this `allow` under the deny > ask > allow fold, and the two fail-closed
      *    asks for an UNRESOLVABLE target fire before any canonical key exists, so they are never exempted.
      */
-    isExempt?: (toolName: string, canonicalPath: string) => boolean | Promise<boolean>;
+    isExempt?: (toolName: string, canonicalPath: string, identity?: ToolCallIdentity) => boolean | Promise<boolean>;
     /**
      * design/380 O13 — the deployment HARD-CLOSE knob for guarded writes. Armed (`true`), a covered
      * write whose env does NOT provide `writeFileGuarded` is REFUSED (deny, typed message) — never the