@sema-agent/core 7.8.0 → 7.9.1

package/CHANGELOG.md

@@ -1,5 +1,79 @@
 # Changelog
 
+## 7.9.1 — 2026-09-08
+
+### Wire (additive) — `mcp.injection_dropped`: the request-lane MCP drop reaches the user (L-167; @server @cli @client-core)
+- **One mint, host facts.** A host that drops an entry of the user's own request-lane MCP injection (a `.mcp.json` row) now hands the FACTS to core — `mcpInjectionDroppedNotice({ sessionId, server, reason, field? })` — and core composes the notice: code `mcp.injection_dropped`, audience `user`, one sentence per reason naming the recovery. The host spells no code, audience or text (`@contract mcp.injection_dropped.single_mint`); a fact outside the vocabulary (an unlisted reason, an empty session or server name) is refused at the mint with a `TypeError`, never shaped into a notice that routes nowhere.
+- **Closed set** `McpInjectionDropReason` = `malformed_entry` / `name_reserved_by_deployment` / `gate_closed` / `over_cap` (`MCP_INJECTION_DROP_REASONS`, registered in CLOSED-SETS with its text table's fence); `detail: { sessionId, server, reason, field? }` — `sessionId` is REQUIRED (the routing half of a user row) and lifted onto the typed key by the one delivery throat; `field` present only for a non-empty host-supplied key. Dedup unit is the host's: per leg per server name.
+- **Consumers:** `ENGINE_NOTICE_CODES` +1 (`mcp.injection_dropped`, `NOTICE_AUDIENCE` row `user`) — a downstream audience mirror diffing against the catalog gains one row; server's `engine_notice` whitelist +1; cli renders one user-level transcript line off `detail.reason`. Exports +5 (`MCP_INJECTION_DROP_REASONS`, `MCP_INJECTION_DROP_TEXT`, `mcpInjectionDroppedNotice`, `McpInjectionDropReason`, `McpInjectionDropFacts`).
+
+### Narrowing — a path rule is judged against the path the tool really opens (#635)
+- **One effective-target resolver, shared with tool execution.** `ToolPathTarget` gains three resolution members — `base` (`"cwd" | "root"`, absent ⇒ `cwd`), `absent` (`"none" | "base"`, absent ⇒ `none`) and `patternParam` (the parameter whose ABSOLUTE glob pattern carries its own base directory) — declared by Read/Edit/Write/NotebookEdit (`cwd`/`none`) and Grep/Glob (`root`/`base`; Glob + `pattern`). `effectivePathTargetOf` (new export, with `pathTargetBaseOf`, `pathTargetSlotOnly` and the closed sets `TOOL_PATH_BASES` / `TOOL_PATH_ABSENCES`) is the one reader: both permission-rule lanes judge a call with it, and the four canonicalizing write fences plus the two search tools share the BASE SELECTION (and, for Glob, the absolute-pattern split) before applying their own identity to it — lexical-normal for a rule, canonical for a tool. One declaration, one selection, so a fence and the tool it fences can no longer resolve one call to two files. **Three shapes now REACH the rules that name them** (each was silently unreachable before): `Grep(//proj/**)` vs a Grep with the path omitted (the tool searches the root); `Glob(//proj/secret/**)` vs `{pattern:"/proj/secret/**"}` (the absolute pattern is the base); and a relative Grep `path`, which resolves against the ROOT as the tool does rather than against the live `cd`. The file tools are byte-unchanged (their declared `cwd` base is the old guess). One honesty change: a relative spelling with NO usable base is now "no verdict" instead of being fabricated into `/<spelling>`.
+- **Wire (additive, @server @cli @client-core @web-admin):** `ToolRosterEntry.pathTarget` carries optional `base` / `absent` / `patternParam` (present only when the definition declares them), and so do `ToolCallFace.pathTarget` and the parked row's face — without them the gate's stamped face loses the facts that say which file a call is about. A mirrored row schema with `additionalProperties: false` must admit the three keys. `ToolPathTarget` / `ToolCallFace.pathTarget` / `ToolCallLike.face.pathTarget` / the checkpoint parked-face row now all name ONE shape: `ToolCallPathTarget` is the READER type (both spellings satisfy it) and `ToolRosterPathTarget` its NORMALIZED spelling (`aliases` and `skillScopeEligible` always present, as the mint has always filled them) — both new exports; the call face and the parked row keep the normalized one, so a consumer already reading `face.pathTarget.aliases` compiles unchanged. `@server` `pathBases` is unchanged.
+- **The declaration door** (`toolFaceProblem`, caller faces and MCP `toolFaces` alike) refuses a `base` or `absent` word outside its closed set, a `patternParam` that is not a top-level schema property, a `patternParam` declared while `absent` is not `"base"` (it could never be read), **`base: "root"` on a face whose `access` is not `"read"`** — two write guards not taught by this change (the session-transcript directory guard, which is handed no root at all, and the frozen-spec deny) resolve a write target against the call's working directory alone, so a write face declaring a root base would be judged on two different files; refused until #638 threads the base through both, with no built-in affected (the three write tools declare `base: "cwd"`, the two search tools are reads) — and **`absent: "base"` on a face whose `access` is not `"read"`** — that word says "with no path, the call is about the whole base directory", which is a search SCOPE; a write with no path names no file, and a write face declaring it would be judged on its base by the rule lanes and on nothing by the containment fences (a writer could then evade the sensitive-path guard by omitting its path). A refused face does not mount, as before.
+- **An EMPTY path slot is absent on both sides.** Grep and Glob read their scope argument with the engine's own slot reader (first NON-EMPTY string under the declared param) instead of `!== undefined`. Behavior change, small and in the closing direction: `Glob({pattern:"/proj/secret/**", path:""})` now decomposes the absolute pattern exactly as an omitted `path` does (it used to fold `""` to the root and match the absolute pattern there, while every fence judged the pattern's own base — one call, two directories, which is how a root deny could be walked past). `Grep` with `path:""` still searches the whole root, as it did.
+- **A win-family spelling lands where the env puts it.** `canonicalizeTarget` never joins a spelling it calls absolute (a drive letter, a UNC root) to the base a tool hands it — it passes the spelling through and the execution env resolves it against its own working directory. So the resolver does not apply the DECLARED base to such a spelling either; it uses the tracked cwd with the root as the floor, which is what the tool's env will do. Without this, `Grep({path:"C:/secret.txt"})` under root `/` with a live `cd` to `/proj` was judged `/C:/secret.txt` while the tool read `/proj/C:/secret.txt`, and `Grep(//proj/**)` — a deny that fired in 7.9.0 — missed. The source-side fix is #637 (the canonicalizer's absoluteness is family-blind); this branch retires with it.
+- **The protective floor hands over the slot, not the resolution.** A call whose face declares no path target of its own is judged against the catalog's declaration for the NAME (design/388 B6) — a floor whose whole justification is "naming a slot can only tighten a deny". Naming a slot does; claiming how a FOREIGN tool of the same name resolves that slot does not, so the floor now supplies `param`/`aliases`/`access` and lets the resolution members default (`pathTargetSlotOnly`, new export). Net effect versus 7.9.0 for a call that carries a face: none — this keeps the floor where it was while the declarations moved. A BARE request (no face at all — a policy invoked outside a Runner) does read the catalog whole, resolution members included, which is the point: there the catalog IS the tool being judged.
+
+### Narrowing — the tightening (deny/ask) reach reads a real shell lexer (#631)
+- **Reach.** `programRunReachOf(rule, command)` answers the closed set `ProgramRunReach` = `reached` / `not_reached` / `unreadable` (registered in CLOSED-SETS); `ruleReachesProgramRun` is its boolean face (unchanged signature, `reached` only). The command is read by `src/core/shell-lexer.ts` (no grammar library): quotes and escapes, every expansion form, the full redirection operator set (IO_NUMBER, `&>`/`&>>`, `N>&M-`, `>&-`, `<>`, `<<<`, here-documents whose bodies are skipped), every connector (`&` and a newline bound segments), subshell/group boundaries, leading keywords (`if rm -r x; then …` runs `rm`), leading assignments, and the closed wrapper table `SHELL_WRAPPER_TABLE` (`command`/`builtin`/`exec`/`env`/`sudo`/`doas`/`pkexec`/`nohup`/`time`/`nice`/`timeout`/`stdbuf`/`xargs`/`watch`/`ionice`/`setsid`/`taskset`/`chrt`/`strace`/`ltrace`/`flock`/`script`/`unshare`/`nsenter`/`noglob`/`nocorrect` — upstream's three strips as one table). Peeling is ADDITIVE (`ShellSegment.peeled`): `sudo rm -r x` is a run of `sudo …` and of `rm -r x`, so a deny on either reaches, and a rule body is never peeled (`Bash(sudo rm -r x)` denies exactly that). A command/process substitution anywhere in a segment (`$(…)`, backticks, `<(…)`, inside `${…}`/`$((…))`, a redirection operand, an unquoted here-document body) marks the segment `peelUnreadable`: the runs it spells are still compared (`echo "$(rm -r x)"` reaches `Bash(echo:*)`), and every other deny/ask reads `unreadable` — the commands INSIDE a substitution are deliberately not read (an approval prompt, never a guessed boundary). Words are compared argv-wise with quotes removed on BOTH sides: `rm "-r" x`, `sudo rm -r x`, `command rm -r x`, `rm -r x; echo "$HOME"`, `rm -r x &> log`, `rm -r x 2>&-`, `npm test & curl x`, `do curl x; done`, `timeout -- 5 rm -r x` now REACH a `Bash(rm -r:*)` / `Bash(curl:*)` deny or ask (7.9.0: silence on every one of them). A `#` comment and a quoted-delimiter here-document body are not runs (7.9.0 judged `echo ok # ; curl x` as a curl run — a limitation, not over-approximation). A leading `~` is an expansion of one word (an exact deny on the expanded path asks; a prefix deny reaches). Module split beside the lexer: `shell-scan.ts` (the byte-walking scanners) and `shell-wrapper-table.ts` (the table).
+- **Unreadable is a fail-closed ask, never silence — and only when a standing deny/ask rule could not be judged** (zero tightening rules ⇒ the lane stays silent, as before). Unreadable = an expansion where the rule reads a word (`rm $X` vs `Bash(rm -r:*)`; `"$@"` / `"${a[@]…}"` after an exact body — they may be zero words), an unterminated quote/substitution, a syntax error (`> ;`, a dangling `&&`), a `for`/`case`/`function` header, a wrapper handed its command as one string (`env -S`, `flock -c`, `script -c`) or to a shell (`watch`, `script`), a wrapper option outside the row's CLOSED option sets (short or long — the table names every option it reads; an unknown one asks rather than guessing its arity), an expanding option value or operand, a positional that does not match (`taskset zz`), more than 8 wrapper layers, a here-document delimiter spelled with an expansion, a command over 10 000 characters (`MAX_SHELL_READ_CHARS`, upstream's own bound). Per lane: the PERSISTED store answers `{ unreadable: true, reason }` — the same shape as an unreadable store (origin `rule_store_unavailable`, real-approval, the classifier never answers; the message says the reason instead of "the store could not be read"); the ORG verdict carries `unreadable: <reason>` beside the first rule it could not judge (`behavior: "ask"`, origin `org_rule`, message names rule + reason); the rule DSL mints `{ action: "ask", matchedAskRule, requiresRealApproval: true }`. Precedence: a deny that cannot be judged outranks an ask that can; within one behavior a reach settles it. **No new AskOrigin word** — `rule_store_unavailable`'s meaning is widened to "the person's deny/ask rows cannot be enforced for this call" (store unreadable OR call unreadable against them; JSDoc amended).
+- **Wire (additive):** `PersistedRuleUnreadable.reason?: string`; `OrgGateVerdict.verdict.unreadable?: string` (only beside `behavior: "ask"`; both screened by the normalizers, a non-string dropped); `PersistedRuleVerdict.unreadable?: string`; `orgRuleVerdictFor` returns `OrgRuleVerdict` (the same two members plus the optional third). New exports: `programRunReachOf`, `PROGRAM_RUN_REACHES`, `ProgramRunReach`, `ProgramRunReachOutcome`, `readShellCommand`, `isFullyReadable`, `MAX_SHELL_READ_CHARS`, `SHELL_WRAPPER_TABLE`, `ShellCommandShape`/`ShellSegment`/`ShellWord`/`ShellWrapperName`, `OrgRuleVerdict`. Retired (internal, never exported): `stripRedirections`, `stripFdDuplications`, `ruleLaneSegmentsOf`, `ruleAdmitsProgramRun`.
+- **The allow side is byte-untouched:** `ruleAdmitsCommand` keeps its whole-string refusal of every shell construct (`rm -r x > f` is admitted by nothing; a quoted spelling is not an allow's equal) — and the deny now reads the quoted spelling, so an exact allow row minted for `rm "-r" x` no longer outruns a `Bash(rm -r:*)` deny.
+- **Merged-tree round (four `not_reached` blind spots, each now `unreadable` or reached at all three lanes, the classifier never consulted):** ① an extended glob's INTERIOR is read for substitutions (`echo @($(rm -r x))` — the pattern's interior runs a program). ② a clustered `xargs -tI R` records the replacement token by the resolved letter (`-tI R rm -R x` no longer reads `rm -R x` as literal). ③ **executors are rows of the same closed table**: `viaShell` now means "evaluates its operands as shell input" (a command string, a script file, an expression) and covers `eval`, `source`, `.`, `trap`, `let`, `sh`/`bash`/`zsh`/`dash`/`ksh`/`fish`/`csh`/`tcsh` beside `watch`/`script` — the string is not split and judged (upstream splits on whitespace; the strict word stands), so `bash -c 'rm -r x'`, `eval 'rm -r x'`, `bash cleanup.sh`, `sudo bash -c …` ask once when a deny/ask rule stands (7.9.0: silence); a new row member `executes` names the words after which a NON-wrapper runs a command anywhere in its argv — `find` with `-exec`/`-execdir`/`-ok`/`-okdir` (such a word, or any expansion among `find`'s arguments, asks; `find . -name '*.ts'` stays silent). The executor's own run is still read (`Bash(eval:*)`, `Bash(find:*)` reach). ④ indirect arithmetic through a parameter SUBSCRIPT (`${arr[a]}`, `${arr[$i]}`, `${#arr[n]}` — bash evaluates an indexed subscript recursively, so a stored `arr[$(…)]` runs; `[@]`/`[*]`/a number name nothing) and through the `(( … ))` command (read as the arithmetic command — a run-less piece — instead of two boundaries around a phantom program) are unreadable, the same law as `$((a))`. `isFullyReadable` (exported; not read by the offer lane, which mints from its own reader) answers false for every shape above. **The round's two adversarial passes (all findings adopted):** a `$…` inside arithmetic or a subscript is a name too (`(( $1 ))`, `${arr[$1]}`); the arithmetic command is read after `time`/`time -p`/`{`/an adjacent `!`, and its interior is judged safe only when it is digits, operators and spaces — `((:);)` (nested subshells bash re-reads after the arithmetic parse fails) asks instead of vanishing; an `xargs -I` token carrying an expansion stops the peel; `$[…]` (legacy arithmetic) and a slice offset/length naming a variable (`${x:a}`, `${x:0:a}`) are hidden runs like a subscript; **builtins whose operands NAME variables** (`VARIABLE_OPERAND_BUILTINS` in the table module: `printf`, `unset`, `read`, `mapfile`/`readarray`, `declare`/`typeset`/`local`/`export`/`readonly`, `test`/`[`/`[[`) mark a hidden run when an operand spells an array element with a non-numeric subscript (`printf -v 'arr[a]'`, `-v'arr[a]'`, `unset arr[a]`, `declare arr[a]=1`, `[[ -v arr[a] ]]`) or an integer-attribute assignment (`declare -i x=a`) — judged at every peel candidate (`command printf -v …`); `compgen`/`complete` with `-C`/`-F` join the `executes` rows; an unclosed `((` is an unreadable tail in linear time. Not judged (documented, deliberate — the price would be a prompt on every `export FOO="$BAR"` / `[[ $n -gt 0 ]]`): an operand that is WHOLLY an expansion to one of those builtins, and an arithmetic comparison's operands.
+- **@cli** (card copy): an ask of origin `rule_store_unavailable` may now be "your command could not be read against your deny/ask rules (<reason>)", not only "the rule store could not be read" — the decision's `message` carries the reason; a card that hard-codes store wording for the origin should read the message. An org ask's message has a second form (`… may reach this call, which could not be read against it (<reason>)`). **@server**: zero required changes (both new members are optional and screened; `OrgGateVerdict` producers may add `unreadable` on an ask verdict).
+
+## 7.9.0 — 2026-09-08
+
+The resume decision ladder leaves runtask.ts, and the two `runtask.ts` seams design/388 slice 1 shipped unwired in 7.8.0 are wired.
+
+### BREAKING — content-form deny/ask rules get their engine lane (#625; cli B-043 root cause)
+- **One three-state rule model.** A persisted rule row carries `behavior: "deny" | "ask" | "allow"` (closed set `RULE_BEHAVIORS`, one precedence table `RULE_BEHAVIOR_PRECEDENCE`: deny > ask > allow, read by every adjudication). Identity is the (behavior, text, scope) triple. Renames: `PersistedAllowRule`→`PersistedRule`, `ParsedAllowRule`→`ParsedRule`, `StoredAllowRules`→`StoredRules`; `parseAllowRuleText`→`parseRuleText(text, behavior)` (no default), `formatAllowRuleText`→`formatRuleText`. Removed exports: those five names. Same-name reshapes: `PersistedRuleHit.behavior`; `ToolGateInput.persistedRules.admits`→`adjudicate` (the answer is a verdict; a read failure MUST answer `{ unreadable: true }`); `RuleTombstone` / `RuleAddDelta` / `QuarantinedRuleAdd` / `RuleSyncDrop` / `RuleSyncJoinDelta.quarantine[]` / `SessionRuleAdd` / `RemovedPermissionRule` / `RuleCandidate` / `RedeemResult` / `RedeemedBatchMember` carry `behavior`; `removePersistedRule({ behavior })`; `RuleApprovalRecord.schema` 3→4; `ImportPreview.uncovered.denyAskBuckets` removed; `PermissionRulePolicyOptions.bashPrefixLane` removed, `pathBases` added; `PersistedRuleTool` is `string` (tools derive from the catalog's path targets, `ruleToolGrammarOf`); `PersistedRuleMatch` +`path`; `directoryRuleAdmits` no longer reads the tool.
+- **Store rows (@server two stores + contract kit):** every row / tombstone / quarantine / dropped entry carries `behavior` (required on the wire: a row without it is not shapeable and is skipped with a warning; a tombstone without it withholds this round's add). File store schema 3→4 (`.rule-schema-4`; a schema-3 bucket migrates once with `behavior: "allow"` on every row and tombstone; a behavior word outside the set is left for a person, refused whole). Sync contract kit +3 cases. `RuleSyncResponseBody.dropped[].behavior` required; `PermissionRuleSyncResult.resurrected[].behavior`.
+- **Closed sets (@cli @client-core @server readers):** `DeniedBy` +`persisted_rule` (a person's own standing deny row); `AskOrigin` +`rule_store_unavailable` (a wired persisted-rule store could not be read: the ask is fail-closed, the classifier does not answer it, real-approval derived); `PermissionRuleIssue.code` −`unsupported.bash_prefix_rules_store` +`invalid.command_rule` / `unsupported.path_base`.
+- **The lane.** The persisted-rule lane reads the store once per decision (not only on a surviving ask) and adjudicates: a deny row refuses outright (`deniedBy: "persisted_rule"`, a veto row in the station table); an ask row asks with `matchedAskRule` (origin `ask_rule`, a person's standing "ask me each time" that the classifier never answers, by design); an allow row is the prior predicate. The edit round re-adjudicates. Path family: `Edit(~/.sema/settings.json)` / `Write(//tmp/secret/**)` deny/ask rules judge the call's path target (deny/ask read the protective slot, allow the declared slot: the 7.8.0 two-reader rule); pattern grammar `//abs`, `~/`, `/root-relative`, cwd-relative, `*` within a segment, `**` across (narrower than CC's gitignore semantics: `?` / `[]` / `{}` / `!` refused, disclosed). Precedence across authorities: org deny > org ask > personal deny > personal ask > personal allow > bare ask.
+- **The compiler** (`createPermissionRulePolicy`) no longer refuses a Bash prefix deny/ask (`Bash(rm -r:*)` in `permissions.deny` / `permissions.ask` compiles; the retired re-coding never appears, tripwire pinned); an allow in content form still refuses `unsupported.bash_prefix`. Redirections are stripped on the tighten side before matching (`> file`, `2>`, `>|`, fd duplications; the remaining forms are #631).
+- **@cli:** the shell's escort of content-form ask/deny rules into bare tool-name asks (B-043's amplification) retires whole; `permissions.deny` / `permissions.ask` content rules go up the wire as written. Judgement: `permissions.ask: ["Bash(rm -r:*)"]` + auto ⇒ `date` zero cards and zero classifier calls, `rm -r x` a real card of origin `ask_rule`; deny likewise.
+
+### Fixes over the merged tree (main-tree adversarial round over #625 × 393 S3)
+- **#632 — a deny row imported while a call was PARKED now vetoes the resumed execution.** The resumed execution boundary re-adjudicates the person's persisted-rule lane in the same posture as the deny-narrowing layers: a matching deny row (or an ask row, or an unreadable store — the durable path cannot re-ask) ends the call with `deniedBy: "persisted_rule"`, the approval is spent, the call is re-issued. `Prepared.persistedRuleLane` (internal seat) carries the lane to the driver. Pin: park → import deny → resume ⇒ zero executions; control without the row executes once.
+- **Schema-4 rule buckets are strict on every row's `behavior`.** A correctly checksummed schema-4 file carrying a rule, tombstone or quarantined row whose behavior word is outside deny/ask/allow is refused WHOLE (`list()` rejects, the lane reads `unreadable` ⇒ the ask carries `rule_store_unavailable`), never read as "no rule" beside a live allow row.
+- **Known limits, disclosed (tickets, not this release):** #631 — the tighten-side command reader is a hand-written stripper: `command rm -r x`, `rm "-r" x`, `rm -r x; echo "$HOME"` (expansion makes segmentation fail) do not reach a `Bash(rm -r:*)` deny/ask; direction = a real shell lexer with wrappers, and an unreadable command asks instead of no-match. #635 — the path lane reads the call's path slot, not the search tools' effective target: `Grep(//proj/**)` with the path omitted (tool default = root), `Glob` with an absolute pattern, and a relative Grep path resolved against liveCwd where the tool resolves against root, are not reached; direction = one effective-target resolver shared with tool execution. Both are under-blocking relative to the rule's intent, not wider than 7.8.0 (which had no engine-side deny at all).
+
+### Wire (additive — new frames start being pushed; the vocabulary shipped in 7.8.0)
+- `tool_roster_delta` frames are now PUSHED. The driver subscribes to the leg's roster-delta seat at the point it pushes `wiring_manifest` (the roster on the manifest is the baseline a delta diffs against; a delta the seat buffered before the subscription flushes first, in publish order) and forwards each run-time roster change (the RefreshMcpTools seam) as its own identity-minted frame: `delta.fromDigest` = the digest the consumer holds, `delta.roster` the whole post-change roster, `delta.summary` the added/removed/changed names. One refresh that changes the roster ⇒ exactly one frame; a refresh that changes nothing publishes none. A consumer that adopted 7.8.0's tolerant default (adopt the carried roster, record a skew when `fromDigest` mismatches) needs nothing new. @server (live projection of the roster: the frame is on the wire now), @cli (the two frames `wiring_manifest.manifest.tools` / `tool_roster_delta` parse as already claimed).
+- `tool_end.structured` is projected through the LEG's card projector (`Prepared.structuredProjector`: the engine card set ∪ the caller rows' declared `renderHints.resultCards`) on every arm that mints a tool_end body — the live loop, the resumed batch's executed and refused arms, the deferred-sibling close, the two orphan reconciles. Effect on the wire: a caller tool's DECLARED card now rides its frame (7.8.0 dropped it — only engine cards passed); an undeclared `details.type` is still dropped and is now announced ONCE per leg as `config.tool_card_undeclared` (audience operator), which 7.8.0 minted at the seat but never reached from the loop.
+- 7.8.0's "Not wired" disclosure retires whole: the roster delta frame, the structured projector and the manifest-side subscription are wired; the `resume` identity arm was already wired in 7.8.0.
+
+### Narrowing
+- **design/388 §2.2 ④ — a caller's `renderHints.resultCards` must live under the tool's OWN card namespace** (the row's `cardId`: `caller:<contractId>` — one mint, `rosterCardId`, read by the row and by the prepare door). A declaration naming another contract's namespace, an engine card (`builtin:*` or a bare engine card type) or a bare name is refused at prepare, `config.tool_face_invalid`. Load-bearing now that the leg projector admits every DECLARED card onto the wire (a 7.8.0 tree accepted the declaration and dropped the card at projection; the S3 tree would have shipped it as a foreign card). @cli @server: a caller tool that declared a foreign card namespace now fails prepare instead of mounting.
+
+### Internal (byte-invariant on the runtime — design/393 S3)
+- `Runner.resumeStream`'s pre-CAS ladder (E1–E10 of the decomposition map, 1 918 lines) moved verbatim into eight `resume-*.ts` lanes (layer 3), each behind ONE Input: admission (+ wake shaping), review-outcome (+ gate match, park twins), policy-outcome, checkpoint-screen (+ abort / handle / constraint rungs), internals-and-config, apply (+ settlement mint), preflight, claim. E11 (the post-claim hand-off) stays the driver's. The four async rungs enter their successor in their own last continuation (a `next` seat — the tool gate's fold→lanes shape), and the internals-and-config rung hands the ladder's one window await back as a started promise the driver awaits where the ladder did, so no host read of the ladder moved off its tick. runtask.ts 9 186 → 7 470 lines; dist `runtask.js` −730 / +50 with every moved line accounted for.
+- `toolEndBodyFrom` / `reconciledToolEndBody` (internal machinery, not on the public surface) take the projector as a required parameter; the module-level `structuredFrom` is gone — `createStructuredProjector()` with no options is the engine set alone (the fixture form). `ToolRosterDeltaSeat.unsubscribe()` (additive) closes the lane with the leg.
+
+### Pins
+- `test/design393-s3-resume-lanes.test.ts` (WIRED / Input shape / await boundaries — five in-body mutations red), `test/design393-s3-388-seams.test.ts` (the two seams end to end on a real stdio MCP server and a caller tool with a declared card — three mutations red), the run-lane residents pins, G5's generic-Input pin.
+
+### Gates (#627 — server [6626] door request)
+- **A `checkpoint.unsupported_version` refusal always names its arm (#627).** The word rides an OPTIONAL
+  `detail.reason`, so nothing red when a throw site omitted it — and the file ledger's replay refusal
+  (`FileCheckpointStore`, an event kind written by a newer worker) had omitted it since it was written. It
+  now carries `reason: "ledger_event_unknown"`, the tenth member of the closed set: the one arm that is NOT
+  row-scoped — no row under that data root is readable by this binary, so the host rolls the binary forward
+  rather than routing one token to another worker. **@server**: additive word on an optional member; a
+  consumer holding a total table over `reason` gains a row.
+- The word list leaves the constructor's inline type for a named closed set, `CheckpointErrorReason`
+  (exported from `src/core/checkpoint-store.ts`; the public export surface is unchanged), registered in
+  `docs/CLOSED-SETS.md` with a new **mint-obligation** leg in `gate:closed-sets`: every
+  `new CheckpointError("checkpoint.unsupported_version", …)` under `src/` must pass a detail object literal
+  whose `reason` is spelled AT the site (a literal, or a conditional whose branches are) and is a member of
+  the set — a missing detail, a missing/shorthand/computed word, or a word outside the set reds with
+  `file:line`, and a per-row population floor reds when the walker stops seeing the sites at all. The
+  registry's two G8 floors were re-measured in the same pass (rows 8 → 10, switches 1 → 3; both had drifted
+  below the census, which is the blindness a floor exists to make loud).
+
+
 ## 7.8.0 — 2026-09-08
 
 One roster instead of 29 name tables. `ToolSpec` already described a tool completely; the engine, the server and the shells still re-asserted each tool's identity and axes by NAME in hand-kept tables (a retired name lived on as a key in five of them). This version mints ONE effect roster per prepared leg from the mounted instances, derives every remaining table from a static catalog, and closes the mount array behind a builder.
@@ -29,7 +103,7 @@ One roster instead of 29 name tables. `ToolSpec` already described a tool comple
 - A deferred tool's placeholder carries the real tool's `aliases` (dispatch by alias resolves to the same slot before and after activation, the roster's name→row resolution agrees with the dispatcher's — wire name first, then alias, in mount order — and a transcript call under an alias activates the canonical entry on replay). The MCP `toolFaces` overlay binds to the RAW accepted tool name (`Tool.mcpRemoteName`, a typed carry the materializer stamps): two raw spellings folding onto one minted name cannot make a face land on the other tool — the unaccepted spelling is announced undeclared. `TOOL_KEY_MAX_CHARS` / `TOOL_KEYS_MAX`; `ToolCallLike` / `callPathTargetOf` / `isPathConfinableWrite` / `fileOpAccessOf` (the compaction summary records file ops for the FILE families only — a search tool's `path` is a root, not a file read).
 - The roster carries every name the model can call: the ToolSearch instance the deferred lane appends to the harness list rides the roster's ENGINE LANE (`RosterBuilder.mountEngineLane`) as the trailing row, minted after the disclosure lane (which reads the mount array and never writes it) — the prompt manifest's tool rows are the mount array; the roster is that plus the engine lane. The effect map follows the instance the harness dispatches to (a later same-name mount's declared effect is the name's truth). `gate:tool-catalog` rule ②b: a resolvable `defineTool({ name })` with no catalog row is red (per-file `HOST_FACTORY_DEFINITIONS` exemption list, empty today).
 
-### Not wired in 7.8.0 — three runtask.ts seams deferred to design/393 S3 (the seats are minted; the driver does not yet consume them)
+### Not wired in 7.8.0 — three runtask.ts seams deferred to design/393 S3 (the seats are minted; the driver does not yet consume them) — RETIRED in 7.9.0: all three are wired there (see that section)
 - **Disclosure**: the three items below are the driver-side half of this slice. In 7.8.0 the roster, its delta seat and the structured projector all exist and are pinned at the seat/function level, but runtask.ts (design/393's domain, being decomposed in parallel) does not yet call them: no `tool_roster_delta` frame is pushed and `tool_end` still projects through the module-level card set. A consumer must not rely on `tool_roster_delta` frames until the version that lands 393 S3. (The `resume` identity arm — `judgeParkedToolIdentity` minting `resume.tool_contract_mismatch` — IS wired in 7.8.0: the merge-seam adversarial round showed a same-name replacement executing under a different face once the rechecks read faces, so it did not wait for S3.)
 - `tool_end`: the body projection reads `prepared.structuredProjector` (the per-leg card set + the once-per-leg announce) in place of the module-level `structuredFrom` (tool-end-body.ts:77 via runtask).
 - `wiring_manifest`: beside the manifest push (runtask.ts ≈:4149) subscribe `prepared.toolRosterDeltas.subscribe((delta) => queue.push({ type: "tool_roster_delta", delta, ...ident() }))`.

package/dist/agents/subagent.d.ts

@@ -248,7 +248,7 @@ export declare function classifySubagentError(terminal: TerminalCause): {
  * delegation's landing report from `structured` and MUST NOT scrape the model-facing text. The
  * `async_launched` receipt honored it (`type:"agent"`, on the allowlist); the **completed** delivery
  * did not: its `details` was `{...child}` — a bare `TaskResult` spread with no `type` key at all — so
- * `structuredFrom`'s allowlist dropped it every time. The one card the contract names by name was the
+ * the card projector's allowlist dropped it every time. The one card the contract names by name was the
  * one card that could never arrive, and the only way to get the child's report was the thing the
  * contract forbids.
  *

package/dist/core/ask-origin.d.ts

@@ -41,6 +41,14 @@ import type { PermissionResult } from "./tool-policy.js";
  *    lane may answer it).
  *  - `org_rule` — an organization policy rule asked (or stamped an existing ask): "no configuration
  *    clears this, a person nods".
+ *  - `rule_store_unavailable` — the deployment wired a persisted-rule store and could not READ it for
+ *    this call (a read failure, a timeout), OR could not read the CALL against the person's standing
+ *    deny/ask rows (the tightening lexer's `unreadable` word: an expansion where a rule reads a word, an
+ *    unterminated quote, a syntax error — the answer's `reason`): the person's own deny/ask rows cannot
+ *    be enforced for this call, so it fails closed the way an unreadable org snapshot does — an allow
+ *    tightens to an ask a person must clear, and no automatic lane may answer ("does one of my rules
+ *    forbid this?" is unanswered). One word for both, deliberately: the AUTHORITY semantics (who may
+ *    answer, what clears it, what the evidence records) are identical, and only the mechanism differs.
  *  - `hook` — a deployment's PreToolUse screening face raised or co-raised the ask; the word is
  *    engine-stamped at the fold and is the deployment's own per-call adjudication.
  *  - `ask_rule` — an EXPLICIT `ask` permission rule matched: a person's standing "ask me each time",
@@ -61,7 +69,7 @@ import type { PermissionResult } from "./tool-policy.js";
  *    observer or an approval card can say WHICH engine layer raised the question, which one word
  *    could not.
  */
-export declare const ASK_ORIGINS: readonly ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
+export declare const ASK_ORIGINS: readonly ["content_question", "unresolvable", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 export type AskOrigin = (typeof ASK_ORIGINS)[number];
 /** Whether a value is a member of the closed origin set. Exported because the word crosses process
  *  boundaries: a host validating one it received must not hand-roll the set. */
@@ -87,6 +95,9 @@ export interface AskOriginFacts {
      *  read-back off the decision (a policy can put `decisionReason: "org_rule"` on its own ask; the
      *  gate's cell cannot be written by a policy). */
     readonly org: "rule" | "unavailable" | undefined;
+    /** The gate's own record of its persisted-rule lane's READ: `"unavailable"` when the wired store could
+     *  not be read for this call (the lane's deny/ask rows are unenforceable). Written only by the gate. */
+    readonly ruleStore?: "unavailable" | undefined;
     /** Which of the gate's OWN post-fold tightens minted the standing ask, if one did — again the gate's
      *  record of its own layer (a tighten replaces an `allow` wholesale, so at most one fires per pass),
      *  never a read-back of `decisionReason: "safety"` off a decision a policy could have composed. */
@@ -127,6 +138,7 @@ export declare const ORIGIN_IMPLIES_REAL_APPROVAL: {
     readonly unresolvable: false;
     readonly org_unavailable: "at_derivation";
     readonly org_rule: "at_derivation";
+    readonly rule_store_unavailable: "at_derivation";
     readonly hook: false;
     readonly ask_rule: false;
     readonly denial_limit_fallback: "at_mint";
@@ -148,6 +160,8 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  *  - `org_unavailable` / `org_rule`: judgment may clear a `requiresRealApproval` bit a POLICY minted,
  *    but not the org's — while adjudication is unavailable the org's answer is unknown, and an org
  *    ask carries the org's own "a person nods" semantic.
+ *  - `rule_store_unavailable`: the person's own deny/ask rows are unreadable — whether one forbids this
+ *    call is unknown, and a classifier verdict would answer that question in the person's stead.
  *  - `hook`: the deployment's own per-call adjudication; the classifier is its delegate for
  *    hesitation, not an override for its screening face.
  *  - `ask_rule`: a person's standing "ask me each time" — the classifier answering it would decide
@@ -169,6 +183,7 @@ declare const CLASSIFIER_MAY_ANSWER: {
     readonly unresolvable: false;
     readonly org_unavailable: false;
     readonly org_rule: false;
+    readonly rule_store_unavailable: false;
     readonly hook: false;
     readonly ask_rule: false;
     readonly denial_limit_fallback: false;

package/dist/core/ask-origin.js

@@ -1,4 +1,4 @@
-export const ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
+export const ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 const ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
 export function isAskOrigin(v) {
     return ASK_ORIGIN_SET.has(v);
@@ -19,6 +19,8 @@ function originLadder(decision, facts) {
         return "org_unavailable";
     if (facts.org === "rule")
         return "org_rule";
+    if (facts.ruleStore === "unavailable")
+        return "rule_store_unavailable";
     if (decision.decisionReason === "hook")
         return "hook";
     if (decision.matchedAskRule !== undefined)
@@ -36,6 +38,7 @@ export const ORIGIN_IMPLIES_REAL_APPROVAL = {
     unresolvable: false,
     org_unavailable: "at_derivation",
     org_rule: "at_derivation",
+    rule_store_unavailable: "at_derivation",
     hook: false,
     ask_rule: false,
     denial_limit_fallback: "at_mint",
@@ -48,6 +51,7 @@ const CLASSIFIER_MAY_ANSWER = {
     unresolvable: false,
     org_unavailable: false,
     org_rule: false,
+    rule_store_unavailable: false,
     hook: false,
     ask_rule: false,
     denial_limit_fallback: false,

package/dist/core/checkpoint-store.d.ts

@@ -843,15 +843,10 @@ export type PendingAction = {
      * display `family` + declared `pathTarget` — off the same roster row at the same mint. The pre-CAS resume-edit
      * recheck has no roster yet; it rebuilds the call face from these (`parkedCallFaceOf`) and judges the edit as
      * the live gate judged the original (merge-seam H1: without them a caller slot fell to the catalog's slot for
-     * the NAME). Any member absent ⇒ pre-388 row ⇒ the recheck falls to the catalog, never a widened grant.
+     * the NAME). Any member absent ⇒ pre-388 row ⇒ the recheck falls to the catalog, never a widened grant — including #635's resolution members, which a row written before them simply lacks (they then read as their documented defaults).
      */
     family?: import("./tool-face.js").ToolFamily;
-    pathTarget?: {
-        param: string;
-        aliases: string[];
-        access: "read" | "create" | "edit";
-        skillScopeEligible: boolean;
-    };
+    pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
     /**
      * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an
      * older reader ignores. Unlike that precedent seat — which resume DOES read, through its
@@ -1967,6 +1962,30 @@ export interface CheckpointSummary {
  * {@link ResourceLedger.spentMicroUsd}. Pure; reads no clock/random.
  */
 export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
+/**
+ * WHICH arm of a multi-arm {@link CheckpointError} `code` fired (requested 2026-08-10: a deployment retry
+ * policy needs to tell "a newer worker can redeem this row" from "this row is damaged/caller-declared and
+ * no worker ever will" — blanket-retriable and gate-shape heuristics were both refuted downstream, so the
+ * throw site carries the fact it always knew).
+ *
+ * A CLOSED SET with one home, registered in `docs/CLOSED-SETS.md`. It is carried in an OPTIONAL member, so
+ * the compiler is silent when a throw site omits it, and a site that omits it hands the host a refusal it
+ * cannot classify — the registry's mint-obligation leg is what makes the omission loud (every
+ * `checkpoint.unsupported_version` construction site must spell one of these words AT the site).
+ *
+ *  · `unsupported_version` arms: `"version_newer"` (the row's format is newer than this worker's —
+ *    retryable on a newer worker), `"env_factory_missing"` (retryable on a factory-wired worker),
+ *    `"governed_unwired"` (retryable on an org-wired worker), `"origin_missing"` (a pending approval row
+ *    minted before the ask's origin was persisted on the park — terminal for the row's bytes; the host
+ *    decides the orphaned card itself, no worker version redeems it), `"ledger_event_unknown"` (a durable
+ *    LEDGER carries an event kind this binary does not know, so the replay is refused rather than served
+ *    incomplete — the one arm that is not row-scoped: NO row in that data directory is readable here, so
+ *    the host rolls the binary forward instead of routing one token elsewhere).
+ *  · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`, `"real_approval_forged"`,
+ *    `"read_face_damaged"`, `"read_face_forged"`, `"constraint_chain_missing"` (all terminal for the row's
+ *    current bytes — no worker version redeems a damaged row).
+ */
+export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */
 export declare class CheckpointError extends Error {
     readonly code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
@@ -2142,20 +2161,11 @@ export declare class CheckpointError extends Error {
          *  gave one (same carrier, same semantics: retry the SAME token after the wait). Absent on
          *  every other code. */
         retryAfterMs?: number;
-        /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
-         *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
-         *  damaged/caller-declared and no worker ever will" — blanket-retriable and gate-shape heuristics were
-         *  both refuted downstream, so the throw site carries the fact it always knew). Closed set;
-         *  additive and optional like `field` — `code` remains the only REQUIRED discriminant.
-         *   · `unsupported_version` arms: `"version_newer"` (retryable on a newer worker),
-         *     `"env_factory_missing"` (retryable on a factory-wired worker), `"governed_unwired"`
-         *     (retryable on an org-wired worker), `"origin_missing"` (a pending approval row minted
-         *     before the ask's origin was persisted on the park — terminal for the row's bytes; the host
-         *     decides the orphaned card itself, no worker version redeems it).
-         *   · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`,
-         *     `"real_approval_forged"`, `"constraint_chain_missing"` (all terminal for the row's
-         *     current bytes — no worker version redeems a damaged row). */
-        reason?: "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
+        /** WHICH arm fired, where one `code` covers several — the word list and what each word means to a
+         *  host live at {@link CheckpointErrorReason}, its one home. Additive and optional like `field`
+         *  (`code` remains the only REQUIRED discriminant), which is exactly why the obligation to SPELL it
+         *  is a gate rather than a type: see the closed set's own doc. */
+        reason?: CheckpointErrorReason;
     } | undefined;
     constructor(code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
     /** `runner.resume` was handed an {@link ResumeOutcome} whose `gate` arm does not match the
@@ -2330,20 +2340,11 @@ export declare class CheckpointError extends Error {
          *  gave one (same carrier, same semantics: retry the SAME token after the wait). Absent on
          *  every other code. */
         retryAfterMs?: number;
-        /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
-         *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
-         *  damaged/caller-declared and no worker ever will" — blanket-retriable and gate-shape heuristics were
-         *  both refuted downstream, so the throw site carries the fact it always knew). Closed set;
-         *  additive and optional like `field` — `code` remains the only REQUIRED discriminant.
-         *   · `unsupported_version` arms: `"version_newer"` (retryable on a newer worker),
-         *     `"env_factory_missing"` (retryable on a factory-wired worker), `"governed_unwired"`
-         *     (retryable on an org-wired worker), `"origin_missing"` (a pending approval row minted
-         *     before the ask's origin was persisted on the park — terminal for the row's bytes; the host
-         *     decides the orphaned card itself, no worker version redeems it).
-         *   · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`,
-         *     `"real_approval_forged"`, `"constraint_chain_missing"` (all terminal for the row's
-         *     current bytes — no worker version redeems a damaged row). */
-        reason?: "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
+        /** WHICH arm fired, where one `code` covers several — the word list and what each word means to a
+         *  host live at {@link CheckpointErrorReason}, its one home. Additive and optional like `field`
+         *  (`code` remains the only REQUIRED discriminant), which is exactly why the obligation to SPELL it
+         *  is a gate rather than a type: see the closed set's own doc. */
+        reason?: CheckpointErrorReason;
     } | undefined);
 }
 /**

package/dist/core/effective-path-target.d.ts

@@ -0,0 +1,43 @@
+import type { ToolCallPathTarget } from "./tool-face.js";
+import { type ToolCallLike } from "./tool-registry.js";
+/** The bases of ONE CALL a target resolves against: the task root, and the live tracked working directory
+ *  (absent when no tracker moved or the caller keeps none). Facts of the call, never of the tool. */
+export interface ToolPathBases {
+    readonly root?: string | undefined;
+    readonly cwd?: string | undefined;
+}
+/**
+ * WHICH base this target's relative spellings resolve against, as SPELLED by the caller (no normalization:
+ * the tool hands this straight to `canonicalizeTarget`, which resolves win-form and symlinked spellings the
+ * fences must not pre-fold). `undefined` ⇒ the deployment gave no such base, so a relative spelling in this
+ * slot names nothing this reader can locate.
+ */
+export declare function pathTargetBaseOf(pt: Pick<ToolCallPathTarget, "base"> | undefined, bases: ToolPathBases): string | undefined;
+/**
+ * design/116 批④ #8 (CC 2.1.198 RWp, bundle :332987) — decompose an ABSOLUTE glob pattern into a base
+ * directory + relative pattern: cut at the last separator before the first glob metachar (`* ? [ {`); a
+ * pattern with no metachar splits dirname/basename. `undefined` for a relative pattern (the caller keeps it
+ * as-is) or when no usable base can be derived.
+ *
+ * Lives HERE rather than beside the search engine because two readers need the identical cut: Glob's own
+ * scope resolution and the path fences that must know which directory an absolute pattern really searches.
+ */
+export declare function splitAbsoluteGlobPattern(pattern: string): {
+    baseDir: string;
+    relativePattern: string;
+} | undefined;
+/**
+ * The absolute, LEXICAL-NORMAL path this call is about under ONE reading of its path slot, or `undefined`
+ * when that reading locates none. `pt` is the reading (design/388 B6/B17: the PROTECTIVE target for a
+ * tightening fence, the DECLARED target for a grant) — this function never picks between the two.
+ *
+ * The order is the tool's own:
+ *  ① a spelling in the slot wins — absolute as spelled, relative against {@link pathTargetBaseOf}'s base;
+ *  ② otherwise, when the declaration says an absent slot means `none`, the call is about no path;
+ *  ③ otherwise a `patternParam`'s ABSOLUTE pattern supplies its own base directory;
+ *  ④ otherwise the base itself (the tool searches all of it).
+ *
+ * A base the deployment did not supply yields `undefined`: a relative spelling with nothing to resolve
+ * against names no file, and claiming it names `/<spelling>` was a fabrication no fence should judge.
+ */
+export declare function effectivePathTargetOf(call: ToolCallLike, pt: ToolCallPathTarget | undefined, bases: ToolPathBases): string | undefined;

package/dist/core/effective-path-target.js

@@ -0,0 +1,56 @@
+import { isAbsolutePathForm } from "../tools/fs/safety.js";
+import { lexicalNormalAbsolutePathOf } from "./permission-rule-model.js";
+import { pathTargetValue } from "./tool-registry.js";
+export function pathTargetBaseOf(pt, bases) {
+    return (pt?.base ?? "cwd") === "root" ? bases.root : (bases.cwd ?? bases.root);
+}
+export function splitAbsoluteGlobPattern(pattern) {
+    if (!isAbsolutePathForm(pattern))
+        return undefined;
+    const m = /[*?[{]/.exec(pattern);
+    if (!m) {
+        const i = Math.max(pattern.lastIndexOf("/"), pattern.lastIndexOf("\\"));
+        if (i <= 0)
+            return undefined;
+        return { baseDir: pattern.slice(0, i), relativePattern: pattern.slice(i + 1) };
+    }
+    const prefix = pattern.slice(0, m.index);
+    const cut = Math.max(prefix.lastIndexOf("/"), prefix.lastIndexOf("\\"));
+    if (cut === -1)
+        return undefined;
+    let baseDir = pattern.slice(0, cut);
+    if (baseDir === "" && cut === 0)
+        baseDir = "/";
+    if (/^[A-Za-z]:$/.test(baseDir))
+        baseDir = baseDir + pattern[cut];
+    if (!baseDir)
+        return undefined;
+    return { baseDir, relativePattern: pattern.slice(cut + 1) };
+}
+function under(base, rest) {
+    return `${base === "/" ? "" : base}/${rest}`;
+}
+export function effectivePathTargetOf(call, pt, bases) {
+    if (pt === undefined)
+        return undefined;
+    const declaredBase = pathTargetBaseOf(pt, bases);
+    const spelled = pathTargetValue(call.args, pt);
+    if (spelled !== undefined)
+        return resolveSpelling(spelled, declaredBase, bases);
+    if ((pt.absent ?? "none") === "none")
+        return undefined;
+    if (pt.patternParam !== undefined) {
+        const pattern = pathTargetValue(call.args, { param: pt.patternParam });
+        const split = pattern === undefined ? undefined : splitAbsoluteGlobPattern(pattern);
+        if (split !== undefined)
+            return resolveSpelling(split.baseDir, declaredBase, bases);
+    }
+    return declaredBase === undefined ? undefined : lexicalNormalAbsolutePathOf(declaredBase);
+}
+function resolveSpelling(spelled, declaredBase, bases) {
+    if (spelled.startsWith("/"))
+        return lexicalNormalAbsolutePathOf(spelled);
+    const landsOn = isAbsolutePathForm(spelled) ? pathTargetBaseOf(undefined, bases) : declaredBase;
+    const normalBase = landsOn === undefined ? undefined : lexicalNormalAbsolutePathOf(landsOn);
+    return normalBase === undefined ? undefined : lexicalNormalAbsolutePathOf(under(normalBase, spelled));
+}

package/dist/core/engine-notice.d.ts

@@ -61,6 +61,14 @@ export interface EngineNotice {
      *    its explicit {@link NOTICE_AUDIENCE} row (#433 made the registry total over the catalog —
      *    no engine-minted code is audience-defaulted any more). The refusal itself
      *    (`mcp.server_revoked`) is a tool RESULT code, not a notice.
+     *  - `"mcp.injection_dropped"` (L-167) — an entry of the user's own request-lane MCP injection
+     *    was NOT mounted for the leg. The HOST owns the drop sites and supplies the facts; CORE composes
+     *    the notice ({@link import("./mcp-injection-drop.js").mcpInjectionDroppedNotice}, the one mint).
+     *    `detail: { sessionId, server, reason, field? }` — `reason` is the closed set
+     *    `malformed_entry` / `name_reserved_by_deployment` / `gate_closed` / `over_cap`
+     *    (`MCP_INJECTION_DROP_REASONS`, CLOSED-SETS), `field` names the bad key for `malformed_entry`
+     *    when known. `"user"` audience; `sessionId` REQUIRED at the mint (a user row with no session
+     *    routes nowhere — refused, never fabricated). Dedup unit: per leg per server name, the host's.
      *  - `"config.models_swapped"` — `Runner.swapModels` replaced the model catalog generation
      *    (zero-restart model switching). `detail: { models, tiers, occurrenceId }` — key COUNTS only,
      *    never the

package/dist/core/fs-write-gate-policy.js

@@ -1,6 +1,7 @@
 import { canonicalizeTarget, writeTargetPath } from "../tools/fs/safety.js";
 import { isWithin } from "./runner/session-rule-policy.js";
 import { declaredPathTargetOf, isProtectedWrite } from "./tool-registry.js";
+import { pathTargetBaseOf } from "./effective-path-target.js";
 const ask = (message) => ({ action: "ask", message, decisionReason: "rule" });
 export function createFsWriteGatePolicy(opts) {
     const { env, rootPath, defaultWrite } = opts;
@@ -26,7 +27,7 @@ export function createFsWriteGatePolicy(opts) {
             if (path === undefined) {
                 return ask(`write tool "${req.toolName}" requires approval: the call has no resolvable path target to confine${declared === undefined ? " (the tool declares no path target)" : ""}${advisory}`);
             }
-            const canon = await canonicalizeTarget(env, path, signal, req.cwd ?? rootPath);
+            const canon = await canonicalizeTarget(env, path, signal, pathTargetBaseOf(declared, { root: rootPath, cwd: req.cwd }));
             if (!canon.ok) {
                 return ask(`write to "${path}" requires approval: its real target could not be resolved (${canon.message})${advisory}`);
             }

package/dist/core/gate-lanes.d.ts

@@ -45,6 +45,7 @@ export declare function normalizeOrgGateVerdict(answer: unknown, unreadable: str
 export declare function normalizePersistedRuleHit(hit: PersistedRuleAnswer): {
     hit?: PersistedRuleHit;
     unreadable?: true;
+    reason?: string;
     coverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
 };
 /**