@sema-agent/core 7.8.0 → 7.9.1

package/dist/core/tool-catalog-entries.js

@@ -15,7 +15,7 @@ export const TOOL_CATALOG_ENTRIES = [
         cards: ["text", "notebook", "file_unchanged", "image", "document"],
         face: {
             family: "file-read", effect: "read", contract: c("core.read@1"),
-            pathTarget: { param: "file_path", aliases: ["path"], access: "read" },
+            pathTarget: { param: "file_path", aliases: ["path"], access: "read", base: "cwd", absent: "none" },
             ruleFace: { params: ["file_path", "path", "offset", "limit", "pages"] },
             renderHints: { summaryParams: ["file_path"] },
             offload: false, compactable: true, budgetExempt: true,
@@ -26,7 +26,7 @@ export const TOOL_CATALOG_ENTRIES = [
         cards: ["edit"],
         face: {
             family: "file-write", effect: "write", contract: c("core.edit@1"),
-            pathTarget: { param: "file_path", aliases: ["path"], access: "edit", skillScopeEligible: true },
+            pathTarget: { param: "file_path", aliases: ["path"], access: "edit", skillScopeEligible: true, base: "cwd", absent: "none" },
             ruleFace: { params: ["file_path", "path", "old_string", "new_string", "replace_all"] },
             renderHints: { summaryParams: ["file_path"], approvalCard: "file-edit" },
             compactable: true,
@@ -37,7 +37,7 @@ export const TOOL_CATALOG_ENTRIES = [
         cards: ["create", "update"],
         face: {
             family: "file-write", effect: "write", contract: c("core.write@1"),
-            pathTarget: { param: "file_path", aliases: ["path"], access: "create", skillScopeEligible: true },
+            pathTarget: { param: "file_path", aliases: ["path"], access: "create", skillScopeEligible: true, base: "cwd", absent: "none" },
             ruleFace: { params: ["file_path", "path", "content"] },
             renderHints: { summaryParams: ["file_path"], approvalCard: "file-write" },
             offload: false, compactable: true,
@@ -48,7 +48,7 @@ export const TOOL_CATALOG_ENTRIES = [
         cards: ["notebook-edit"],
         face: {
             family: "file-write", effect: "write", contract: c("core.notebook_edit@1"),
-            pathTarget: { param: "notebook_path", aliases: ["path"], access: "edit" },
+            pathTarget: { param: "notebook_path", aliases: ["path"], access: "edit", base: "cwd", absent: "none" },
             ruleFace: { params: ["notebook_path", "path", "cell_id", "cell_type", "edit_mode", "new_source"] },
             renderHints: { userFacingName: "Edit Notebook", summaryParams: ["notebook_path"], approvalCard: "notebook-edit" },
         },
@@ -78,7 +78,7 @@ export const TOOL_CATALOG_ENTRIES = [
         cards: ["grep"],
         face: {
             family: "search", effect: "read", contract: c("core.grep@1"),
-            pathTarget: { param: "path", access: "read" },
+            pathTarget: { param: "path", access: "read", base: "root", absent: "base" },
             ruleFace: { params: ["pattern", "path", "glob", "type", "output_mode", "head_limit", "offset", "multiline", "context", "ignore_case", "-i", "-n", "-o", "-A", "-B", "-C"] },
             renderHints: { userFacingName: "Search", summaryParams: ["pattern", "path"] },
             offloadThresholdChars: 20_000, compactable: true,
@@ -89,7 +89,7 @@ export const TOOL_CATALOG_ENTRIES = [
         cards: ["glob"],
         face: {
             family: "search", effect: "read", contract: c("core.glob@1"),
-            pathTarget: { param: "path", access: "read" },
+            pathTarget: { param: "path", access: "read", base: "root", absent: "base", patternParam: "pattern" },
             ruleFace: { params: ["pattern", "path", "max_results"] },
             renderHints: { userFacingName: "Search", summaryParams: ["pattern", "path"] },
             compactable: true,

package/dist/core/tool-face.d.ts

@@ -46,18 +46,94 @@ export type ToolApprovalCard = (typeof TOOL_APPROVAL_CARDS)[number];
 export declare const TOOL_PATH_ACCESSES: readonly ["read", "create", "edit"];
 export type ToolPathAccess = (typeof TOOL_PATH_ACCESSES)[number];
 /**
- * The parameter that names this tool's filesystem target, and how the target is touched. Present ⇔ the
- * tool can be confirmed BY PATH (write confinement, sensitive-path guards, edited-file tracking, the
- * transcript-directory gate). `param` outranks every alias (NotebookEdit's `notebook_path` beats a decoy
+ * The BASE a RELATIVE spelling in the target slot resolves against — the tool's OWN resolution base,
+ * DECLARED so every fence resolves the very path the tool will open instead of guessing one:
+ *
+ *  - `cwd` — the live tracked working directory, falling back to the task root when no tracker moved
+ *    (Read / Edit / Write / NotebookEdit: each hands `cwdRef.current` to `canonicalizeTarget` as its base);
+ *  - `root` — the task root, always (Grep / Glob: their `path` describes say "relative to root", and the
+ *    tools hand `rootCanonical` to the same resolver whatever the shell's `cd` did).
+ *
+ * Absent ⇒ `cwd`: the pre-declaration reading every fence took, kept as the floor for a face (a caller's,
+ * an MCP server's) that declares no base. This one word is the whole difference the fences had to model,
+ * and getting it wrong is SILENT — a rule about the path the tool really opens simply never fires.
+ */
+export declare const TOOL_PATH_BASES: readonly ["cwd", "root"];
+export type ToolPathBase = (typeof TOOL_PATH_BASES)[number];
+/**
+ * What the call targets when the target slot carries NO usable spelling:
+ *
+ *  - `none` — nothing. A file tool with no path names no file, so no path rule speaks about the call;
+ *  - `base` — the resolution base ITSELF. A search tool with no `path` searches the WHOLE base, so a rule
+ *    naming the base (or anything containing it) does reach the call.
+ *
+ * Absent ⇒ `none` (the pre-declaration reading: an absent slot was "no resolvable path" for every tool).
+ */
+export declare const TOOL_PATH_ABSENCES: readonly ["none", "base"];
+export type ToolPathAbsence = (typeof TOOL_PATH_ABSENCES)[number];
+/**
+ * The parameter that names a tool's filesystem target, how the target is touched, and how a spelling in that
+ * slot RESOLVES — as a READER sees it, whichever side it came from. Present ⇔ the tool can be confirmed BY
+ * PATH (write confinement, sensitive-path guards, edited-file tracking, the transcript-directory gate, the
+ * permission-rule path family). `param` outranks every alias (NotebookEdit's `notebook_path` beats a decoy
  * `file_path`). `skillScopeEligible` (default false) is the SEPARATE authorization domain of the
  * active-skill `allowPaths` face — a confinable write tool is not automatically eligible there.
+ *
+ * ONE shape, two spellings: a DECLARATION ({@link ToolPathTarget}, what a catalog row / a `ToolSpec` / an
+ * MCP overlay writes) and the roster row's NORMALIZED form (`aliases` always an array, `skillScopeEligible`
+ * always a boolean) that the wire carries and the gate stamps on a call. Both are readable through this
+ * type, which is what every fence reads — the shape used to be re-declared at each of them, and a member
+ * added to one spelling silently never reached the others.
+ *
+ * The three RESOLUTION members are read by one function (`effectivePathTargetOf`, effective-path-target.ts)
+ * that every fence and the tools themselves go through: the declaration is the single source, so a fence
+ * and the tool it fences cannot resolve one call to two different files.
  */
-export interface ToolPathTarget {
+export interface ToolCallPathTarget {
     param: string;
     aliases?: readonly string[];
     access: ToolPathAccess;
+    skillScopeEligible?: boolean;
+    /** How a RELATIVE spelling in `param` (or an alias) resolves. Absent ⇒ `cwd`. */
+    base?: ToolPathBase;
+    /** What the call targets when the slot is absent. Absent ⇒ `none`. */
+    absent?: ToolPathAbsence;
+    /**
+     * A top-level parameter whose ABSOLUTE glob pattern carries its own base directory (Glob's `pattern`:
+     * `/proj/secret/**` searches `/proj/secret` with no `path` at all). Consulted ONLY when the target slot
+     * is absent and `absent` is `base` — the tool's own precedence, in which an explicit `path` wins and a
+     * relative pattern leaves the base alone.
+     */
+    patternParam?: string;
+}
+/** The DECLARATION spelling of {@link ToolCallPathTarget}: what a catalog row, a `ToolSpec` or an MCP
+ *  overlay writes. `skillScopeEligible` is narrowed to `true` — a declaration says "eligible" or says
+ *  nothing; "eligible: false" is the absence, and spelling it would be a second way to say one thing. */
+export interface ToolPathTarget extends ToolCallPathTarget {
     skillScopeEligible?: true;
 }
+/**
+ * The NORMALIZED spelling of {@link ToolCallPathTarget}: what the roster MINTS, what the wire carries, and
+ * what the gate stamps on a call. `aliases` and `skillScopeEligible` are always present because the mint
+ * fills them — a guarantee a consumer reading a stamped face has always had, and one the shared reader type
+ * deliberately does not weaken (an optional member here would break `face.pathTarget.aliases.includes(…)`
+ * at compile time for every downstream that already reads it).
+ */
+export interface ToolRosterPathTarget extends ToolCallPathTarget {
+    aliases: readonly string[];
+    skillScopeEligible: boolean;
+}
+/**
+ * The SLOT half of a target — which argument names the path — with the RESOLUTION half (`base` / `absent` /
+ * `patternParam`) dropped, so the reader falls back to the documented defaults.
+ *
+ * #635, from the adversarial round: the protective floor (design/388 B6 — a face that declares no target of
+ * its own is judged against the CATALOG's declaration for the name) rests on "naming a slot can only TIGHTEN
+ * a deny". Naming a slot does. Claiming how a FOREIGN tool of the same name RESOLVES that slot does not: a
+ * wrong claim moves the judged path to a different file, and the deny the floor exists to keep then misses.
+ * So the floor hands over the slot and keeps its mouth shut about the resolution.
+ */
+export declare function pathTargetSlotOnly(pt: ToolCallPathTarget): ToolCallPathTarget;
 /**
  * The parameter vocabulary a permission rule (`Tool(param:pattern)`) may name. DERIVED by default from
  * the tool's schema: the SCALAR top-level parameters (string/number/integer/boolean and their enum/const/

package/dist/core/tool-face.js

@@ -2,6 +2,16 @@ export const TOOL_FAMILIES = ["shell", "file-read", "file-write", "search", "web
 export const TOOL_MOUNT_TAGS = ["hands", "backgroundTasks", "workflow", "delegation", "hostInternals", "peerLane", "scheduler", "memory", "scenario", "always", "optional"];
 export const TOOL_APPROVAL_CARDS = ["file-edit", "file-write", "notebook-edit", "shell", "fetch", "plan", "question", "generic"];
 export const TOOL_PATH_ACCESSES = ["read", "create", "edit"];
+export const TOOL_PATH_BASES = ["cwd", "root"];
+export const TOOL_PATH_ABSENCES = ["none", "base"];
+export function pathTargetSlotOnly(pt) {
+    return {
+        param: pt.param,
+        access: pt.access,
+        ...(pt.aliases !== undefined ? { aliases: pt.aliases } : {}),
+        ...(pt.skillScopeEligible !== undefined ? { skillScopeEligible: pt.skillScopeEligible } : {}),
+    };
+}
 export const TOOL_WIRE_NAME_MAX_CHARS = 128;
 export const TOOL_CONTRACT_MAX_CHARS = 64;
 export const TOOL_KEY_MAX_CHARS = 256;

package/dist/core/tool-policy.d.ts

@@ -4,12 +4,7 @@ import type { Settlement } from "./gate-outcome.js";
 /** design/388 B6 — the per-call face (see {@link ToolCallRequest.face}). */
 export interface ToolCallFace {
     family: import("./tool-face.js").ToolFamily;
-    pathTarget?: {
-        param: string;
-        aliases: readonly string[];
-        access: "read" | "create" | "edit";
-        skillScopeEligible: boolean;
-    };
+    pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
     capabilityId: string;
     contractId: string;
     shapeDigest: string;

package/dist/core/tool-registry.d.ts

@@ -10,7 +10,7 @@
  *
  * Layer-0 vocabulary: depends on the leaf catalog and the face vocabulary only.
  */
-import { type ToolCatalogEntry, type ToolMountTag, type ToolPathAccess } from "./tool-face.js";
+import { type ToolCallPathTarget, type ToolCatalogEntry, type ToolMountTag, type ToolPathAccess } from "./tool-face.js";
 /** The whole static catalog, one frozen row per definition (design/388 §2.1 `describeToolCatalog()`).
  *  Replaces the retired name-keyed exports `HAND_TOOL_EFFECTS` / `DEFAULT_BUDGET_EXEMPT_TOOLS` /
  *  `COMPACTABLE_TOOLS`: filter this instead (`e.mountedBy.includes("hands")`, `e.face.budgetExempt`,
@@ -45,24 +45,21 @@ export interface ToolCallLike {
     toolName: string;
     args: unknown;
     face?: {
-        pathTarget?: {
-            param: string;
-            aliases?: readonly string[];
-            access: ToolPathAccess;
-        };
+        pathTarget?: ToolCallPathTarget;
     } | undefined;
 }
-type CallPathTarget = {
-    param: string;
-    aliases?: readonly string[];
-    access: ToolPathAccess;
-};
+type CallPathTarget = ToolCallPathTarget;
 /**
  * design/388 B6/B17 — the path target a PROTECTIVE fence reads (a deny-list judging a write's target: sensitive paths,
  * frozen paths, write protection, the transcript gate; edit tracking): the object face's own declaration first, the
  * catalog's declaration for the NAME as the FLOOR — for a bare request (a policy invoked outside a Runner) and for a
  * face that declares none. Reading the catalog for an undeclared same-name tool can only TIGHTEN a deny-list (it adds
  * a slot to judge — the pre-388 posture, never wider), which is exactly why this floor is wrong for a grant.
+ *
+ * #635: "can only tighten" is true of the SLOT and false of the RESOLUTION, so the floor hands over the first and
+ * defaults the second (`pathTargetSlotOnly`). Telling a fence that a FOREIGN tool of the same name resolves its slot
+ * against the project root is a claim about someone else's implementation: get it wrong and the judged path moves to
+ * a different file, and the deny this floor exists to preserve simply misses.
  */
 export declare function protectivePathTargetOf(call: ToolCallLike): CallPathTarget | undefined;
 /**

package/dist/core/tool-registry.js

@@ -1,4 +1,4 @@
-import { TOOL_MOUNT_TAGS } from "./tool-face.js";
+import { TOOL_MOUNT_TAGS, pathTargetSlotOnly } from "./tool-face.js";
 import { ENGINE_CARDS, TOOL_CATALOG_ENTRIES } from "./tool-catalog-entries.js";
 export function describeToolCatalog() {
     return TOOL_CATALOG_ENTRIES;
@@ -49,7 +49,10 @@ export function pathTargetValue(args, pt) {
     return undefined;
 }
 export function protectivePathTargetOf(call) {
-    return call.face?.pathTarget ?? pathTargetOf(call.toolName);
+    if (call.face?.pathTarget !== undefined)
+        return call.face.pathTarget;
+    const floor = pathTargetOf(call.toolName);
+    return floor === undefined || call.face === undefined ? floor : pathTargetSlotOnly(floor);
 }
 export function declaredPathTargetOf(call) {
     return call.face !== undefined ? call.face.pathTarget : pathTargetOf(call.toolName);

package/dist/core/tool-roster.d.ts

@@ -1,6 +1,6 @@
 import { Type, type Static, type TSchema } from "typebox";
 import type { AgentTool } from "../internal/harness-types.js";
-import { type ToolFamily, type ToolMountTag, type ToolPathTarget, type ToolRenderHints, type ToolRuleFace } from "./tool-face.js";
+import { type ToolFamily, type ToolRosterPathTarget, type ToolMountTag, type ToolPathTarget, type ToolRenderHints, type ToolRuleFace } from "./tool-face.js";
 import type { ToolContentOrigin, ToolEffect } from "./tool-spec.js";
 export declare const ROSTER_SOURCES: readonly ["builtin", "caller", "host", "mcp", "a2a", "external", "synthetic"];
 export type RosterSource = (typeof ROSTER_SOURCES)[number];
@@ -55,6 +55,9 @@ export declare const ToolRosterEntry: Type.TObject<{
         aliases: Type.TArray<Type.TString>;
         access: Type.TUnion<[Type.TLiteral<"read">, Type.TLiteral<"create">, Type.TLiteral<"edit">]>;
         skillScopeEligible: Type.TBoolean;
+        base: Type.TOptional<Type.TUnion<[Type.TLiteral<"cwd">, Type.TLiteral<"root">]>>;
+        absent: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"base">]>>;
+        patternParam: Type.TOptional<Type.TString>;
     }>>;
     ruleFace: Type.TObject<{
         primaryParams: Type.TArray<Type.TString>;
@@ -126,6 +129,9 @@ export declare const ToolRoster: Type.TObject<{
             aliases: Type.TArray<Type.TString>;
             access: Type.TUnion<[Type.TLiteral<"read">, Type.TLiteral<"create">, Type.TLiteral<"edit">]>;
             skillScopeEligible: Type.TBoolean;
+            base: Type.TOptional<Type.TUnion<[Type.TLiteral<"cwd">, Type.TLiteral<"root">]>>;
+            absent: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"base">]>>;
+            patternParam: Type.TOptional<Type.TString>;
         }>>;
         ruleFace: Type.TObject<{
             primaryParams: Type.TArray<Type.TString>;
@@ -205,6 +211,9 @@ export declare const ToolRosterDelta: Type.TObject<{
                 aliases: Type.TArray<Type.TString>;
                 access: Type.TUnion<[Type.TLiteral<"read">, Type.TLiteral<"create">, Type.TLiteral<"edit">]>;
                 skillScopeEligible: Type.TBoolean;
+                base: Type.TOptional<Type.TUnion<[Type.TLiteral<"cwd">, Type.TLiteral<"root">]>>;
+                absent: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"base">]>>;
+                patternParam: Type.TOptional<Type.TString>;
             }>>;
             ruleFace: Type.TObject<{
                 primaryParams: Type.TArray<Type.TString>;
@@ -265,7 +274,7 @@ export declare function parkedToolFace(roster: ToolRoster | undefined, toolName:
  *  partial face). This is the face every recheck of the row judges under, roster or no roster. */
 export declare function parkedCallFaceOf(pending: {
     family?: ToolFamily;
-    pathTarget?: ToolRosterEntry["pathTarget"];
+    pathTarget?: ToolRosterPathTarget;
     capabilityId?: string;
     contractId?: string;
     shapeDigest?: string;
@@ -396,6 +405,13 @@ export declare class RosterBuilder {
 /** Which source a `TaskSpec.tools` entry mounts as: a definition carrying a CORE contract is a built-in the host chose
  *  to mount; anything else is the caller's own tool. Identity follows the object, never the name. */
 export declare function callerMountSource(tool: AgentTool): RosterSource;
+/** The card namespace a roster row owns (design/388 §2.2 ④) — ONE mint, read by the row and by the prepare door that
+ *  judges a caller's `renderHints.resultCards` against it: `builtin:<name>` for engine-owned definitions,
+ *  `<mcp|a2a>:<peer>/<tool>` for protocol tools, `<caller|external>:<contractId>` for everything the caller mounts. */
+export declare function rosterCardId(source: RosterSource, toolName: string, peer: string | null, protocolTool: string, contractId: string): string;
+/** The card namespace a `TaskSpec.tools` entry will own once mounted — the same mint the row makes, so the prepare
+ *  door and the roster row cannot disagree about which namespace a caller card must live under. */
+export declare function callerCardIdOf(tool: Pick<AgentTool, "name" | "parameters">): string;
 /** One row (design/388 §2.5). Every axis is read off the instance or the leg facts; nothing off a name table. */
 export declare function mintRosterEntry(tool: AgentTool, meta: RosterMountMeta, facts: RosterSnapshotFacts): ToolRosterEntry;
 /**
@@ -414,6 +430,8 @@ export declare class ToolRosterDeltaSeat {
     republish(): ToolRosterDelta | undefined;
     /** Install the stream sink; anything published before is flushed in order. */
     subscribe(sink: (delta: ToolRosterDelta) => void): void;
+    /** The leg ended: drop the sink so a late republish never reaches a closed stream (it buffers, bounded, unread). */
+    unsubscribe(): void;
     /** Take the buffered deltas (a consumer that polls instead of subscribing). */
     drain(): ToolRosterDelta[];
 }

package/dist/core/tool-roster.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { Type } from "typebox";
 import { getToolContract } from "../prompt-assembly/tool-catalog.js";
 import { protocolOf } from "./protocol-table.js";
-import { RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_CHARS, RENDER_HINT_MAX_LIST, TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_KEYS_MAX, TOOL_KEY_MAX_CHARS, TOOL_MOUNT_TAGS, } from "./tool-face.js";
+import { RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_CHARS, RENDER_HINT_MAX_LIST, TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_KEYS_MAX, TOOL_KEY_MAX_CHARS, TOOL_MOUNT_TAGS, TOOL_PATH_ABSENCES, TOOL_PATH_BASES, } from "./tool-face.js";
 function lit(values) {
     return Type.Union(values.map((v) => Type.Literal(v)));
 }
@@ -42,7 +42,15 @@ export const ToolRosterEntry = Type.Object({
     contentOrigin: lit(["local", "execution", "external"]),
     contentOriginProvenance: lit(["declared", "server", "exempted", "default"]),
     family: lit(TOOL_FAMILIES),
-    pathTarget: Type.Optional(Type.Object({ param: Key, aliases: Type.Array(Key), access: lit(["read", "create", "edit"]), skillScopeEligible: Type.Boolean() }, { additionalProperties: false })),
+    pathTarget: Type.Optional(Type.Object({
+        param: Key,
+        aliases: Type.Array(Key),
+        access: lit(["read", "create", "edit"]),
+        skillScopeEligible: Type.Boolean(),
+        base: Type.Optional(lit(TOOL_PATH_BASES)),
+        absent: Type.Optional(lit(TOOL_PATH_ABSENCES)),
+        patternParam: Type.Optional(Key),
+    }, { additionalProperties: false })),
     ruleFace: Type.Object({ primaryParams: Type.Array(Key), params: Type.Array(Key) }, { additionalProperties: false }),
     approvalPreview: Type.Boolean(),
     validateInput: Type.Boolean(),
@@ -335,17 +343,24 @@ export class RosterBuilder {
 export function callerMountSource(tool) {
     return getToolContract(tool, "caller").origin === "core" ? "builtin" : "caller";
 }
+export function rosterCardId(source, toolName, peer, protocolTool, contractId) {
+    return source === "builtin" || source === "synthetic"
+        ? `builtin:${toolName}`
+        : source === "mcp" || source === "a2a"
+            ? `${source}:${peer}/${protocolTool}`
+            : `${source === "external" ? "external" : "caller"}:${contractId}`;
+}
+export function callerCardIdOf(tool) {
+    const t = tool;
+    return rosterCardId(callerMountSource(t), t.name, null, t.name, getToolContract(t, "caller").contractId);
+}
 export function mintRosterEntry(tool, meta, facts) {
     const face = faceOf(tool);
     const fallbackOrigin = meta.source === "builtin" ? "core" : meta.source === "synthetic" ? "synthetic" : meta.source === "mcp" || meta.source === "a2a" ? meta.source : "caller";
     const d = getToolContract(tool, fallbackOrigin);
     const peer = meta.origin?.peer ?? null;
     const protocolTool = peer !== null ? protocolOf(tool.name)?.parse(tool.name)?.tool ?? tool.name : tool.name;
-    const cardId = meta.source === "builtin" || meta.source === "synthetic"
-        ? `builtin:${tool.name}`
-        : meta.source === "mcp" || meta.source === "a2a"
-            ? `${meta.source}:${peer}/${protocolTool}`
-            : `${meta.source === "external" ? "external" : "caller"}:${d.contractId}`;
+    const cardId = rosterCardId(meta.source, tool.name, peer, protocolTool, d.contractId);
     const { keys: inputKeys } = inputKeysOf(tool.parameters);
     const declaredEffect = face.effect;
     const foldedEffect = facts.effects.get(tool.name);
@@ -385,7 +400,17 @@ export function mintRosterEntry(tool, meta, facts) {
         contentOriginProvenance,
         family: face.family !== undefined && TOOL_FAMILIES.includes(face.family) ? face.family : "other",
         ...(pathTarget !== undefined
-            ? { pathTarget: { param: pathTarget.param, aliases: [...(pathTarget.aliases ?? [])], access: pathTarget.access, skillScopeEligible: pathTarget.skillScopeEligible === true } }
+            ? {
+                pathTarget: {
+                    param: pathTarget.param,
+                    aliases: [...(pathTarget.aliases ?? [])],
+                    access: pathTarget.access,
+                    skillScopeEligible: pathTarget.skillScopeEligible === true,
+                    ...(pathTarget.base !== undefined ? { base: pathTarget.base } : {}),
+                    ...(pathTarget.absent !== undefined ? { absent: pathTarget.absent } : {}),
+                    ...(pathTarget.patternParam !== undefined ? { patternParam: pathTarget.patternParam } : {}),
+                },
+            }
             : {}),
         ruleFace: rf,
         approvalPreview: typeof tool.approvalPreview === "function",
@@ -431,6 +456,9 @@ export class ToolRosterDeltaSeat {
         for (const d of pending)
             sink(d);
     }
+    unsubscribe() {
+        this.#sink = undefined;
+    }
     drain() {
         const pending = this.#pending;
         this.#pending = [];

package/dist/index.d.ts

@@ -53,6 +53,7 @@ export { runCascade, type CascadeRung, type CascadeConfig, type CascadeAttempt,
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult } from "./core/mcp.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, classifyMcpFailure, type McpFailure, type McpFailureKind, type McpDelivered } from "./core/mcp-failure.js";
+export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice, type McpInjectionDropReason, type McpInjectionDropFacts } from "./core/mcp-injection-drop.js";
 export { materializeA2aTools, A2aRpcError, type MaterializedA2a, type A2aPeerStatus, type A2aRefreshResult, type A2aToolAxis } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf, type ProtocolNamespace, type ProtocolId } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions, } from "./core/session-policy-store.js";
@@ -124,10 +125,11 @@ export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/f
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
-export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathTarget, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
+export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
 export { type ToolCallFace } from "./core/tool-policy.js";
+export { effectivePathTargetOf, pathTargetBaseOf, type ToolPathBases } from "./core/effective-path-target.js";
 export { TOOL_CONFORMANCE_VECTORS, describeToolConformanceVectors, type ToolConformanceVector } from "./core/tool-conformance.js";
 export { applyMcpToolFaces, toolFaceProblem, APPROVAL_CARD_REQUIRED_KEYS, type McpToolFace } from "./core/runner/tool-face-overlay.js";
 export { createStructuredProjector } from "./core/runner/tool-output-projection.js";
@@ -186,12 +188,13 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
  * allowed and widening is not.
  */
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, type ProgramRunReach, type ProgramRunReachOutcome, pathRuleReaches, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, type PermissionRuleStore, type PermissionRuleStoreProvider, type PermissionRuleStoreConfig, type EffectivePermissionRules, type EffectivePermissionRule, type RemovedPermissionRule, type RuleSource, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, type SessionRulePartition, type SessionRuleAdd, type SessionRuleApplyResult, } from "./core/permission-rule-session.js";
-export { orgRuleVerdictFor, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRulePartitionConfig, type OrgRuleResolution, type OrgRuleStatus, } from "./core/permission-rule-org.js";
+export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, type ShellCommandShape, type ShellSegment, type ShellWord, type ShellWrapperName, } from "./core/shell-lexer.js";
+export { orgRuleVerdictFor, type OrgRuleVerdict, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRulePartitionConfig, type OrgRuleResolution, type OrgRuleStatus, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES, type RuleSyncDropReason, type RuleQuarantineReason } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, type ConfirmResult, type ConfirmRefusalReason, precheckEditedRuleText, type EditedRuleTextPrecheck, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleOffer2, type StaleRuleApprovalRecord, type RuleConsentDeps, type RedeemResult, type RedeemedBatchMember, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, } from "./core/permission-rule-consent.js";
 export { FileDurableRulePartitionProvider, ORG_STATE_FILE } from "./stores/file/permission-rule-store.js";

package/dist/index.js

@@ -40,6 +40,7 @@ export { runCascade, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX } from "./core/mcp.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, classifyMcpFailure } from "./core/mcp-failure.js";
+export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice } from "./core/mcp-injection-drop.js";
 export { materializeA2aTools, A2aRpcError } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, } from "./core/session-policy-store.js";
@@ -100,10 +101,11 @@ export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, } from "./core/task-notification.js";
-export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, } from "./core/tool-face.js";
+export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, pathTargetSlotOnly, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
 export {} from "./core/tool-policy.js";
+export { effectivePathTargetOf, pathTargetBaseOf } from "./core/effective-path-target.js";
 export { TOOL_CONFORMANCE_VECTORS, describeToolConformanceVectors } from "./core/tool-conformance.js";
 export { applyMcpToolFaces, toolFaceProblem, APPROVAL_CARD_REQUIRED_KEYS } from "./core/runner/tool-face-overlay.js";
 export { createStructuredProjector } from "./core/runner/tool-output-projection.js";
@@ -145,11 +147,12 @@ export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/au
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, pathRuleReaches, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, } from "./core/permission-rule-session.js";
+export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, } from "./core/shell-lexer.js";
 export { orgRuleVerdictFor, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, precheckEditedRuleText, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, } from "./core/permission-rule-consent.js";

package/dist/stores/file/checkpoint-store.js

@@ -16,7 +16,7 @@ const KNOWN_CHECKPOINT_LEDGER_EVENTS = new Set(Object.keys(CHECKPOINT_LEDGER_EVE
 function applyCheckpointEvent(cps, ev) {
     if (!KNOWN_CHECKPOINT_LEDGER_EVENTS.has(ev.t)) {
         throw new CheckpointError("checkpoint.unsupported_version", `file checkpoint ledger: unrecognised event kind "${String(ev.t)}" — ` +
-            `it was written by a newer worker; refusing the replay rather than serving an incomplete authority`);
+            `it was written by a newer worker; refusing the replay rather than serving an incomplete authority`, { reason: "ledger_event_unknown" });
     }
     if (ev.t === "put") {
         cps.set(ev.token, ev.cp);