dsh-ptc-plus 0.5.3 → 0.5.6

package/internal/capability-plan.js

@@ -83,11 +83,19 @@ function createLegacyCapabilityPlan(input) {
   if (!Array.isArray(options.capabilities)) throw new TypeError('ptc-plus: capabilities must be an array')
   const ids = new Set()
   const excluded = []
+  // Ids whose own invocation path the inventory could not reach. The planner states
+  // availability from the recorded choices, so a row the inventory already proved
+  // unreachable is closed here too — otherwise a baseline full contract keeps instructing
+  // a call the composition does not deliver. The policy generation states the same fact as
+  // `availabilitySource: 'invocation-path'`; a recorded v1/v2 inventory carries no such
+  // field, so its recomposition is unchanged.
+  const pathClosed = new Set()
   const capabilities = options.capabilities.map(raw => {
     const value = record(raw, 'capability')
     const id = text(value.id, 'capability id')
     if (ids.has(id)) throw new TypeError(`ptc-plus: duplicate capability identity ${id}`)
     ids.add(id)
+    if (value.effectiveAvailability === 'closed') pathClosed.add(id)
     const revision = text(value.revision, 'capability revision')
     if (EXCLUDED_CATEGORIES.has(value.category)) {
       excluded.push({ id, revision, category: value.category })
@@ -148,8 +156,10 @@ function createLegacyCapabilityPlan(input) {
       throw new TypeError(`ptc-plus: cannot determine the MCP server owner of ${capability.id}; conflicting namespaces: ${capability.mcpServerCandidates.join(', ')}`)
     }
     const serverClosed = capability.mcpServer !== undefined && overrides[`mcpServers.${capability.mcpServer}`] === 'closed'
-    const explicit = serverClosed ? 'closed' : Object.hasOwn(overrides, capability.id) ? overrides[capability.id] : undefined
-    const entry = { id: capability.id, revision: capability.revision, category: capability.category, selection: explicit ?? 'on-demand', reason: serverClosed ? 'mcp-server-disabled' : explicit ? 'manual-override' : 'baseline-not-selected' }
+    const unreachable = pathClosed.has(capability.id)
+    const explicit = serverClosed || unreachable ? 'closed' : Object.hasOwn(overrides, capability.id) ? overrides[capability.id] : undefined
+    const entry = { id: capability.id, revision: capability.revision, category: capability.category, selection: explicit ?? 'on-demand',
+      reason: serverClosed ? 'mcp-server-disabled' : unreachable ? 'invocation-path' : explicit ? 'manual-override' : 'baseline-not-selected' }
     entries.push(entry)
     selections.set(capability.id, entry)
     if (explicit === 'full') full.push(capability)
@@ -235,6 +245,12 @@ function createLegacyCapabilityPlan(input) {
     schema, enabled: true, configurationRevision, entries,
     excluded: excluded.sort(compareIds), catalogText, directoryText, directoryCategories,
     budgets: { unit: 'utf8-bytes', budgetBytes, directoryBudgetBytes, contractBytes: bytes(catalogText), directoryBytes: bytes(directoryText), overageBytes: Math.max(0, bytes(catalogText) - budgetBytes) },
+    // Configured ids this composition resolved no definition for. The composition is built
+    // from the step's admission, so a configured capability that step does not deliver is
+    // listed here beside one that no longer exists at all — the field states what this
+    // plan could not resolve, not what this session may call, and no model-visible text is
+    // rendered from it. Reading it as the capability list would name a closed capability
+    // as available and an absent one as configured.
     unresolvedConfigurationIds: [...new Set([...baseline, ...Object.keys(overrides)])].filter(id => !capabilities.some(entry => entry.id === id)).sort(),
     statisticsStatus: settings.usable ? 'enabled' : settings.reason,
   })

package/internal/capability-policy.js

@@ -82,6 +82,19 @@ export function capabilityRule(policy, capability) {
   return { availability, disclosure, availabilitySource, disclosureSource }
 }
 
+/** The policy document a record's own words make.
+ *
+ * A configuration that saved no policy has only a synthesized document, whose bottom layer is
+ * shaped by switches that belong to no record. Editing a rule, or writing one saved cell, must
+ * start from the record's own layers instead: the declared defaults plus the layers the record
+ * wrote (the legacy override record and the usage-statistics switch `capabilityPolicyForConfig`
+ * folds into the allocation).
+ */
+export function capabilityPolicyFromRecord(config) {
+  return capabilityPolicyForConfig({ ...config, capabilityPolicy: undefined,
+    capabilityManagementEnabled: false })
+}
+
 /** Change one reusable dimension, removing only that dimension for automatic. */
 export function changeCapabilityRule(policy, id, dimension, choice) {
   const next = structuredClone(policy)

package/internal/capability-selection.js

@@ -0,0 +1,330 @@
+import { createUserMessage } from '@deepseek-ai/dsh-llm'
+import { CAPABILITY_PLAN_FORM, isPtcMessageSource, PTC_MESSAGE_SOURCE_KIND, RETIRED_SURFACE_RECORD } from './message-sources.js'
+import { CAPABILITY_DISCLOSURES } from './capability-policy.js'
+
+/**
+ * Session capability choices: the capability decisions this session recorded.
+ *
+ * The panel states two different facts side by side. The saved column answers
+ * "what does the global configuration say", and this record answers "what did
+ * this session decide". Keeping them apart is what lets a session state a choice
+ * while the global configuration still reads as it did: neither answer is
+ * derived from the other, and neither needs a session runtime.
+ *
+ * Three states, one question: no record (`none`) means the session inherits the
+ * saved column; a readable newest record (`decided`) is that session's own
+ * answer; a newest record this build cannot parse (`unreadable`) supersedes the
+ * readable ones before it, so no consumer may answer from an older record in its
+ * place. The third state is a fact about that record, not a state of the panel:
+ * every row it touches keeps its control, and recording a new decision replaces
+ * it.
+ *
+ * A choice never claims supply. It names an entry by id and never adds or
+ * restores a row, because the row it applies to exists only while the host
+ * declares that entry. A record may therefore outlive the declaration it was
+ * written for: the session keeps its decision, the catalogue stops offering the
+ * row, and nothing reads the record as a supply. `change()` asks this module's
+ * vocabulary before it appends, so a decision about an entry this vocabulary
+ * cannot name never becomes a record.
+ *
+ * A record is not the only shape this session's decision has ever had. Before
+ * this record existed, the plugin wrote a session's choices into a plan snapshot —
+ * the one it delivered, or the one a pending command receipt carried when no step
+ * had accepted it yet — and those sessions have no record at all. Reading such
+ * a session as `none` would recompose it from an empty set and withdraw choices
+ * its own log still holds, so this module reads the newest delivered plan's
+ * `sessionOverrides` as the same statement (`decided`, marked `legacy`) when the
+ * session recorded none. The delivered plan is the equivalent form of one
+ * statement, never a second owner: a record outvotes it, and the next write
+ * restates every choice this read answered with. Only a plan that delivered a
+ * choice is such a statement — an empty override map says the session inherited
+ * everything, which is the state a session without a record already reads as — and
+ * a plan that states the map unreadably reports `unreadable` for the same reason a
+ * record does.
+ *
+ * A choice about this session's capability set is a statement the session makes
+ * about itself, not correspondence with the model, and the carrier it travels on
+ * decides when it may be written. It travels as the plugin record below, which the
+ * host retains on every read and interprets as a surface node by none: a decision
+ * taken before the session's first step is therefore durable at once and never
+ * becomes a surface node ahead of the protected head. The `user/message` form is
+ * the historical carrier that 0.5.4 and earlier wrote; it is still read (a session
+ * persisted by those releases keeps its decision), and no writer produces it.
+ */
+export const CAPABILITY_SELECTION_FORM = 'capability-selection'
+export const CAPABILITY_SELECTION_SCHEMA = 'ptc-capability-selection/v1'
+
+/**
+ * The log record this session's own choice is written as.
+ *
+ * A choice about this session's capability set is the session's statement about
+ * itself, not correspondence with the model, so it belongs in the log beside the
+ * turn events rather than on the model-visible surface. A plugin record is the
+ * host's carrier for exactly that kind of fact: it is retained on every read,
+ * interpreted as a surface node by none, and it may be written at any moment —
+ * including before the host publishes its protected surface head, where a message
+ * would make the whole log unreadable.
+ *
+ * A record that exists only as a plugin record means the step that composes the
+ * next environment is the only reader that has to know it, which is why the panel
+ * and the planner read this type directly instead of waiting for a delivery.
+ */
+export const CAPABILITY_SELECTION_RECORD = 'plugin:ptc-plus/capability-selection'
+
+const MAX_CHOICES = 256
+/** The one entry-id vocabulary a choice record may use; its writer validates the same form. */
+export const CAPABILITY_ENTRY_ID = /^(tools|skills|mcp|mcpServers)\.[^\s]{1,200}$/
+const ENTRY_ID = CAPABILITY_ENTRY_ID
+const AVAILABILITY = ['enabled', 'closed', 'automatic']
+const DISCLOSURE = ['automatic', ...CAPABILITY_DISCLOSURES]
+const PREFIX = 'PTC Plus session capability choices. These are this session\'s own decisions; the global configuration still owns the saved column, and the host still owns which entries exist. Choices:'
+
+function isRecord(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+function sortedEntries(choices) {
+  return Object.entries(choices).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
+}
+
+export function normalizeCapabilitySelection(value) {
+  if (!isRecord(value) || Reflect.ownKeys(value).length !== 2
+    || !Object.hasOwn(value, 'schema') || !Object.hasOwn(value, 'choices')) {
+    throw new TypeError('invalid capability selection')
+  }
+  if (value.schema !== CAPABILITY_SELECTION_SCHEMA) throw new TypeError('invalid capability selection schema')
+  if (!isRecord(value.choices) || Reflect.ownKeys(value.choices).length > MAX_CHOICES) {
+    throw new TypeError('invalid capability selection choices')
+  }
+  const choices = {}
+  for (const [id, choice] of sortedEntries(value.choices)) {
+    if (!ENTRY_ID.test(id) || !isRecord(choice) || Reflect.ownKeys(choice).length === 0) {
+      throw new TypeError('invalid capability selection entry')
+    }
+    const next = {}
+    for (const [dimension, selection] of Object.entries(choice)) {
+      const allowed = dimension === 'availability' ? AVAILABILITY
+        : dimension === 'disclosure' ? DISCLOSURE : undefined
+      if (allowed === undefined || !allowed.includes(selection)) throw new TypeError('invalid capability selection dimension')
+      next[dimension] = selection
+    }
+    choices[id] = next
+  }
+  return Object.freeze({ schema: CAPABILITY_SELECTION_SCHEMA,
+    choices: Object.freeze(Object.fromEntries(Object.entries(choices).map(([id, choice]) => [id, Object.freeze(choice)]))) })
+}
+
+/** The exact model-visible wording one selection record carries. */
+export function capabilitySelectionText(selection) {
+  return `${PREFIX}\n${JSON.stringify(normalizeCapabilitySelection(selection).choices)}`
+}
+
+/**
+ * The historical message this statement was written as before the record carrier.
+ *
+ * 0.5.4 and earlier appended this message on the model-visible surface, which is what
+ * `scripts/repair-session-log.mjs` repairs. No writer produces it now: the record below is
+ * the statement, and this form survives so that a session persisted by one of those releases
+ * is still read, and so that the repair has the shape it retires to build a fixture from.
+ */
+export function capabilitySelectionMessage(selection) {
+  const text = capabilitySelectionText(selection)
+  const message = createUserMessage({
+    source: { kind: PTC_MESSAGE_SOURCE_KIND, form: CAPABILITY_SELECTION_FORM },
+    content: [{ type: 'text', text }],
+  })
+  if (readCapabilitySelection(message) === undefined) throw new TypeError('invalid capability selection message')
+  return message
+}
+
+/** Read one committed plugin record back as this session's selection, or nothing. */
+export function readCapabilitySelectionRecord(event) {
+  if (event?.type !== CAPABILITY_SELECTION_RECORD || event.ignorable !== true) return undefined
+  try {
+    return normalizeCapabilitySelection(event.data)
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Whether one event states this session's capability selection at all.
+ *
+ * The record type states it, and so does the historical message form. A repaired statement
+ * (`RETIRED_SURFACE_RECORD`) states it only when the payload it kept is this owner's own form:
+ * a repair retires every surface node ahead of the protected head, whichever owner wrote it, so
+ * the carrier alone says nothing about who the statement belongs to. Reading another owner's
+ * retired statement as this one would answer `unreadable` for a decision this session never made
+ * — and would then outvote the selection the session did record.
+ */
+function statesCapabilitySelection(event) {
+  if (event?.type === CAPABILITY_SELECTION_RECORD) return true
+  const source = event?.data?.source
+  return isPtcMessageSource(source) && source.form === CAPABILITY_SELECTION_FORM
+}
+
+/**
+ * Read one selection out of either carrier.
+ *
+ * A record and the historical message state the same selection, so a caller that walks a log
+ * does not have to know which release wrote it — and a repaired statement answers for the owner
+ * whose form it carries.
+ */
+export function readCapabilitySelectionStatement(event) {
+  if (event?.type === CAPABILITY_SELECTION_RECORD) return readCapabilitySelectionRecord(event)
+  if (event?.type === RETIRED_SURFACE_RECORD) {
+    return event.ignorable === true && statesCapabilitySelection(event) ? readCapabilitySelection(event.data) : undefined
+  }
+  return event?.type === 'user/message' ? readCapabilitySelection(event.data) : undefined
+}
+
+/** Read one selection record back from a message, message projection or message fact. */
+export function readCapabilitySelection(value) {
+  const source = value?.source
+  if (!isPtcMessageSource(source) || source.form !== CAPABILITY_SELECTION_FORM) return undefined
+  if (!Array.isArray(value.content) || value.content.length !== 1 || value.content[0]?.type !== 'text') return undefined
+  const text = value.content[0].text
+  if (typeof text !== 'string' || !text.startsWith(`${PREFIX}\n`)) return undefined
+  try {
+    const choices = JSON.parse(text.slice(PREFIX.length + 1))
+    const selection = normalizeCapabilitySelection({ schema: CAPABILITY_SELECTION_SCHEMA, choices })
+    return capabilitySelectionText(selection) === text ? selection : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * How this session's newest selection record reads.
+ *
+ * The newest record is the current statement whether or not this build can parse
+ * it, so an unreadable one is not evidence for an earlier record either.
+ */
+export function classifyCapabilitySelection(records) {
+  if (!Array.isArray(records)) return Object.freeze({ state: 'none' })
+  for (let index = records.length - 1; index >= 0; index -= 1) {
+    const record = records[index]
+    if (record?.form !== CAPABILITY_SELECTION_FORM) continue
+    try {
+      return Object.freeze({ state: 'decided',
+        selection: normalizeCapabilitySelection({ schema: CAPABILITY_SELECTION_SCHEMA, choices: record.choices }) })
+    } catch {
+      return Object.freeze({ state: 'unreadable' })
+    }
+  }
+  return Object.freeze({ state: 'none' })
+}
+
+/**
+ * The dimension rule one selection states, or `{}` when it states no decision.
+ *
+ * One selection is the vocabulary a saved decision, a command intent and a
+ * delivered plan's override all use; a record states dimensions. This function
+ * is the only place the two spellings meet, so a writer that copies a selection
+ * into a record and a reader that turns a delivered override back into one
+ * cannot disagree about what that selection meant. Anything narrower — a rule
+ * naming only one dimension — is already in this shape and is copied as it is.
+ */
+export function capabilityRuleOfSelection(selection) {
+  if (isRecord(selection)) return { ...selection }
+  return selection === undefined || selection === 'inherit' ? {}
+    : selection === 'automatic' ? { availability: 'automatic', disclosure: 'automatic' }
+      : selection === 'closed' ? { availability: 'closed' } : { availability: 'enabled', disclosure: selection }
+}
+
+/**
+ * The dimension form of one recorded-by-plan override.
+ *
+ * A delivered plan recorded this session's choices in the compact vocabulary a
+ * saved configuration uses — one whole selection per entry, or the dimensions a
+ * policy rule states — while a record states dimensions only. The two meet in
+ * `capabilityRuleOfSelection`, which is why the plan is an equivalent form of one
+ * statement rather than a second vocabulary: every value it reads maps back to
+ * the same compact selection, so a choice read from a plan and restated into a
+ * record says what the plan said.
+ */
+function planChoice(override) {
+  const choice = capabilityRuleOfSelection(override)
+  return Object.keys(choice).length === 0 ? undefined : choice
+}
+
+/**
+ * This session's statement as its newest delivered plan recorded it.
+ *
+ * Only a plan that delivered at least one choice is a statement: an empty
+ * override map says the session inherited everything, which is the state a
+ * session without a record already reads as, not a decision to migrate. A plan
+ * whose overrides cannot be read as this vocabulary is `unreadable` for the same
+ * reason a record is: it supersedes what came before it and this build cannot
+ * say what it decided.
+ */
+function planSelection(message) {
+  const snapshot = message?.source?.snapshot
+  const overrides = snapshot?.sessionOverrides
+  // A snapshot that states no choices at all (the v1 generation) recorded nothing to
+  // migrate. One that states them in a shape this vocabulary cannot read is
+  // `unreadable`: it supersedes what came before it, and reporting `none` would let
+  // the composition withdraw a decision the log still holds.
+  if (overrides === undefined) return Object.freeze({ state: 'none' })
+  if (!isRecord(overrides)) return Object.freeze({ state: 'unreadable' })
+  try {
+    // The entries are collected as pairs and materialized with own data properties: an
+    // override key the record vocabulary cannot name (for example `__proto__`) must reach
+    // the vocabulary check as a name it refuses, not silently become the map's prototype
+    // and leave the statement reading `none` where the record branch reads `unreadable`.
+    const entries = []
+    for (const [id, override] of sortedEntries(overrides)) {
+      const choice = planChoice(override)
+      if (choice !== undefined) entries.push([id, choice])
+    }
+    if (entries.length === 0) return Object.freeze({ state: 'none' })
+    return Object.freeze({ state: 'decided', legacy: true,
+      selection: normalizeCapabilitySelection({ schema: CAPABILITY_SELECTION_SCHEMA, choices: Object.fromEntries(entries) }) })
+  } catch {
+    return Object.freeze({ state: 'unreadable' })
+  }
+}
+
+/**
+ * How this session's newest statement reads, from its own log events.
+ *
+ * One entry answers for every consumer: a record when the session wrote one,
+ * otherwise the newest delivered plan as the equivalent form. Reading the plan
+ * only when no record exists keeps the record the newest word, so a session that
+ * upgraded and then decided again is not answered from an older plan.
+ *
+ * A caller that knows which session the log belongs to passes that identity, and a
+ * delivered plan that names a different session is then not read as this session's
+ * statement. A plan message carries the session it was composed for, and the writers
+ * that restore one require that identity; a record carries none, so the log it was
+ * appended to is its only identity.
+ */
+export function capabilitySelectionOf(events, sessionId) {
+  const records = []
+  let delivered
+  for (const event of Array.isArray(events) ? events : []) {
+    // A record is the statement itself; the message form is the same statement on a release
+    // that wrote one. A repaired statement keeps its wording and loses only the carrier, so all
+    // three take part in the same "newest statement wins" ordering — but only while the payload
+    // is this owner's own form, because the repair retires every owner's surface node.
+    if (event?.type === CAPABILITY_SELECTION_RECORD || event?.type === RETIRED_SURFACE_RECORD) {
+      if (!statesCapabilitySelection(event)) continue
+      records.push({ form: CAPABILITY_SELECTION_FORM, choices: readCapabilitySelectionStatement(event)?.choices })
+      continue
+    }
+    if (event?.type !== 'user/message') continue
+    const source = event.data?.source
+    if (!isPtcMessageSource(source)) continue
+    if (source.form === CAPABILITY_SELECTION_FORM) {
+      records.push({ form: CAPABILITY_SELECTION_FORM, choices: readCapabilitySelection(event.data)?.choices })
+    } else if (source.form === CAPABILITY_PLAN_FORM
+      && (sessionId === undefined || source.sessionId === sessionId)) delivered = event.data
+  }
+  const recorded = classifyCapabilitySelection(records)
+  return recorded.state === 'none' ? planSelection(delivered) : recorded
+}
+
+/** The choice this session recorded for one entry, or `undefined` when it recorded none. */
+export function capabilityChoiceOf(statement, id) {
+  return statement?.state === 'decided' ? statement.selection.choices[id] : undefined
+}

package/internal/direct-surface-owner.js

@@ -637,7 +637,15 @@ export function createDirectSurfaceOwner({
       if (!isCurrent()) return assembly
       const sessionPtc = presentation !== 'native' && id !== undefined
       const sessionPtcProjection = presentation === 'ptc' && id !== undefined
-      if (sessionPtc) await capabilityEnvironment?.prepare(agent, assembly.sections)
+      // The step's admission is the delivered capability set: the Host renders its own
+      // `tools:sdk` block from it and builds a program's `tools` members from it, so a
+      // declaration composed from the registered-definitions view can name a member this
+      // step does not deliver. Reading it here keeps the declaration, the plan and the
+      // program about one set; a host that publishes no admission states no set, and the
+      // registry view is then the only evidence left.
+      const delivered = sessionPtc && context?.toolSet !== undefined
+        ? toolSchemasForAgent(agent, context.toolSet) : undefined
+      if (sessionPtc) await capabilityEnvironment?.prepare(agent, assembly.sections, false, undefined, delivered)
       const userBindings = sessionPtc ? await userBindingsForAgent(agent) : undefined
       if (!isCurrent()) return assembly
       const runCode = tools?.find(tool => tool?.name === RUN_CODE)
@@ -668,9 +676,9 @@ export function createDirectSurfaceOwner({
         && assembly.sections.some(section => section?.name === 'tools:sdk'
           || (sessionPtcProjection && section?.name === completedState.collapseSectionName))
       const sections = projectsSections
-        ? (capabilityEnvironment?.projectSections(agent, assembly.sections) ?? assembly.sections).map(section => {
+        ? (capabilityEnvironment?.projectSections(agent, assembly.sections, delivered) ?? assembly.sections).map(section => {
             if (section?.name === 'tools:sdk') {
-              return { ...section, text: capabilitySdk(capabilityEnvironment?.sdk(agent, section.text) ?? section.text,
+              return { ...section, text: capabilitySdk(capabilityEnvironment?.sdk(agent, section.text, delivered) ?? section.text,
                 userBindings !== undefined, languageSemantics) }
             }
             if (sessionPtcProjection && section?.name === completedState.collapseSectionName) {
@@ -680,8 +688,13 @@ export function createDirectSurfaceOwner({
           })
         : assembly.sections
       if (id !== undefined) {
+        // A top-level call is repaired into a program call only for a member this step
+        // delivers: the admission is what the declaration and the program state, so a
+        // name the registry merely carries is a call no member answers and no schema
+        // proves. A step that published no admission keeps the registry view.
+        const callable = delivered ?? toolSchemasForAgent(agent)
         const nativeSchemas = presentation === 'ptc'
-          ? new Map((capabilityEnvironment?.visibleSchemas(agent, toolSchemasForAgent(agent)) ?? toolSchemasForAgent(agent))
+          ? new Map((capabilityEnvironment?.visibleSchemas(agent, callable) ?? callable)
             .filter(schema => typeof schema?.name === 'string'
               && schema.name !== RUN_CODE && schema.name !== EDIT_RUN_CODE)
             .map(schema => [schema.name, schema]))

package/internal/edit-transport-owner.js

@@ -310,8 +310,9 @@ export function createEditTransportOwner(ctx, {
           subCallId: `${String(exec.callId)}:derived`, name: RUN_CODE, arguments: argumentsValue }
         const executionStart = agent.session.append('tool/ptc-dispatch-start', data)
         const derivedExec = { callId: data.subCallId, rootCallId: data.rootCallId,
-          parent: rootExec.token, name: RUN_CODE, arguments: argumentsValue, agent, signal: rootSignal }
-        const dispatch = () => dispatchToolCall(ctx.tools, derivedExec)
+          parent: rootExec.token, name: RUN_CODE, arguments: argumentsValue, agent, signal: rootSignal,
+          ...(rootExec.toolSet === undefined ? {} : { toolSet: rootExec.toolSet }) }
+        const dispatch = () => dispatchToolCall(ctx.tools, derivedExec, ctx)
         const tentative = await executeTentative(executionStart.seq, start.rootCallSeq,
           dispatch, executionLog, derivedExec)
         const inner = tentative.result

package/internal/host-tool-sdk.js

@@ -260,41 +260,29 @@ export function sessionExecutionAvailable(tools, scope, name = 'run_code') {
 }
 
 /**
- * Executions this plugin submitted under the host's batch dispatch contract.
+ * Dispatch one tool call through the Host's invocation policy.
  *
- * That contract assigns the execution identity itself, so the execution object a
- * host runs is not the one the caller built and carries no parent token the caller
- * could compare. The submission record is what remains: the call id this plugin
- * chose, which the host matched its result back to.
- */
-const batchSubmissions = new WeakSet()
-
-/**
- * Whether this execution was submitted as a host batch call.
- * @param {object} execution - an execution object this plugin built.
- * @returns {boolean} true when the batch contract dispatched it.
- */
-export function isBatchSubmission(execution) {
-  return execution !== null && typeof execution === 'object' && batchSubmissions.has(execution)
-}
-
-/**
- * Dispatch one tool call through the host registry.
- *
- * Two dispatch contracts are published. A registry host accepts one call and
- * resolves to that call's settled result. An executor host accepts a complete
- * model batch, assigns the execution identity itself, and resolves to the
- * ordered outcomes — so the caller supplies only the call it wants run, and the
- * executor's own token is the one its observers see.
+ * Registry Hosts accept an execution input directly. Executor Hosts reserve
+ * batches for root calls; nested inputs use the published invocation pipeline
+ * so the Host retains their actual parent token and enclosing root identity.
+ * The Host owns validation, policy, cancellation and result materialization.
  * @param {object} tools - the host tool registry (`ctx.tools`).
  * @param {object} execution - call identity, arguments, agent and signal.
+ * @param {object} [ctx] - the owning plugin context, required for nested execution.
  * @returns {Promise<object>} this call's settled result.
  */
-export async function dispatchToolCall(tools, execution) {
+export async function dispatchToolCall(tools, execution, ctx) {
   if (typeof tools?.selectExecutor !== 'function') return tools.execute(execution)
-  // Recorded before the host runs the batch: it calls back into this plugin during
-  // the dispatch, and the relation has to be provable then.
-  batchSubmissions.add(execution)
+  if (execution.parent !== undefined) {
+    if (ctx === undefined) throw new Error('ptc-plus: nested Host execution requires its owning context')
+    const { ToolExecutionPipeline } = await import('@deepseek-ai/dsh-tools/pipeline')
+    const pipeline = new ToolExecutionPipeline(ctx, {
+      get: (name, scope) => hostTransportDefinition(tools, scope, name),
+    })
+    const prepared = await pipeline.prepare(execution)
+    const outcome = prepared.kind === 'dispatch' ? await pipeline.dispatch(prepared.exec) : prepared
+    return pipeline.complete(prepared.exec, outcome)
+  }
   const settled = await tools.execute({
     calls: [{ id: execution.callId, name: execution.name, arguments: JSON.stringify(execution.arguments) }],
     signal: execution.signal,

package/internal/message-sources.js

@@ -7,6 +7,27 @@ export function isPtcMessageSource(source) {
     || (source?.kind === 'plugin' && source.plugin === 'ptc-plus')
 }
 
+/**
+ * The delivered capability plan form.
+ *
+ * The plan producer composes this message; naming its form here keeps the
+ * vocabulary of what this plugin writes in one module, so the record reader can
+ * recognize a delivered plan without importing the producer that composes one.
+ */
+export const CAPABILITY_PLAN_FORM = 'capability-plan'
+
+/**
+ * The record a surface statement becomes when it may no longer occupy the surface.
+ *
+ * A session written before the record carrier carries a decision as a `user/message` ahead of the
+ * Host's protected head, and the released format refuses such a log on every read.
+ * `scripts/repair-session-log.mjs` keeps the sequence number and the payload and gives up only the
+ * carrier. The statement is therefore still a statement of the owner whose form its payload names,
+ * which is why this carrier lives beside the forms rather than in either owner: two owners read it,
+ * and each of them reads only its own.
+ */
+export const RETIRED_SURFACE_RECORD = 'plugin:ptc-plus/retired-surface-statement'
+
 /** DSH owns aggregate runtime-context messages independently of PTC messages. */
 export function isHostRuntimeContextSource(source) {
   return source?.kind === 'runtime-context'

package/internal/program-bindings.js

@@ -3,10 +3,19 @@ import { record, text } from './record-utils.js'
 import { createHash } from 'node:crypto'
 import { snapshotJsonValue } from '@deepseek-ai/dsh-util-values'
 
-/** Derive SDK contracts from the public, scope-qualified tool registry. */
-export function toolSdkSchemas(tools, scope) {
-  return tools.schemas(scope).filter(schema => schema.name !== 'run_code').map(schema => {
-    const definition = tools.get(schema.name, scope)
+/**
+ * Derive SDK contracts from the public, scope-qualified tool registry.
+ *
+ * `toolSet` is the step's admission, and passing it is how a caller states the set the
+ * Host actually delivers for that step: the Host renders its own `tools:sdk` block and
+ * builds a program's `tools` members from the admitted definitions, so a contract list
+ * read from the registered-definitions view can name a member no step delivers.
+ */
+export function toolSdkSchemas(tools, scope, toolSet = undefined) {
+  return tools.schemas(scope, toolSet).filter(schema => schema.name !== 'run_code').map(schema => {
+    // The definition is read through the same admission, so a contract describes the
+    // definition this step delivers rather than one the registry would resolve.
+    const definition = tools.get(schema.name, scope, toolSet)
     const output = snapshotJsonValue(definition?.output?.schema)
     if (output === undefined) {
       throw new TypeError(`ptc-plus: tool "${schema.name}" output schema must be lossless JSON before SDK projection`)

package/internal/runtime-bridge-owner.js

@@ -25,7 +25,7 @@ import {
 } from './program-bindings.js'
 import { deepFreeze } from './record-utils.js'
 import { adaptRunCodeSchema } from './direct-surface-owner.js'
-import { hostTransportDefinition, isBatchSubmission } from './host-tool-sdk.js'
+import { hostTransportDefinition } from './host-tool-sdk.js'
 import { REPL_MEMORY_META_KEY, withReplMemorySnapshot } from './repl-memory-projection.js'
 import { withUserBindingDraftCapability } from './user-binding-draft-projection.js'
 import { POST_EDIT_KEY } from './session-journal-schema.js'
@@ -347,7 +347,11 @@ export function createRuntimeBridgeOwner({
     )))
     const metadata = Object.freeze([
       ...(capabilityEnvironment?.toolMetadata(executionToken?.agent, toolCapabilityMetadata(schemas, annotations), schemas) ?? toolCapabilityMetadata(schemas, annotations)),
-      ...(capabilityEnvironment?.metadata(executionToken?.agent) ?? []),
+      // The same set, as the third argument's own evidence: a derived row (`skills.*`,
+      // `mcp.*`) states the invocation path it still has, and the operations it can name
+      // are the members this program was handed — not the ones the composition froze when
+      // the session was last composed, which a step that delivers less does not rewrite.
+      ...(capabilityEnvironment?.metadata(executionToken?.agent, schemas) ?? []),
       ...PROGRAM_CAPABILITY_METADATA.map(entry => entry.namespace === 'code'
         && cellConfig.userBindingsEnabled === true
         ? { ...entry, members: [...entry.members, BINDING_SUBMISSION] }
@@ -698,17 +702,13 @@ function applyEditableSlots(definition, promptText, slotPatches) {
   /**
    * Whether this execution is the derived execution the edit transport submitted.
    *
-   * A registry host runs the very object the plugin built, so the call id, the root
-   * call and the parent token it carries all prove the relation. The batch contract
-   * assigns its own identity instead: the parent token is the host's own and the
-   * root call is whichever call that host treats as direct. What survives there is
-   * the call id this plugin chose, which the host matched the batch result back to,
-   * together with the dispatch record; the derived source is compared beside it.
+   * Both Host invocation contracts preserve the submitted call id, enclosing
+   * root and actual parent token. All three must match; a root batch submission
+   * cannot establish a nested execution merely by choosing the same call id.
    */
   const isDerivedExecution = (derived, exec) => {
     if (derived === null || typeof derived !== 'object' || exec === null || typeof exec !== 'object') return false
     if (derived.callId !== exec.callId) return false
-    if (isBatchSubmission(derived)) return true
     return exec.parent !== undefined
       && derived.rootCallId === exec.rootCallId && derived.parent === exec.parent
   }

package/internal/runtime-config.js

@@ -130,6 +130,16 @@ export function resolveConfig(config = {}) {
     }
   }
   resolved.capabilityPolicy = JSON.stringify(capabilityPolicyForConfig(provided.has('capabilityPolicy') ? resolved : { ...resolved, capabilityPolicy: undefined }))
+  // Whether the record holds this policy is a fact about the input document, not about this
+  // resolution's output: a configuration this function already resolved carries the answer,
+  // and resolving that answer's own product again must not re-infer it from the policy this
+  // function just wrote. Callers that reconcile by resolving a source that may itself be
+  // resolved (the plugin resolves its raw document and then re-resolves the result) would
+  // otherwise report every policy as saved, which is what makes a synthesized bottom layer
+  // decide the saved column. The marker only means something beside a policy the document
+  // itself holds, so a document that writes the marker without one states no provenance.
+  resolved.capabilityPolicySaved = provided.has('capabilityPolicy')
+    && (typeof config.capabilityPolicySaved === 'boolean' ? config.capabilityPolicySaved : true)
   if (!provided.has('capabilityPolicy') && resolved.capabilityManagementEnabled) {
     if (!provided.has('capabilityRecoveryEnabled')) resolved.capabilityRecoveryEnabled = true
     if (!provided.has('modelPreviewEnabled')) resolved.modelPreviewEnabled = true