glasspane-mcp 1.3.1 → 1.5.0

package/dist/dispatch.d.ts

@@ -26,7 +26,7 @@ export declare const MCP_PROTOCOL_VERSION: "2025-06-18";
 export declare const SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
 export declare const SERVER_INFO: {
     readonly name: "glasspane-mcp";
-    readonly version: "1.3.1";
+    readonly version: "1.5.0";
 };
 export declare const PARSE_ERROR = -32700;
 export declare const INVALID_REQUEST = -32600;

package/dist/engine-client.d.ts

@@ -139,6 +139,28 @@ export declare const RESTORE_BASE_DEADLINE_MS = 30000;
 export declare function isReplayUnsafeMethod(method: string): boolean;
 /** The non-replayable methods, for gates that must see the set change on purpose. */
 export declare const REPLAY_UNSAFE_METHOD_NAMES: readonly string[];
+/**
+ * Methods whose re-issue writes daemon state the *caller* depends on, even though
+ * replaying them is not unsafe in the sense {@link REPLAY_UNSAFE_REASONS} means
+ * (no operation of the user's is performed a second time). They are the other half
+ * of the answer to "may this be narrowed by sending it again?", and they are kept
+ * apart from the set above because `test/probe-liveness.test.mjs` pins that set's
+ * membership as the no-replay judgement.
+ *
+ * `snapshot` is here because of a ring, not of a click: `storeSnapshot`
+ * (`engine/Sources/GlassPaneEngine/EngineCore.swift:2070`) appends the new
+ * baseline and then trims oldest-first to `EngineCore.snapshotHistoryLimit` (the
+ * same file, line 25 — 8 entries). A `gp_snapshot` whose caller timed out may
+ * therefore have been carried out already, and every re-send — "with a smaller
+ * maxDepth", which is what the tool layer used to say — adds another entry that can
+ * evict the baseline the caller's *own earlier* snapshot returned, the one
+ * `gp_restore {snapshotId}` needs later. Evicting a caller's evidence to fetch a
+ * cheaper copy of it is not narrowing.
+ *
+ * `attach` writes state too, and is already a replay-unsafe method; `tools.ts`
+ * unions the two lists rather than repeating names here.
+ */
+export declare const STATE_CHANGING_ON_RETRY_METHOD_NAMES: readonly string[];
 /** Deadline for one request; `restore` scales with its replayed step count. */
 export declare function engineDeadlineMs(method: string, params?: Record<string, unknown>): number;
 /** When the caller gets its answer for `method`: its deadline, capped. */
@@ -366,6 +388,12 @@ export declare class EngineJsonRpcClient {
      * Oldest request this client still tracks, settled ones included: that is the
      * request the daemon's arrival-ordered answer belongs to. `Map` iteration is
      * insertion order, which is the order the requests went out.
+     *
+     * An entry whose id-less answer has already been taken (`arrivalOrderConsumed`)
+     * is passed over for *this* purpose while staying in the map for the echoed-id
+     * lookup: the guess has been spent once and may not be spent again on the next
+     * id-less frame, and the request it was spent on is still the request whose real
+     * reply can arrive with its id (finding 中-4).
      */
     private oldestTracked;
     /**

package/dist/http-gateway-cli.js

@@ -219,6 +219,7 @@ function isReplayUnsafeMethod(method) {
   return Object.prototype.hasOwnProperty.call(REPLAY_UNSAFE_REASONS, method);
 }
 var REPLAY_UNSAFE_METHOD_NAMES = Object.keys(REPLAY_UNSAFE_REASONS);
+var STATE_CHANGING_ON_RETRY_METHOD_NAMES = ["snapshot"];
 function engineDeadlineMs(method, params) {
   if (method === "restore") {
     const steps = params?.steps;
@@ -275,6 +276,10 @@ var NARROWING_AUTHORITY = {
   mcp: "the gp_* tool that took this call publishes its own parameters, and their floors, in the schema shown beside that tool \u2014 read it there, not here",
   http: "this gateway publishes no parameter listing of its own, so the floors a body was accepted against are in the request contract this call was copied from"
 };
+function clientClosingRemedy(surface) {
+  const readRoute = surface === "mcp" ? "gp_recent_reports lists the operations this session recorded and gp_last_evidence {operationId} returns one in full" : "this gateway keeps no operation trail of its own, so the stderr line this reply is written to is the record";
+  return `this shell's own engine client is ending, which measures nothing about the daemon: nothing here authorises touching the daemon's lifecycle, and no restart is authorised by this answer. What is unknown stays unknown: whether the daemon finished this request cannot be told from a client that stopped asking. The reply may still land, under the bound this shell already states \u2014 ${lateReplyRoute(surface)} \u2014 and this shutdown is one of the endings that bound names: the server log line written at this moment lists the requests this client stopped tracking. Read what happened rather than performing it a second time: ${readRoute}. Ask through a server process that still has a live engine client.`;
+}
 function reIssueGuidance(surface) {
   return `wait for the outstanding reply rather than sending this request again: the daemon answers one request at a time, so a second copy of it now only queues behind the one still running and answers nothing sooner, and if the first did take effect the copy performs it a second time. What is worth narrowing here, and whether it can still be narrowed at the values this request already sent, is a fact about a schema, and this layer holds no schema for any request: ${NARROWING_AUTHORITY[surface]}. Re-send only after reading that, and only if the request is one whose repetition changes nothing`;
 }
@@ -430,8 +435,8 @@ var EngineJsonRpcClient = class {
     this.state.closed = true;
     this.teardown(new EngineCallError(
       GP_E_ENGINE_UNREACHABLE,
-      "engine client closed",
-      daemonUnreachableRemedy()
+      "engine client closed: this shell's own client is ending, so whether the daemon finished this request is not known here and this client can no longer attribute the reply that may still land",
+      clientClosingRemedy(this.surface)
     ));
     this.io.close();
   }
@@ -480,7 +485,11 @@ var EngineJsonRpcClient = class {
     if (typeof id === "number") {
       const entry = this.pending.get(id);
       if (!entry) {
-        this.report(`engine sent a frame for request id ${id}, which this client never issued (or already gave up on): ${truncate(line)}`);
+        const tracked = [...this.pending.values()];
+        const held = tracked.length === 0 ? "nothing is tracked now" : `this client still tracks ${tracked.length} request(s): ` + tracked.map((kept) => "'" + kept.method + "' id " + kept.id + (kept.settled ? " (caller already answered)" : "")).join(", ");
+        this.report(
+          `engine sent a frame for request id ${id}, which this client never issued (or already gave up on); ` + held + ": " + truncate(line)
+        );
         return;
       }
       this.pending.delete(id);
@@ -495,8 +504,9 @@ var EngineJsonRpcClient = class {
       const target = this.oldestTracked();
       if (target) {
         if (target.settled) {
-          this.pending.delete(target.id);
           this.reportLateReply(target, frame, true);
+          target.arrivalOrderConsumed = true;
+          this.retainForLateReply();
           return;
         }
         if (frame.error) {
@@ -557,9 +567,20 @@ var EngineJsonRpcClient = class {
    * Oldest request this client still tracks, settled ones included: that is the
    * request the daemon's arrival-ordered answer belongs to. `Map` iteration is
    * insertion order, which is the order the requests went out.
+   *
+   * An entry whose id-less answer has already been taken (`arrivalOrderConsumed`)
+   * is passed over for *this* purpose while staying in the map for the echoed-id
+   * lookup: the guess has been spent once and may not be spent again on the next
+   * id-less frame, and the request it was spent on is still the request whose real
+   * reply can arrive with its id (finding 中-4).
    */
   oldestTracked() {
-    return this.pending.values().next().value;
+    for (const entry of this.pending.values()) {
+      if (!entry.arrivalOrderConsumed) {
+        return entry;
+      }
+    }
+    return void 0;
   }
   /**
    * Route the reply that lands after its caller was already answered. `inferred`
@@ -1041,8 +1062,8 @@ var LEGACY_EVIDENCE_SCHEMA_VERSION = "glasspane.evidence/0.1-draft";
 var AttributionLevelSchema = z.enum(["soft", "strong", "weak"]);
 var CircuitBreakerLevelSchema = z.number().int().min(0).max(3);
 var SelectorSchema = z.strictObject({
-  role: z.string().max(SELECTOR_MAX_LENGTH),
-  title: z.string().max(SELECTOR_MAX_LENGTH).optional(),
+  role: z.string().min(1).max(SELECTOR_MAX_LENGTH),
+  title: z.string().min(1).max(SELECTOR_MAX_LENGTH).optional(),
   identifier: z.string().max(SELECTOR_MAX_LENGTH).optional()
 });
 var ActionSchema = z.enum([
@@ -1279,6 +1300,10 @@ function sortKeys(value) {
   return value;
 }
 
+// src/update-state.ts
+var CA_ROOTS_STATUSES = ["ok", "probe-failed", "empty", "unavailable", "write-unverified"];
+var KNOWN_CA_ROOTS_STATUSES = new Set(CA_ROOTS_STATUSES);
+
 // src/project-registry.ts
 import fs2 from "node:fs";
 import os2 from "node:os";
@@ -1794,14 +1819,9 @@ var OPERATION_ID_PATTERN2 = /^op_[0-9A-HJKMNP-TV-Z]{26}$/;
 var OptionalOperationIdSchema = z5.string().regex(OPERATION_ID_PATTERN2).optional();
 var OptionalProjectIdSchema = z5.string().regex(/^prj_[0-9A-HJKMNP-TV-Z]{26}$/).optional();
 var ExpectSchema = z5.union([z5.string().max(512), z5.boolean()]);
-var ShellSelectorSchema = z5.strictObject({
-  role: z5.string().min(1).max(SELECTOR_MAX_LENGTH),
-  title: z5.string().min(1).max(SELECTOR_MAX_LENGTH).optional(),
-  identifier: z5.string().max(SELECTOR_MAX_LENGTH).optional()
-});
 var SnapshotIdSchema = z5.string().regex(/^snap_[0-9A-HJKMNP-TV-Z]{26}$/);
 var ActStepSchema = z5.strictObject({
-  selector: ShellSelectorSchema,
+  selector: SelectorSchema,
   action: ActionSchema
 });
 var RestoreStepsSchema = z5.array(ActStepSchema).min(1).max(64).optional();
@@ -1841,12 +1861,12 @@ var AuditUiArgs = z5.strictObject({
   minHitTargetPt: OptionalHitTargetSchema
 });
 var ActArgs = z5.strictObject({
-  selector: ShellSelectorSchema,
+  selector: SelectorSchema,
   action: ActionSchema,
   degrade: z5.boolean().optional()
 });
 var AssertElementArgs = z5.strictObject({
-  selector: ShellSelectorSchema,
+  selector: SelectorSchema,
   property: AssertionPropertySchema,
   expected: ExpectSchema
 });
@@ -1890,9 +1910,11 @@ var selectorJsonSchema = {
   type: "object",
   additionalProperties: false,
   properties: {
-    // `minLength` here is the advertised half of {@link ShellSelectorSchema};
+    // `minLength` here is the advertised half of the kernel's `SelectorSchema`;
     // `test/tools.test.mjs` compares the two against each other and against the
-    // daemon's own rule, so neither side can be tightened or loosened alone.
+    // daemon's own rule, and `test/consumer-consistency.test.mjs` compares both
+    // against the published `kernel/schemas/evidence-pack.schema.json`, so no
+    // side can be tightened or loosened alone.
     role: { type: "string", minLength: 1, maxLength: SELECTOR_MAX_LENGTH },
     title: { type: "string", minLength: 1, maxLength: SELECTOR_MAX_LENGTH },
     identifier: { type: "string", maxLength: SELECTOR_MAX_LENGTH }
@@ -2176,6 +2198,25 @@ var TOOL_SPECS = [
 var TOOL_BY_NAME = new Map(
   TOOL_SPECS.map((spec) => [spec.name, spec])
 );
+var TARGET_SELECTING_KNOBS = {
+  gp_act: {
+    param: "selector",
+    picks: "which control the action is performed on",
+    substitute: "a different control takes the press, and the user's screen changes in a way no one asked for"
+  },
+  gp_assert_element: {
+    param: "selector",
+    picks: "which element the claim is about",
+    substitute: "the answer then describes a different element, while this session's trail still files it as the verdict on the claim you first made"
+  }
+};
+function targetSelectingKnob(specName, paramName) {
+  if (!Object.prototype.hasOwnProperty.call(TARGET_SELECTING_KNOBS, specName)) {
+    return null;
+  }
+  const entry = TARGET_SELECTING_KNOBS[specName];
+  return entry !== void 0 && entry.param === paramName ? { picks: entry.picks, substitute: entry.substitute } : null;
+}
 function narrowingKnobsFor(spec, params) {
   const properties = spec.inputSchema.properties ?? {};
   const knobs = [];
@@ -2190,11 +2231,21 @@ function narrowingKnobsFor(spec, params) {
     } else if (name === "limit") {
       knobs.push({ name, kind: "limit", minimum: schema.minimum, maximum: schema.maximum, sent });
     } else if (name === "selector" || name === "role" || name === "title") {
-      knobs.push({ name, kind: "selector", sent: void 0 });
+      const target = targetSelectingKnob(spec.name, name);
+      knobs.push(target === null ? { name, kind: "selector", sent: void 0 } : { name, kind: "target", sent: void 0, picks: target.picks, substitute: target.substitute });
     }
   }
   return knobs;
 }
+function replyShrinkingKnobs(knobs) {
+  return knobs.filter((knob) => knob.kind !== "target");
+}
+function targetKnobs(knobs) {
+  return knobs.filter((knob) => knob.kind === "target");
+}
+function describeTargetKnob(knob) {
+  return `'${knob.name}' names ${knob.picks ?? "which element this operation is about"}, so changing it is not a smaller or cheaper request \u2014 it is a different operation, and ${knob.substitute ?? "the answer then describes something else"}`;
+}
 function atAdvertisedFloor(knob) {
   return knob.minimum !== void 0 && knob.sent !== void 0 && knob.sent <= knob.minimum;
 }
@@ -2208,6 +2259,8 @@ function knobSubject(kind) {
       return "the image";
     case "selector":
       return "the reply";
+    case "target":
+      return "the element the operation is about";
   }
 }
 function describeKnob(knob) {
@@ -2224,19 +2277,27 @@ function describeKnob(knob) {
       return knob.name === "selector" ? "a more specific selector (aim at one element)" : `a tighter ${knob.name} filter`;
     case "scale":
       return `a smaller scale${bounds}${knob.sent !== void 0 ? `, currently ${knob.sent}` : ""}`;
+    case "target":
+      return describeTargetKnob(knob);
   }
 }
 function oversizedReplyAdvice(spec, params) {
   const knobs = narrowingKnobsFor(spec, params);
   const atFloor = knobs.filter(atAdvertisedFloor);
-  const shrinkable = knobs.filter((knob) => !atAdvertisedFloor(knob));
+  const target = targetKnobs(knobs);
+  const shrinkable = replyShrinkingKnobs(knobs).filter((knob) => !atAdvertisedFloor(knob));
   const head = `the reply was too large for one frame (${MAX_FRAME_BYTES}-byte limit); `;
-  const floorNote = atFloor.length === 0 ? "" : `${atFloor.map(describeKnob).join("; ")}; `;
+  const refused = [...atFloor.map(describeKnob), ...target.map(describeTargetKnob)];
+  const floorNote = refused.length === 0 ? "" : `${refused.join("; ")}; `;
   if (shrinkable.length === 0) {
-    return knobs.length > 0 ? head + `${atFloor.map(describeKnob).join("; ")} \u2014 nothing left to narrow on this request: ask a smaller question (one element, one region) rather than retrying it unchanged; the connection is intact and the daemon keeps answering other requests` : head + "this tool advertises no parameter that shrinks a reply, so do not retry it unchanged \u2014 ask a smaller question (one element, one region) instead; the connection is intact and the daemon keeps answering other requests";
+    return knobs.length > 0 ? head + floorNote + "nothing left to narrow on this request: " + (target.length > 0 ? "this request already carries one element and one region, so read the tree with gp_observe and, if the element you meant is another one, make that its own claim rather than treating this answer as a size problem" : "ask a smaller question (one element, one region) rather than retrying it unchanged") + "; the connection is intact and the daemon keeps answering other requests" : head + "this tool advertises no parameter that shrinks a reply, so do not retry it unchanged \u2014 ask a smaller question (one element, one region) instead; the connection is intact and the daemon keeps answering other requests";
   }
   return head + floorNote + `retry with ${shrinkable.map(describeKnob).join(" and ")}; the reply body has to fit one frame, and a retried identical request will be dropped identically; the connection is intact and the daemon keeps answering other requests`;
 }
+var NOT_NARROWABLE_BY_RETRY = /* @__PURE__ */ new Set([
+  ...REPLAY_UNSAFE_METHOD_NAMES,
+  ...STATE_CHANGING_ON_RETRY_METHOD_NAMES
+]);
 async function readTrail(session, turn, limit) {
   await turn.acquire();
   try {

package/dist/http-gateway.js

@@ -215,6 +215,7 @@ function isReplayUnsafeMethod(method) {
   return Object.prototype.hasOwnProperty.call(REPLAY_UNSAFE_REASONS, method);
 }
 var REPLAY_UNSAFE_METHOD_NAMES = Object.keys(REPLAY_UNSAFE_REASONS);
+var STATE_CHANGING_ON_RETRY_METHOD_NAMES = ["snapshot"];
 function engineDeadlineMs(method, params) {
   if (method === "restore") {
     const steps = params?.steps;
@@ -271,6 +272,10 @@ var NARROWING_AUTHORITY = {
   mcp: "the gp_* tool that took this call publishes its own parameters, and their floors, in the schema shown beside that tool \u2014 read it there, not here",
   http: "this gateway publishes no parameter listing of its own, so the floors a body was accepted against are in the request contract this call was copied from"
 };
+function clientClosingRemedy(surface) {
+  const readRoute = surface === "mcp" ? "gp_recent_reports lists the operations this session recorded and gp_last_evidence {operationId} returns one in full" : "this gateway keeps no operation trail of its own, so the stderr line this reply is written to is the record";
+  return `this shell's own engine client is ending, which measures nothing about the daemon: nothing here authorises touching the daemon's lifecycle, and no restart is authorised by this answer. What is unknown stays unknown: whether the daemon finished this request cannot be told from a client that stopped asking. The reply may still land, under the bound this shell already states \u2014 ${lateReplyRoute(surface)} \u2014 and this shutdown is one of the endings that bound names: the server log line written at this moment lists the requests this client stopped tracking. Read what happened rather than performing it a second time: ${readRoute}. Ask through a server process that still has a live engine client.`;
+}
 function reIssueGuidance(surface) {
   return `wait for the outstanding reply rather than sending this request again: the daemon answers one request at a time, so a second copy of it now only queues behind the one still running and answers nothing sooner, and if the first did take effect the copy performs it a second time. What is worth narrowing here, and whether it can still be narrowed at the values this request already sent, is a fact about a schema, and this layer holds no schema for any request: ${NARROWING_AUTHORITY[surface]}. Re-send only after reading that, and only if the request is one whose repetition changes nothing`;
 }
@@ -426,8 +431,8 @@ var EngineJsonRpcClient = class {
     this.state.closed = true;
     this.teardown(new EngineCallError(
       GP_E_ENGINE_UNREACHABLE,
-      "engine client closed",
-      daemonUnreachableRemedy()
+      "engine client closed: this shell's own client is ending, so whether the daemon finished this request is not known here and this client can no longer attribute the reply that may still land",
+      clientClosingRemedy(this.surface)
     ));
     this.io.close();
   }
@@ -476,7 +481,11 @@ var EngineJsonRpcClient = class {
     if (typeof id === "number") {
       const entry = this.pending.get(id);
       if (!entry) {
-        this.report(`engine sent a frame for request id ${id}, which this client never issued (or already gave up on): ${truncate(line)}`);
+        const tracked = [...this.pending.values()];
+        const held = tracked.length === 0 ? "nothing is tracked now" : `this client still tracks ${tracked.length} request(s): ` + tracked.map((kept) => "'" + kept.method + "' id " + kept.id + (kept.settled ? " (caller already answered)" : "")).join(", ");
+        this.report(
+          `engine sent a frame for request id ${id}, which this client never issued (or already gave up on); ` + held + ": " + truncate(line)
+        );
         return;
       }
       this.pending.delete(id);
@@ -491,8 +500,9 @@ var EngineJsonRpcClient = class {
       const target = this.oldestTracked();
       if (target) {
         if (target.settled) {
-          this.pending.delete(target.id);
           this.reportLateReply(target, frame, true);
+          target.arrivalOrderConsumed = true;
+          this.retainForLateReply();
           return;
         }
         if (frame.error) {
@@ -553,9 +563,20 @@ var EngineJsonRpcClient = class {
    * Oldest request this client still tracks, settled ones included: that is the
    * request the daemon's arrival-ordered answer belongs to. `Map` iteration is
    * insertion order, which is the order the requests went out.
+   *
+   * An entry whose id-less answer has already been taken (`arrivalOrderConsumed`)
+   * is passed over for *this* purpose while staying in the map for the echoed-id
+   * lookup: the guess has been spent once and may not be spent again on the next
+   * id-less frame, and the request it was spent on is still the request whose real
+   * reply can arrive with its id (finding 中-4).
    */
   oldestTracked() {
-    return this.pending.values().next().value;
+    for (const entry of this.pending.values()) {
+      if (!entry.arrivalOrderConsumed) {
+        return entry;
+      }
+    }
+    return void 0;
   }
   /**
    * Route the reply that lands after its caller was already answered. `inferred`
@@ -1031,8 +1052,8 @@ var LEGACY_EVIDENCE_SCHEMA_VERSION = "glasspane.evidence/0.1-draft";
 var AttributionLevelSchema = z.enum(["soft", "strong", "weak"]);
 var CircuitBreakerLevelSchema = z.number().int().min(0).max(3);
 var SelectorSchema = z.strictObject({
-  role: z.string().max(SELECTOR_MAX_LENGTH),
-  title: z.string().max(SELECTOR_MAX_LENGTH).optional(),
+  role: z.string().min(1).max(SELECTOR_MAX_LENGTH),
+  title: z.string().min(1).max(SELECTOR_MAX_LENGTH).optional(),
   identifier: z.string().max(SELECTOR_MAX_LENGTH).optional()
 });
 var ActionSchema = z.enum([
@@ -1269,6 +1290,10 @@ function sortKeys(value) {
   return value;
 }
 
+// src/update-state.ts
+var CA_ROOTS_STATUSES = ["ok", "probe-failed", "empty", "unavailable", "write-unverified"];
+var KNOWN_CA_ROOTS_STATUSES = new Set(CA_ROOTS_STATUSES);
+
 // src/project-registry.ts
 import fs2 from "node:fs";
 import os from "node:os";
@@ -1784,14 +1809,9 @@ var OPERATION_ID_PATTERN2 = /^op_[0-9A-HJKMNP-TV-Z]{26}$/;
 var OptionalOperationIdSchema = z5.string().regex(OPERATION_ID_PATTERN2).optional();
 var OptionalProjectIdSchema = z5.string().regex(/^prj_[0-9A-HJKMNP-TV-Z]{26}$/).optional();
 var ExpectSchema = z5.union([z5.string().max(512), z5.boolean()]);
-var ShellSelectorSchema = z5.strictObject({
-  role: z5.string().min(1).max(SELECTOR_MAX_LENGTH),
-  title: z5.string().min(1).max(SELECTOR_MAX_LENGTH).optional(),
-  identifier: z5.string().max(SELECTOR_MAX_LENGTH).optional()
-});
 var SnapshotIdSchema = z5.string().regex(/^snap_[0-9A-HJKMNP-TV-Z]{26}$/);
 var ActStepSchema = z5.strictObject({
-  selector: ShellSelectorSchema,
+  selector: SelectorSchema,
   action: ActionSchema
 });
 var RestoreStepsSchema = z5.array(ActStepSchema).min(1).max(64).optional();
@@ -1831,12 +1851,12 @@ var AuditUiArgs = z5.strictObject({
   minHitTargetPt: OptionalHitTargetSchema
 });
 var ActArgs = z5.strictObject({
-  selector: ShellSelectorSchema,
+  selector: SelectorSchema,
   action: ActionSchema,
   degrade: z5.boolean().optional()
 });
 var AssertElementArgs = z5.strictObject({
-  selector: ShellSelectorSchema,
+  selector: SelectorSchema,
   property: AssertionPropertySchema,
   expected: ExpectSchema
 });
@@ -1880,9 +1900,11 @@ var selectorJsonSchema = {
   type: "object",
   additionalProperties: false,
   properties: {
-    // `minLength` here is the advertised half of {@link ShellSelectorSchema};
+    // `minLength` here is the advertised half of the kernel's `SelectorSchema`;
     // `test/tools.test.mjs` compares the two against each other and against the
-    // daemon's own rule, so neither side can be tightened or loosened alone.
+    // daemon's own rule, and `test/consumer-consistency.test.mjs` compares both
+    // against the published `kernel/schemas/evidence-pack.schema.json`, so no
+    // side can be tightened or loosened alone.
     role: { type: "string", minLength: 1, maxLength: SELECTOR_MAX_LENGTH },
     title: { type: "string", minLength: 1, maxLength: SELECTOR_MAX_LENGTH },
     identifier: { type: "string", maxLength: SELECTOR_MAX_LENGTH }
@@ -2166,6 +2188,25 @@ var TOOL_SPECS = [
 var TOOL_BY_NAME = new Map(
   TOOL_SPECS.map((spec) => [spec.name, spec])
 );
+var TARGET_SELECTING_KNOBS = {
+  gp_act: {
+    param: "selector",
+    picks: "which control the action is performed on",
+    substitute: "a different control takes the press, and the user's screen changes in a way no one asked for"
+  },
+  gp_assert_element: {
+    param: "selector",
+    picks: "which element the claim is about",
+    substitute: "the answer then describes a different element, while this session's trail still files it as the verdict on the claim you first made"
+  }
+};
+function targetSelectingKnob(specName, paramName) {
+  if (!Object.prototype.hasOwnProperty.call(TARGET_SELECTING_KNOBS, specName)) {
+    return null;
+  }
+  const entry = TARGET_SELECTING_KNOBS[specName];
+  return entry !== void 0 && entry.param === paramName ? { picks: entry.picks, substitute: entry.substitute } : null;
+}
 function narrowingKnobsFor(spec, params) {
   const properties = spec.inputSchema.properties ?? {};
   const knobs = [];
@@ -2180,11 +2221,21 @@ function narrowingKnobsFor(spec, params) {
     } else if (name === "limit") {
       knobs.push({ name, kind: "limit", minimum: schema.minimum, maximum: schema.maximum, sent });
     } else if (name === "selector" || name === "role" || name === "title") {
-      knobs.push({ name, kind: "selector", sent: void 0 });
+      const target = targetSelectingKnob(spec.name, name);
+      knobs.push(target === null ? { name, kind: "selector", sent: void 0 } : { name, kind: "target", sent: void 0, picks: target.picks, substitute: target.substitute });
     }
   }
   return knobs;
 }
+function replyShrinkingKnobs(knobs) {
+  return knobs.filter((knob) => knob.kind !== "target");
+}
+function targetKnobs(knobs) {
+  return knobs.filter((knob) => knob.kind === "target");
+}
+function describeTargetKnob(knob) {
+  return `'${knob.name}' names ${knob.picks ?? "which element this operation is about"}, so changing it is not a smaller or cheaper request \u2014 it is a different operation, and ${knob.substitute ?? "the answer then describes something else"}`;
+}
 function atAdvertisedFloor(knob) {
   return knob.minimum !== void 0 && knob.sent !== void 0 && knob.sent <= knob.minimum;
 }
@@ -2198,6 +2249,8 @@ function knobSubject(kind) {
       return "the image";
     case "selector":
       return "the reply";
+    case "target":
+      return "the element the operation is about";
   }
 }
 function describeKnob(knob) {
@@ -2214,19 +2267,27 @@ function describeKnob(knob) {
       return knob.name === "selector" ? "a more specific selector (aim at one element)" : `a tighter ${knob.name} filter`;
     case "scale":
       return `a smaller scale${bounds}${knob.sent !== void 0 ? `, currently ${knob.sent}` : ""}`;
+    case "target":
+      return describeTargetKnob(knob);
   }
 }
 function oversizedReplyAdvice(spec, params) {
   const knobs = narrowingKnobsFor(spec, params);
   const atFloor = knobs.filter(atAdvertisedFloor);
-  const shrinkable = knobs.filter((knob) => !atAdvertisedFloor(knob));
+  const target = targetKnobs(knobs);
+  const shrinkable = replyShrinkingKnobs(knobs).filter((knob) => !atAdvertisedFloor(knob));
   const head = `the reply was too large for one frame (${MAX_FRAME_BYTES}-byte limit); `;
-  const floorNote = atFloor.length === 0 ? "" : `${atFloor.map(describeKnob).join("; ")}; `;
+  const refused = [...atFloor.map(describeKnob), ...target.map(describeTargetKnob)];
+  const floorNote = refused.length === 0 ? "" : `${refused.join("; ")}; `;
   if (shrinkable.length === 0) {
-    return knobs.length > 0 ? head + `${atFloor.map(describeKnob).join("; ")} \u2014 nothing left to narrow on this request: ask a smaller question (one element, one region) rather than retrying it unchanged; the connection is intact and the daemon keeps answering other requests` : head + "this tool advertises no parameter that shrinks a reply, so do not retry it unchanged \u2014 ask a smaller question (one element, one region) instead; the connection is intact and the daemon keeps answering other requests";
+    return knobs.length > 0 ? head + floorNote + "nothing left to narrow on this request: " + (target.length > 0 ? "this request already carries one element and one region, so read the tree with gp_observe and, if the element you meant is another one, make that its own claim rather than treating this answer as a size problem" : "ask a smaller question (one element, one region) rather than retrying it unchanged") + "; the connection is intact and the daemon keeps answering other requests" : head + "this tool advertises no parameter that shrinks a reply, so do not retry it unchanged \u2014 ask a smaller question (one element, one region) instead; the connection is intact and the daemon keeps answering other requests";
   }
   return head + floorNote + `retry with ${shrinkable.map(describeKnob).join(" and ")}; the reply body has to fit one frame, and a retried identical request will be dropped identically; the connection is intact and the daemon keeps answering other requests`;
 }
+var NOT_NARROWABLE_BY_RETRY = /* @__PURE__ */ new Set([
+  ...REPLAY_UNSAFE_METHOD_NAMES,
+  ...STATE_CHANGING_ON_RETRY_METHOD_NAMES
+]);
 async function readTrail(session, turn, limit) {
   await turn.acquire();
   try {