mixdog 1.4.2 → 1.4.3

package/src/session-runtime/tool-policy/agent-profile-fold.mjs

@@ -13,10 +13,7 @@ import {
 } from '../../runtime/agent/orchestrator/session/manager/workflow-switch-notice.mjs';
 import { sessionTailCacheExpired } from '../../runtime/agent/orchestrator/agent-runtime/cache-strategy.mjs';
 import { mergePendingDeferredToolDelta } from '../../runtime/agent/orchestrator/runtime-core/deferred-tool-delta.mjs';
-import {
-  agentMcpToolPermission,
-  connectorPolicyAgentOf,
-} from '../../runtime/agent/orchestrator/mcp/agent-connectors.mjs';
+import { foldLateDeferredTools } from '../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
 import { agentListEntries } from '../../runtime/agent/orchestrator/session/manager/prompt-utils.mjs';
 import { markToolSurfaceMigrated } from '../../runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs';
 import { resetBp2StableContext } from '../../runtime/agent/orchestrator/context/collect.mjs';
@@ -92,24 +89,14 @@ function cacheCold(session) {
   );
 }
 
-// The connector tools among `names` the session's agent may run now.
-function connectorTools(session, names) {
-  const agent = connectorPolicyAgentOf(session);
-  return [...names]
-    .filter((name) => name.startsWith('mcp__') && agentMcpToolPermission(agent, name) !== 'disabled')
-    .sort();
-}
-
-// A bot thread's tools that changed without its prompt: feature gates that
-// opened (or closed) and connectors added or removed. Nothing in the request
-// prefix moves. An opened tool joins the deferred catalog — reachable by
+// A bot thread's tools that changed without its prompt: workflow and
+// reaction gates that opened (or closed). Nothing in the request prefix
+// moves. An opened tool joins the late deferred catalog — reachable by
 // deferred loading, which brings its schema into the conversation — and a
 // gone one is refused at call time; the next turn's deferred_tools_delta
 // notice names both. Gate changes are folded into the prompt at the next
-// cold point (promptFoldPending). Connectors live in the bot's agent.json,
-// so they are compared only when its profile stamp moved (`edited`).
-// Returns true when anything changed.
-function stageLiveToolChanges({ liveDeniedTools, modelStandaloneTools }, session, workflow, { edited = false } = {}) {
+// cold point (promptFoldPending). Returns true when anything changed.
+function stageLiveToolChanges({ liveDeniedTools, modelStandaloneTools }, session, workflow) {
   const added = [];
   const removed = [];
   const known = new Map(schemaTools(session).map((tool) => [toolName(tool), tool]));
@@ -121,24 +108,17 @@ function stageLiveToolChanges({ liveDeniedTools, modelStandaloneTools }, session
     const fresh = modelStandaloneTools().filter(
       (tool) => opened.includes(toolName(tool)) && !known.has(toolName(tool))
     );
-    if (fresh.length) session.deferredToolCatalog = [...(session.deferredToolCatalog || []), ...fresh];
+    // The late pool, never the boot catalog a native request keeps byte-stable.
+    if (fresh.length) session.deferredLateToolCatalog = [...(session.deferredLateToolCatalog || []), ...fresh];
     for (const tool of fresh) known.set(toolName(tool), tool);
     session.disallowedTools = [...live];
     added.push(...opened.filter((name) => known.has(name)));
     removed.push(...closed);
     session.promptFoldPending = true;
   }
-  // Connectors gate MCP tools at call time only (pre-dispatch-deny.mjs).
-  const previous = session.agentConnectorTools;
-  const permitted = edited || !Array.isArray(previous) ? connectorTools(session, known.keys()) : previous;
-  session.agentConnectorTools = permitted;
-  if (edited && Array.isArray(previous)) {
-    added.push(...permitted.filter((name) => !previous.includes(name)));
-    removed.push(...previous.filter((name) => !permitted.includes(name)));
-  }
-  if (!added.length && !removed.length) {
-    return opened.length + closed.length > 0 || !Array.isArray(previous);
-  }
+  // Connector moves are staged at every turn start, for every session kind
+  // (tool-availability.mjs stageConnectorAvailability).
+  if (!added.length && !removed.length) return opened.length + closed.length > 0;
   mergePendingDeferredToolDelta(session, {
     added: added.map((name) => ({ name, description: known.get(name)?.description || '' })),
     removed,
@@ -162,7 +142,8 @@ function liftAgentDenial({ liveDeniedTools, modelStandaloneTools }, session) {
   if (!known.has('agent')) {
     const fresh = modelStandaloneTools().filter((tool) => toolName(tool) === 'agent');
     if (!fresh.length) return false;
-    session.deferredToolCatalog = [...(session.deferredToolCatalog || []), ...fresh];
+    // The late pool, never the boot catalog a native request keeps byte-stable.
+    session.deferredLateToolCatalog = [...(session.deferredLateToolCatalog || []), ...fresh];
     known.set('agent', fresh[0]);
   }
   session.disallowedTools = disallowed.filter((name) => name !== 'agent');
@@ -185,6 +166,7 @@ export function createAgentProfileFold({
   liveDeniedTools,
   stagePolicy,
   applyPolicy,
+  presentPromptSettings = () => {},
   turnInFlight,
 }) {
   // An agent profile edit that met a running turn: the next turn applies it.
@@ -206,7 +188,13 @@ export function createAgentProfileFold({
     // re-appends its deferred manifest.
     if (typeof staged.stableContext === 'string') resetBp2StableContext(session, staged.stableContext);
     applyPolicy(session, staged);
+    // Late tools join the rebuilt manifest (MCP instructions return with the
+    // server's next tool load): no notice.
+    foldLateDeferredTools(session);
     rewriteConversationBp3Core(session, staged.core);
+    // Every prompt setting as it stands — style, profile, language, core
+    // memory, instruction files — so no part of the prompt contradicts another.
+    presentPromptSettings(session, staged);
     if (session.agentProfileRevision !== undefined) {
       session.agentProfileRevision = agentProfileRevision(identity.agent, { mixy: agentMode });
       const { leadPromptParts } = activeWorkflowContext(config, getDataDir());
@@ -231,7 +219,9 @@ export function createAgentProfileFold({
     // prompt they were created with; they are task-scoped, and their skill
     // bodies are still restored from current sources at Compact.
     if (!session?.id || !session.promptIdentity || isAgentOwner(session)) return false;
-    const compacted = COLD_INTENTS.has(session.pendingCacheBreakIntent);
+    // A compaction is a cold point: the prompt is rebuilt instead of the
+    // dropped notices being sent again (pre-send compaction marks it).
+    const compacted = COLD_INTENTS.has(session.pendingCacheBreakIntent) || session.compactionFoldPending === true;
     if (!compacted && !(foldPending(session) && cacheCold(session))) return false;
     return foldPrompt(session, PROMPT_FOLD_INTENT);
   }
@@ -256,7 +246,7 @@ export function createAgentProfileFold({
    * release changed wait silently; both are folded in at the next cold point
    * (foldPromptIfCold). Returns true when the session changed (save it).
    */
-  async function refreshAgentProfile({ trigger = 'save' } = {}) {
+  async function refreshAgentProfile({ trigger = 'save', onlyIfEdited = false } = {}) {
     const session = getSession?.();
     const identity = session?.promptIdentity;
     const agent = identity?.agent;
@@ -276,15 +266,14 @@ export function createAgentProfileFold({
     const edited =
       recoverMode || session.agentProfileRevision !== revision || (agentMode && session.agentRosterRevision !== roster);
     // At a turn's start its own turn is the one counted; nothing runs yet.
+    if (onlyIfEdited && !edited) return false;
     const busy = () => getSession?.() !== session || (trigger !== 'turn' && turnInFlight(session));
     if (busy()) {
       agentProfilePending = true;
       return false;
     }
     const toolsChanged = agentMode
-      ? stageLiveToolChanges({ liveDeniedTools, modelStandaloneTools }, session, workflow, {
-          edited: session.agentProfileRevision !== revision,
-        })
+      ? stageLiveToolChanges({ liveDeniedTools, modelStandaloneTools }, session, workflow)
       : trigger === 'resume' && syncAgentListing(session);
     if (!edited) return (trigger === 'resume' && (await foldPromptIfCold())) || toolsChanged;
     // A coding session from before profile stamps keeps its prompt when it
@@ -315,14 +304,22 @@ export function createAgentProfileFold({
    *  fold pending prompt changes if the cache is cold anyway. */
   async function applyPendingAgentProfile() {
     let changed = false;
-    // A bot thread's connector baseline, before any edit can be compared to it.
     const session = getSession?.();
-    if (session?.id && sessionModeOf(session) === AGENT_MODE && !Array.isArray(session.agentConnectorTools)) {
-      session.agentConnectorTools = connectorTools(session, schemaTools(session).map(toolName));
-    }
-    if (agentProfilePending || orchestrationRecoveryNeeded(session)) {
+    // A bot thread compares its profile and roster stamps every turn, so hand
+    // edits and other processes' saves of AGENT.md, PERSONA.md and the roster
+    // reach it too.
+    // A thread from before profile stamps keeps its prompt until a save.
+    const botThread = Boolean(
+      session?.id &&
+        session.promptIdentity?.agent &&
+        sessionModeOf(session) === AGENT_MODE &&
+        session.agentProfileRevision !== undefined
+    );
+    const pending = agentProfilePending || orchestrationRecoveryNeeded(session);
+    if (pending || botThread) {
       agentProfilePending = false;
-      changed = await refreshAgentProfile({ trigger: 'turn' });
+      // A turn with nothing pending acts only on moved stamps.
+      changed = await refreshAgentProfile({ trigger: 'turn', onlyIfEdited: !pending });
     }
     changed = (await foldPromptIfCold()) || changed;
     return syncAgentListing(session) || changed;

package/src/session-runtime/tool-policy/mode-switch.mjs

@@ -17,7 +17,7 @@ function modeLoadableTools(session, mode) {
     ...toolNames(session.deferredCallableTools),
     ...toolNames(session.deferredDiscoveredTools),
   ]);
-  const deferred = new Set(toolNames(session.deferredToolCatalog));
+  const deferred = new Set([...toolNames(session.deferredToolCatalog), ...toolNames(session.deferredLateToolCatalog)]);
   const denied = new Set(
     [...(session.disallowedTools || []), ...(session.workflowOverlay?.deniedTools || [])].map(String)
   );

package/src/session-runtime/tool-policy/policy-stage.mjs

@@ -17,9 +17,19 @@ import {
 } from '../../runtime/agent/orchestrator/context/collect.mjs';
 import {
   _buildBaseRules,
+  _buildLeadLanguage,
+  _buildLeadLanguageContext,
   _buildLeadMetaContext,
 } from '../../runtime/agent/orchestrator/session/manager/rules-cache.mjs';
-import { sessionRolePromptFields } from '../../runtime/agent/orchestrator/session/manager/session-prompt-composition.mjs';
+import {
+  notePromptSettingsPresented,
+  promptConfigSlice,
+} from '../../runtime/agent/orchestrator/session/manager/prompt-settings.mjs';
+import { normalizeInstructionFilesMode } from '../../runtime/shared/instruction-files-mode.mjs';
+import {
+  buildWorkspacePromptContext,
+  sessionRolePromptFields,
+} from '../../runtime/agent/orchestrator/session/manager/session-prompt-composition.mjs';
 import {
   delegationDisabled,
   honoredSchemaAllowlist,
@@ -32,14 +42,19 @@ import { AGENT_MODE, sessionModeOf } from '../../runtime/agent/orchestrator/sess
 import { unusedModelEditToolName } from '../../runtime/shared/edit-tool-dialect.mjs';
 import {
   presentedAgentCatalogSlice,
+  refreshSessionBp3Environment,
+  replaceLanguageBlock,
+  replaceWorkspaceCoreSlices,
+  replaceWorkspaceEnvironment,
   withPresentedWorkspaceSlices,
 } from '../../runtime/agent/orchestrator/session/manager/prompt-utils.mjs';
-import { leadPartsFor, rewriteSystemHeading, toolNames } from './surface-helpers.mjs';
+import { leadPartsFor, rewriteConversationBp3Core, rewriteSystemHeading, toolNames } from './surface-helpers.mjs';
 
 export function createPolicyStage({
   getRoute,
   getMode,
   getDataDir,
+  getConfig,
   modelStandaloneTools,
   featureDisallowedTools,
   loadCoreMemoryContext,
@@ -96,17 +111,58 @@ export function createPolicyStage({
     }
   }
 
+  // The prompt-shaping settings sections `session` renders from `config` (the
+  // runtime's in-memory config) and `coreMemoryContext`, as session creation
+  // composes them (session-prompt-composition.mjs composeSessionSystem).
+  // `language` is the response language block closing the environment.
+  function promptSettingsSections(session, identity, config, coreMemoryContext) {
+    const ownerIsAgent = isAgentOwner(session);
+    const schemaAllowedTools = honoredSchemaAllowlist(session.schemaAllowedTools, {
+      ownerIsAgent,
+      agent: identity.agent,
+    });
+    const toolFreeRole = ownerIsAgent && schemaAllowedTools?.length === 0;
+    const agentMode = sessionModeOf(session) === AGENT_MODE;
+    const lead = !identity.skipAgentRules && !toolFreeRole && !ownerIsAgent;
+    const slice = promptConfigSlice(config);
+    const skip = identity.profileSkip || {};
+    const skills = schemaAllowedTools?.length === 0 ? [] : collectPromptSkillsCached(session.cwd, config);
+    const { packContext, summary, leadPromptParts, orchestrationMode } = activeWorkflowContext(config, getDataDir());
+    // A coding Lead's mode text, as session creation records it.
+    const codingLead = !ownerIsAgent && !agentMode;
+    return {
+      meta: lead ? _buildLeadMetaContext({ includeOutputStyle: !agentMode, config: slice }) : '',
+      // The workflow pack and the skill listing BP2 carries.
+      workflow: String(packContext || ''),
+      workflowName: summary?.name || summary?.id || null,
+      orchestration: codingLead ? String(leadPartsFor(session, leadPromptParts).orchestrationContext || '') : '',
+      orchestrationMode: codingLead ? orchestrationMode || '' : '',
+      skills: buildSkillManifest(skills),
+      instructionFilesMode: normalizeInstructionFilesMode(slice?.instructionFiles),
+      language: lead ? _buildLeadLanguageContext({ includeOutputStyle: !agentMode, config: slice }) : '',
+      instructionFiles:
+        toolFreeRole || agentMode || skip.claudemd ? '' : String(loadInstructionFilesContext?.(session) || ''),
+      coreMemory: skip.memory ? '' : String(coreMemoryContext || ''),
+      // Not a section: the language per-request rules match (tail-reminder-rules.mjs).
+      responseLanguage: lead ? _buildLeadLanguage({ config: slice }) || null : null,
+    };
+  }
+
   // The policy `config` gives `session`, computed without touching the
   // session, so a turn that starts during the async rebuild cannot lose tools
   // to it. `conversation`: the rebuilt BP3 core keeps the instruction files
   // and core memory the prompt presents now (withPresentedWorkspaceSlices).
-  async function stagePolicy(session, identity, config, { conversation = false } = {}) {
+  // `settings`: the prompt settings sections as they stand (a fold or an
+  // empty rebuild presents them); `coreMemoryContext` a snapshot already read.
+  async function stagePolicy(session, identity, config, { conversation = false, coreMemoryContext: memory } = {}) {
     const ownerIsAgent = isAgentOwner(session);
     const schemaAllowedTools = honoredSchemaAllowlist(session.schemaAllowedTools, {
       ownerIsAgent,
       agent: identity.agent,
     });
     const toolFreeRole = ownerIsAgent && schemaAllowedTools?.length === 0;
+    const freshMemory = memory ?? (await leadCoreMemoryContext());
+    const settings = promptSettingsSections(session, identity, config, freshMemory);
 
     const {
       summary: workflow,
@@ -139,12 +195,11 @@ export function createPolicyStage({
             provider: getRoute()?.provider,
             model: getRoute()?.model,
           });
-    const coreMemoryContext = conversation ? '' : await leadCoreMemoryContext();
+    const coreMemoryContext = conversation ? '' : freshMemory;
     // BP2's stable part as session creation composes it
     // (session-prompt-composition.mjs): the Lead meta context and the skill
     // manifest of the skills in scope now.
     const skipRules = identity.skipAgentRules || toolFreeRole;
-    const skills = schemaAllowedTools?.length === 0 ? [] : collectPromptSkillsCached(session.cwd);
     const { sessionMarkerCore, stableSystemContext } = composeSystemPrompt({
       ...sessionRolePromptFields(identity, {
         ownerIsAgent,
@@ -160,8 +215,8 @@ export function createPolicyStage({
       // setting; agent mode carries none.
       instructionFilesContext:
         conversation || toolFreeRole || agentMode ? null : loadInstructionFilesContext?.(session) || null,
-      metaContext: skipRules || ownerIsAgent ? undefined : _buildLeadMetaContext({ includeOutputStyle: !agentMode }),
-      skillManifest: buildSkillManifest(skills),
+      metaContext: settings.meta || undefined,
+      skillManifest: settings.skills,
     });
     return {
       workflow,
@@ -174,9 +229,44 @@ export function createPolicyStage({
       core: conversation ? withPresentedWorkspaceSlices(session, sessionMarkerCore) : sessionMarkerCore,
       // Without BP1 the BP2 block cannot be located: null leaves it as it is.
       stableContext: skipRules ? null : stableSystemContext,
+      settings,
     };
   }
 
+  /**
+   * Make the prompt present `staged.settings` (an empty session's rebuild, a
+   * fold): the BP3 core's instruction files and core memory and the language
+   * block closing the environment; the caller has written BP2 and the core.
+   * A staged workspace re-root keeps the slices it will replace itself.
+   */
+  function presentPromptSettings(session, staged) {
+    const { settings } = staged;
+    if (!session.workspaceReroot) {
+      rewriteConversationBp3Core(
+        session,
+        replaceWorkspaceCoreSlices(staged.core, {
+          coreMemoryContext: settings.coreMemory,
+          instructionFilesContext: settings.instructionFiles,
+        })
+      );
+    }
+    if (typeof session.bp3EnvironmentContext === 'string') {
+      session.bp3EnvironmentContext = replaceLanguageBlock(session.bp3EnvironmentContext, settings.language);
+      refreshSessionBp3Environment(session, session.cwd);
+    }
+    notePromptSettingsPresented(session, settings);
+  }
+
+  /** An empty session's rebuild: the shell, git and listing facts as they stand. */
+  function refreshEnvironmentFacts(session) {
+    if (typeof session.bp3EnvironmentContext !== 'string' || !session.cwd || session.workspaceReroot) return;
+    const { environmentContext } = buildWorkspacePromptContext(session, session.cwd, {
+      instructionFilesMode: promptConfigSlice(getConfig?.())?.instructionFiles,
+    });
+    session.bp3EnvironmentContext = replaceWorkspaceEnvironment(session.bp3EnvironmentContext, environmentContext);
+    refreshSessionBp3Environment(session, session.cwd);
+  }
+
   // Apply a staged policy synchronously; the BP3 core is the caller's. The
   // prompt then carries the session's workflow and tools as they stand.
   function applyPolicy(session, staged) {
@@ -184,6 +274,7 @@ export function createPolicyStage({
     delete session.orchestrationModeOverlay;
     delete session.workflowOpenedTools;
     delete session.promptFoldPending;
+    delete session.compactionFoldPending;
     session.workflow = toSessionWorkflowMeta(staged.workflow);
     session.orchestrationMode = staged.orchestrationMode;
     session.sessionMode = staged.sessionMode;
@@ -197,5 +288,12 @@ export function createPolicyStage({
     session.updatedAt = Date.now();
   }
 
-  return { liveDeniedTools, stagePolicy, applyPolicy };
+  return {
+    liveDeniedTools,
+    stagePolicy,
+    applyPolicy,
+    promptSettingsSections,
+    presentPromptSettings,
+    refreshEnvironmentFacts,
+  };
 }

package/src/session-runtime/tool-policy/workflow-overlay.mjs

@@ -78,7 +78,8 @@ export function createWorkflowOverlay({ liveDeniedTools, modelStandaloneTools })
     if (!loadableTools.length) return;
     const opened = session.workflowOpenedTools || [];
     session.workflowOpenedTools = [...new Set([...opened, ...loadableTools])];
-    if (fresh.length) session.deferredToolCatalog = [...(session.deferredToolCatalog || []), ...fresh];
+    // The late pool, never the boot catalog a native request keeps byte-stable.
+    if (fresh.length) session.deferredLateToolCatalog = [...(session.deferredLateToolCatalog || []), ...fresh];
     session.disallowedTools = (session.disallowedTools || []).filter((name) => !loadableTools.includes(String(name)));
     const byName = new Map(schemaTools(session).map((tool) => [toolName(tool), tool]));
     // Announced on every switch that opens them: a pending removal (a switch

package/src/session-runtime/tool-policy-refresh.mjs

@@ -1,7 +1,7 @@
-// Refresh the empty Lead session's model-facing tool surface and BP1/BP3
-// layers after workflow or search/memory settings change. Conversation
-// sessions keep their frozen schema; the next new session picks up the
-// updated policy. The exceptions are a workflow or orchestration mode switch
+// Bring a session to the settings as they stand at each turn start
+// (reconcileTurnSettings): an empty session's tool surface and BP1/BP3 are
+// rebuilt; a conversation keeps its prefix and takes moved tool gates live.
+// Setters only save config. The exceptions are a workflow or orchestration mode switch
 // made in the session itself (switchSessionWorkflow,
 // switchSessionOrchestrationMode), which that conversation takes as an overlay.
 import { sessionHasConversationMessages } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
@@ -9,6 +9,17 @@ import { createAgentProfileFold } from './tool-policy/agent-profile-fold.mjs';
 import { createPolicyStage } from './tool-policy/policy-stage.mjs';
 import { createSessionSwitches } from './tool-policy/session-switches.mjs';
 import { rewriteBp3Core } from './tool-policy/surface-helpers.mjs';
+import {
+  stageConnectorAvailability,
+  stageToolAvailability,
+} from '../runtime/agent/orchestrator/runtime-core/tool-availability.mjs';
+import { resetBp2StableContext } from '../runtime/agent/orchestrator/context/collect.mjs';
+import {
+  promptSettingsRecord,
+  stagePromptSettingsNotice,
+} from '../runtime/agent/orchestrator/session/manager/prompt-settings.mjs';
+import { isAgentOwner } from '../runtime/agent/orchestrator/agent-owner.mjs';
+import { configForSession, currentMode } from './tool-policy/surface-helpers.mjs';
 
 export function createToolPolicyRefresh({
   getSession,
@@ -24,11 +35,21 @@ export function createToolPolicyRefresh({
   activeWorkflowContext,
   invalidatePreSessionToolSurface,
   persistSession,
+  toolDefinitionsFor = () => [],
+  getSurfaceGeneration,
 }) {
-  const { liveDeniedTools, stagePolicy, applyPolicy } = createPolicyStage({
+  const {
+    liveDeniedTools,
+    stagePolicy,
+    applyPolicy,
+    promptSettingsSections,
+    presentPromptSettings,
+    refreshEnvironmentFacts,
+  } = createPolicyStage({
     getRoute,
     getMode,
     getDataDir,
+    getConfig,
     modelStandaloneTools,
     featureDisallowedTools,
     loadCoreMemoryContext,
@@ -55,6 +76,153 @@ export function createToolPolicyRefresh({
     );
   }
 
+  // What the gates a surface is built from read: the config object (replaced,
+  // never mutated, on every adopt and every reload of a change made
+  // elsewhere), the surface generation (skills/plugins invalidate it) and the
+  // live gate list (which carries bridge presence).
+  const configGenerations = new WeakMap();
+  let configCount = 0;
+  function availabilityKey() {
+    const config = getConfig?.() || {};
+    let generation = configGenerations.get(config);
+    if (generation === undefined) {
+      generation = ++configCount;
+      configGenerations.set(config, generation);
+    }
+    return `${generation}|${getSurfaceGeneration?.() || 0}|${featureDisallowedTools().join(',')}`;
+  }
+  // Session → the key it was last brought to (process-local, so a session
+  // first seen here, e.g. resumed, is checked once).
+  const appliedKeys = new WeakMap();
+
+  const conversationEmpty = (session) =>
+    !sessionHasConversationMessages(session) && !sessionHasConversationMessages({ messages: session.liveTurnMessages });
+
+  // The revision of the prompt settings `session` would be built from now.
+  function settingsRevision(session, coreMemory) {
+    const identity = session.promptIdentity;
+    if (!identity) return undefined;
+    const config = configForSession(getConfig(), session.workflow?.id, currentMode(session));
+    return promptSettingsRecord(promptSettingsSections(session, identity, config, coreMemory)).revision;
+  }
+
+  /** A session just built from the current settings (`coreMemory`: the
+   *  snapshot its prompt was composed with). */
+  function noteToolAvailability(session, coreMemory = '') {
+    if (session) {
+      appliedKeys.set(session, {
+        gates: availabilityKey(),
+        settings: settingsRevision(session, String(coreMemory || '')),
+      });
+    }
+  }
+
+  /** Whether a settings change reaches the current session's whole prompt
+   *  (no session yet, or one without a conversation, rebuilt at its turn). */
+  function settingsReachCurrentSession() {
+    const session = getSession?.();
+    return !session?.id || (Boolean(session.promptIdentity) && conversationEmpty(session));
+  }
+
+  async function readCoreMemory() {
+    try {
+      return String((await loadCoreMemoryContext?.()) || '');
+    } catch {
+      return '';
+    }
+  }
+
+  async function reconcileSession(session) {
+    // Connector switches are read from their (stat-cached) files every turn.
+    const connectors = stageConnectorAvailability(session);
+    const coreMemory = await readCoreMemory();
+    const gates = availabilityKey();
+    const identity = session.promptIdentity;
+    // The prompt settings as they stand, file-based ones included (core
+    // memory, instruction files, output-style files, the workflow pack, the
+    // skill listing): their revision is part of the key.
+    const sections = identity
+      ? promptSettingsSections(
+          session,
+          identity,
+          configForSession(getConfig(), session.workflow?.id, currentMode(session)),
+          coreMemory
+        )
+      : null;
+    const settings = sections ? promptSettingsRecord(sections).revision : undefined;
+    const applied = appliedKeys.get(session);
+    if (applied?.gates === gates && applied.settings === settings && !session.promptSettingsRecheck) {
+      return connectors ? { rebuilt: false, ...connectors } : null;
+    }
+    let rebuilt = false;
+    let settingsChanged = [];
+    if (identity && conversationEmpty(session)) {
+      // Nothing was sent: the whole prompt is rebuilt in place.
+      const staged = await stagePolicy(session, identity, getConfig(), { coreMemoryContext: coreMemory });
+      if (getSession?.() === session && conversationEmpty(session)) {
+        if (typeof staged.stableContext === 'string') resetBp2StableContext(session, staged.stableContext);
+        applyPolicy(session, staged);
+        rewriteBp3Core(session, staged.core);
+        presentPromptSettings(session, staged);
+        refreshEnvironmentFacts(session);
+        // The first-turn MCP fold may rebuild it in place too (an empty
+        // session reopened from disk was never marked).
+        session.deferredInitialRefreshPending = true;
+        rebuilt = true;
+      }
+    } else if (identity) {
+      // A conversation keeps its prefix: told once, folded at the next cold point.
+      settingsChanged = stagePromptSettingsNotice(session, sections);
+      // A delegated worker is never folded: after a compaction it is told
+      // again instead (rearmPromptSettingsNotice).
+      if (settingsChanged.length && !isAgentOwner(session)) session.promptFoldPending = true;
+    }
+    const staged = stageToolAvailability(session, featureDisallowedTools(), toolDefinitionsFor);
+    appliedKeys.set(session, { gates, settings: rebuilt ? session.promptSettings?.revision : settings });
+    const tools = staged || connectors;
+    const merged =
+      staged && connectors
+        ? { added: [...staged.added, ...connectors.added], removed: [...staged.removed, ...connectors.removed] }
+        : tools;
+    return rebuilt || tools || settingsChanged.length
+      ? { rebuilt, ...(merged || {}), ...(settingsChanged.length ? { settingsChanged } : {}) }
+      : null;
+  }
+
+  // One reconcile per session at a time: a turn start and a surface read of
+  // the same empty session share it.
+  const inflight = new WeakMap();
+
+  /** Turn start, any session kind: an empty session is rebuilt from current
+   *  settings; a conversation keeps its prefix, takes moved tool gates live
+   *  (stageToolAvailability) and prompt settings as a one-time notice. */
+  function reconcileTurnSettings() {
+    const session = getSession?.();
+    if (!session?.id) return Promise.resolve(null);
+    let running = inflight.get(session);
+    if (!running) {
+      running = reconcileSession(session).finally(() => inflight.delete(session));
+      inflight.set(session, running);
+    }
+    return running;
+  }
+
+  /** A read of an empty session's surface or status: the same reconcile, so
+   *  what is shown is what its first turn will send. A conversation (or a
+   *  running turn) is left to its turn start. */
+  function reconcileEmptySession() {
+    const session = getSession?.();
+    if (!session?.id || turnInFlight(session) || !conversationEmpty(session)) return Promise.resolve(null);
+    return reconcileTurnSettings();
+  }
+
+  /** Sync: whether an empty session's surface lags the settings gates. */
+  function emptySessionStale() {
+    const session = getSession?.();
+    if (!session?.id || turnInFlight(session) || !conversationEmpty(session)) return false;
+    return appliedKeys.get(session)?.gates !== availabilityKey();
+  }
+
   async function refreshEmptySessionToolPolicy() {
     invalidatePreSessionToolSurface?.();
     const session = getSession?.();
@@ -67,8 +235,11 @@ export function createToolPolicyRefresh({
     const staged = await stagePolicy(session, identity, getConfig());
     // Apply: re-check admission after the await, then mutate synchronously.
     if (!admitsRefresh(session)) return { appliedToCurrentSession: false };
+    if (typeof staged.stableContext === 'string') resetBp2StableContext(session, staged.stableContext);
     applyPolicy(session, staged);
     rewriteBp3Core(session, staged.core);
+    presentPromptSettings(session, staged);
+    refreshEnvironmentFacts(session);
     return { appliedToCurrentSession: true };
   }
 
@@ -91,10 +262,16 @@ export function createToolPolicyRefresh({
     liveDeniedTools,
     stagePolicy,
     applyPolicy,
+    presentPromptSettings,
     turnInFlight,
   });
 
   return {
+    reconcileTurnSettings,
+    reconcileEmptySession,
+    emptySessionStale,
+    noteToolAvailability,
+    settingsReachCurrentSession,
     refreshEmptySessionToolPolicy,
     switchSessionWorkflow: switches.switchSessionWorkflow,
     switchSessionOrchestrationMode: switches.switchSessionOrchestrationMode,