deepstrike 0.2.74__tar.gz → 0.2.76__tar.gz

{deepstrike-0.2.74 → deepstrike-0.2.76}/Cargo.lock

@@ -254,7 +254,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-core"
-version = "0.2.74"
+version = "0.2.76"
 dependencies = [
  "compact_str",
  "deepstrike-tokenizer",
@@ -268,7 +268,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-node"
-version = "0.2.74"
+version = "0.2.76"
 dependencies = [
  "compact_str",
  "deepstrike-core",
@@ -280,7 +280,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-py"
-version = "0.2.74"
+version = "0.2.76"
 dependencies = [
  "compact_str",
  "deepstrike-core",
@@ -291,10 +291,11 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-sdk"
-version = "0.2.74"
+version = "0.2.76"
 dependencies = [
  "async-stream",
  "async-trait",
+ "base64 0.22.1",
  "bytes",
  "compact_str",
  "deepstrike-core",
@@ -327,7 +328,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-tokenizer"
-version = "0.2.74"
+version = "0.2.76"
 dependencies = [
  "pretty_assertions",
  "tiktoken-rs",
@@ -335,7 +336,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-wasm"
-version = "0.2.74"
+version = "0.2.76"
 dependencies = [
  "compact_str",
  "deepstrike-core",

{deepstrike-0.2.74 → deepstrike-0.2.76}/Cargo.toml

@@ -3,13 +3,13 @@ resolver = "2"
 members = ["crates/deepstrike-core", "crates/deepstrike-tokenizer", "crates/deepstrike-py"]
 
 [workspace.package]
-version = "0.2.74"
+version = "0.2.76"
 edition = "2024"
 repository = "https://github.com/kongusen/deepstrike"
 
 [workspace.dependencies]
-deepstrike-core = { path = "crates/deepstrike-core", version = "0.2.74" }
-deepstrike-tokenizer = { path = "crates/deepstrike-tokenizer", version = "0.2.74" }
+deepstrike-core = { path = "crates/deepstrike-core", version = "0.2.76" }
+deepstrike-tokenizer = { path = "crates/deepstrike-tokenizer", version = "0.2.76" }
 notify = "6"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

{deepstrike-0.2.74 → deepstrike-0.2.76}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepstrike
-Version: 0.2.74
+Version: 0.2.76
 Requires-Dist: httpx>=0.27
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: anyio>=4.0

{deepstrike-0.2.74 → deepstrike-0.2.76}/crates/deepstrike-core/src/context/manager.rs

@@ -367,11 +367,14 @@ impl ContextManager {
     /// from *this* value, so it must NOT discount paged content (else collapse → rho drops →
     /// un-collapse would oscillate).
     pub fn rho(&self) -> f64 {
-        self.pressure.pressure(
+        let observed = self.pressure.pressure(
             &self.partitions,
             &self.engine,
             self.last_observed_prompt_tokens,
-        )
+        );
+        // A provider sees a selected projection, not the entire resident history. Its smaller
+        // count must not suppress compaction while the unselected history still triggers renewal.
+        observed.max(self.pressure.pressure(&self.partitions, &self.engine, None))
     }
 
     pub fn set_observed_prompt_tokens(&mut self, tokens: u32) {
@@ -427,6 +430,10 @@ impl ContextManager {
             target_tokens,
             &self.engine,
         );
+        if result.0 > 0 || !result.2.is_empty() {
+            // The measurement describes the request before this rewrite, not the new context.
+            self.last_observed_prompt_tokens = None;
+        }
         if let Some(ts) = now_ms {
             self.last_compact_ms = Some(ts);
         }
@@ -475,6 +482,7 @@ impl ContextManager {
             .renewal
             .renew(&self.partitions, self.max_tokens, &self.engine);
         self.sprint += 1;
+        self.last_observed_prompt_tokens = None;
         // History was rebuilt wholesale — drop handles anchored to messages it no longer carries,
         // and start a fresh collapse generation (P0-C) since the whole prefix changed.
         self.prune_orphaned_handles();
@@ -994,6 +1002,17 @@ impl ContextManager {
             .is_none()
     }
 
+    /// A refused `skill` activation: withdraw the `skill:<name>` knowledge the host staged for it,
+    /// unless the skill is already active under an earlier admission.
+    pub fn retract_refused_skill(&mut self, name: &str) -> bool {
+        if self.active_skills.contains_key(name) {
+            return false;
+        }
+        self.partitions
+            .knowledge
+            .retract_staged(&format!("skill:{name}"))
+    }
+
     /// K3: deactivate a skill — the toolset re-widens at the next `emit_call_llm` (an epoch event,
     /// same cache cost class as activation) and the skill's `skill:<name>` knowledge pin is marked
     /// for the next boundary sweep. Errs-open: not-active is a no-op (returns false).
@@ -1239,6 +1258,20 @@ mod tests {
     use crate::types::message::CoreMessage;
     use crate::types::skill::SkillMetadata;
 
+    #[test]
+    fn low_provider_usage_does_not_hide_resident_history_pressure() {
+        let mut mgr = ContextManager::with_config(
+            1_000,
+            ContextConfig::default(),
+            ContextTokenEngine::char_approx(),
+        );
+        mgr.push_history(CoreMessage::user("large history"), 1_100);
+        mgr.set_observed_prompt_tokens(10);
+        assert_eq!(mgr.should_compress(), PressureAction::AutoCompact);
+        mgr.compress(PressureAction::AutoCompact);
+        assert!(!mgr.should_renew());
+    }
+
     #[test]
     fn preparation_freezes_state_plan_and_render_identity() {
         let mut mgr = ContextManager::new(100_000);

{deepstrike-0.2.74 → deepstrike-0.2.76}/crates/deepstrike-core/src/context/partitions.rs

@@ -209,6 +209,29 @@ impl KnowledgePartition {
         }))
     }
 
+    /// Withdraw content staged under `key` for something the kernel then refused (a skill whose
+    /// activation was rejected). A freshly appended entry has never been rendered, so it is dropped
+    /// outright; an existing entry keeps its rendered bytes, loses the staged upsert, and leaves at
+    /// the next boundary. Returns whether anything was withdrawn.
+    pub fn retract_staged(&mut self, key: &str) -> bool {
+        let Some(index) = self
+            .entries
+            .iter()
+            .position(|entry| entry.key.as_deref() == Some(key))
+        else {
+            return false;
+        };
+        let entry = &mut self.entries[index];
+        if entry.pending.take().is_some() {
+            entry.evict_at_boundary = true;
+            return true;
+        }
+        let tokens = entry.tokens;
+        self.entries.remove(index);
+        self.token_count = self.token_count.saturating_sub(tokens);
+        true
+    }
+
     /// Mark the keyed entry for removal at the next boundary. Errs-open: unknown key is a no-op.
     /// Returns whether a matching entry was marked.
     pub fn remove(&mut self, key: &str) -> bool {

{deepstrike-0.2.74 → deepstrike-0.2.76}/crates/deepstrike-core/src/context/renewal.rs

@@ -61,31 +61,25 @@ impl RenewalPolicy {
         // History: carry recent turns up to carryover budget.
         let carryover_budget = config.carryover_tokens(max_tokens);
         let mut remaining = carryover_budget;
-        let mut carried: Vec<_> = partitions
-            .history
-            .messages
-            .iter()
-            .enumerate()
-            .rev()
-            .take_while(|(index, _msg)| {
-                let t = partitions.history.measured_tokens(*index, engine);
-                if t <= remaining {
-                    remaining = remaining.saturating_sub(t);
-                    true
-                } else {
-                    false
-                }
-            })
-            .map(|(index, msg)| {
-                (
-                    msg.clone(),
-                    partitions.history.measured_tokens(index, engine),
-                )
-            })
-            .collect();
-        carried.reverse();
-        for (msg, t) in carried {
-            renewed.history.push(msg, t);
+        let messages = &partitions.history.messages;
+        let mut start = messages.len();
+        // Carry whole conversational transactions, so a budget boundary cannot strand a result
+        // without its assistant call (or omit one result of a parallel call batch).
+        for unit in super::units::unit_boundaries(messages).into_iter().rev() {
+            let tokens = unit.clone().fold(0u32, |sum, index| {
+                sum.saturating_add(partitions.history.measured_tokens(index, engine))
+            });
+            if tokens > remaining {
+                break;
+            }
+            remaining = remaining.saturating_sub(tokens);
+            start = unit.start;
+        }
+        for (index, msg) in messages.iter().enumerate().skip(start) {
+            renewed.history.push(
+                msg.clone(),
+                partitions.history.measured_tokens(index, engine),
+            );
         }
 
         renewed
@@ -147,6 +141,33 @@ mod tests {
         assert!(renewed.history.token_count <= 100);
     }
 
+    #[test]
+    fn renewal_never_carries_a_tool_result_without_its_call() {
+        use crate::types::message::{ContentPart, ToolCall};
+        let mut ctx = ContextPartitions::new(&ContextConfig::default());
+        ctx.history.push(CoreMessage::user("read"), 10);
+        let mut call = CoreMessage::assistant("");
+        call.tool_calls.push(ToolCall {
+            id: "call-1".into(),
+            name: "read".into(),
+            arguments: serde_json::json!({}),
+        });
+        ctx.history.push(call, 80);
+        ctx.history.push(
+            CoreMessage::tool(vec![ContentPart::ToolResult {
+                call_id: "call-1".into(),
+                output: "result".into(),
+                is_error: false,
+                durable_content: None,
+            }]),
+            40,
+        );
+        let renewed = make_policy(0.1).renew(&ctx, 1_000, &ContextTokenEngine::char_approx());
+        assert!(crate::context::units::strict_tool_pairing_is_valid(
+            &renewed.history.messages
+        ));
+    }
+
     #[test]
     fn renewal_clears_task_scratchpad_keeps_goal() {
         let cfg = ContextConfig::default();

{deepstrike-0.2.74 → deepstrike-0.2.76}/crates/deepstrike-core/src/context/token_engine.rs

@@ -44,7 +44,7 @@ impl TokenCounter for CharApproxCounter {
 /// implementation applies the same 0.25 tokens/char divisor to every script). This wraps
 /// `deepstrike-tokenizer`'s real cl100k BPE tokenizer (previously an orphaned crate — not a
 /// workspace member, zero call sites anywhere) and adds a fixed margin on top. That only
-/// guarantees a value above the selected `cl100k_base` estimate; it does not prove that the
+/// guarantees a value above its chunked `cl100k_base` estimate; it does not prove that the
 /// result is conservative for every provider model. Native Anthropic/Gemini token counts take
 /// precedence where callers explicitly request them.
 pub struct FallbackEstimator {
@@ -69,17 +69,54 @@ impl Default for FallbackEstimator {
     }
 }
 
+/// Bound BPE merge work for long unbroken tool output. Chunk boundaries are UTF-8-safe and
+/// deterministic; boundary merges are deliberately sacrificed by this heuristic estimator.
+fn estimation_chunks(mut text: &str) -> impl Iterator<Item = &str> {
+    std::iter::from_fn(move || {
+        if text.is_empty() {
+            return None;
+        }
+        let mut end = text.len().min(1_024);
+        while !text.is_char_boundary(end) {
+            end -= 1;
+        }
+        let (chunk, rest) = text.split_at(end);
+        text = rest;
+        Some(chunk)
+    })
+}
+
 impl TokenCounter for FallbackEstimator {
     fn count(&self, text: &str) -> u32 {
-        let raw = self.tokenizer.count(text) as f64;
-        ((raw * self.safety_margin).ceil() as u32).max(1)
+        let raw = estimation_chunks(text).fold(0u32, |sum, chunk| {
+            sum.saturating_add(self.tokenizer.count(chunk))
+        });
+        ((raw as f64 * self.safety_margin).ceil() as u32).max(1)
     }
 
     fn truncate<'a>(&self, text: &'a str, max_tokens: u32) -> &'a str {
         // Budget in *raw* BPE tokens so that, after the margin is applied by `count`, the
         // truncated text's reported count still fits within `max_tokens`.
         let raw_budget = ((max_tokens as f64) / self.safety_margin).floor() as u32;
-        self.tokenizer.truncate(text, raw_budget)
+        let mut remaining = raw_budget;
+        let mut end = 0;
+        for chunk in estimation_chunks(text) {
+            let tokens = self.tokenizer.count(chunk);
+            if tokens <= remaining {
+                remaining -= tokens;
+                end += chunk.len();
+            } else {
+                let mut prefix_end = self.tokenizer.truncate(chunk, remaining).len();
+                // Retokenizing a prefix can change its last merge. Enforce the same count budget
+                // on the returned prefix, without ever processing another unbounded string.
+                while prefix_end > 0 && self.tokenizer.count(&chunk[..prefix_end]) > remaining {
+                    prefix_end = chunk[..prefix_end].char_indices().next_back().unwrap().0;
+                }
+                end += prefix_end;
+                break;
+            }
+        }
+        &text[..end]
     }
 }
 
@@ -101,7 +138,12 @@ impl ContextTokenEngine {
     /// [`FallbackEstimator`]), replacing the previous `char_approx()` default that
     /// underestimated CJK-heavy text by 40-70%.
     pub fn fallback_estimator() -> Self {
-        Self(Arc::new(FallbackEstimator::default()))
+        static COUNTER: std::sync::OnceLock<Arc<dyn TokenCounter>> = std::sync::OnceLock::new();
+        Self(
+            COUNTER
+                .get_or_init(|| Arc::new(FallbackEstimator::default()))
+                .clone(),
+        )
     }
 
     pub fn count(&self, text: &str) -> u32 {
@@ -186,6 +228,31 @@ fn modality_estimate_tokens(part: &ContentPart) -> Option<u32> {
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    #[test]
+    fn default_engines_share_the_immutable_bpe_tables() {
+        let first = ContextTokenEngine::fallback_estimator();
+        let second = ContextTokenEngine::fallback_estimator();
+        assert!(
+            Arc::ptr_eq(&first.0, &second.0),
+            "starting or restoring an operation must not reload the tokenizer tables"
+        );
+    }
+
+    #[test]
+    fn large_unbroken_estimates_are_bounded_and_truncation_remains_utf8_safe() {
+        let estimator = FallbackEstimator::default();
+        let started = std::time::Instant::now();
+        assert!(estimator.count(&"y".repeat(100 * 1024)) > 20_000);
+        assert!(
+            started.elapsed() < std::time::Duration::from_secs(10),
+            "100 KiB of unbroken tool output must not stall the host for tens of seconds"
+        );
+        let text = "核实需求与运行结果🙂".repeat(2_000);
+        let truncated = estimator.truncate(&text, 2_000);
+        assert!(text.starts_with(truncated));
+        assert!(estimator.count(truncated) <= 2_000);
+    }
     use crate::types::message::{ContentPart, CoreMessage};
 
     fn engine() -> ContextTokenEngine {

{deepstrike-0.2.74 → deepstrike-0.2.76}/crates/deepstrike-core/src/governance/pipeline.rs

@@ -14,6 +14,8 @@ pub struct GovernancePipeline {
     pub veto: VetoAuthority,
     pub rate_limiter: RateLimiter,
     pub constraints: ConstraintValidator,
+    /// Withhold statically denied tools from the provider surface (see [`Self::denies_tool`]).
+    pub hide_denied_tools: bool,
 }
 
 fn severity(v: &GovernanceVerdict) -> u8 {
@@ -32,9 +34,28 @@ impl GovernancePipeline {
             veto: VetoAuthority::new(),
             rate_limiter: RateLimiter::default(),
             constraints: ConstraintValidator::new(),
+            hide_denied_tools: false,
         }
     }
 
+    /// Whether every call to `name` is denied regardless of its arguments or timing — a veto or a
+    /// `deny` permission. Argument constraints and rate limits are per-call, and `ask_user` is a
+    /// runtime decision, so none of them make a tool statically unusable.
+    pub fn denies_tool(&self, name: &str) -> bool {
+        let probe = ToolCall {
+            id: "governance-surface".into(),
+            name: name.into(),
+            arguments: serde_json::Value::Null,
+        };
+        matches!(
+            self.veto.check(&probe),
+            Some(GovernanceVerdict::Deny { .. })
+        ) || matches!(
+            self.permission.check(&probe),
+            Some(GovernanceVerdict::Deny { .. })
+        )
+    }
+
     /// Set the current timestamp for rate limiting.
     pub fn set_time(&mut self, now_ms: u64) {
         self.rate_limiter.set_time(now_ms);

{deepstrike-0.2.74 → deepstrike-0.2.76}/crates/deepstrike-core/src/mm/memory.rs

@@ -393,6 +393,65 @@ pub struct MemoryRecallLifecycle {
     pub last_recalled_at: u64,
 }
 
+/// What the host's store holds for one record it just recalled — the only input the recall
+/// lifecycle needs. The store reports state; it never reports the *next* state.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct MemoryRecallPrior {
+    pub record_id: String,
+    #[serde(default)]
+    pub recall_count: u64,
+    #[serde(default)]
+    pub pinned: bool,
+}
+
+/// A recalled record whose count crossed the promotion threshold on this recall (M4).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct MemoryPromotion {
+    pub record_id: String,
+    pub recall_count: u64,
+}
+
+/// M3/M4 · the one derivation of a recall's lifecycle, shared by the model's `query_memory`
+/// syscall and every host recall route.
+///
+/// Each distinct record counts once per derivation however many hits named it, so a prefetch that
+/// issues several overlapping queries cannot inflate a count. Promotion is edge-triggered — it is
+/// suggested on the recall that crosses the threshold, never again on later ones — and a pinned
+/// record is never suggested, because it is already where a promotion would put it.
+pub fn derive_recall_lifecycle(
+    priors: &[MemoryRecallPrior],
+    recalled_at: u64,
+    promotion_threshold: Option<u64>,
+) -> (Vec<MemoryRecallLifecycle>, Vec<MemoryPromotion>) {
+    let mut seen = std::collections::BTreeSet::new();
+    let mut recalls = Vec::with_capacity(priors.len());
+    let mut promotions = Vec::new();
+    for prior in priors {
+        if !seen.insert(prior.record_id.as_str()) {
+            continue;
+        }
+        let recall_count = prior.recall_count.saturating_add(1);
+        recalls.push(MemoryRecallLifecycle {
+            record_id: prior.record_id.clone(),
+            recall_count,
+            last_recalled_at: recalled_at,
+        });
+        if let Some(threshold) = promotion_threshold
+            && !prior.pinned
+            && prior.recall_count < threshold
+            && recall_count >= threshold
+        {
+            promotions.push(MemoryPromotion {
+                record_id: prior.record_id.clone(),
+                recall_count,
+            });
+        }
+    }
+    (recalls, promotions)
+}
+
 /// Memory validation error.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(tag = "error_kind", rename_all = "snake_case")]
@@ -770,4 +829,52 @@ mod tests {
         ));
         assert_eq!(store.len(), 1);
     }
+
+    fn prior(record_id: &str, recall_count: u64, pinned: bool) -> MemoryRecallPrior {
+        MemoryRecallPrior {
+            record_id: record_id.into(),
+            recall_count,
+            pinned,
+        }
+    }
+
+    #[test]
+    fn a_recall_counts_each_record_once_and_suggests_promotion_only_on_the_crossing() {
+        let (recalls, promotions) = derive_recall_lifecycle(
+            &[
+                prior("crossing", 2, false),
+                prior("crossing", 2, false),
+                prior("already_past", 3, false),
+                prior("pinned", 2, true),
+                prior("fresh", 0, false),
+            ],
+            42,
+            Some(3),
+        );
+        assert_eq!(
+            recalls
+                .iter()
+                .map(|recall| (recall.record_id.as_str(), recall.recall_count))
+                .collect::<Vec<_>>(),
+            vec![
+                ("crossing", 3),
+                ("already_past", 4),
+                ("pinned", 3),
+                ("fresh", 1)
+            ]
+        );
+        assert!(recalls.iter().all(|recall| recall.last_recalled_at == 42));
+        assert_eq!(
+            promotions,
+            vec![MemoryPromotion {
+                record_id: "crossing".into(),
+                recall_count: 3
+            }]
+        );
+        assert!(
+            derive_recall_lifecycle(&[prior("crossing", 2, false)], 1, None)
+                .1
+                .is_empty()
+        );
+    }
 }

{deepstrike-0.2.74 → deepstrike-0.2.76}/crates/deepstrike-core/src/runtime/chain_validator/mod.rs

@@ -2097,6 +2097,8 @@ mod tests {
                             ),
                             tokens: Some(64),
                             tool_call_id: None,
+                            is_error: false,
+                            tool_calls: Vec::new(),
                         })
                         .collect(),
                     ..InitialContext::default()
@@ -2184,6 +2186,7 @@ mod tests {
                                     Vec::new()
                                 },
                                 tool_call_id: None,
+                                is_error: false,
                                 tokens: None,
                             },
                             observed_input_tokens: None,

{deepstrike-0.2.74 → deepstrike-0.2.76}/crates/deepstrike-core/src/runtime/kernel/observation.rs

@@ -76,6 +76,14 @@ pub enum KernelObservation {
         subject: Option<String>,
         reason: String,
     },
+    /// A model `skill` syscall the kernel admitted. Hosts pin the skill's content only on this
+    /// fact, never on the raw call: activation is a capability mutation the kernel adjudicates.
+    SkillAdmitted {
+        turn: u32,
+        name: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        expires_at_turn: Option<u32>,
+    },
     CapabilityChanged {
         turn: u32,
         #[serde(default, skip_serializing_if = "Vec::is_empty")]

{deepstrike-0.2.74 → deepstrike-0.2.76}/crates/deepstrike-core/src/runtime/kernel/wire/command.rs

@@ -43,6 +43,12 @@ pub enum HostCommand {
     ApplySkillActivation(ApplySkillActivationCommand),
     ApplyPolicyPatch(ApplyPolicyPatchCommand),
     UpdateDeadline(UpdateDeadlineCommand),
+    /// §22.13 · a memory write the host authored while this operation runs (a session extract, a
+    /// semantic archive summary). The host still performs the I/O; the kernel is the one that says
+    /// whether the write may happen, by the same validation rule and the same rolling write quota
+    /// the model's `write_memory` syscall answers to. A refusal is journaled as
+    /// `memory_validation_failed`; an admitted write journals nothing and the host persists it.
+    AdmitMemoryWrite(AdmitMemoryWriteCommand),
 }
 
 /// Cancellation. The operation id lives in the envelope and is **not** repeated here: the
@@ -181,6 +187,16 @@ pub struct SeedKnowledgeCommand {
     pub entries: Vec<KnowledgeEntry>,
 }
 
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct AdmitMemoryWriteCommand {
+    /// The host's record id, named by the audit fact when the write is refused.
+    pub record_id: String,
+    pub name: String,
+    /// UTF-8 byte length of the content the host intends to persist.
+    pub content_bytes: u32,
+}
+
 /// §13.2 · skill activation state. Both directions in one command so a swap is atomic.
 #[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -265,6 +281,11 @@ pub struct GovernancePolicy {
     pub rate_limits: Vec<RateLimitSpec>,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub constraints: Vec<ParamConstraint>,
+    /// Withhold tools this policy statically denies (veto or `deny` permission) from the provider
+    /// surface, and say so once in the knowledge slot. The kernel decides the hidden set with the
+    /// same rules that enforce the calls, so the surface and the gate cannot disagree.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub hide_denied_tools: Option<bool>,
 }
 
 /// Per-tool rolling-window rate limit.
@@ -558,6 +579,9 @@ impl LivePolicyPatch {
                 next.governance_policy.vetoed_tools = policy.vetoed_tools.clone();
                 next.governance_policy.rate_limits = policy.rate_limits.clone();
                 next.governance_policy.constraints = policy.constraints.clone();
+                next.governance_policy.hide_denied_tools = policy
+                    .hide_denied_tools
+                    .unwrap_or(current.governance_policy.hide_denied_tools);
                 super::config::validate_governance(
                     &next.governance_policy,
                     current.kernel_limits.collection_limits.governance_rules,