Commit 3e63078

options?: {

declaredTools?: ReadonlySet<string>;

agentReachable?: boolean;

},

| `## Using Your Tools` bullets | A bullet is kept only when **every** tool it names is declared — a bullet that still named a missing tool would send the model after something it cannot call, which is the defect being fixed. Sub-bullets are keyed on the single tool they name, and the "prefer dedicated tools" bullet goes when none of its sub-bullets survive. One later exception: bridge reachability satisfies the Agent prerequisite in the two Agent bullets (§4.6); Codebase Search still requires declared `grep_search` and `glob`. |

#13033 defers `agent` by default, which made the absolute form of the §4.3

rule self-defeating: the Subagent Delegation and Codebase Search bullets are

the policy that sends the model to the deferred-tool bridge to discover Agent,

so dropping them whenever `agent` is undeclared would turn deferral into

silent removal. `PromptToolSurface` therefore carries one more input,

`agentReachable`, set in `startChat` when `agent` is declared or is registered

behind both bridge halves and listed in the deferred summary. That input

satisfies only their Agent prerequisite: Codebase Search still requires

declared `grep_search` and `glob`. No other gated line gains an exception —

`monitor` stays gated on declaration — and an Agent withheld from the eager

reveal in an incomplete-bridge session is neither declared nor

bridge-reachable, so both lines still drop there.

2. **Effect, and no drift outside it (in CI).** The file-work bracket is pinned in the two states the reachability exception (§4.6) distinguishes, and the pinned bounds below are exactly the ones `prompts.test.ts` asserts: with `agentReachable` unset the drop must stay within 900-1,500 characters (measured 1,135 — delegation 448 + codebase search 368 + monitor 317 of bullet text, plus dropped line breaks); with `agentReachable: true` — the default in practice, since the bridge pair is exempt from `tools.eager` — both Agent bullets survive and only the monitor policy drops (must stay within 250-450; measured 317). A narrower allowlist drops 3,158 characters (Agent unreachable) or 2,709 (reachable — the default this PR creates), two example blocks included, measured at this commit; no CI bracket pins the narrow case, so those figures are descriptive (the pre-exception measurement was 4,327 with three example blocks). A third test asserts all four model-specific example notations are gated, not just the bracket form. Together they fail on a lost saving and on newly added ungated tool text. `changes nothing outside the two gated sections` strips `## Using Your Tools` and `# Examples` from both renders and asserts the remainder is identical.

3. **Invariant, both directions (in CI).** Undeclared Agent is permitted only under the reachability exception (§4.6); other named tools must remain declared. `never names an undeclared tool inside the gated sections` sweeps every `ToolNames` value against the gated text with a word-boundary match, and `gates every tool name the gated sections can mention, on every example set` makes that config-independent by withholding each of the 66 names in turn against all four example sets — the check that would have caught the model-specific notations going ungated. `keeps the policy text of every tool that is declared` pins the opposite direction so gating cannot over-reach. Scoped to those sections because of the residues in §6.

4. **Reverse checks and plumbing (in CI).** `leaves CodeModeOnly guidance untouched by the declared set` asserts code mode renders identically with and without a snapshot, and `keeps Agent guidance when Agent is bridge-reachable` asserts `getMainSessionBaseSystemPrompt` reads the `Config` session snapshots (`getPromptToolSnapshot()`, plus `getPromptAgentReachable()` since #13033) — the property that keeps `/context` and the request on one source.

- No-snapshot and all-declared base prompts are unchanged, byte for byte.

- In a trimmed session, no bullet or example names a tool the session cannot call — declared, or bridge-reachable for the Agent bullets (§4.6) — and every declared tool's policy text is still present.