A session id is the host's to supply, so the model is no longer shown one (comms-tg70)

[GraemeF]

session_id was declared on seven tool schemas, so tools/list showed the
model a parameter it has no way to fill. The value comes from Claude Code's
PreToolUse hook, or from a non-CC host that stamps it into arguments itself —
neither route ever needed it advertised. A human does not type their session id
into the compose box (docs/agent-experience.md principle 1).

This is an encoding subtraction, not a supply deletion. Every channel that
binds an identity still binds one.

What the tool advertises and what it accepts are now separate

ToolDef.hostSuppliedArgs names the arguments a host stamps in out of band.
The guard in registerTools admits properties ∪ hostSuppliedArgs, while the
unknown-argument error still names only the advertised ones — an error reading
"Valid arguments: …, session_id" would put the parameter back on the surface
this removes it from.

The relaxation is per-tool, not a hole in the check: a tool listing nothing
still rejects session_id, and every tool still rejects everything else.

Seven tools carry it, not the five in the hook matcher. subscribe and
unsubscribe are the identity route for a listen-first non-CC seat, and a host
stamping the argument on a tool CC never stamps must not be told it is unknown.

An eighth site: the instructions block

This one is past the seven schemas, and is called out deliberately.

COMMY_INSTRUCTIONS in packages/mcp/mcp-server.ts is the MCP instructions:
field — injected into every connected agent's context verbatim. It carried a
**session_id.** paragraph telling the model: "Pass your conversation's
session id as the optional argument on post, edit_message, react,
unreact, and current_identity."

That is the agent-visible surface in prose, and principle 1 reaches it for the
same reason it reaches the schema. Removing the property while leaving the
paragraph would ship a self-contradictory build: tools/list no longer
advertises the argument, and the instructions still tell the model to send it.
Same subtraction, second encoding.

It is a clean revert if it should be split out — packages/mcp/mcp-server.ts
plus its test in packages/mcp/mcp-server.test.ts, nothing else depends on it.

The contract a non-CC host implements now lives in docs/self-hosting.md,
which its operator reads: the seven accepting tools, the fact that the argument
is deliberately not advertised, and the UUID-or-unbound-stub rule.

The manifest test asserts the rule one seam over

hooks-manifest.test.ts held that a tool whose adapter path reaches
boundHttp must DECLARE session_id. Nothing declares one now, so the rule is
restated as RECEIVE and traced from the accept-side marker instead. The
substance is unchanged — the id still has to reach the tool.

That rule comes from a source scan, and a scan that stops matching satisfies
every "no tool violates this" assertion by looking at nothing. So the receiving
set is pinned at exactly seven, and the advertise side is traced separately and
asserted empty. Verified by mutation, not by inspection: renaming the marker
fails the pin, and returning a session_id property to a schema fails the
advertise-side rule. Without the pin, the first mutation went silently green.

Supply is proven by the tests that were already there

The tools-session suite passes session_id in arguments and asserts the
mint. Those are now tests of an undeclared argument being read, and they would
fail loudly if the guard rejected it. Three new ones state the property
directly: the argument is accepted where no schema advertises it, a tool that
takes none still rejects it, and a genuinely unknown argument is still rejected
alongside it.

Closes comms-tg70.