Brief P1: fix the tools array per epoch, reach other tools through call_tool

Approved 2026-09-17. Evidence is in docs/decisions.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/design.md

@@ -90,8 +90,13 @@ ordinary outbound networking can reach the whole tailnet and the internet as the
    and starts a new epoch whose prefix is the baseline plus the summary. The old log is kept.
 5. **Pinned slots.** Main session, subagents, and scheduled runs each use their own server slot so
    they do not evict each other's cache. Verify the pinning mechanism on the deployed build.
-6. **Progressive disclosure.** Only a small core tool set has schemas in the baseline. Everything
-   else is found through one `find_tool` call that appends the schema when needed.
+6. **Progressive disclosure.** The `tools` array is fixed for the whole epoch. The template renders
+   it at the top of the prompt, so any change re-reads everything. Only a small core tool set has
+   schemas in it. Everything else is found through `find_tool`, which returns schemas as an
+   ordinary tool result, and is called through one fixed `call_tool(name, arguments)` meta-tool.
+   `brokerd` applies grants to the target tool, not to `call_tool`. Never prompt the model to call
+   a tool that is not in the `tools` array: the server's grammar forces such a call into a
+   declared tool.
 7. **Liveness, not deadlines.** Streaming always. The timeout is "no bytes for N seconds", never a
    total-request deadline.
 8. **Runaway control.** Per-turn thinking-token cap, per-turn tool-iteration cap, detection of