The tier and the writable roots are injected from two spellings of one set #2738

emrg/server/daemon.py defines the set of tools that both the sandbox tier and the host-named writable roots reach:

_ROOT_CONSUMING_TOOLS = SHELL_TOOL_NAMES | {"write", "edit"}

with a comment stating what the name is for: the injection site reads it twice — once for the tier and once for the roots — and two hand-written unions would be two chances to drift apart. _apply_escalation leans on the same claim, in a comment that the set is "read here and at the injection site, so the two cannot drift".

Measured. Only one of those two reads used the name. The tier branch spelled the union out by hand:

if tc_name in SHELL_TOOL_NAMES | {"write", "edit"} and req.sandbox:

so the set had one definition and two spellings, which is the state its own comment exists to prevent.

What that costs. A tool added to _ROOT_CONSUMING_TOOLS — the documented single place to add one — receives the session's writable roots and no tier at all. Nothing reports it. The call runs at whatever tier the tool falls back to, while the escalation path already accepts that name because it reads the constant: a tool can be told it may ask for a wider tier by a call that carries none. Driving _inject_tool_arguments with a name that is in the set and not in the union produces {'writable_roots': [...]} and no sandbox key.

Why the existing reading misses it. tests/test_sandbox_extra_roots.py::test_the_roots_are_injected_into_exactly_the_tools_that_can_use_them asserts _ROOT_CONSUMING_TOOLS == SHELL_TOOL_NAMES | {"write", "edit"} — equality of values, which holds equally for one source and for two. That is the reading issue #2734 recorded when four hand-written copies of one schema passed for one source, applied unchanged to this set.

What the fix must satisfy

• Both branches of _inject_tool_arguments read _ROOT_CONSUMING_TOOLS; no hand-written union remains anywhere outside its definition.
• A test drives the pair through a name that is in the set and nowhere else, and asserts that the tier and the roots both land. A member of the union cannot distinguish the two spellings, so the probe has to come from outside it.
• That test fails on the tree before the fix and passes after it, so the guard is known to fail on the defect rather than only to pass without it.