Where the runtime's permissions are composed, a runtime carrying the tool runner subscribes mesh-sdk's EveryEvent (every seat's, module's and module stream's events) and nothing else for it, replacing the per-family list. Builds: design 34 every-event §6, §8, §25, §27 Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h