refactor(execute_code): schema diet — persistence woven in, not bolted on (712 → 654 tok/call)

[teknium1]

Campaign entry (#95681), post-kernel-adoption cleanup. The kernel arc (#94647/#96787/#96991) grew execute_code's served schema 631 → 712 by APPENDING a conditional kernel paragraph behind a now-dead _get_kernel_mode() check. This PR makes persistence part of the tool's one story instead of a bolt-on, and sweeps prose the kernel made stale.

Changes (all editorial — zero behavior)

• Kernel note → core description. Persistence is the tool's second sentence now ("build on earlier work instead of re-loading it"), not a trailing afterthought. The dead conditional is gone from the builder.
• "per script" → "per call" in the limits line: with a persistent kernel there is no per-script world; the tool-call budget is per call (it resets each cell — matches runtime).
• Stale/duplicated prose swept: "Print your final result to stdout" was taught twice (description + code param) — now once, in the param where it's read at write-time; terminal foreground-only was taught twice (limits line + terminal stub line) — the stub, which session-filters correctly, keeps it; "conditional branching" → "branching"; "for transient failures" tail dropped.
• reset param: "Session-kernel mode only … Ignored in per-call mode" described a mode that no longer exists → "Discard the kernel's persistent state and start fresh."
• Remote fail-open deliberately NOT in the schema (comment documents the choice): hosts that can't sustain a kernel degrade silently and the result's kernel field tells the truth per call — teaching every session about a rare degraded path is rent not worth paying.

Numbers (as served, o200k_base, full toolset)

	tok/call
pre-kernel-arc	631
main today (kernel note appended)	712
this PR	654 (−58 vs main; +23 vs pre-kernel for a genuinely new capability)

The dynamic machinery (per-session tool-stub filtering, strict/project cwd variants) is untouched — it's the good kind of dynamic. Contract test updated: test_kernel_persistence_is_taught_unconditionally pins that every session learns persistence + reset, in both modes, regardless of stale config keys.

Tests: 86 passed / 1 pre-existing failure (TestRpcTokenAuthorization, predates the arc).

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 5dc9178 — fix(execute_code): honest interpreter note — Hermes's own py}

⚠️ Warnings

OSV vulnerability scan · View job

6 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in website/package-lock.json
• CVE-2026-71554 in uv.lock
• CVE-2026-70608 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-70606 in package-lock.json
• CVE-2026-71554 in uv.lock

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 4m6s vs 5m7s (-19.9%). 6 job(s) slower, 6 faster,

• OS-specific tests / macOS-only tests: -8.0s
• OS-specific tests / Windows-only tests: -7.0s
• Python tests / Run tests: -6.0s
• Python tests / e2e: -4.0s
• Python lints / ruff enforcement (blocking): -4.0s