fix: judge a search that names no path against the directory it would use

The guard's rule was that a call naming no path is not judged, because a tool
that names no path cannot leave the facet. That is true of a tool with no path
argument and false of three that have one with a default: `grep` and `glob`
document theirs as "Defaults to the session workspace", and `recall` falls back
to a directory its own marker search picks. On any session whose facet is
narrower than its directory — every session whose focus was set from the panel
rather than by starting the conversation in the folder — a bare `grep` searches
outside the facet and returns what it finds.

An absent argument is not an absent path; it is the default one. The three tools
are now judged against the directory they would have searched, through the same
containment test that decides every other call, and the refusal is its own
sentence rather than the "that path is outside" one: the path at issue is one the
model never wrote, so the remedy is a second argument, not a grant.

A tool with no path argument at all is still left alone. `bash` is still the
documented way out, and the first deployment running this plugin confirmed it is
a real one: an agent scoped to one module used a shell command to parse a config
file outside its facet, having been told in the same prompt not to. That is what
this plugin is for, and what it cannot do is stated in the README rather than
implied.

README.md

@@ -48,6 +48,15 @@ wrong, and an agent that cannot reach a shared type does not stop needing it.
 So an out-of-scope file call is put to you, and saying yes records the grant for
 the rest of the conversation.
 
+**A tool that names no path is judged on the path it would use.** `grep`, `glob`
+and `recall` all default to a directory when the model omits one — the session
+directory for the first two, a marker-chosen one for the third — and on a session
+whose facet is narrower than its directory, that default reads outside the facet.
+An absent argument is not an absent path, so those three are judged against the
+default they would have searched, and the refusal says which argument to add.
+`lib/scope.js` holds the list; a tool with no path argument at all is still left
+alone, because it has no default that could leave.
+
 ### The `facet` tool
 
 | action | effect |
@@ -208,7 +217,10 @@ Honest boundaries, because each one is a decision rather than an oversight:
 - **`bash` is not guarded.** A shell command cannot be judged reliably from
   argv, so the facet is enforced on the file tools and `bash` remains a
   legitimate way out. The prompt tells the model this rather than pretending
-  otherwise.
+  otherwise. It is not a theoretical hole: the first deployment to run this had
+  an agent scoped to one module use a shell command to parse a config file
+  outside its facet, having been told in the same prompt not to. A prompt is not
+  a guard, which is what the rest of this plugin is for.
 - **Tools that name a path in a shape the table cannot read are not guessed at** —
   including MCP tools. See `PATH_ARGUMENTS` in `lib/scope.js`; it is a list of
   tools whose path argument is a plain top-level string.
@@ -225,26 +237,29 @@ Honest boundaries, because each one is a decision rather than an oversight:
 
 Verified:
 
-- 73 tests (`npm test`) over the scope algebra, the policy state, the guard, and
+- 81 tests (`npm test`) over the scope algebra, the policy state, the guard, and
   the browser half — including that containment is decided on canonical targets
   (a symlink inside the facet pointing outside it is refused), that a prefix is
   not a parent (`/a/room` does not contain `/a/roommate`), that a malformed tool
   call never makes the guard throw, that a live `mode` edit decides the next call
   without the guard being remounted, that an agent narrowing the user has since
   narrowed past is dropped rather than honoured, that `reset` lands on the
-  declared scope rather than the session directory, and that every `facet` result
-  satisfies the tool's own declared output schema.
+  declared scope rather than the session directory, that a search naming no path
+  is refused when the directory it defaults to is outside the facet, and that
+  every `facet` result satisfies the tool's own declared output schema.
 - The bundle's patch layers parse, merge and land correctly against the real
   profile: `dsh --profile web --patch ./cordis.patch.yml --patch
   ./presets/facet.patch.yml --dump-config` shows `facet-policy`, `preset-facet`,
   the `facet-guard` row and the compaction config, with `preset-standard`
   untouched. The optional `standard-compaction` overlay was checked the same way.
 
-**Not yet verified: a live session.** The plugin has not been loaded by a running
-harness, because that needs the bundle installed. The first thing to check after
-installing is that `preset-facet` is not `broken` — a preset whose child row
-fails to resolve still appears on the roster, with its diagnostic, and cannot
-compose a session:
+**Verified live.** The bundle is installed in a `web` profile and composing
+sessions: the runtime binding is in the running session's context, the crosshair
+panel writes the declaration, and the guard decides the calls it names. That is
+also where the `bash` boundary above was confirmed the hard way. The first thing
+to check after any change is still that `preset-facet` is not `broken` — a preset
+whose child row fails to resolve still appears on the roster, with its
+diagnostic, and cannot compose a session:
 
 ```sh
 dsh --profile web --dump-config | grep -A 3 preset-facet
@@ -309,7 +324,7 @@ lib/scope.js                 the pure half — argument extraction, text, reason
 lib/guard.js                 preset row: rule, binding, tool, pre-execute guard
 presets/facet.patch.yml      the `facet` agent preset
 presets/standard-compaction.patch.yml   optional: the same budget for `standard`
-test/                        78 tests
+test/                        81 tests
 ```
 
 `client/client.js` is a browser half rather than a module the host imports, and