phone loads its spec from an embedded manifest under crates/rhema-claw/tools; the Rust side keeps only the invoke half. It stays replay-unsafe: a resumed run must not re-queue a control command or re-retire a device. With this every registry-served tool spec in the daemon comes from a manifest; only the ToolResolver-style tools (identity_exec) keep their specs inline.