Function route_session_set 

pub fn route_session_set(
    retained: Option<&Arc<RwLock<SessionToolSet>>>,
    catalog: &ToolCatalog,
    fallback_session: impl FnOnce() -> SessionId,
) -> SessionToolSet

Resolve the session tool set for the extension-provider route (Task 17, closing the Task 16 policy divergence): when the runtime threads its RETAINED per-stream set, the route consumes THAT set’s current state — including exact activations — at its pinned generation. The route must never silently mint a fresh default-core set for the same round. Only callers with no retained handle at all (internal/sync helpers) fall back to a fresh default-core set with zero activations under a locally minted session.

Generation drift is deliberately SURVIVED here (per-tool digest validation fix): the retained set is served as-is even when the catalog generation moved past its snapshot, because every actual execution still passes through ExecutionGate::authorize, which unconditionally re-validates each called tool’s current record (presence, digest, provenance) against the session’s pins. Denying the whole retained set wholesale would let an unrelated background catalog mutation kill an entire in-flight round of schema-identical tools. Infallible: neither path can be denied anymore, so the return type is the plain set.