@sellable/mcp 0.1.958 → 0.1.959

package/dist/tools/refill-v3-advance.js

@@ -35,7 +35,7 @@ export const REFILL_V3_ADVANCE_TOOL_NAME = "refill_v3_advance";
 export const refillV3AdvanceToolDefinitions = [
     {
         name: REFILL_V3_ADVANCE_TOOL_NAME,
-        description: "THE DEFAULT REFILL ENTRY POINT. Whenever this tool is exposed, every ordinary request to refill, top up, fill, max out, load up, or otherwise add sends for a workspace, a sender, or a day routes HERE, and `refill_sends` is the superseded V1 fallback that applies only to servers which do NOT expose this tool. Never infer the route: use tool availability. When the operator names a workspace, resolve it with `list_workspaces`; fail closed if no accessible workspace matches or more than one matches, and never mutate the active workspace. Use configured context only when the operator named none. Start here: do not open the refill ladder with `get_refill_target_plan` or `refill_sends`. Advance exactly ONE fresh, fenced Refill V3 step for one workspace and scope. Pass only {workspaceId, scope}; refill defaults to yolo:true. YOLO is an autonomy grant, not a mode. Pass explicit yolo:false only when the operator asks for a conservative, review-first run. MCP carries signed run continuity internally. An advanced result is ALREADY EXECUTED and has reread its authority. For campaign_attention_required, call refill_v3_continue first with no decision: live-job waiting, exact actionable enrichment, and same-template generation are deterministic. Only model_decision_required routes the returned accurate campaign packet to refill-sends-work-campaign for one repair, criteria, rubric, waterfall, or source-expansion judgment. Repeat until complete, awaiting_external_change, or blocked, and report every terminal sender/date/lane row.",
+        description: "THE DEFAULT REFILL ENTRY POINT. Whenever this tool is exposed, every ordinary request to refill, top up, fill, max out, load up, or otherwise add sends for a workspace, a sender, or a day routes HERE, and `refill_sends` is the superseded V1 fallback that applies only to servers which do NOT expose this tool. Never infer the route: use tool availability. When the operator names a workspace, resolve it with `list_workspaces`; fail closed if no accessible workspace matches or more than one matches, and never mutate the active workspace. Use configured context only when the operator named none. Start here: do not open the refill ladder with `get_refill_target_plan` or `refill_sends`. Advance exactly ONE fresh, fenced Refill V3 step for one workspace and scope. Pass only {workspaceId, scope}; refill defaults to yolo:true. YOLO is an autonomy grant, not a mode. Pass explicit yolo:false only when the operator asks for a conservative, review-first run. MCP carries signed run continuity internally. An advanced result is ALREADY EXECUTED and has reread its authority. For campaign_attention_required, call refill_v3_continue first with no decision: live-job waiting, exact actionable enrichment, and same-template generation are deterministic. Only model_decision_required routes the returned accurate campaign packet to refill-sends-work-campaign for one repair, criteria, rubric, waterfall, or source-expansion judgment. Repeat until complete, awaiting_external_change, or blocked, and report every terminal sender/date/lane row. A thrown error is not a terminal: call this tool once more with the identical workspaceId and scope (the MCP keeps the run current) and report a blocker only if it fails the same way.",
         inputSchema: REFILL_V3_ADVANCE_INPUT_SCHEMA,
         outputSchema: REFILL_V3_ADVANCE_OUTPUT_SCHEMA,
         annotations: {

package/dist/tools/refill-v3-campaign-work.d.ts

@@ -249,6 +249,12 @@ export type RefillV3AuthorityReceipt = {
      */
     externalReasonCode?: "endpoint_temporarily_unavailable";
     correctiveContext?: RefillV3AttentionCorrection;
+    /**
+     * Present only when the run's source-cycle bookkeeping for an effect that
+     * already happened could not be written. The effect and this receipt stand;
+     * the fresh re-observation decides the next step.
+     */
+    sourceCycleRecordError?: string;
     /**
      * V31-BATCH-001: the deterministic enrichment batch ladder's decision and
      * its numeric basis, present only on `enrich_bounded_sample` receipts so

package/dist/tools/refill-v3-continue-contract.d.ts

@@ -270,6 +270,10 @@ export declare const REFILL_V3_CONTINUE_OUTPUT_SCHEMA: Readonly<{
         readonly receiptPersistence: {
             readonly type: "object";
         };
+        readonly recoveredFromError: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
     };
     readonly additionalProperties: false;
     readonly allOf: readonly [{

package/dist/tools/refill-v3-continue-contract.js

@@ -142,6 +142,9 @@ export const REFILL_V3_CONTINUE_OUTPUT_SCHEMA = Object.freeze({
         // consumed a sequence, so the caller can continue the SAME run.
         runToken: { type: "string", minLength: 1 },
         receiptPersistence: { type: "object" },
+        // The work's error when its one re-observation found the world had moved;
+        // the result is that fresh observation, handled by its own kind.
+        recoveredFromError: { type: "string", minLength: 1 },
     },
     additionalProperties: false,
     allOf: [

package/dist/tools/refill-v3-continue.d.ts

@@ -265,6 +265,10 @@ export declare const refillV3ContinueToolDefinitions: {
             readonly receiptPersistence: {
                 readonly type: "object";
             };
+            readonly recoveredFromError: {
+                readonly type: "string";
+                readonly minLength: 1;
+            };
         };
         readonly additionalProperties: false;
         readonly allOf: readonly [{
@@ -390,31 +394,38 @@ export type RefillV3ContinueInput = {
      */
     decision?: unknown;
 };
+/**
+ * Present when this continuation's work failed and its one re-observation
+ * found the world had moved; the result is that fresh observation.
+ */
+type RefillV3RecoveredFromError = {
+    recoveredFromError?: string;
+};
 export type RefillV3ContinueResult = {
     kind: "continuation_pending";
     retryAfterMs: number;
     runningForSeconds?: number;
-} | {
+} | ({
     kind: "world_advanced";
     advanceResult: Extract<RefillV3AdvanceResult, {
         kind: "advanced";
     }>;
-} | {
+} & RefillV3RecoveredFromError) | ({
     kind: "world_step_pending";
     advanceResult: Extract<RefillV3AdvanceResult, {
         kind: "run_step_pending";
     }>;
-} | {
+} & RefillV3RecoveredFromError) | ({
     kind: "world_terminal";
     advanceResult: Extract<RefillV3AdvanceResult, {
         kind: "awaiting_external_change" | "complete" | "blocked";
     }>;
-} | {
+} & RefillV3RecoveredFromError) | ({
     kind: "attention_refresh_required";
     advanceResult: Extract<RefillV3AdvanceResult, {
         kind: "campaign_attention_required";
     }>;
-} | {
+} & RefillV3RecoveredFromError) | {
     kind: "model_decision_required";
     runToken: string;
     packet: RefillV3CampaignAttentionPacket;
@@ -566,6 +577,8 @@ type RefillV3ContinueProductionOwners = {
         protectedFitDigest: string;
         receipt: Record<string, unknown>;
     }) => Promise<unknown>;
+    /** Injectable pause for the bounded transient retry of a source-cycle write. */
+    sleep?: (ms: number) => Promise<void>;
 };
 export declare function runRefillV3CampaignWorkWithProductionOwners(input: {
     packet: RefillV3CampaignAttentionPacket;

package/dist/tools/refill-v3-continue.js

@@ -18,7 +18,7 @@ export const REFILL_V3_CONTINUE_TOOL_NAME = "refill_v3_continue";
 export const refillV3ContinueToolDefinitions = [
     {
         name: REFILL_V3_CONTINUE_TOOL_NAME,
-        description: "Continue exactly one server-issued Refill V3 campaign-attention packet. continuation_pending means the same operation is still running: wait retryAfterMs and call this tool with identical scope and no decision until it returns. Reconcile transport timeouts the same way; do not call advance or dispatch another search while pending. Call first without decision: after a fresh revalidation, the tool deterministically owns live-job waiting, selected-source row copying, exact actionable enrichment, and same-template message generation. It returns model_decision_required only when the accurate packet needs a genuine repair, criteria, rubric, waterfall, or source-expansion judgment; then call again with that one closed decision. Only an exact fresh packet can dispatch one existing campaign-work authority, which re-observes the exact sender/date and settles before a sibling campaign may advance. The caller cannot supply batch sizes, readiness digests, retry counters, fill inputs, scheduler inputs, or idempotency keys.",
+        description: "Continue exactly one server-issued Refill V3 campaign-attention packet. continuation_pending means the same operation is still running: wait retryAfterMs and call this tool with identical scope and no decision until it returns. Reconcile transport timeouts the same way; do not call advance or dispatch another search while pending. Call first without decision: after a fresh revalidation, the tool deterministically owns live-job waiting, selected-source row copying, exact actionable enrichment, and same-template message generation. It returns model_decision_required only when the accurate packet needs a genuine repair, criteria, rubric, waterfall, or source-expansion judgment; then call again with that one closed decision. Only an exact fresh packet can dispatch one existing campaign-work authority, which re-observes the exact sender/date and settles before a sibling campaign may advance. The caller cannot supply batch sizes, readiness digests, retry counters, fill inputs, scheduler inputs, or idempotency keys. A result with recoveredFromError already re-observed after a failure: handle it by its kind. A thrown error is not a terminal: call refill_v3_advance once more with the identical scope and report a blocker only if it fails the same way.",
         inputSchema: REFILL_V3_CONTINUE_INPUT_SCHEMA,
         outputSchema: REFILL_V3_CONTINUE_OUTPUT_SCHEMA,
         annotations: {
@@ -183,6 +183,33 @@ const DEFAULT_PRODUCTION_OWNERS = {
 export async function runRefillV3CampaignWorkWithProductionOwners(input, owners = DEFAULT_PRODUCTION_OWNERS) {
     const decoded = decodeRefillV3CampaignWorkOutput(input.output);
     const chosen = decoded.ok ? decoded.value.actions[0] : null;
+    // A source-cycle row is the run's BOOKKEEPING for a source effect that has
+    // already happened or been refused; it is never the effect itself. Throwing
+    // here on 2026-10-05 discarded Justin's applied 396-row engager import and
+    // stopped the Slack run with nothing scheduled. A transient failure is
+    // retried in place (retrying the whole stage would re-dispatch the search);
+    // any other failure rides on the receipt, and the persisted campaign-work
+    // receipt plus the fresh re-observation still guard against a repeat.
+    const recordSourceCycle = async (record) => {
+        if (!owners.recordSourceCycle)
+            return undefined;
+        const sleep = owners.sleep ??
+            ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+        for (let attempt = 0;; attempt += 1) {
+            try {
+                await owners.recordSourceCycle(record);
+                return undefined;
+            }
+            catch (error) {
+                const retryDelay = POST_ADVANCE_TRANSPORT_RETRY_DELAYS_MS[attempt];
+                if (retryDelay === undefined ||
+                    !isRetryablePostAdvanceTransportError(error)) {
+                    return error instanceof Error ? error.message : String(error);
+                }
+                await sleep(retryDelay);
+            }
+        }
+    };
     let diagnosticRows = [];
     const record = (value) => value && typeof value === "object" && !Array.isArray(value)
         ? value
@@ -195,6 +222,9 @@ export async function runRefillV3CampaignWorkWithProductionOwners(input, owners
     const scopeEcho = `${input.packet.scope.workspaceId}:${input.packet.scope.campaignId}:${input.packet.scope.tableId}`;
     const receipt = (params) => ({
         ...(params.batchPlan === undefined ? {} : { batchPlan: params.batchPlan }),
+        ...(params.sourceCycleRecordError === undefined
+            ? {}
+            : { sourceCycleRecordError: params.sourceCycleRecordError }),
         outcome: params.outcome,
         result: params.result,
         scopeEcho,
@@ -813,7 +843,10 @@ export async function runRefillV3CampaignWorkWithProductionOwners(input, owners
                     senderId: request.scope.senderId,
                     date: request.scope.date,
                     lane: input.packet.scope.lane,
-                    family: input.packet.evidence.leadSourceFamily,
+                    // The family being SEARCHED, which a family switch makes differ from
+                    // the packet's observed family. Its negative set is the one that
+                    // guards this dispatch, and the receipt below names the same family.
+                    family: request.sourceCommand.family,
                     protectedFitDigest,
                 };
                 // The run fact scopes both sides of reconciliation: writes are stamped
@@ -884,28 +917,27 @@ export async function runRefillV3CampaignWorkWithProductionOwners(input, owners
                         : null,
                 });
                 if (sourceOutcome.kind === "dispatched") {
-                    if (owners.recordSourceCycle) {
-                        await owners.recordSourceCycle({
-                            ...sourceCycleScope,
-                            ...sourceCycleRunFact,
-                            receipt: {
-                                schemaVersion: 1,
-                                kind: "search",
-                                campaignId: request.scope.campaignId,
-                                family: request.sourceCommand.family,
-                                protectedFitDigest,
-                                requestFingerprint: request.sourceCommand.requestFingerprint,
-                                sourceFingerprint: sourceOutcome.receipt.sourceAfterFingerprint,
-                                keywordBatch: request.sourceCommand.keywordBatch,
-                                postIds: request.sourceCommand.selectedPostIds,
-                                importedCount: sourceOutcome.receipt.importedCount,
-                                yieldEvidence: sourceOutcome.receipt.yieldEvidence,
-                                observedAt: request.scope.date,
-                            },
-                        });
-                    }
+                    const sourceCycleRecordError = await recordSourceCycle({
+                        ...sourceCycleScope,
+                        ...sourceCycleRunFact,
+                        receipt: {
+                            schemaVersion: 1,
+                            kind: "search",
+                            campaignId: request.scope.campaignId,
+                            family: request.sourceCommand.family,
+                            protectedFitDigest,
+                            requestFingerprint: request.sourceCommand.requestFingerprint,
+                            sourceFingerprint: sourceOutcome.receipt.sourceAfterFingerprint,
+                            keywordBatch: request.sourceCommand.keywordBatch,
+                            postIds: request.sourceCommand.selectedPostIds,
+                            importedCount: sourceOutcome.receipt.importedCount,
+                            yieldEvidence: sourceOutcome.receipt.yieldEvidence,
+                            observedAt: request.scope.date,
+                        },
+                    });
                     const changed = sourceOutcome.receipt.importedCount > 0;
                     return receipt({
+                        sourceCycleRecordError,
                         outcome: changed ? "applied" : "no_effect",
                         result,
                         idempotencyKey: request.idempotencyKey,
@@ -914,27 +946,26 @@ export async function runRefillV3CampaignWorkWithProductionOwners(input, owners
                     });
                 }
                 if (sourceOutcome.kind === "recorded_exhaustion") {
-                    if (owners.recordSourceCycle) {
-                        await owners.recordSourceCycle({
-                            ...sourceCycleScope,
-                            ...sourceCycleRunFact,
-                            receipt: {
-                                schemaVersion: 1,
-                                kind: "exhaustion",
-                                campaignId: request.scope.campaignId,
-                                family: request.sourceCommand.family,
-                                protectedFitDigest,
-                                requestFingerprint: request.idempotencyKey,
-                                sourceFingerprint: priorSourceFingerprint ?? request.scope.evidenceFingerprint,
-                                keywordBatch: null,
-                                postIds: null,
-                                importedCount: 0,
-                                yieldEvidence: sourceOutcome.receipt.yieldEvidence,
-                                observedAt: request.scope.date,
-                            },
-                        });
-                    }
+                    const sourceCycleRecordError = await recordSourceCycle({
+                        ...sourceCycleScope,
+                        ...sourceCycleRunFact,
+                        receipt: {
+                            schemaVersion: 1,
+                            kind: "exhaustion",
+                            campaignId: request.scope.campaignId,
+                            family: request.sourceCommand.family,
+                            protectedFitDigest,
+                            requestFingerprint: request.idempotencyKey,
+                            sourceFingerprint: priorSourceFingerprint ?? request.scope.evidenceFingerprint,
+                            keywordBatch: null,
+                            postIds: null,
+                            importedCount: 0,
+                            yieldEvidence: sourceOutcome.receipt.yieldEvidence,
+                            observedAt: request.scope.date,
+                        },
+                    });
                     return receipt({
+                        sourceCycleRecordError,
                         outcome: "no_effect",
                         result,
                         idempotencyKey: request.idempotencyKey,
@@ -949,7 +980,7 @@ export async function runRefillV3CampaignWorkWithProductionOwners(input, owners
                     // returning the retained job wait. Previously the pending branch
                     // wrote nothing, so the job could settle and disappear while the
                     // next advance still advertised the identical round as untried.
-                    await owners.recordSourceCycle({
+                    const sourceCycleRecordError = await recordSourceCycle({
                         ...sourceCycleScope,
                         ...sourceCycleRunFact,
                         receipt: {
@@ -975,6 +1006,7 @@ export async function runRefillV3CampaignWorkWithProductionOwners(input, owners
                     // evidence-free timeout: reobserve so the next coordinator step can
                     // wait on (or consume) the exact job without replaying the search.
                     return receipt({
+                        sourceCycleRecordError,
                         outcome: "no_effect",
                         result,
                         idempotencyKey: request.idempotencyKey,
@@ -995,27 +1027,26 @@ export async function runRefillV3CampaignWorkWithProductionOwners(input, owners
                     // authority, and let the same outer run re-observe/continue. Returning
                     // `receipt_incomplete` here left settlement null and repeated the
                     // same packet while every sibling sender/lane stayed unreachable.
-                    if (owners.recordSourceCycle) {
-                        await owners.recordSourceCycle({
-                            ...sourceCycleScope,
-                            ...sourceCycleRunFact,
-                            receipt: {
-                                schemaVersion: 1,
-                                kind: "exhaustion",
-                                campaignId: request.scope.campaignId,
-                                family: request.sourceCommand.family,
-                                protectedFitDigest,
-                                requestFingerprint: request.idempotencyKey,
-                                sourceFingerprint: priorSourceFingerprint ?? request.scope.evidenceFingerprint,
-                                keywordBatch: null,
-                                postIds: null,
-                                importedCount: 0,
-                                yieldEvidence: input.packet.evidence.priorYieldReceipt,
-                                observedAt: request.scope.date,
-                            },
-                        });
-                    }
+                    const sourceCycleRecordError = await recordSourceCycle({
+                        ...sourceCycleScope,
+                        ...sourceCycleRunFact,
+                        receipt: {
+                            schemaVersion: 1,
+                            kind: "exhaustion",
+                            campaignId: request.scope.campaignId,
+                            family: request.sourceCommand.family,
+                            protectedFitDigest,
+                            requestFingerprint: request.idempotencyKey,
+                            sourceFingerprint: priorSourceFingerprint ?? request.scope.evidenceFingerprint,
+                            keywordBatch: null,
+                            postIds: null,
+                            importedCount: 0,
+                            yieldEvidence: input.packet.evidence.priorYieldReceipt,
+                            observedAt: request.scope.date,
+                        },
+                    });
                     return receipt({
+                        sourceCycleRecordError,
                         outcome: "no_effect",
                         result: "source_frontier_exhausted",
                         idempotencyKey: request.idempotencyKey,
@@ -1059,28 +1090,26 @@ export async function runRefillV3CampaignWorkWithProductionOwners(input, owners
                             yieldEvidence: input.packet.evidence.priorYieldReceipt,
                         });
                         if (exhaustionVerdict.exhausted) {
-                            if (owners.recordSourceCycle) {
-                                await owners.recordSourceCycle({
-                                    ...sourceCycleScope,
-                                    ...sourceCycleRunFact,
-                                    receipt: {
-                                        schemaVersion: 1,
-                                        kind: "exhaustion",
-                                        campaignId: request.scope.campaignId,
-                                        family: request.sourceCommand.family,
-                                        protectedFitDigest,
-                                        requestFingerprint: request.idempotencyKey,
-                                        sourceFingerprint: priorSourceFingerprint ??
-                                            request.scope.evidenceFingerprint,
-                                        keywordBatch: null,
-                                        postIds: null,
-                                        importedCount: 0,
-                                        yieldEvidence: input.packet.evidence.priorYieldReceipt,
-                                        observedAt: request.scope.date,
-                                    },
-                                });
-                            }
+                            const sourceCycleRecordError = await recordSourceCycle({
+                                ...sourceCycleScope,
+                                ...sourceCycleRunFact,
+                                receipt: {
+                                    schemaVersion: 1,
+                                    kind: "exhaustion",
+                                    campaignId: request.scope.campaignId,
+                                    family: request.sourceCommand.family,
+                                    protectedFitDigest,
+                                    requestFingerprint: request.idempotencyKey,
+                                    sourceFingerprint: priorSourceFingerprint ?? request.scope.evidenceFingerprint,
+                                    keywordBatch: null,
+                                    postIds: null,
+                                    importedCount: 0,
+                                    yieldEvidence: input.packet.evidence.priorYieldReceipt,
+                                    observedAt: request.scope.date,
+                                },
+                            });
                             return receipt({
+                                sourceCycleRecordError,
                                 outcome: "no_effect",
                                 result: "source_frontier_exhausted",
                                 idempotencyKey: request.idempotencyKey,
@@ -1143,12 +1172,13 @@ export async function runRefillV3CampaignWorkWithProductionOwners(input, owners
                     });
             }
             if (request.action === "record_source_frontier_exhausted") {
+                let sourceCycleRecordError;
                 if (owners.recordSourceCycle) {
                     const protectedFitDigest = input.packet.evidence.protectedFitDigest ||
                         `sha256:${createHash("sha256")
                             .update(input.packet.evidence.campaignObjective)
                             .digest("hex")}`;
-                    await owners.recordSourceCycle({
+                    sourceCycleRecordError = await recordSourceCycle({
                         workspaceId: request.scope.workspaceId,
                         runToken: input.runToken,
                         scopeFingerprint: input.scopeFingerprint,
@@ -1176,6 +1206,7 @@ export async function runRefillV3CampaignWorkWithProductionOwners(input, owners
                     });
                 }
                 return receipt({
+                    sourceCycleRecordError,
                     outcome: "no_effect",
                     result,
                     idempotencyKey: request.idempotencyKey,
@@ -1368,7 +1399,63 @@ function deterministicCampaignDecision(packet) {
         consumedDiagnosticRowIds: null,
     };
 }
+/**
+ * V33-JUSTIN-SELF-HEAL · an unattended refill never ends on a raw error that
+ * a fresh observation can answer.
+ *
+ * On 2026-10-05 Justin's own-post refresh imported 396 engagers and a
+ * bookkeeping 409 then escaped as a raw error, so the Slack host reported a
+ * blocker with nothing scheduled although the run credential was still
+ * current. Once this continuation holds a refreshed credential, any failure
+ * gets ONE re-observation with it. When the world moved, that observation is
+ * returned like any other and names the error it recovered from. When nothing
+ * moved, the same work would fail the same way, so the original error stands:
+ * a deterministic failure surfaces instead of looping. A failure before the
+ * credential was refreshed is never masked.
+ */
 async function executeRefillV3Continuation(input, dependencies) {
+    const progress = {
+        runToken: null,
+        packet: null,
+    };
+    try {
+        return await executeRefillV3ContinuationStep(input, dependencies, progress);
+    }
+    catch (error) {
+        const runToken = progress.runToken;
+        const failedPacket = progress.packet;
+        if (!runToken || !failedPacket)
+            throw error;
+        let observed;
+        try {
+            observed = await reconnectPostAdvanceStage({
+                sleep: dependencies.sleep,
+                operation: () => dependencies.advance({
+                    workspaceId: failedPacket.scope.workspaceId,
+                    scope: input.scope,
+                    ...(input.campaignId === undefined
+                        ? {}
+                        : { campaignId: input.campaignId }),
+                    ...(input.yolo === undefined ? {} : { yolo: input.yolo }),
+                    runToken,
+                }),
+            });
+        }
+        catch {
+            throw error;
+        }
+        if (observed.kind === "campaign_attention_required" &&
+            samePacket(failedPacket, observed.packet)) {
+            throw error;
+        }
+        return {
+            ...continuationResultFromAdvance(observed),
+            recoveredFromError: (error instanceof Error ? error.message : String(error)) ||
+                "unknown_error",
+        };
+    }
+}
+async function executeRefillV3ContinuationStep(input, dependencies, progress) {
     const workspaceId = normalizeExplicitWorkspaceId(input.workspaceId);
     if (!workspaceId || workspaceId !== input.packet.scope.workspaceId) {
         throw new Error("refill_v3_continue requires one exact workspace matching the server-issued packet.");
@@ -1422,6 +1509,8 @@ async function executeRefillV3Continuation(input, dependencies) {
     if (!runToken || !scopeFingerprint) {
         throw new Error("refill_v3_continue got no refreshed run credential from its own internal advance, which already consumed this run's sequence. Refusing to return a spent token.");
     }
+    progress.runToken = runToken;
+    progress.packet = advanceResult.packet;
     const deterministicDecision = deterministicCampaignDecision(advanceResult.packet);
     const decision = deterministicDecision ?? input.decision;
     if (decision === undefined) {
@@ -1642,6 +1731,9 @@ async function executeRefillV3Continuation(input, dependencies) {
     if (input.yolo === true &&
         (preparationOwnsSettlement || directlyQueuedRowsOwnSettlement) &&
         campaignSettlementIsReady(settlement)) {
+        // This advance spends the refreshed credential, so a failure past here has
+        // no unspent credential left to re-observe with.
+        progress.runToken = null;
         const postSettlementAdvance = await reconnectPostAdvanceStage({
             sleep: dependencies.sleep,
             operation: () => dependencies.advance({

package/dist/tools/registry.d.ts

@@ -11516,6 +11516,10 @@ export declare const allTools: ({
             readonly receiptPersistence: {
                 readonly type: "object";
             };
+            readonly recoveredFromError: {
+                readonly type: "string";
+                readonly minLength: 1;
+            };
         };
         readonly additionalProperties: false;
         readonly allOf: readonly [{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/mcp",
-  "version": "0.1.958",
+  "version": "0.1.959",
   "type": "module",
   "description": "Sellable MCP server for Claude Code, Codex, and Hermes campaign workflows",
   "main": "dist/index.js",

package/skills/refill-sends/SKILL.md

@@ -823,6 +823,13 @@ process lives. If a server restart reports that retained attention is missing,
 stop with `continuation_reconciliation_required` and the exact scope and last
 receipt; do not invent a replacement run or claim the prior effect failed.
 Never treat a timeout as zero effect.
+A result carrying `recoveredFromError` means the continuation's work failed,
+the MCP re-observed once, and the world had moved: handle that result by its
+own kind and name the error in the final report. A thrown error is not a
+terminal: the MCP still holds the run's current credential, so call
+`refill_v3_advance` once more with the identical workspace, scope, campaignId,
+and yolo grant. Report a blocker only if that fresh call fails with the same
+error.
 Continue the authorized refill across every connected sender and requested
 lane until the coordinator returns row-complete terminal evidence. Preserve the
 rubric, message, caps, and exclusions; pending work needs no renewed approval.

package/skills/refill-sends-workflow/SKILL.md

@@ -456,6 +456,13 @@ Each call answers with exactly one of six results:
   restarted MCP reports missing retained attention, stop with
   `continuation_reconciliation_required`, the exact scope, and the last receipt;
   do not open a replacement run for an uncertain effect.
+  A result carrying `recoveredFromError` means the continuation's work failed,
+  the MCP re-observed once, and the world had moved: handle that result by its
+  own kind and name the error in the final report. A thrown error is not a
+  terminal: the MCP still holds the run's current credential, so call
+  `refill_v3_advance` once more with the identical workspace, scope,
+  campaignId, and yolo grant. Report a blocker only if that fresh call fails
+  with the same error.
   Interpret its world wrappers
   by their outer kind: `world_terminal` means `advanceResult` is already the
   canonical `awaiting_external_change`, `complete`, or `blocked` terminal, so