@sema-agent/core 7.21.1 → 7.22.0

package/dist/core/checkpoint-store.d.ts

@@ -102,11 +102,11 @@ export type PlatformLimitReason = Extract<ResourceLimitReason, "env_lifetime" |
 export interface SafetyAxis {
     /** design/70: the tool is egress-marked (`ToolSpec.egress` — an external write: push, open PR, send). */
     egress?: boolean;
-    /** design/77 §4: this call carries an irreversibility MANDATE — the tool's own `always`/`maybe` tier, the
-     *  operator's `shellGate:"always"`, the probe's structural verdict (mandated / unanswered), or the shell
-     *  gate's own tighten under its `"maybe"` tier; a policy ask the doctrine's probe neither tightened nor
-     *  mandated carries no bit (its park is the budgetable kind). */
+    /** design/77 §4: an irreversibility MANDATE **of the TOOL's own** (its `always`/`maybe` tier); a SHELL SEAT raise is NOT this axis, see {@link shell}. */
     irreversible?: boolean;
+    /** The engine's SHELL SEAT raised this ask. Its question is about TEXT — not about undoing an act — so
+     *  the two axes are mutually exclusive. */
+    shell?: boolean;
 }
 /**
  * design/80 §D-E: a DETERMINISTIC, REDACTED risk summary attached AT MINT to an escalation
@@ -948,10 +948,10 @@ export interface CheckpointState {
     /**
      * design/199 — the READ-face containment state at suspend (v9,
      * {@link FACE_CHECKPOINT_VERSION}): the RESOLVED face plus the NORMALIZED deny-set ADDITIONS in
-     * force (deployment ∪ task layers; the built-in table is engine code, never frozen here — a newer
-     * engine's built-ins apply on resume as everywhere else). Written ONLY when the posture is
-     * non-default (face "open", or additions present) — an absent section IS the default posture and
-     * resumes as roots + built-ins on any worker. Resume folds STRICTER-WINS: face = roots unless the
+     * force (deployment ∪ task layers; the built-in table is engine code under the RESUMING deployment's
+     * own tier selection — empty unless it made one — never frozen here). Written ONLY when the posture
+     * is non-default (face "open", or additions present) — an absent section IS the default posture and
+     * resumes as roots plus whatever built-in tiers the resuming worker selected. Resume folds STRICTER-WINS: face = roots unless the
      * section says open AND the live resolution says open; deny additions = frozen ∪ live (add-only,
      * monotone — a resume can never widen what the cut leg could read).
      *

package/dist/core/engine-notice.d.ts

@@ -109,6 +109,18 @@ export interface EngineNotice {
      *    its explicit {@link NOTICE_AUDIENCE} row (#433 made the registry total over the catalog —
      *    no engine-minted code is audience-defaulted any more). The refusal itself
      *    (`mcp.server_revoked`) is a tool RESULT code, not a notice.
+     *  - `"mcp.server_redialed"` — a host asked this run to RE-DIAL one MCP server (the run
+     *    handle's `reconnectMcpServer` verb) and this is what came of it. `detail: { server, outcome,
+     *    added, removed, reason?, sessionId, runId }` — `outcome` is the result's own three-word answer
+     *    (`reconnected` / `refused` / `not_declared`) and `added`/`removed` are COUNTS of namespaced
+     *    tool names, never the names themselves (a server's tool names are server-authored text and
+     *    this is an operator line, not a disclosure channel). ONE code rather than a success code and a
+     *    failure code: the outcome is data about one event, not two kinds of event, and both would
+     *    carry the same presentation tier — a consumer alerting on failures reads one field.
+     *    `"operator"` audience: re-dialing is deployment plumbing and a failed one leaves the server
+     *    DOWN, which only the operator can act on. Dedup unit: once per ATTEMPT — never folded per run,
+     *    because two attempts on one server are two different answers and folding the second would hide
+     *    the one that says the server is still down.
      *  - `"mcp.injection_dropped"` (L-167) — an entry of the user's own request-lane MCP injection
      *    was NOT mounted for the leg. The HOST owns the drop sites and supplies the facts; CORE composes
      *    the notice ({@link import("./mcp-injection-drop.js").mcpInjectionDroppedNotice}, the one mint).
@@ -707,6 +719,28 @@ export declare function deliverEngineNotice(onNotice: ((notice: EngineNotice) =>
  * one repeated disclosure about one run. The account is per-RUN by its own contract sentence ("at most
  * once per family, per run"), so it must carry the run's own id. Same omit-never-fabricate rule.
  */
+/** What a settled leg still owes a person BEFORE the compensation lane has had its say: the facts the
+ *  terminal-adoption lane holds, carried to the settle lane that closes the account
+ *  ({@link settleOwedUserInput}). */
+export interface OwedUserInputAccount {
+    /** The harness's at-agent_end snapshot, held because the tail still had something to say about it. */
+    readonly held: {
+        steer: number;
+        followUp: number;
+    } | undefined;
+    /** What a durable park's migration carried onto the new checkpoint, by family. */
+    readonly migrated: {
+        steer: number;
+        followUp: number;
+    };
+    /** The resumed leg's undelivered continuation frames, and how many of them the migration carried. */
+    readonly continuation: {
+        frames: ReadonlyArray<{
+            seq?: number;
+        }>;
+        carried: number;
+    };
+}
 /**
  * What this leg still OWES a person, one count per family — the input to {@link undrainedUserInputNotices}.
  * TWO lanes accept caller input and either can be holding some when a run ends: the harness's live queue
@@ -727,11 +761,25 @@ export declare function owedUserInputCounts(held: {
         seq?: number;
     }>;
     carried: number;
-    rowMayReturn: boolean;
+    rowReturned: boolean;
 }): {
     steer: number;
     followUp: number;
 };
+/** Close the account — the ONE settlement point, called AFTER the reopen compensation with what that
+ *  compensation actually did. Ordering is the whole rule: the counts are arithmetic, and the only fact they
+ *  cannot be computed without is one the lane before this one does not have yet. EXACTLY ONCE per account,
+ *  which is what lets the teardown call it again as a backstop for a settle lane that threw on its way here
+ *  (an account nobody closes is the silence this seat exists to end; a second row would be the same loss
+ *  counted twice). Keyed on the account OBJECT — one per run, minted by the lane that assembles it. NEVER
+ *  THROWS: a station calls it from a teardown path where the run is already failing, and a disclosure that
+ *  takes the cleanup down with it is worse than the silence it was fixing (the absent-sink arm of
+ *  {@link deliverEngineNotice} ends at a bare `console.warn`, which a host-replaced console can throw from). */
+export declare function settleOwedUserInput(account: OwedUserInputAccount, rowReturned: boolean, ids: {
+    taskId?: string;
+    sessionId?: string;
+    runId?: string;
+}, onNotice: ((notice: EngineNotice) => void) | undefined): void;
 export declare function undrainedUserInputNotices(counts: {
     steer: number;
     followUp: number;

package/dist/core/engine-notice.js

@@ -32,12 +32,25 @@ export function deliverEngineNotice(onNotice, notice) {
     console.warn(notice.message);
 }
 export function owedUserInputCounts(held, migrated, continuation) {
-    const owedContinuation = (continuation.rowMayReturn ? continuation.frames.filter((f) => f.seq === undefined).length : continuation.frames.length) - continuation.carried;
+    const owedContinuation = (continuation.rowReturned ? continuation.frames.filter((f) => f.seq === undefined).length : continuation.frames.length) - continuation.carried;
     return {
         steer: Math.max(0, (held?.steer ?? 0) - migrated.steer) + Math.max(0, owedContinuation),
         followUp: Math.max(0, (held?.followUp ?? 0) - migrated.followUp),
     };
 }
+export function settleOwedUserInput(account, rowReturned, ids, onNotice) {
+    if (SETTLED_OWED_ACCOUNTS.has(account))
+        return;
+    SETTLED_OWED_ACCOUNTS.add(account);
+    try {
+        const owed = owedUserInputCounts(account.held, account.migrated, { ...account.continuation, rowReturned });
+        for (const notice of undrainedUserInputNotices(owed, ids.taskId, ids.sessionId, ids.runId))
+            deliverEngineNotice(onNotice, notice);
+    }
+    catch {
+    }
+}
+const SETTLED_OWED_ACCOUNTS = new WeakSet();
 export function undrainedUserInputNotices(counts, taskId, sessionId, runId) {
     const tid = taskId !== undefined ? { taskId } : {};
     const sid = sessionId !== undefined ? { sessionId } : {};

package/dist/core/governance-codes.d.ts

@@ -119,7 +119,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -18,6 +18,8 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.layout_unowned_root_content",
     "memory.tail",
     "memory.pollution_mark_failed",
+    "memory.session_incarnation_mismatch",
+    "memory.session_incarnation_unreadable",
     "memory.session_polluted",
     "memory.harvest_quarantined",
     "memory.delegation_static_mark_waived",
@@ -132,6 +134,7 @@ export const ENGINE_NOTICE_CODES = [
     "delegation.ask_unresolvable",
     "mcp.injection_dropped",
     "mcp.revocation_probe_failed",
+    "mcp.server_redialed",
     "workflow.governance_key_stripped",
     "workflow.agent_option_ignored",
     "memory.session_polluted",
@@ -214,6 +217,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "checkpoint.execution_outcome_unrecorded": "operator",
     "mcp.injection_dropped": "user",
     "mcp.revocation_probe_failed": "operator",
+    "mcp.server_redialed": "operator",
     "workflow.governance_key_stripped": "operator",
     "workflow.agent_option_ignored": "operator",
     "memory.content_class_declared": "operator",

package/dist/core/mcp.d.ts

@@ -190,6 +190,25 @@ export interface MaterializedMcp {
      * misroute).
      */
     refresh: (server?: string) => Promise<McpRefreshResult[]>;
+    /**
+     * RE-DIAL one named server — the action {@link refresh} deliberately is not. It closes
+     * whatever handle the server still has and dials it again through the SAME `connectServer` the
+     * materialization used, so the schema gate, the namespacing, the axis derivation and the metadata
+     * cache seeding cannot drift between a first connect and a re-dial: one function, not one
+     * convention.
+     *
+     * ONE SERVER, NAMED — CC 2.1.259's control-channel request carries a REQUIRED `serverName` and has
+     * no all-servers form, and an all-servers arm would close HEALTHY connections to re-dial them (a
+     * stdio server owning a device or a port is exactly the one that cannot be re-dialed while its
+     * predecessor still holds the device). CLOSE-THEN-DIAL, so a re-dial that FAILS leaves the server
+     * DISCONNECTED until another re-dial or the next leg's materialize, and calls in flight on the
+     * replaced connection fail with it — inherent to re-dialing, and CC's behavior too.
+     *
+     * NOT A MODEL FACE (CC has no such tool either): a verb that can leave a connection down is a host
+     * act, and its consumer entrance is the run handle's `reconnectMcpServer`. LEG-LOCAL like
+     * {@link refresh}: the result rides no checkpoint, and a durable resume takes a fresh listing.
+     */
+    reconnect: (server: string) => Promise<McpReconnectResult>;
     dispose: () => Promise<void>;
 }
 /** One per-server entry of {@link MaterializedMcp.refresh}. `added`/`removed` are namespaced
@@ -244,6 +263,52 @@ export interface McpRefreshResult {
      */
     listingIncomplete?: McpListingIncomplete;
 }
+/**
+ * The result of {@link MaterializedMcp.reconnect} — ONE server, because the face takes one.
+ *
+ * `outcome` is the whole top level, three words, so a consumer mapping it onto a three-state wire
+ * answer needs no table: `reconnected` is the only success, and everything that did not reconnect is
+ * either `refused` (the engine declined, or the dial/first listing failed — `reason` says which) or
+ * `not_declared` (no server of that name in this leg's spec). Sub-reasons ride `reason`; a fourth
+ * word would be a new state for every downstream to learn.
+ *
+ * @contract mcp.redial.roster_assertion — a re-dial result carries `tools` IF AND ONLY IF it asserts a
+ * roster for its `prefix` domain, and that one rule is what every consumer of it reads: the fresh intake
+ * on `reconnected`, the EMPTY roster on a dial that failed after the old connection was already closed
+ * (the server is down, so its tools are withdrawn rather than left mounted and unusable), and NOTHING at
+ * all on an arm that never touched the connection — an unknown name, a revoked server, a re-dial already
+ * in flight, a disposed materialization — whose mounted roster is left exactly as it was.
+ */
+export interface McpReconnectResult {
+    server: string;
+    /** The consumer's splice domain, same meaning and same mint as {@link McpRefreshResult.prefix}. */
+    prefix: string;
+    outcome: "reconnected" | "refused" | "not_declared";
+    /** Why, on every non-`reconnected` outcome (neutralized + bounded when it embeds remote text).
+     *  Never the only machine-readable fact: see {@link status}. */
+    reason?: string;
+    toolCount: number;
+    /** Namespaced names this re-dial added / took away relative to what the server had mounted a moment
+     *  ago — a first successful dial adds its whole roster, a failed dial removes it. */
+    added: string[];
+    removed: string[];
+    /** See the type docstring: present iff this result asserts a roster for `prefix`. */
+    tools?: AgentTool[];
+    axes?: McpToolAxis[];
+    dropped?: McpDroppedTool[];
+    /** The OPERATOR lines this re-dial produced (an incomplete listing walk, a kept-but-defective tool
+     *  schema, a spec naming tools a resources-only server cannot serve). Also appended to
+     *  {@link MaterializedMcp.warnings}, which the runner drains ONCE at prepare — so the copy here is
+     *  what the run handle's verb forwards to `onError(phase:"mcp")`. One production, two drains. */
+    warnings?: string[];
+    /** The NEW connect-time status record (also swapped into {@link MaterializedMcp.statuses}), present
+     *  whenever the dial was attempted: a consumer keys its next action off `errorCode` / `httpStatus`
+     *  (a 401 is a re-authorization door, a `spawn_failed` a missing binary), not off {@link reason}. */
+    status?: McpServerStatus;
+    /** The re-dial's own `tools/list` walk did not finish — {@link McpRefreshResult.listingIncomplete}
+     *  minus the retention arm: a re-dial has no previous listing on this connection to retain from. */
+    listingIncomplete?: McpListingIncomplete;
+}
 /** design/99 §E9 — projected per-server MCP status (see {@link MaterializedMcp.statuses}). NOTE: `serverInfo`
  *  and `error` are SERVER-controlled strings (verbatim from the remote) — UNTRUSTED; a consumer rendering them
  *  into a TUI/log must treat them as such (a misbehaving server could embed ANSI/break-out sequences). `toolNames`

package/dist/core/mcp.js

@@ -709,7 +709,52 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
     const droppedTools = [];
     let disposing = false;
     const serverHandles = [];
-    const dialKinds = entries.map((spec) => {
+    const redialsInFlight = new Set();
+    const commitConnectedServer = (spec, s, transportKind) => {
+        const raised = [];
+        clients.push(s.client);
+        const handle = { name: spec.name, spec, client: s.client, health: s.health, tools: s.tools, listedRaw: s.listedTools, transportKind, announce: s.announce, instructions: s.instructions };
+        const hIdx = serverHandles.findIndex((h) => h.name === spec.name);
+        if (hIdx === -1)
+            serverHandles.push(handle);
+        else
+            serverHandles[hIdx] = handle;
+        const hasInstructions = s.instructions !== undefined;
+        const announceClose = () => {
+            if (disposing)
+                return;
+            s.status.transportClosed = true;
+            if (hasInstructions)
+                instructionsDelta.pendingRemovals.push(spec.name);
+        };
+        s.announce.fn = announceClose;
+        if (s.health.dead)
+            announceClose();
+        if (s.resourceServer) {
+            const rIdx = resourceServers.findIndex((rs) => rs.server === spec.name);
+            if (rIdx === -1)
+                resourceServers.push(s.resourceServer);
+            else
+                resourceServers[rIdx] = s.resourceServer;
+        }
+        for (const d of s.dropped)
+            droppedTools.push({ server: inlineUntrusted(spec.name, 160), ...d });
+        for (const a of s.schemaAdvisories)
+            raised.push(schemaAdvisoryWarning(spec.name, a.tool, a.reason));
+        if (s.toolsCapabilityAbsent === true && spec.allowTools !== undefined && spec.allowTools.length > 0) {
+            raised.push(toolsCapabilityAbsentWarning(spec.name));
+        }
+        if (s.listingIncomplete)
+            raised.push(listingIncompleteWarning(spec.name, s.listingIncomplete));
+        warnings.push(...raised);
+        const sIdx = statuses.findIndex((st) => st.name === spec.name);
+        if (sIdx === -1)
+            statuses.push(s.status);
+        else
+            statuses[sIdx] = s.status;
+        return raised;
+    };
+    const readDialKind = (spec) => {
         try {
             const kind = spec.transport.kind;
             return kind === "stdio" || kind === "http" ? kind : undefined;
@@ -717,7 +762,33 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
         catch {
             return undefined;
         }
-    });
+    };
+    const dialKinds = entries.map(readDialKind);
+    const prefixOf = (name) => mintNamespacePrefix(MCP_NAMESPACE, name);
+    const reconcileInstructions = (name, before, after, connected) => {
+        let owedRemoval = false;
+        for (let i = instructionsDelta.pendingRemovals.length - 1; i >= 0; i--) {
+            if (instructionsDelta.pendingRemovals[i] !== name)
+                continue;
+            instructionsDelta.pendingRemovals.splice(i, 1);
+            owedRemoval = true;
+        }
+        let hadPendingAdd = false;
+        for (let i = instructionsDelta.pendingAdds.length - 1; i >= 0; i--) {
+            if (instructionsDelta.pendingAdds[i].server !== name)
+                continue;
+            instructionsDelta.pendingAdds.splice(i, 1);
+            hadPendingAdd = true;
+        }
+        if (after !== undefined) {
+            instructionsDelta.pendingAdds.push({ server: name, text: after });
+            return;
+        }
+        if (connected)
+            return;
+        if (before !== undefined || owedRemoval || hadPendingAdd)
+            instructionsDelta.pendingRemovals.push(name);
+    };
     const settled = await Promise.allSettled(entries.map((spec, i) => connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure, isServerRevoked, dialKinds[i])));
     try {
         for (let i = 0; i < entries.length; i++) {
@@ -725,36 +796,12 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
             const spec = entries[i];
             if (r.status === "fulfilled") {
                 const s = r.value;
-                clients.push(s.client);
-                serverHandles.push({ name: spec.name, spec, client: s.client, health: s.health, tools: s.tools, listedRaw: s.listedTools, transportKind: dialKinds[i] });
                 tools.push(...s.tools);
                 toolAxes.push(...s.axes);
                 if (s.instructions) {
                     serverInstructions.push({ server: spec.name, text: s.instructions });
                 }
-                const hasInstructions = s.instructions !== undefined;
-                const announceClose = () => {
-                    if (disposing)
-                        return;
-                    s.status.transportClosed = true;
-                    if (hasInstructions)
-                        instructionsDelta.pendingRemovals.push(spec.name);
-                };
-                s.announce.fn = announceClose;
-                if (s.health.dead)
-                    announceClose();
-                if (s.resourceServer)
-                    resourceServers.push(s.resourceServer);
-                for (const d of s.dropped)
-                    droppedTools.push({ server: inlineUntrusted(spec.name, 160), ...d });
-                for (const a of s.schemaAdvisories)
-                    warnings.push(schemaAdvisoryWarning(spec.name, a.tool, a.reason));
-                if (s.toolsCapabilityAbsent === true && spec.allowTools !== undefined && spec.allowTools.length > 0) {
-                    warnings.push(toolsCapabilityAbsentWarning(spec.name));
-                }
-                if (s.listingIncomplete)
-                    warnings.push(listingIncompleteWarning(spec.name, s.listingIncomplete));
-                statuses.push(s.status);
+                commitConnectedServer(spec, s, dialKinds[i]);
             }
             else {
                 warnings.push(asServerWarning(spec, r.reason));
@@ -770,6 +817,89 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
         await Promise.allSettled(settled.map((r) => (r.status === "fulfilled" ? r.value.client.close() : Promise.resolve())));
         throw mergeErr;
     }
+    const redialOnce = async (server) => {
+        const prefix = prefixOf(server);
+        const declined = (outcome, reason) => ({ server, prefix, outcome, reason, toolCount: 0, added: [], removed: [] });
+        if (disposing)
+            return declined("refused", "this materialization is being disposed — the task is tearing down");
+        const spec = entries.find((e) => e.name === server);
+        if (spec === undefined)
+            return declined("not_declared", `no MCP server named ${inlineUntrusted(server, 120)} is declared for this task`);
+        if (isServerRevoked(server))
+            return declined("refused", "server revoked by the operator — the re-dial did not contact it");
+        if (redialsInFlight.has(server))
+            return declined("refused", "a re-dial of this server is already in flight — wait for it to settle");
+        redialsInFlight.add(server);
+        try {
+            const hIdx = serverHandles.findIndex((h) => h.name === server);
+            const prior = hIdx === -1 ? undefined : serverHandles[hIdx];
+            const priorNames = prior ? prior.tools.map((t) => t.name) : [];
+            const priorInstructions = prior?.instructions;
+            if (prior) {
+                prior.announce.fn = undefined;
+                serverHandles.splice(hIdx, 1);
+                const cIdx = clients.indexOf(prior.client);
+                if (cIdx !== -1)
+                    clients.splice(cIdx, 1);
+                await prior.client.close().catch(() => undefined);
+            }
+            const dialKind = readDialKind(spec);
+            let connected;
+            try {
+                connected = await connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure, isServerRevoked, dialKind);
+            }
+            catch (err) {
+                const { kind, delivered, httpStatus } = classifyMcpFailure(err, { phase: "connect", transport: dialKind });
+                const status = { name: server, status: "failed", errorCode: kind, delivered, ...(httpStatus !== undefined ? { httpStatus } : {}), error: namedMcpFailureText(err) };
+                const sIdx = statuses.findIndex((st) => st.name === server);
+                if (sIdx === -1)
+                    statuses.push(status);
+                else
+                    statuses[sIdx] = status;
+                const raised = asServerWarning(spec, err);
+                warnings.push(raised);
+                reconcileInstructions(server, priorInstructions, undefined, false);
+                return {
+                    server,
+                    prefix,
+                    outcome: "refused",
+                    reason: inlineUntrusted(namedMcpFailureText(err), 240),
+                    toolCount: 0,
+                    added: [],
+                    removed: priorNames,
+                    tools: [],
+                    axes: [],
+                    dropped: [],
+                    warnings: [raised.message],
+                    status,
+                };
+            }
+            if (disposing) {
+                await connected.client.close().catch(() => undefined);
+                return declined("refused", "this materialization was disposed while the re-dial was in flight — the new connection was closed");
+            }
+            const raised = commitConnectedServer(spec, connected, dialKind);
+            reconcileInstructions(server, priorInstructions, connected.instructions, true);
+            const newNames = connected.tools.map((t) => t.name);
+            return {
+                server,
+                prefix,
+                outcome: "reconnected",
+                toolCount: newNames.length,
+                added: newNames.filter((n) => !priorNames.includes(n)),
+                removed: priorNames.filter((n) => !newNames.includes(n)),
+                tools: connected.tools,
+                axes: connected.axes,
+                dropped: connected.dropped.map((d) => ({ server: inlineUntrusted(server, 160), ...d })),
+                ...(raised.length > 0 ? { warnings: raised.map((w) => w.message) } : {}),
+                status: connected.status,
+                ...(connected.listingIncomplete !== undefined ? { listingIncomplete: connected.listingIncomplete } : {}),
+            };
+        }
+        finally {
+            redialsInFlight.delete(server);
+        }
+    };
     return {
         tools,
         toolAxes,
@@ -779,8 +909,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
         droppedTools,
         statuses,
         refresh: async (server) => {
-            const prefixOf = (name) => mintNamespacePrefix(MCP_NAMESPACE, name);
-            const targets = server !== undefined ? serverHandles.filter((h) => h.name === server) : serverHandles;
+            const targets = server !== undefined ? serverHandles.filter((h) => h.name === server) : [...serverHandles];
             const results = [];
             if (server !== undefined && targets.length === 0) {
                 return [{ server, prefix: prefixOf(server), status: "not_connected", toolCount: 0, added: [], removed: [] }];
@@ -834,8 +963,25 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
                     });
                 }
             }
+            for (let i = 0; i < results.length; i++) {
+                const entry = results[i];
+                if (entry.status !== "refreshed")
+                    continue;
+                if (serverHandles.find((h) => h.name === entry.server)?.tools === entry.tools)
+                    continue;
+                results[i] = {
+                    server: entry.server,
+                    prefix: entry.prefix,
+                    status: "failed",
+                    toolCount: 0,
+                    added: [],
+                    removed: [],
+                    error: "this server was re-dialed while the refresh was reading another server — the listing is from the connection that re-dial replaced, so it was discarded",
+                };
+            }
             return results;
         },
+        reconnect: redialOnce,
         dispose: async () => {
             disposing = true;
             await Promise.allSettled(clients.map((c) => c.close()));
@@ -1063,13 +1209,13 @@ function renderDirChildren(server, uri, children, flags) {
     };
 }
 function buildResourceTools(resourceServers, isServerRevoked = () => false) {
-    const listable = resourceServers.filter((rs) => rs.listAllowed);
-    const readable = resourceServers.filter((rs) => rs.readAllowed);
-    if (listable.length === 0 && readable.length === 0)
+    const listable = () => resourceServers.filter((rs) => rs.listAllowed);
+    const readable = () => resourceServers.filter((rs) => rs.readAllowed);
+    if (listable().length === 0 && readable().length === 0)
         return { tools: [], axes: [] };
     const tools = [];
     const axes = [];
-    if (listable.length > 0) {
+    if (listable().length > 0) {
         tools.push({
             name: LIST_MCP_RESOURCES,
             description: "List the resources available from connected MCP servers (uri / name / description). Pass `server` to limit " +
@@ -1082,9 +1228,10 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
             },
             execute: async (_id, params, signal) => {
                 const { server } = (params ?? {});
-                const targets = server ? listable.filter((rs) => rs.server === server) : listable;
+                const live = listable();
+                const targets = server ? live.filter((rs) => rs.server === server) : live;
                 if (server && targets.length === 0) {
-                    return { content: [{ type: "text", text: `Error: no MCP server ${inlineUntrusted(server)} with listable resources. Available: ${serverNames(listable)}.` }], details: undefined, terminate: false };
+                    return { content: [{ type: "text", text: `Error: no MCP server ${inlineUntrusted(server)} with listable resources. Available: ${serverNames(live)}.` }], details: undefined, terminate: false };
                 }
                 const sections = [];
                 const all = [];
@@ -1146,7 +1293,7 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
         });
         axes.push({ name: LIST_MCP_RESOURCES, effect: "read" });
     }
-    if (readable.length > 0) {
+    if (readable().length > 0) {
         tools.push({
             name: READ_MCP_RESOURCE,
             description: "Read a specific MCP resource by `server` + `uri` (from ListMcpResourcesTool). Its content is external/untrusted data.",
@@ -1164,9 +1311,10 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                 const { server, uri } = (params ?? {});
                 if (!server || !uri)
                     return { content: [{ type: "text", text: "Error: `server` and `uri` are required." }], details: undefined, terminate: false };
-                const rs = readable.find((r) => r.server === server);
+                const live = readable();
+                const rs = live.find((r) => r.server === server);
                 if (!rs)
-                    return { content: [{ type: "text", text: `Error: no MCP server ${inlineUntrusted(server)} with readable resources. Available: ${serverNames(readable)}.` }], details: undefined, terminate: false };
+                    return { content: [{ type: "text", text: `Error: no MCP server ${inlineUntrusted(server)} with readable resources. Available: ${serverNames(live)}.` }], details: undefined, terminate: false };
                 const what = `The read of resource ${inlineUntrusted(uri)}`;
                 if (isServerRevoked(server)) {
                     return {
@@ -1203,7 +1351,7 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
         });
         axes.push({ name: READ_MCP_RESOURCE, effect: "read" });
     }
-    if (listable.length > 0) {
+    if (listable().length > 0) {
         tools.push({
             name: READ_MCP_RESOURCE_DIR,
             description: "List the MCP resources UNDER a directory `uri` on `server` — its child resources (those whose uri is " +
@@ -1223,9 +1371,10 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                 const { server, uri } = (params ?? {});
                 if (!server || !uri)
                     return { content: [{ type: "text", text: "Error: `server` and `uri` are required." }], details: undefined, terminate: false };
-                const rs = listable.find((r) => r.server === server);
+                const live = listable();
+                const rs = live.find((r) => r.server === server);
                 if (!rs)
-                    return { content: [{ type: "text", text: `Error: no MCP server ${inlineUntrusted(server)} with listable resources. Available: ${serverNames(listable)}.` }], details: undefined, terminate: false };
+                    return { content: [{ type: "text", text: `Error: no MCP server ${inlineUntrusted(server)} with listable resources. Available: ${serverNames(live)}.` }], details: undefined, terminate: false };
                 const what = `The directory listing of ${inlineUntrusted(uri)}`;
                 if (isServerRevoked(server)) {
                     return {

package/dist/core/memory-engine/consolidation.d.ts

@@ -302,11 +302,16 @@ export type ConsolidationGateRead = {
  * ONE source for "is a run owed", so the edge can never sit disarmed while the trigger believes nothing is owed.
  */
 export declare function recommendationUnconsumed(row: Pick<ConsolidationGateRow, "lastRecommendedAt" | "lastRunAt">): boolean;
+/** §2.2 — the ONE reading of "how many distinct sessions has this scope banked since its last completed run", for every gate comparing it against `minSessionsBetweenRuns` and every sentence reporting it. The stored `count` includes the most recent harvest's session, and that one is never material to a decision taken on its own behalf: this bookkeeping also runs on the suspend path, so it may still be running, and at a terminal harvest its notes are the ones just written. Banked is one less than stored; an absent row banks nothing.
+ *  Never re-derived — two gates comparing two numbers is how a run is admitted for a crossing that was never minted, and how a refusal reports a figure the recommendation notice contradicts. */
+export declare function sessionsSinceExcludingCurrent(row: Pick<ConsolidationGateRow, "sessions"> | undefined): number;
 /**
  * §2.2 — the engine-minted session count (harvest-tail bookkeeping; ≤1 row write per terminal
  * harvest; the OFF mode never calls this — D-9a zero-write). Returns the recommendation edge:
  * `recommended` is true exactly ONCE per threshold crossing (once-per-越线沿; a completed run
  * resets the edge).
+ *
+ * The ring records the calling session (dedup), so `count` INCLUDES the caller; the gate here and the number beside it are {@link sessionsSinceExcludingCurrent}, which takes it back out.
  */
 export declare function recordConsolidationSession(controlDir: string, scope: string, sessionId: string, opts: ScreenedConsolidationOptions, now: () => number): {
     recommended: boolean;

package/dist/core/memory-engine/consolidation.js

@@ -150,19 +150,23 @@ export function consolidationGateFileExists(controlDir) {
 export function recommendationUnconsumed(row) {
     return row.lastRecommendedAt !== undefined && (row.lastRunAt === undefined || row.lastRecommendedAt > row.lastRunAt);
 }
+export function sessionsSinceExcludingCurrent(row) {
+    return Math.max(0, (row?.sessions.count ?? 0) - 1);
+}
 export function recordConsolidationSession(controlDir, scope, sessionId, opts, now) {
     return updateConsolidationGate(controlDir, (file) => {
         const row = file.scopes[scope] ?? freshRow();
         if (row.sessions.ring.includes(sessionId)) {
-            return { result: { recommended: false, sessionsSince: row.sessions.count } };
+            return { result: { recommended: false, sessionsSince: sessionsSinceExcludingCurrent(row) } };
         }
         row.sessions.count += 1;
         row.sessions.ring.push(sessionId);
         if (row.sessions.ring.length > CONSOLIDATION_SESSION_RING_MAX)
             row.sessions.ring.splice(0, row.sessions.ring.length - CONSOLIDATION_SESSION_RING_MAX);
         const at = now();
+        const banked = sessionsSinceExcludingCurrent(row);
         const timeOpen = row.lastRunAt === undefined || at - row.lastRunAt >= opts.minRunIntervalMs;
-        const sessionsOpen = row.sessions.count >= opts.minSessionsBetweenRuns;
+        const sessionsOpen = banked >= opts.minSessionsBetweenRuns;
         const edgeArmed = !recommendationUnconsumed(row);
         let recommended = false;
         if (timeOpen && sessionsOpen && edgeArmed) {
@@ -170,7 +174,7 @@ export function recordConsolidationSession(controlDir, scope, sessionId, opts, n
             row.lastRecommendedAt = at;
         }
         file.scopes[scope] = row;
-        return { next: file, result: { recommended, sessionsSince: row.sessions.count } };
+        return { next: file, result: { recommended, sessionsSince: banked } };
     });
 }
 export function recordActiveSetBaseline(controlDir, scope, size, ratioCap, _now) {