@sema-agent/core 7.21.1 → 7.22.0

package/dist/core/runner/run-settle-and-teardown.js

@@ -9,7 +9,7 @@ import { hasDestroy, isIsolated } from "../remote-env.js";
 import { resolveTaskModel } from "../roles.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { emitTrace } from "../trace.js";
-import { deliverEngineNotice } from "../types.js";
+import { deliverEngineNotice, settleOwedUserInput } from "../types.js";
 import { assembleResult } from "./assemble-result.js";
 import { discloseUnconsumedHalt } from "./halt-attribution.js";
 import { forwardSafely } from "./forward-sink.js";
@@ -21,7 +21,7 @@ import { settleTeardownLeg } from "./teardown-bounded.js";
 import { autoRunConsolidationFromRecommendation, autoRunOnRecommendationEffective, scopeHasUnconsumedRecommendation } from "./memory-consolidation-driver.js";
 import { amendTerminal, terminalProjection } from "./terminal-projection.js";
 export async function runSettleAndTeardown(input) {
-    const { spec, queue, prepared, resume, internals, rs, stats, ident, parentToolCallId, subagentName, loopLatch, timeout, ownCommittedTailRef, emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp, setResult, onSuggestions, onSuspend, runner, sessions } = input;
+    const { spec, queue, prepared, resume, internals, rs, stats, ident, parentToolCallId, subagentName, loopLatch, timeout, ownCommittedTailRef, emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp, owedUserInput, setResult, onSuggestions, onSuspend, runner, sessions } = input;
     try {
         if (comp?.compacted) {
             queue.push({
@@ -141,6 +141,7 @@ export async function runSettleAndTeardown(input) {
             });
         }
         discloseUnconsumedHalt({ accepted: loopLatch.userHalted, consumption: prepared.harness.haltConsumption(), onNotice: runner.deps.onNotice, sessionId: prepared.sessionId, runId: rs.telemetry.runId, taskId: spec.taskId });
+        let rowReturned = false;
         if (resume !== undefined &&
             resume.pendingActionStarted !== true &&
             result.terminal.kind !== "completed" &&
@@ -149,12 +150,14 @@ export async function runSettleAndTeardown(input) {
             resume.onEnvRestoreFailed !== undefined) {
             try {
                 await resume.onEnvRestoreFailed("env_failed");
+                rowReturned = true;
                 amendTerminal(result, "resume.reopened_unstarted", (m) => `${m ?? "the resume leg did not complete"} — the approved action never started, so the checkpoint was REOPENED (pending): the same approval can be resumed again, do not ask for a fresh one`);
             }
             catch {
                 amendTerminal(result, "resume.reopen_failed_unstarted", (m) => `${m ?? "the resume leg did not complete"} — the approved action never started, and reopening the checkpoint FAILED: its state is unprovable from here. Re-read it before deciding; do NOT issue a fresh approval on the assumption the old one is dead`);
             }
         }
+        settleOwedUserInput(owedUserInput, rowReturned, { taskId: spec.taskId ?? prepared.sessionId, sessionId: prepared.sessionId, runId: prepared.runId }, runner.deps.onNotice);
         prepared.sealReadStateSeat?.(ownCommittedTailRef.current);
         {
             const wss = prepared.workspaceStateSettle;
@@ -299,6 +302,7 @@ export async function runSettleAndTeardown(input) {
         }
     }
     finally {
+        settleOwedUserInput(owedUserInput, !prepared.suspendProgressRef.executedApproved, { taskId: spec.taskId ?? prepared.sessionId, sessionId: prepared.sessionId, runId: prepared.runId }, runner.deps.onNotice);
         const ownedEnvDying = prepared.ownedEnv !== undefined &&
             hasDestroy(prepared.ownedEnv) &&
             isIsolated(prepared.ownedEnv) &&

package/dist/core/runner/run-terminal-adoption.d.ts

@@ -19,7 +19,7 @@ import type { Model } from "../../internal/llm.js";
 import { type MaybeCompactOptions } from "../auto-compaction.js";
 import type { SessionStore } from "../session.js";
 import type { PushQueue } from "../push-queue.js";
-import { type Brain, type TaskEvent, type TaskSpec } from "../types.js";
+import type { Brain, OwedUserInputAccount, TaskEvent, TaskSpec } from "../types.js";
 import { type Stats } from "./assemble-result.js";
 import type { EndOfTaskCompaction, Prepared, RunnerDepsSeat, RunState } from "./contracts.js";
 export interface RunTerminalAdoptionInput<R> {
@@ -95,5 +95,8 @@ export interface RunTerminalAdoptionResult {
     /** This lane's ONE evaluation of {@link answerSettled}: a clean `"stop"` final with no queued continuation lost. The
      *  settle lane hands it to the arbitration (`ResultFlags.answerSettled`), the teardown attribution and the notice. */
     answerSettled: boolean;
+    /** The undrained-input account, UNSETTLED: this lane knows every fact but one — whether this leg's consumed
+     *  checkpoint row comes back — and that one is the next lane's compensation to perform, not to predict. */
+    owedUserInput: OwedUserInputAccount;
 }
 export declare function runTerminalAdoption<R>(input: RunTerminalAdoptionInput<R>): Promise<R>;

package/dist/core/runner/run-terminal-adoption.js

@@ -3,7 +3,6 @@ import { DEFAULT_COMPACTION_SETTINGS } from "../../internal/harness.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
 import { appendInterruptionMarker, reconcileInterruptedSession } from "../session-reconcile.js";
 import { emitTrace } from "../trace.js";
-import { deliverEngineNotice, owedUserInputCounts, undrainedUserInputNotices } from "../types.js";
 import { answerSettled, errorCodeOf } from "./assemble-result.js";
 import { awaitChargeWithSlowDisclosure, discloseUnevaluableWindow } from "./clock-and-limits.js";
 import { buildWorkingFileAttachments, centerAdoptionOption, contextInstructionFilesOption, emitInputTruncated, forkContextOption } from "./compaction-call-options.js";
@@ -109,10 +108,7 @@ export async function runTerminalAdoption(input) {
         }
         migratedParked = prepared.harness.dropParkedUserInputs(carried);
     }
-    const owed = owedUserInputCounts(undrainedUserAtEnd.current, migratedParked, { frames: prepared.undeliveredContinuationRef.current.parkedSteers, carried: carriedContinuation, rowMayReturn: committedPause === undefined && !prepared.suspendProgressRef.executedApproved });
-    for (const notice of undrainedUserInputNotices(owed, spec.taskId ?? prepared.sessionId, prepared.sessionId, prepared.runId)) {
-        deliverEngineNotice(runner.deps.onNotice, notice);
-    }
+    const owedUserInput = { held: undrainedUserAtEnd.current, migrated: migratedParked, continuation: { frames: prepared.undeliveredContinuationRef.current.parkedSteers, carried: carriedContinuation } };
     if (rs.attach.attachState?.postCompactPending === true && (rs.attach.attachmentsCfg?.backgroundTasks ?? eventDefaultOn("background_tasks")) === true) {
         emitTrace(rs.telemetry.tracer, () => ({ kind: "compaction.announce_dropped", version: 1, taskId: rs.telemetry.taskId, ts: Date.now() }));
     }
@@ -125,7 +121,7 @@ export async function runTerminalAdoption(input) {
         onCompactionFailed: (reason) => queue.push({ type: "compaction_outcome", outcome: "failed", trigger: "auto", reason, ...ident() }),
         cancelled: abortedLive,
     }, runner, sessions);
-    return await next({ threw, comp, answerSettled: settled });
+    return await next({ threw, comp, answerSettled: settled, owedUserInput });
 }
 async function finish(spec, prepared, opts, runner, sessions) {
     let comp;

package/dist/core/runner/runtask.js

@@ -296,6 +296,7 @@ export class Runner {
         const acceptedSteerInputs = new Map();
         const notifyRef = {};
         const captureOptOutRef = {};
+        const mcpRedialRef = {};
         const manualCompactRef = { requested: false, waiters: [] };
         const drainManualCompactWaiters = (outcome) => {
             manualCompactRef.requested = false;
@@ -348,6 +349,7 @@ export class Runner {
                     internals: { ...(internals ?? {}), detachHub, forwardScope: createForwardSinkScope(this.deps.onNotice) },
                     notifyRef,
                     captureOptOutRef,
+                    mcpRedialRef,
                     entryActor,
                     entryTracer,
                 });
@@ -383,7 +385,7 @@ export class Runner {
             locallyClaimedTokens: this.locallyClaimedTokens, parentConstraintRegistry: this.parentConstraintRegistry, suspendedEnvReaps: this.suspendedEnvReaps,
         });
         const { steer } = streamSteerVerb({ spec, internals, queue, acceptedSteerInputs, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, steeringError, runner: this.depsSeat });
-        const { notify, optOutMemoryCapture, compact, detach, interrupt } = streamLifecycleVerbs({ live, ready, orTimeout, steeringError, notifyRef, captureOptOutRef, manualCompactRef, detachHub });
+        const { notify, optOutMemoryCapture, reconnectMcpServer, compact, detach, interrupt } = streamLifecycleVerbs({ live, ready, orTimeout, steeringError, notifyRef, captureOptOutRef, mcpRedialRef, manualCompactRef, detachHub });
         const { halt, destroy } = streamHaltVerbs({ spec, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, run, reapSuspended, runner: this.depsSeat });
         return {
             [Symbol.asyncIterator]: () => queue[Symbol.asyncIterator](),
@@ -398,6 +400,7 @@ export class Runner {
             steer,
             notify,
             optOutMemoryCapture,
+            reconnectMcpServer,
             compact,
             detach,
             interrupt,
@@ -406,14 +409,14 @@ export class Runner {
         };
     }
     runLocked(input) {
-        const { spec, queue, setResult, onSuggestions, onReady, onSuspend, manualCompactRef, taskIdRef, resume, internals, notifyRef, captureOptOutRef, entryActor, entryTracer } = input;
+        const { spec, queue, setResult, onSuggestions, onReady, onSuspend, manualCompactRef, taskIdRef, resume, internals, notifyRef, captureOptOutRef, mcpRedialRef, entryActor, entryTracer } = input;
         return runNotificationLane({
             spec, queue, resume, internals, taskIdRef,
             runner: this.depsSeat, self: this, sessions: this.sessions, sessionReadStates: this.sessionReadStates, pendingSessionNotifications: this.pendingSessionNotifications,
             prepareTask,
             next: ({ prepared, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef, modelCatalog, notificationLane, unsubscribeTaskNotifications }) => {
                 const { runSourceTaskId, parentToolCallId, ident, emitDelegationLifecycle, loopLatch, stats, undrainedUserAtEnd, userInputLostAtEnd } = runIdentityWiring({
-                    spec, queue, prepared, internals, taskIdRef, onReady, manualCompactRef, notifyRef, captureOptOutRef, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef,
+                    spec, queue, prepared, internals, taskIdRef, onReady, manualCompactRef, notifyRef, captureOptOutRef, mcpRedialRef, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef,
                     notificationLane, pendingSessionNotifications: this.pendingSessionNotifications, runner: this.depsSeat,
                 });
                 const rs = createRunState();
@@ -472,9 +475,9 @@ export class Runner {
                             next: ({ final, threw, abortedLive, userInterruptedLive, strandedHumanAnswers }) => runTerminalAdoption({
                                 spec, queue, prepared, rs, stats, ident, emitCommitted, startedToolCallIds, toolLabels, timeout, compactionBrain, compactionBreaker, windowSafetyOptions,
                                 undrainedUserAtEnd, userInputLostAtEnd, final, threw, abortedLive, userInterruptedLive, runner: this.depsSeat, sessions: this.sessions,
-                                next: ({ threw, comp, answerSettled }) => runSettleAndTeardown({
+                                next: ({ threw, comp, answerSettled, owedUserInput }) => runSettleAndTeardown({
                                     spec, queue, prepared, resume, internals, rs, stats, ident, parentToolCallId, subagentName, loopLatch, timeout, ownCommittedTailRef,
-                                    emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp,
+                                    emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp, owedUserInput,
                                     setResult, onSuggestions, onSuspend, runner: this.depsSeat, sessions: this.sessions,
                                 }),
                             }),

package/dist/core/runner/stream-lifecycle-verbs.d.ts

@@ -1,6 +1,6 @@
 import type { ToolDetachHub } from "../tool-detach.js";
 import type { TaskStream } from "../types.js";
-import type { CaptureOptOutRef, LiveHandle, ManualCompactRef, NotifyRef, TaskStreamLiveSeat } from "./contracts.js";
+import type { CaptureOptOutRef, LiveHandle, ManualCompactRef, McpRedialRef, NotifyRef, TaskStreamLiveSeat } from "./contracts.js";
 export interface StreamLifecycleVerbsInput {
     /** borrowed-readonly — the stream's live state: `resultValue` (the finished-task refusals) and `handle`, read at each call. */
     live: TaskStreamLiveSeat;
@@ -14,6 +14,8 @@ export interface StreamLifecycleVerbsInput {
     notifyRef: NotifyRef;
     /** borrowed-readonly — the capture opt-out bridge; `flip` is bound by the run body when a memory session mounted. */
     captureOptOutRef: CaptureOptOutRef;
+    /** borrowed-readonly — the MCP re-dial bridge; `redial` is bound by the run body when the leg declared MCP servers. */
+    mcpRedialRef: McpRedialRef;
     /** borrowed-mutable — the manual-compaction request seat: the compact verb arms it and parks its waiter here. */
     manualCompactRef: ManualCompactRef;
     /** borrowed-readonly — the run-local detach hub the detach verb requests through. */
@@ -24,6 +26,8 @@ export interface StreamLifecycleVerbsResult {
     notify: TaskStream["notify"];
     /** The stream's `optOutMemoryCapture` verb. */
     optOutMemoryCapture: TaskStream["optOutMemoryCapture"];
+    /** The stream's `reconnectMcpServer` verb. */
+    reconnectMcpServer: TaskStream["reconnectMcpServer"];
     /** The stream's `compact` verb. */
     compact: TaskStream["compact"];
     /** The stream's `detach` verb. */

package/dist/core/runner/stream-lifecycle-verbs.js

@@ -1,6 +1,6 @@
 import { isSystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
 export function streamLifecycleVerbs(input) {
-    const { live, ready, orTimeout, steeringError, notifyRef, captureOptOutRef, manualCompactRef, detachHub } = input;
+    const { live, ready, orTimeout, steeringError, notifyRef, captureOptOutRef, mcpRedialRef, manualCompactRef, detachHub } = input;
     const notify = async (input, opts) => {
         const notifyError = (msg, code) => {
             const e = new Error(`cannot notify: ${msg}`);
@@ -69,6 +69,27 @@ export function streamLifecycleVerbs(input) {
         }
         return captureOptOutRef.flip(reason);
     };
+    const reconnectMcpServer = async (server) => {
+        const serverIn = server;
+        if (typeof serverIn !== "string" || serverIn.length === 0) {
+            const e = new Error(`cannot reconnect an MCP server: \`server\` must be a non-empty server name`);
+            e.code = "steering.invalid_content";
+            throw e;
+        }
+        if (live.resultValue)
+            throw steeringError("the task has already finished");
+        const h = live.handle ?? (await orTimeout(ready));
+        if (!h)
+            throw steeringError("the task is not running");
+        if (live.resultValue !== undefined || h.loop.ended)
+            throw steeringError("the task is no longer running");
+        if (mcpRedialRef.redial === undefined) {
+            const e = new Error(`cannot reconnect an MCP server: this run declared no MCP servers — there is nothing to re-dial`);
+            e.code = "mcp.reconnect_unavailable";
+            throw e;
+        }
+        return mcpRedialRef.redial(serverIn);
+    };
     const compact = async (opts) => {
         if (live.resultValue)
             throw steeringError("the task has already finished");
@@ -131,5 +152,5 @@ export function streamLifecycleVerbs(input) {
         h.abortController.abort();
         void h.harness.abort();
     };
-    return { notify, optOutMemoryCapture, compact, detach, interrupt };
+    return { notify, optOutMemoryCapture, reconnectMcpServer, compact, detach, interrupt };
 }

package/dist/core/runner-deps.d.ts

@@ -179,20 +179,21 @@ export interface RunnerDeps {
     /**
      * design/199 件B — DEPLOYMENT-layer ADDITIONS to the built-in sensitive-path READ deny set
      * ({@link import("../tools/fs/read-deny.js").READ_FACE_DEFAULT_DENY_ENTRIES}); see
-     * {@link TaskSpec.readDenyPatterns} for the judged surfaces. Add-only on THIS seat: unions with
-     * the active built-ins and any task-layer additions, and `[]` ≡ absent — narrowing the built-in
+     * {@link TaskSpec.readDenyPatterns} for the judged surfaces. INDEPENDENT of the built-in switch. Add-only on
+     * THIS seat: unions with the active built-ins and any task-layer additions, and `[]` ≡ absent — narrowing the built-in
      * set is the sibling knobs' job ({@link readDenyBuiltinTiers} / {@link readDenyBuiltinExclude},
      * #245 revision of D-4), not a replacement escape hatch here. Bad entry shapes refuse loudly at
      * prepare (#123).
      */
     readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
     /**
-     * The deployment's built-in deny-table TIER selection:
-     * EXACTLY the listed tiers of
+     * The deployment's built-in deny-table TIER selection — the ON/OFF switch for the whole built-in
+     * table, OFF unless this seat says otherwise. EXACTLY the listed tiers of
      * {@link import("../tools/fs/read-deny.js").READ_FACE_BUILTIN_DENY_TABLE} are active (`[]` = none —
-     * explicit and legal); absent = the default selection
-     * ({@link import("../tools/fs/read-deny.js").READ_DENY_DEFAULT_TIERS}: every tier except
-     * `shell-history`, which is unrestricted by default). Composes with
+     * explicit and legal); ABSENT = {@link import("../tools/fs/read-deny.js").READ_DENY_DEFAULT_TIERS},
+     * which is EMPTY: an unconfigured deployment activates no built-in row, so nothing from that table
+     * refuses a read or demotes a shell one. A leg's active tiers are REPORTED on its wiring manifest
+     * ({@link import("./wiring-manifest.js").WiringManifest.readDeny}). Composes with
      * {@link readDenyBuiltinExclude} (tiers first, then row removal); never touches the additions
      * seats or the write faces. Unknown tier names refuse loudly at prepare (#123). DEPLOYMENT seat
      * ONLY: deliberately not a TaskSpec key and not in the governed workflow whitelist — a task or
@@ -324,6 +325,14 @@ export interface RunnerDeps {
     memoryCaptureRecordStore?: (plane: {
         controlDir: string;
     }) => import("./memory-engine/layout.js").SessionCaptureRecordStore;
+    /** which occupant of a session id is running now (a purge may delete a session tree and the
+     *  id be handed out again; without this seat a standing opt-out or pollution record binds the NEXT
+     *  occupant too). An opaque token, STABLE for one occupant's life, DIFFERENT for the next, only
+     *  ever compared ({@link import("./memory-engine/layout.js").sessionRecordBindsIncarnation}).
+     *  ABSENT ⇒ records bind by id (the pre-incarnation bytes); an empty or throwing answer reads the same. */
+    memorySessionIncarnation?: (session: {
+        sessionId: string;
+    }) => string | undefined;
     /**
      * design/339 §6.1 — the v3 memory-consolidation switch, threaded verbatim to the engine seat
      * ({@link import("../core/memory-engine/engine.js").MemoryEngineOptions.consolidation} — same

package/dist/core/skill-listing-budget.d.ts

@@ -65,10 +65,11 @@ export interface ResolvedSkillListingBudget {
  * (`200 000 × 4 × 0.01` = 8 000 bytes).
  *
  * The window is `contextTokens ?? contextWindow`, the same physical coordinate the deferral gate
- * measures against. A window that is absent OR unusable (non-finite, non-positive) reads as
- * {@link SKILL_LISTING_DEFAULT_CONTEXT_TOKENS}: one rule, not a case per bad shape — a model's own
- * declaration is judged by the model doors, and this seat must still produce a number a renderer can
- * compare against.
+ * measures against. `contextTokens: 0` (or any other non-finite/non-positive declared value) does
+ * NOT fall through `??` to `contextWindow` — `0` is not nullish — so it lands here as a
+ * declared-but-unusable window, and this seat folds it to {@link SKILL_LISTING_DEFAULT_CONTEXT_TOKENS}
+ * the same as a genuinely absent window: one rule, not a case per bad shape, because this seat's
+ * job is to always hand a renderer a usable number.
  */
 export declare function resolveSkillListingBudget(opts: {
     fraction?: unknown;

package/dist/core/task-result.d.ts

@@ -562,8 +562,9 @@ export interface TaskResult {
      * duplicates, so re-supplying deployment-shared entries is idempotent) — that is how the frozen
      * posture rides every leg that continues this work, not just the delegation subtree.
      *
-     * **In-presence condition:** present iff non-empty. Built-in entries are never listed (they are in
-     * force on every run and re-compile locally). Same terminal coverage as
+     * **In-presence condition:** present iff non-empty. Built-in entries are never listed — they are the
+     * DEPLOYMENT's own selection (off by default), re-compiled per leg and reported on its wiring
+     * manifest ({@link import("./wiring-manifest.js").WiringManifest.readDeny}). Same terminal coverage as
      * {@link effectiveReadFace}: rides any terminal of a leg that ran; absent on prepare failures.
      *
      * On a DURABLE-PAUSE hand-back these seats are additionally the RE-SUPPLY hint: a checkpoint

package/dist/core/task-spec.d.ts

@@ -789,7 +789,8 @@ export interface TaskSpec {
      * {@link RunnerDeps.readDenyPatterns}; `[]` ≡ absent (union identity); NOTHING at the task layer
      * can remove a built-in — the one removal channel is the DEPLOYMENT's built-in configuration
      * ({@link RunnerDeps.readDenyBuiltinTiers} / {@link RunnerDeps.readDenyBuiltinExclude}, #245
-     * revision of D-4), which no TaskSpec key reaches. Bad entry shapes refuse loudly at prepare
+     * revision of D-4), which no TaskSpec key reaches — and that half is OFF by default, so on an
+     * unconfigured deployment the entries here are the WHOLE judged set. Bad entry shapes refuse loudly at prepare
      * (#123). The write faces are untouched.
      */
     readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];

package/dist/core/task-stream.d.ts

@@ -275,6 +275,32 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
     }): Promise<{
         outcome: "created" | "existed";
     }>;
+    /**
+     * **RE-DIAL one MCP server** on the running task, the action `RefreshMcpTools` deliberately
+     * is not (its contract is "never dials or re-dials"). Core holds no MCP connection across task
+     * legs, so once a server's transport closes this leg is stuck with it: every one of its tools fails
+     * fast and a refresh can only keep reporting `not_connected`. This is the verb a host hangs a
+     * "Reconnect" control on. ONE NAMED SERVER, required — CC 2.1.259's control-channel request carries
+     * a required `serverName` and has no all-servers form, and an all-servers form would CLOSE HEALTHY
+     * connections to re-dial them (the stdio server owning a device or a port — the case this verb
+     * exists for — is the one that cannot be re-dialed while its predecessor still holds the device).
+     *
+     * ⚠️ **A FAILED RE-DIAL LEAVES THE SERVER DOWN.** The old connection is closed BEFORE the new one is
+     * dialed (no other order works for a device-owning server), so a dial that fails has spent a
+     * working connection: the server stays disconnected, with its tools WITHDRAWN from the roster,
+     * until another re-dial or the next leg's materialize — and calls in flight on the replaced
+     * connection fail with it. Both are inherent to re-dialing; CC behaves the same way.
+     *
+     * Resolves {@link import("./mcp.js").McpReconnectResult} — `outcome` is one of three words, so a
+     * consumer mapping it onto a three-state control answer needs no table: `reconnected` (the only
+     * success), `refused` (the engine declined, or the dial failed — `reason` says which and
+     * `status.errorCode` keys the next action), `not_declared` (no server of that name on this leg).
+     * Throws, never silently no-ops: `mcp.reconnect_unavailable` when this run declared NO MCP servers
+     * (a host maps that to "unsupported", not "refused"), `steering.invalid_content` on a missing or
+     * non-string name, and the steer-family `steering.not_running` once the task has finished.
+     * LEG-LOCAL: the result rides no checkpoint, and a durable resume takes a fresh first listing.
+     */
+    reconnectMcpServer(server: string): Promise<import("./mcp.js").McpReconnectResult>;
     /**
      * Hard-**interrupt** the running task — a real abort (not a best-effort hint), equivalent to firing the
      * task's `signal` (design/47). Refused typed (`steering.not_running`, the steer-family liveness code —

package/dist/core/tool-spec.d.ts

@@ -95,8 +95,12 @@ export interface ReversibilityVerdict {
  * spelled, which is the only one derivable from the text.
  */
 export interface ReadRootGrantCandidate {
-    /** An absolute, lexically folded directory in the boundary's own spelling; never a file or a pattern. */
+    /** An absolute, lexically folded path in the boundary's own spelling; never a pattern. A DIRECTORY
+     *  unless {@link covers} says otherwise. */
     readonly dir: string;
+    /** `"exact"` ⇒ {@link dir} is the path the command NAMED, offered verbatim rather than a directory
+     *  containing it. A consumer ADDS the string itself: expanding it into a pattern grants nothing. */
+    readonly covers?: "exact";
     /** Always the literal `true` — a shape, not a value, so the seat cannot be widened into a "maybe this
      *  helps" hint without a visible type change. It claims THIS ask: not the deny layer (judged by pattern
      *  rather than by root, and unmoved by any grant), and not another ask the same call may raise. */

package/dist/core/trace.d.ts

@@ -548,6 +548,11 @@ export type TraceEvent = {
     verdict: "allow" | "block" | "unavailable" | "parse_error";
     /** Present iff `verdict === "unavailable"`: `error` / `timeout`. */
     cause?: "error" | "timeout";
+    /** Present exactly when NO MODEL WAS ASKED because the question did not assemble: `timeout` = the
+     *  assembly outran its cap, `failed` = it threw. The verdict reads `unavailable` / `error` either way
+     *  (nothing was dispatched), and `ms` is then time spent BUILDING, not waiting on a provider — which is
+     *  what separates "the transcript store is slow" from "the provider is down". */
+    notAsked?: "failed" | "timeout";
     ts: number;
 } | {
     /** C1 — the failover brain served this call from a FALLBACK entry (`createFailoverBrain`): the

package/dist/core/types.d.ts

@@ -27,6 +27,6 @@ export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js"
 export type { BackgroundChildEvent, DelegationLifecycleEvent } from "./delegation-frames.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
 export type { ProjectMemoryLoad, ResumePreflightInfo, ResumePreflightVerdict, RunnerDeps } from "./runner-deps.js";
-export type { EngineNotice } from "./engine-notice.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, undrainedUserInputNotices } from "./engine-notice.js";
+export type { EngineNotice, OwedUserInputAccount } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, settleOwedUserInput, undrainedUserInputNotices } from "./engine-notice.js";
 export type { AgentTool, Model, StreamFn, ThinkingLevel, ToolInputValidationContext, ToolInputVerdict };

package/dist/core/types.js

@@ -1,3 +1,3 @@
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, undrainedUserInputNotices } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, settleOwedUserInput, undrainedUserInputNotices } from "./engine-notice.js";

package/dist/core/wiring-manifest.d.ts

@@ -347,6 +347,26 @@ export interface WiringManifest {
     writeProtection?: {
         targetView: WriteProtectionTargetView;
     };
+    /**
+     * EFFECTIVE half only; the present-iff law is the contract sentence below. `builtinTiers` names the
+     * tiers that MATERIALLY activate rows, in {@link
+     * import("../tools/fs/read-deny.js").READ_DENY_BUILTIN_TIERS} order — not the tiers the operator
+     * typed: one whose every row `readDenyBuiltinExclude` removed is not named. Deliberately NOT
+     * reported: `readDenyPatterns`, deployment-supplied TEXTS rather than an enum, so absence means "no
+     * BUILT-IN row judges", never "no read is deny-judged". IN the fingerprint (the
+     * {@link WiringManifest.writeProtection} class): the selection follows the deployment seat, so legs
+     * of one assembly agree.
+     *
+     * @contract read_deny.builtin_activation_disclosed — WHETHER the built-in sensitive-path read deny
+     * table judges a leg is DISCLOSED, never inferred: the table is a deployment opt-in whose default
+     * selection is empty, the leg that compiles the judge relays the tiers its own resolution materially
+     * activated, and the manifest carries that section iff at least one built-in row is active (absence
+     * = no built-in row judges; an empty array is never emitted — "off" and "on to nothing" are one
+     * fact). The disclosure changes no verdict.
+     */
+    readDeny?: {
+        builtinTiers: readonly string[];
+    };
     /**
      * EFFECTIVE half only. PRESENT IFF auto-consolidation is EFFECTIVELY armed on this
      * deployment (`autoRunOnRecommendationEffective`: an explicit `true`, or an absent seat under the
@@ -441,6 +461,9 @@ export interface WiringFacts {
     /** Effective half only — the compiled write-protection judge's OWN target-view word
      *  ({@link WiringManifest.writeProtection}); absent ⇒ this leg compiled no judge (an emptied table). */
     writeProtectionTargetView?: WriteProtectionTargetView;
+    /** Effective half only — the built-in read-deny TIERS this leg's configuration materially activated
+     *  ({@link WiringManifest.readDeny}); empty and absent derive the same thing (no section). */
+    readDenyBuiltinTiersActive?: readonly string[];
     /** Effective half only — `RunnerDeps.autoRunOnRecommendation === true`
      *  ({@link WiringManifest.autoConsolidation}); false ⇒ no section (byte-identical manifest). */
     autoConsolidationOnRecommendation?: boolean;

package/dist/core/wiring-manifest.js

@@ -142,6 +142,9 @@ export function deriveWiringManifest(facts) {
         ...(facts.half === "effective" && facts.hooks !== undefined && facts.hooks.length > 0 ? { hooks: facts.hooks.map((h) => ({ ...h })) } : {}),
         ...(facts.half === "effective" && facts.lsp !== undefined ? { lsp: { ...facts.lsp } } : {}),
         ...(facts.half === "effective" && facts.writeProtectionTargetView !== undefined ? { writeProtection: { targetView: facts.writeProtectionTargetView } } : {}),
+        ...(facts.half === "effective" && facts.readDenyBuiltinTiersActive !== undefined && facts.readDenyBuiltinTiersActive.length > 0
+            ? { readDeny: { builtinTiers: [...facts.readDenyBuiltinTiersActive] } }
+            : {}),
         ...(facts.half === "effective" && facts.autoConsolidationOnRecommendation === true ? { autoConsolidation: { onRecommendation: true } } : {}),
     };
     if (facts.half === "effective") {

package/dist/index.d.ts

@@ -57,7 +57,7 @@ export { assertOracleIsolation, type GraderEnv, type OracleIsolationVerdict, typ
 export { decideAutoPromote, deriveTripwire, FROZEN_DENYLIST_FLOOR, type AutoPromoteTerminal, type AutoPromoteInputs, type PromotedRecord, type TripwireResult, } from "./core/auto-promote.js";
 export { runCascade, type CascadeRung, type CascadeConfig, type CascadeAttempt, type CascadeRunResult, type GateVerdict, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
-export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult } from "./core/mcp.js";
+export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult, type McpReconnectResult } from "./core/mcp.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, classifyMcpFailure, type McpFailure, type McpFailureKind, type McpDelivered } from "./core/mcp-failure.js";
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice, type McpInjectionDropReason, type McpInjectionDropFacts } from "./core/mcp-injection-drop.js";
 export { askUnresolvableNotice, type AskUnresolvableFacts } from "./core/ask-unresolvable-notice.js";
@@ -70,7 +70,7 @@ export { createSessionRulePolicy } from "./core/runner/session-rule-policy.js";
 export { LOCKED_KEY_REGISTRY, resolveLockedKeys, type LockedKey, type LockedConfig } from "./core/locked-config.js";
 export { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, complianceCallDenial, resolveComplianceDenies, type ComplianceCapability, type CompliancePosture, type ComplianceProfile, } from "./core/compliance.js";
 export { admitMemoryScopes, foldAdmissionFreeze, type OwnOrgAdmissionVerdict, type MemoryAdmissionInput, type MemoryAdmissionOutcome, type MemoryAdmissionVerdict, type MemoryScopeAdmission, type MemoryScopeOrigin, type MemoryScopeRequest, } from "./core/memory-admission.js";
-export { assertRetentionCapability, type ManagedRetentionCapability, type RetentionDeclaration, type RetentionDeclaring, type RetentionPolicy, type RetentionReceipt, } from "./core/retention.js";
+export { assertRetentionCapability, RETENTION_CASCADE_DOMAINS, RETENTION_CASCADE_EXEMPT, type ManagedRetentionCapability, type RetentionDeclaration, type RetentionDeclaring, type RetentionPolicy, type RetentionReceipt, } from "./core/retention.js";
 export { GOVERNANCE_CODES, governanceRetryClass, type GovernanceCode, type GovernanceRetryClass } from "./core/governance-codes.js";
 export { NOTICE_AUDIENCE, noticeAudienceOf, ENGINE_NOTICE_CODES, type EngineNoticeCode, type NoticeAudience } from "./core/governance-codes.js";
 export { TtlSessionStore, type TtlSessionStoreOptions, type EvictPolicy } from "./core/session-store.js";
@@ -225,7 +225,8 @@ export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.j
 export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelectiveBody, formatMemoryAge, resolveLinkedIds, RECALL_CAVEAT, DEFAULT_MAX_SELECTED, DEFAULT_MAX_LINKED, type MemorySelector, type MemorySelectRequest, type SelectiveRecallOptions, type SelectiveRecallResult, type LayeredRecallOptions, type LayeredRecallResult, } from "./core/memory-recall.js";
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, normalizeForExactMatch, type ConsolidationParams, type ConsolidationStats, type ConsolidationNote, type ConsolidationLLM, } from "./core/runner/memory-consolidation.js";
 export { consolidateScope, advanceCursorAfterInline, type ConsolidateScopeDeps, type ConsolidateScopeOptions, } from "./core/consolidate-scope.js";
-export { resolveMemoryConsolidationDriver, type MemoryConsolidationDriverDeps, } from "./core/runner/memory-consolidation-driver.js";
+export { resolveMemoryConsolidationDriver, autoRunOnRecommendationEffective, // the ONE arming reading (`memory.auto_consolidation.arming_has_one_resolver`) — the seat's absence is not "off"
+type MemoryConsolidationDriverDeps, } from "./core/runner/memory-consolidation-driver.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
 export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, type PromptBlock, analyzePromptCacheFriendliness, assertPromptCacheFriendly, type PromptProvider, type StablePromptContext, type PromptCacheReport, type PromptTextDeclaration, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";

package/dist/index.js

@@ -56,7 +56,7 @@ export { createSessionRulePolicy } from "./core/runner/session-rule-policy.js";
 export { LOCKED_KEY_REGISTRY, resolveLockedKeys } from "./core/locked-config.js";
 export { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, complianceCallDenial, resolveComplianceDenies, } from "./core/compliance.js";
 export { admitMemoryScopes, foldAdmissionFreeze, } from "./core/memory-admission.js";
-export { assertRetentionCapability, } from "./core/retention.js";
+export { assertRetentionCapability, RETENTION_CASCADE_DOMAINS, RETENTION_CASCADE_EXEMPT, } from "./core/retention.js";
 export { GOVERNANCE_CODES, governanceRetryClass } from "./core/governance-codes.js";
 export { NOTICE_AUDIENCE, noticeAudienceOf, ENGINE_NOTICE_CODES } from "./core/governance-codes.js";
 export { TtlSessionStore } from "./core/session-store.js";
@@ -183,7 +183,7 @@ export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.j
 export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelectiveBody, formatMemoryAge, resolveLinkedIds, RECALL_CAVEAT, DEFAULT_MAX_SELECTED, DEFAULT_MAX_LINKED, } from "./core/memory-recall.js";
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, normalizeForExactMatch, } from "./core/runner/memory-consolidation.js";
 export { consolidateScope, advanceCursorAfterInline, } from "./core/consolidate-scope.js";
-export { resolveMemoryConsolidationDriver, } from "./core/runner/memory-consolidation-driver.js";
+export { resolveMemoryConsolidationDriver, autoRunOnRecommendationEffective, } from "./core/runner/memory-consolidation-driver.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
 export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, analyzePromptCacheFriendliness, assertPromptCacheFriendly, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";

package/dist/orchestration/workflow-governance.js

@@ -297,7 +297,7 @@ function pickWhitelist(scriptSpec) {
         if (!Array.isArray(readDenyPatternsRaw)) {
             throw new WorkflowScriptError('agent(spec): `readDenyPatterns` must be an array of deny entries (a "/"-separated segment run such as ".ssh", or { pattern, caseSensitive? })');
         }
-        const entries = mapUntrustedArray(readDenyPatternsRaw, "agent(spec): `readDenyPatterns`", MAX_SCRIPT_DENY_ENTRIES, "Every entry is judged against every path the child reads, for the child's whole run; the built-in and deployment entries are always in force on top of these.", pickReadDenyEntry);
+        const entries = mapUntrustedArray(readDenyPatternsRaw, "agent(spec): `readDenyPatterns`", MAX_SCRIPT_DENY_ENTRIES, "Every entry is judged against every path the child reads, for the child's whole run; the deployment's own entries, and whichever built-in tiers the deployment switched on (none by default), are in force on top of these.", pickReadDenyEntry);
         try {
             compileReadDeny(entries, "agent(spec).readDenyPatterns");
         }

package/dist/orchestration/workflow-primitives.d.ts

@@ -51,8 +51,8 @@ parentReadFace?: () => TaskSpec["readFace"],
 /** The WRITE seat's twin of the above — the host run's RESOLVED write-face containment, folded
  *  stricter-wins into every spawned child on its own seat (the two seats never read each other). */
 parentWriteFace?: () => TaskSpec["writeFace"], 
-/** Twin of the above for the deny-set additions (built-ins always apply; these are the extra
- *  entries the host's own deployment/task layers stacked on). */
+/** Twin of the above for the deny-set additions (the extra entries the host's own deployment/task
+ *  layers stacked on; the built-in rows the DEPLOYMENT switched on — none by default — apply beside them). */
 parentReadDenyPatterns?: () => TaskSpec["readDenyPatterns"], 
 /** #345 ③ — the HOST task's write-hands clamp is ON (`spec.handsReadOnly === true`). Injected
  *  tighten-only into every spawned child, like the read-face clamp above; see the injection

package/dist/tools/fs/bash-program-position.d.ts

@@ -47,9 +47,16 @@ export declare const ARGV_REENTRY_PROGRAM_RE: RegExp;
 export declare const ARGV_REENTRY_DEFAULT_PROGRAM = "echo";
 /**
  * What a launcher declares about its OWN options: each exact spelling with its ARITY — `0` for a switch, `1` for an
- * option whose value is the next token. A fused `--name=value` and every spelling not in the map fall to the refusal
- * (the conservative side, and the verdict those spellings always had); a `1` with no token left to take is not
- * readable either.
+ * option whose value is the next token. Every spelling not in the map falls to the refusal (the conservative side,
+ * and the verdict those spellings always had); a `1` with no token left to take is not readable either.
+ *
+ * THREE SPELLINGS OF ONE DECLARATION, because getopt has three: an arity-1 entry is honoured separated (`-k 5`),
+ * fused to its long name (`--signal=TERM`) and fused to its short letter (`-k5`), and an arity-0 short entry inside
+ * a cluster of arity-0 letters (`-pv`). Reading only the exact spelling made one program two.
+ *
+ * WHAT A ROW MAY NOT GET WRONG: declaring an arity-1 option as arity 0 steps onto its VALUE and reads the value as
+ * the program — the one direction that turns a refusal into a wrong answer rather than a lost one. A row carries
+ * only options whose arity every supported implementation agrees on; a flag no row declares still refuses.
  */
 export interface LauncherRow {
     /** Consulted ONLY for the launcher the command line itself names — a bare keyword in front of the command
@@ -58,6 +65,19 @@ export interface LauncherRow {
      *  them would turn a whole refusal into an ordinary walked segment — a widening, where every other read of this
      *  table only ever finds MORE program to judge. */
     readonly optionArity: ReadonlyMap<string, 0 | 1>;
+    /** A bare NEGATIVE integer in this launcher's option section is its OWN argument (`nice -5 <cmd>`), not a flag
+     *  the table cannot read. Per row: elsewhere a dash-leading token is an option, and reading one as a number
+     *  would step over a flag whose meaning this table does not know. */
+    readonly negativeIntegerIsOwnArgument?: true;
+    /** Positional operands the launcher takes BEFORE the program, consumed whatever they spell (`timeout DURATION
+     *  COMMAND`); a spelling-based reading under-accepted, and every spelling it missed became the program word. */
+    readonly requiredOperands?: number;
+    /** The launcher reads NAME=VALUE operands with ITS OWN name grammar (`env 1=x …`), wider than the shell's. */
+    readonly assignmentOperands?: true;
+    /** The launcher hands its operands to a SHELL as text (`watch "cat /x"` runs `sh -c`): no program word to read. */
+    readonly shellText?: true;
+    /** With no program word the launcher runs a SHELL: piped text would reach it, so an empty program position refuses. */
+    readonly whenNoProgram?: "shell";
 }
 /**
  * The ONE launcher truth: programs that RUN ANOTHER PROGRAM named in ordinary argv tokens, so a declared reader can
@@ -136,7 +156,8 @@ export interface ProgramPosition {
  */
 export declare function readProgramPosition(toks: SegmentTokens): ProgramPosition;
 /** Does this program position hand a program operands the walk cannot see? True when the chain re-enters through
- *  stdin AND the program it runs is not declared no-path. ONE reading, shared by every consumer. */
-export declare function argvReentryUnjudged(pos: ProgramPosition, noPathPrograms: ReadonlySet<string>): boolean;
+ *  stdin AND the program it runs is not one the caller accepts as a stream target. ONE reading, shared by every
+ *  consumer; WHICH targets are accepted is the caller's declaration, not this reader's. */
+export declare function argvReentryUnjudged(pos: ProgramPosition, acceptedTargets: ReadonlySet<string>): boolean;
 /** ONE sentence per refusal kind, minted here and nowhere else. */
 export declare function programPositionRefusalSentence(refusal: ProgramPositionRefusal): string;