@sema-agent/core 7.21.1 → 7.23.0

package/dist/core/runner/run-terminal-adoption.d.ts

@@ -19,7 +19,7 @@ import type { Model } from "../../internal/llm.js";
 import { type MaybeCompactOptions } from "../auto-compaction.js";
 import type { SessionStore } from "../session.js";
 import type { PushQueue } from "../push-queue.js";
-import { type Brain, type TaskEvent, type TaskSpec } from "../types.js";
+import type { Brain, OwedUserInputAccount, TaskEvent, TaskSpec } from "../types.js";
 import { type Stats } from "./assemble-result.js";
 import type { EndOfTaskCompaction, Prepared, RunnerDepsSeat, RunState } from "./contracts.js";
 export interface RunTerminalAdoptionInput<R> {
@@ -95,5 +95,8 @@ export interface RunTerminalAdoptionResult {
     /** This lane's ONE evaluation of {@link answerSettled}: a clean `"stop"` final with no queued continuation lost. The
      *  settle lane hands it to the arbitration (`ResultFlags.answerSettled`), the teardown attribution and the notice. */
     answerSettled: boolean;
+    /** The undrained-input account, UNSETTLED: this lane knows every fact but one — whether this leg's consumed
+     *  checkpoint row comes back — and that one is the next lane's compensation to perform, not to predict. */
+    owedUserInput: OwedUserInputAccount;
 }
 export declare function runTerminalAdoption<R>(input: RunTerminalAdoptionInput<R>): Promise<R>;

package/dist/core/runner/run-terminal-adoption.js

@@ -3,7 +3,6 @@ import { DEFAULT_COMPACTION_SETTINGS } from "../../internal/harness.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
 import { appendInterruptionMarker, reconcileInterruptedSession } from "../session-reconcile.js";
 import { emitTrace } from "../trace.js";
-import { deliverEngineNotice, owedUserInputCounts, undrainedUserInputNotices } from "../types.js";
 import { answerSettled, errorCodeOf } from "./assemble-result.js";
 import { awaitChargeWithSlowDisclosure, discloseUnevaluableWindow } from "./clock-and-limits.js";
 import { buildWorkingFileAttachments, centerAdoptionOption, contextInstructionFilesOption, emitInputTruncated, forkContextOption } from "./compaction-call-options.js";
@@ -109,10 +108,7 @@ export async function runTerminalAdoption(input) {
         }
         migratedParked = prepared.harness.dropParkedUserInputs(carried);
     }
-    const owed = owedUserInputCounts(undrainedUserAtEnd.current, migratedParked, { frames: prepared.undeliveredContinuationRef.current.parkedSteers, carried: carriedContinuation, rowMayReturn: committedPause === undefined && !prepared.suspendProgressRef.executedApproved });
-    for (const notice of undrainedUserInputNotices(owed, spec.taskId ?? prepared.sessionId, prepared.sessionId, prepared.runId)) {
-        deliverEngineNotice(runner.deps.onNotice, notice);
-    }
+    const owedUserInput = { held: undrainedUserAtEnd.current, migrated: migratedParked, continuation: { frames: prepared.undeliveredContinuationRef.current.parkedSteers, carried: carriedContinuation } };
     if (rs.attach.attachState?.postCompactPending === true && (rs.attach.attachmentsCfg?.backgroundTasks ?? eventDefaultOn("background_tasks")) === true) {
         emitTrace(rs.telemetry.tracer, () => ({ kind: "compaction.announce_dropped", version: 1, taskId: rs.telemetry.taskId, ts: Date.now() }));
     }
@@ -125,7 +121,7 @@ export async function runTerminalAdoption(input) {
         onCompactionFailed: (reason) => queue.push({ type: "compaction_outcome", outcome: "failed", trigger: "auto", reason, ...ident() }),
         cancelled: abortedLive,
     }, runner, sessions);
-    return await next({ threw, comp, answerSettled: settled });
+    return await next({ threw, comp, answerSettled: settled, owedUserInput });
 }
 async function finish(spec, prepared, opts, runner, sessions) {
     let comp;

package/dist/core/runner/runtask.js

@@ -296,6 +296,7 @@ export class Runner {
         const acceptedSteerInputs = new Map();
         const notifyRef = {};
         const captureOptOutRef = {};
+        const mcpRedialRef = {};
         const manualCompactRef = { requested: false, waiters: [] };
         const drainManualCompactWaiters = (outcome) => {
             manualCompactRef.requested = false;
@@ -348,6 +349,7 @@ export class Runner {
                     internals: { ...(internals ?? {}), detachHub, forwardScope: createForwardSinkScope(this.deps.onNotice) },
                     notifyRef,
                     captureOptOutRef,
+                    mcpRedialRef,
                     entryActor,
                     entryTracer,
                 });
@@ -383,7 +385,7 @@ export class Runner {
             locallyClaimedTokens: this.locallyClaimedTokens, parentConstraintRegistry: this.parentConstraintRegistry, suspendedEnvReaps: this.suspendedEnvReaps,
         });
         const { steer } = streamSteerVerb({ spec, internals, queue, acceptedSteerInputs, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, steeringError, runner: this.depsSeat });
-        const { notify, optOutMemoryCapture, compact, detach, interrupt } = streamLifecycleVerbs({ live, ready, orTimeout, steeringError, notifyRef, captureOptOutRef, manualCompactRef, detachHub });
+        const { notify, optOutMemoryCapture, reconnectMcpServer, compact, detach, interrupt } = streamLifecycleVerbs({ live, ready, orTimeout, steeringError, notifyRef, captureOptOutRef, mcpRedialRef, manualCompactRef, detachHub });
         const { halt, destroy } = streamHaltVerbs({ spec, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, run, reapSuspended, runner: this.depsSeat });
         return {
             [Symbol.asyncIterator]: () => queue[Symbol.asyncIterator](),
@@ -398,6 +400,7 @@ export class Runner {
             steer,
             notify,
             optOutMemoryCapture,
+            reconnectMcpServer,
             compact,
             detach,
             interrupt,
@@ -406,14 +409,14 @@ export class Runner {
         };
     }
     runLocked(input) {
-        const { spec, queue, setResult, onSuggestions, onReady, onSuspend, manualCompactRef, taskIdRef, resume, internals, notifyRef, captureOptOutRef, entryActor, entryTracer } = input;
+        const { spec, queue, setResult, onSuggestions, onReady, onSuspend, manualCompactRef, taskIdRef, resume, internals, notifyRef, captureOptOutRef, mcpRedialRef, entryActor, entryTracer } = input;
         return runNotificationLane({
             spec, queue, resume, internals, taskIdRef,
             runner: this.depsSeat, self: this, sessions: this.sessions, sessionReadStates: this.sessionReadStates, pendingSessionNotifications: this.pendingSessionNotifications,
             prepareTask,
             next: ({ prepared, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef, modelCatalog, notificationLane, unsubscribeTaskNotifications }) => {
                 const { runSourceTaskId, parentToolCallId, ident, emitDelegationLifecycle, loopLatch, stats, undrainedUserAtEnd, userInputLostAtEnd } = runIdentityWiring({
-                    spec, queue, prepared, internals, taskIdRef, onReady, manualCompactRef, notifyRef, captureOptOutRef, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef,
+                    spec, queue, prepared, internals, taskIdRef, onReady, manualCompactRef, notifyRef, captureOptOutRef, mcpRedialRef, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef,
                     notificationLane, pendingSessionNotifications: this.pendingSessionNotifications, runner: this.depsSeat,
                 });
                 const rs = createRunState();
@@ -472,9 +475,9 @@ export class Runner {
                             next: ({ final, threw, abortedLive, userInterruptedLive, strandedHumanAnswers }) => runTerminalAdoption({
                                 spec, queue, prepared, rs, stats, ident, emitCommitted, startedToolCallIds, toolLabels, timeout, compactionBrain, compactionBreaker, windowSafetyOptions,
                                 undrainedUserAtEnd, userInputLostAtEnd, final, threw, abortedLive, userInterruptedLive, runner: this.depsSeat, sessions: this.sessions,
-                                next: ({ threw, comp, answerSettled }) => runSettleAndTeardown({
+                                next: ({ threw, comp, answerSettled, owedUserInput }) => runSettleAndTeardown({
                                     spec, queue, prepared, resume, internals, rs, stats, ident, parentToolCallId, subagentName, loopLatch, timeout, ownCommittedTailRef,
-                                    emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp,
+                                    emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp, owedUserInput,
                                     setResult, onSuggestions, onSuspend, runner: this.depsSeat, sessions: this.sessions,
                                 }),
                             }),

package/dist/core/runner/stream-lifecycle-verbs.d.ts

@@ -1,6 +1,6 @@
 import type { ToolDetachHub } from "../tool-detach.js";
 import type { TaskStream } from "../types.js";
-import type { CaptureOptOutRef, LiveHandle, ManualCompactRef, NotifyRef, TaskStreamLiveSeat } from "./contracts.js";
+import type { CaptureOptOutRef, LiveHandle, ManualCompactRef, McpRedialRef, NotifyRef, TaskStreamLiveSeat } from "./contracts.js";
 export interface StreamLifecycleVerbsInput {
     /** borrowed-readonly — the stream's live state: `resultValue` (the finished-task refusals) and `handle`, read at each call. */
     live: TaskStreamLiveSeat;
@@ -14,6 +14,8 @@ export interface StreamLifecycleVerbsInput {
     notifyRef: NotifyRef;
     /** borrowed-readonly — the capture opt-out bridge; `flip` is bound by the run body when a memory session mounted. */
     captureOptOutRef: CaptureOptOutRef;
+    /** borrowed-readonly — the MCP re-dial bridge; `redial` is bound by the run body when the leg declared MCP servers. */
+    mcpRedialRef: McpRedialRef;
     /** borrowed-mutable — the manual-compaction request seat: the compact verb arms it and parks its waiter here. */
     manualCompactRef: ManualCompactRef;
     /** borrowed-readonly — the run-local detach hub the detach verb requests through. */
@@ -24,6 +26,8 @@ export interface StreamLifecycleVerbsResult {
     notify: TaskStream["notify"];
     /** The stream's `optOutMemoryCapture` verb. */
     optOutMemoryCapture: TaskStream["optOutMemoryCapture"];
+    /** The stream's `reconnectMcpServer` verb. */
+    reconnectMcpServer: TaskStream["reconnectMcpServer"];
     /** The stream's `compact` verb. */
     compact: TaskStream["compact"];
     /** The stream's `detach` verb. */

package/dist/core/runner/stream-lifecycle-verbs.js

@@ -1,6 +1,6 @@
 import { isSystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
 export function streamLifecycleVerbs(input) {
-    const { live, ready, orTimeout, steeringError, notifyRef, captureOptOutRef, manualCompactRef, detachHub } = input;
+    const { live, ready, orTimeout, steeringError, notifyRef, captureOptOutRef, mcpRedialRef, manualCompactRef, detachHub } = input;
     const notify = async (input, opts) => {
         const notifyError = (msg, code) => {
             const e = new Error(`cannot notify: ${msg}`);
@@ -69,6 +69,27 @@ export function streamLifecycleVerbs(input) {
         }
         return captureOptOutRef.flip(reason);
     };
+    const reconnectMcpServer = async (server) => {
+        const serverIn = server;
+        if (typeof serverIn !== "string" || serverIn.length === 0) {
+            const e = new Error(`cannot reconnect an MCP server: \`server\` must be a non-empty server name`);
+            e.code = "steering.invalid_content";
+            throw e;
+        }
+        if (live.resultValue)
+            throw steeringError("the task has already finished");
+        const h = live.handle ?? (await orTimeout(ready));
+        if (!h)
+            throw steeringError("the task is not running");
+        if (live.resultValue !== undefined || h.loop.ended)
+            throw steeringError("the task is no longer running");
+        if (mcpRedialRef.redial === undefined) {
+            const e = new Error(`cannot reconnect an MCP server: this run declared no MCP servers — there is nothing to re-dial`);
+            e.code = "mcp.reconnect_unavailable";
+            throw e;
+        }
+        return mcpRedialRef.redial(serverIn);
+    };
     const compact = async (opts) => {
         if (live.resultValue)
             throw steeringError("the task has already finished");
@@ -131,5 +152,5 @@ export function streamLifecycleVerbs(input) {
         h.abortController.abort();
         void h.harness.abort();
     };
-    return { notify, optOutMemoryCapture, compact, detach, interrupt };
+    return { notify, optOutMemoryCapture, reconnectMcpServer, compact, detach, interrupt };
 }

package/dist/core/runner/write-protection-station.d.ts

@@ -12,36 +12,18 @@
  *
  * Two readers, one compile: the gate station mounts `check`, and the leg's wiring manifest reports
  * `targetView`. Compiling twice would be two judges free to disagree about the seats they were handed.
+ *
+ * The SECOND absence this seat carries is the per-judgment one: a judge that HAS its target view but
+ * whose environment could not answer a particular target drops that view and judges by the spelling alone.
+ * That is a run-time fact, so it cannot be announced at compile like the one above — but it is a fact about
+ * the ENVIRONMENT rather than about any one write, so it is announced from here, once per leg per reason,
+ * and carries no call identity. This is the leg-scoped home the dedupe needs: the judge is compiled once
+ * per leg and every judgment of the leg goes through the check minted here.
  */
 import type { ExecutionEnv } from "../../internal/harness.js";
 import type { RunnerDeps } from "../runner-deps.js";
 import type { ToolRoster } from "../tool-roster.js";
 import { type WriteProtectionMount } from "../write-protect.js";
-/**
- * Compile the leg's write-protection judge and announce a missing target view.
- *
- * Returns the mount, or `undefined` when the deployment emptied the table (`[]`): no judge, no tighten
- * mounted at all, and nothing announced — an explicit opt-out is not a degrade. A garbage table refuses
- * prepare loudly from here, as it did from the gate station before, so an unusable table cannot lie
- * dormant on a write-tool-less task.
- *
- * The notice fires exactly once per prepared leg and only when a judge with NO target view sits beside at
- * least one tool whose writes it covers. Coverage runs the judge's OWN per-call test ({@link
- * protectivePathTargetOf}) rather than a copy of it, over every name a row DISPATCHES under — its own and
- * its aliases, because the gate hands the judge the name the call was made with. A row that declares a
- * path target is covered by that declaration under every name; a row that declares none is covered under
- * whichever of its names the catalog gives a non-read slot to. Both halves are load-bearing: a tool named
- * `Write` that declares nothing, and a tool aliased to `Write` that declares nothing, are each judged by
- * spelling alone on a hands-less leg, and each would otherwise go unnamed by the very line that exists to
- * name them. Reported by the ROW's own name — what the deployment mounted.
- *
- * SNAPSHOT BOUNDARY, deliberate and disclosed: the roster read here is the LEG-START one, the same one
- * the wiring manifest reports and for the same reason — this is one announcement per prepared leg, not a
- * subscription. A run that gains its FIRST covered write tool after prepare (a mid-run roster delta) is
- * judged by the same spelling-only judge and is not announced; the leg's `writeProtection.targetView`
- * still reports the judge's reading correctly, because the judge never gains an environment mid-run —
- * only the covered SET can widen.
- */
 export declare function mountWriteProtection(input: {
     /** borrowed-readonly — the deployment seats: the table (`writeProtectedPaths`; absent ⇒ the default
      *  table, `[]` ⇒ opted out), the data root the memory library is materialized under

package/dist/core/runner/write-protection-station.js

@@ -1,11 +1,29 @@
 import { deliverEngineNotice } from "../engine-notice.js";
 import { protectivePathTargetOf } from "../tool-registry.js";
 import { createWriteProtectionCheck } from "../write-protect.js";
+const ABSENCE_REASON = { symlink: "unresolved-symlink", target: "unresolvable-target" };
 export function mountWriteProtection(input) {
+    const announced = new Set();
     const mount = createWriteProtectionCheck(input.deps.writeProtectedPaths, {
         ...(input.deps.memoryEngineDir !== undefined ? { dataRoot: input.deps.memoryEngineDir } : {}),
         ...(input.env !== undefined ? { env: input.env } : {}),
         rootPath: input.rootPath,
+        onViewAbsent: (absence) => {
+            const reason = absence.unresolvedSymlink ? ABSENCE_REASON.symlink : ABSENCE_REASON.target;
+            if (announced.has(reason))
+                return;
+            announced.add(reason);
+            deliverEngineNotice(input.deps.onNotice, {
+                code: "config.write_protection_unresolved",
+                message: `This run's write-protection judge could not resolve a write target in its execution environment ` +
+                    `(${reason === ABSENCE_REASON.symlink ? "a symlink whose real target is unknowable" : "the environment refused or errored on the spelling"}: ${absence.cause}). ` +
+                    `A view that cannot answer does not vote, so that write was judged by its SPELLING against the table and nothing else — ` +
+                    `a target reaching a protected path only through an alias, a bind mount or a ".." walk is cleared. Nothing about this run was ` +
+                    `refused because of it, and nothing here is a defect in the write itself: an environment that cannot answer path questions is a ` +
+                    `deployment fact. Announced once per leg per reason; later writes of the same shape are judged the same way, silently.`,
+                detail: { reason, cause: absence.cause, sessionId: input.sessionId, runId: input.runId },
+            });
+        },
     });
     if (mount === undefined || mount.targetView !== "spelling-only")
         return mount;

package/dist/core/runner-deps.d.ts

@@ -179,20 +179,21 @@ export interface RunnerDeps {
     /**
      * design/199 件B — DEPLOYMENT-layer ADDITIONS to the built-in sensitive-path READ deny set
      * ({@link import("../tools/fs/read-deny.js").READ_FACE_DEFAULT_DENY_ENTRIES}); see
-     * {@link TaskSpec.readDenyPatterns} for the judged surfaces. Add-only on THIS seat: unions with
-     * the active built-ins and any task-layer additions, and `[]` ≡ absent — narrowing the built-in
+     * {@link TaskSpec.readDenyPatterns} for the judged surfaces. INDEPENDENT of the built-in switch. Add-only on
+     * THIS seat: unions with the active built-ins and any task-layer additions, and `[]` ≡ absent — narrowing the built-in
      * set is the sibling knobs' job ({@link readDenyBuiltinTiers} / {@link readDenyBuiltinExclude},
      * #245 revision of D-4), not a replacement escape hatch here. Bad entry shapes refuse loudly at
      * prepare (#123).
      */
     readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
     /**
-     * The deployment's built-in deny-table TIER selection:
-     * EXACTLY the listed tiers of
+     * The deployment's built-in deny-table TIER selection — the ON/OFF switch for the whole built-in
+     * table, OFF unless this seat says otherwise. EXACTLY the listed tiers of
      * {@link import("../tools/fs/read-deny.js").READ_FACE_BUILTIN_DENY_TABLE} are active (`[]` = none —
-     * explicit and legal); absent = the default selection
-     * ({@link import("../tools/fs/read-deny.js").READ_DENY_DEFAULT_TIERS}: every tier except
-     * `shell-history`, which is unrestricted by default). Composes with
+     * explicit and legal); ABSENT = {@link import("../tools/fs/read-deny.js").READ_DENY_DEFAULT_TIERS},
+     * which is EMPTY: an unconfigured deployment activates no built-in row, so nothing from that table
+     * refuses a read or demotes a shell one. A leg's active tiers are REPORTED on its wiring manifest
+     * ({@link import("./wiring-manifest.js").WiringManifest.readDeny}). Composes with
      * {@link readDenyBuiltinExclude} (tiers first, then row removal); never touches the additions
      * seats or the write faces. Unknown tier names refuse loudly at prepare (#123). DEPLOYMENT seat
      * ONLY: deliberately not a TaskSpec key and not in the governed workflow whitelist — a task or
@@ -324,6 +325,14 @@ export interface RunnerDeps {
     memoryCaptureRecordStore?: (plane: {
         controlDir: string;
     }) => import("./memory-engine/layout.js").SessionCaptureRecordStore;
+    /** which occupant of a session id is running now (a purge may delete a session tree and the
+     *  id be handed out again; without this seat a standing opt-out or pollution record binds the NEXT
+     *  occupant too). An opaque token, STABLE for one occupant's life, DIFFERENT for the next, only
+     *  ever compared ({@link import("./memory-engine/layout.js").sessionRecordBindsIncarnation}).
+     *  ABSENT ⇒ records bind by id (the pre-incarnation bytes); an empty or throwing answer reads the same. */
+    memorySessionIncarnation?: (session: {
+        sessionId: string;
+    }) => string | undefined;
     /**
      * design/339 §6.1 — the v3 memory-consolidation switch, threaded verbatim to the engine seat
      * ({@link import("../core/memory-engine/engine.js").MemoryEngineOptions.consolidation} — same

package/dist/core/skill-listing-budget.d.ts

@@ -65,10 +65,11 @@ export interface ResolvedSkillListingBudget {
  * (`200 000 × 4 × 0.01` = 8 000 bytes).
  *
  * The window is `contextTokens ?? contextWindow`, the same physical coordinate the deferral gate
- * measures against. A window that is absent OR unusable (non-finite, non-positive) reads as
- * {@link SKILL_LISTING_DEFAULT_CONTEXT_TOKENS}: one rule, not a case per bad shape — a model's own
- * declaration is judged by the model doors, and this seat must still produce a number a renderer can
- * compare against.
+ * measures against. `contextTokens: 0` (or any other non-finite/non-positive declared value) does
+ * NOT fall through `??` to `contextWindow` — `0` is not nullish — so it lands here as a
+ * declared-but-unusable window, and this seat folds it to {@link SKILL_LISTING_DEFAULT_CONTEXT_TOKENS}
+ * the same as a genuinely absent window: one rule, not a case per bad shape, because this seat's
+ * job is to always hand a renderer a usable number.
  */
 export declare function resolveSkillListingBudget(opts: {
     fraction?: unknown;

package/dist/core/task-registry.d.ts

@@ -185,10 +185,6 @@ export declare class TaskRegistry {
                 tupleIncomplete: true;
             })>>;
         };
-        /** design/151 §7.7 (F-13) — the row's mailbox dies with the row: a WINNING delete also drops
-         *  the (scope, handle) mailbox (advisory — a mailbox fault never blocks the reap; an orphaned
-         *  box is bounded by the mailbox's own `reap` policy). Structural face (drop only), so the
-         *  deployment passes its `RunnerDeps.mailboxStore` directly. */
         mailbox?: {
             drop(scope: string, handle: string): Promise<void>;
         };
@@ -634,8 +630,6 @@ export declare class TaskRegistry {
     private pollBackgroundBash;
     private pollWorkflow;
     private stopBackgroundBash;
-    /** design/135 G2: TaskOutput over a monitor — a RE-READABLE spool snapshot (the watcher owns the env
-     *  cursor, exactly the bash G2b spool posture): repeated polls return the same accumulated output. */
     private pollMonitor;
     private stopMonitor;
     private stopWorkflow;

package/dist/core/task-result.d.ts

@@ -38,6 +38,30 @@ export type TaskStatus = "completed" | "blocked" | "failed" | "suspended" | "nee
  * One remote-workspace lifecycle failure, reported as data on {@link TaskResult.remoteEnvFailures}.
  * See that field for why the eleven-code taxonomy needed a structured channel to reach a caller at all.
  */
+/**
+ * ONE `humanReview` ledger row — what `stats.humanReview.gates[]` carries, what the runner's live
+ * accumulator holds, and what a checkpoint persists. It lived as six structurally-identical inline
+ * copies, the persisted one NARROWER than the rest, so "does a row carry the call it gated?" had six
+ * answers and the persisted one said no while the bytes it stored said yes. One declaration now.
+ */
+export interface HumanReviewGateRow {
+    /** `kind` / `decision` / `toolName` / `toolArg` are documented once, on `stats.humanReview.gates`. */
+    kind: string;
+    waitMs: number;
+    decision?: string;
+    toolName?: string;
+    toolArg?: string;
+    /**
+     * The id of the tool call this row gated — the row's IDENTITY, not a display field. Minted with the
+     * row at each of the four mint sites, never re-derived downstream: a run pushes rows from several
+     * mints while only one passes through the host's `onAsk`, so the two ledgers' counts are legitimately
+     * unequal and there was no key to reconcile on. Absent means one thing — the mint had no call id to
+     * give (a probe row; a durable gate whose checkpoint carries a non-`tool_approval` pending action,
+     * since a `resource_limit` / `needs_review` / `plan_review` pause gates no call; or an older engine).
+     * Never a placeholder.
+     */
+    toolCallId?: string;
+}
 export interface RemoteEnvFailureNote {
     /** Which VM-lifecycle call failed. */
     op: "suspendVM" | "resumeVM" | "postResumeInit";
@@ -562,8 +586,9 @@ export interface TaskResult {
      * duplicates, so re-supplying deployment-shared entries is idempotent) — that is how the frozen
      * posture rides every leg that continues this work, not just the delegation subtree.
      *
-     * **In-presence condition:** present iff non-empty. Built-in entries are never listed (they are in
-     * force on every run and re-compile locally). Same terminal coverage as
+     * **In-presence condition:** present iff non-empty. Built-in entries are never listed — they are the
+     * DEPLOYMENT's own selection (off by default), re-compiled per leg and reported on its wiring
+     * manifest ({@link import("./wiring-manifest.js").WiringManifest.readDeny}). Same terminal coverage as
      * {@link effectiveReadFace}: rides any terminal of a leg that ran; absent on prepare failures.
      *
      * On a DURABLE-PAUSE hand-back these seats are additionally the RE-SUPPLY hint: a checkpoint
@@ -780,16 +805,10 @@ export interface TaskResult {
              *  `irreversible_ask` for durable; `human` for a synchronous ask). `decision` = the adjudication when
              *  known (`allow`/`deny`). design/99 MF-24: `toolName` = the gated tool; `toolArg` = a
              *  SHORT, SECRET-SCRUBBED one-line summary of its input (the same `primaryActivityArg` boundary as the MF-W
-             *  activity arg) — the permission-denial ledger's "denied: Bash(rm …)" display. `toolArg` is set on the
-             *  SYNCHRONOUS-ask path (the input is in scope); a durable-resume gate carries `toolName` only (its input is
-             *  not threaded onto the persisted gate — a documented follow-on). */
-            gates: Array<{
-                kind: string;
-                waitMs: number;
-                decision?: string;
-                toolName?: string;
-                toolArg?: string;
-            }>;
+             *  activity arg) — the permission-denial ledger's "denied: Bash(rm …)" display. `toolArg` rides every mint
+             *  that has the input in scope: the synchronous ask from the request, the durable-resume gate from the
+             *  checkpoint's `pendingAction`; `toolCallId` names the call the row gated (absent = not joinable). */
+            gates: HumanReviewGateRow[];
         };
         /**
          * design/80 D-E-core: a thin FINANCE TAXONOMY of the LLM-derived costs the engine actually prices,

package/dist/core/task-spec.d.ts

@@ -789,7 +789,8 @@ export interface TaskSpec {
      * {@link RunnerDeps.readDenyPatterns}; `[]` ≡ absent (union identity); NOTHING at the task layer
      * can remove a built-in — the one removal channel is the DEPLOYMENT's built-in configuration
      * ({@link RunnerDeps.readDenyBuiltinTiers} / {@link RunnerDeps.readDenyBuiltinExclude}, #245
-     * revision of D-4), which no TaskSpec key reaches. Bad entry shapes refuse loudly at prepare
+     * revision of D-4), which no TaskSpec key reaches — and that half is OFF by default, so on an
+     * unconfigured deployment the entries here are the WHOLE judged set. Bad entry shapes refuse loudly at prepare
      * (#123). The write faces are untouched.
      */
     readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];

package/dist/core/task-stream.d.ts

@@ -275,6 +275,32 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
     }): Promise<{
         outcome: "created" | "existed";
     }>;
+    /**
+     * **RE-DIAL one MCP server** on the running task, the action `RefreshMcpTools` deliberately
+     * is not (its contract is "never dials or re-dials"). Core holds no MCP connection across task
+     * legs, so once a server's transport closes this leg is stuck with it: every one of its tools fails
+     * fast and a refresh can only keep reporting `not_connected`. This is the verb a host hangs a
+     * "Reconnect" control on. ONE NAMED SERVER, required — CC 2.1.259's control-channel request carries
+     * a required `serverName` and has no all-servers form, and an all-servers form would CLOSE HEALTHY
+     * connections to re-dial them (the stdio server owning a device or a port — the case this verb
+     * exists for — is the one that cannot be re-dialed while its predecessor still holds the device).
+     *
+     * ⚠️ **A FAILED RE-DIAL LEAVES THE SERVER DOWN.** The old connection is closed BEFORE the new one is
+     * dialed (no other order works for a device-owning server), so a dial that fails has spent a
+     * working connection: the server stays disconnected, with its tools WITHDRAWN from the roster,
+     * until another re-dial or the next leg's materialize — and calls in flight on the replaced
+     * connection fail with it. Both are inherent to re-dialing; CC behaves the same way.
+     *
+     * Resolves {@link import("./mcp.js").McpReconnectResult} — `outcome` is one of three words, so a
+     * consumer mapping it onto a three-state control answer needs no table: `reconnected` (the only
+     * success), `refused` (the engine declined, or the dial failed — `reason` says which and
+     * `status.errorCode` keys the next action), `not_declared` (no server of that name on this leg).
+     * Throws, never silently no-ops: `mcp.reconnect_unavailable` when this run declared NO MCP servers
+     * (a host maps that to "unsupported", not "refused"), `steering.invalid_content` on a missing or
+     * non-string name, and the steer-family `steering.not_running` once the task has finished.
+     * LEG-LOCAL: the result rides no checkpoint, and a durable resume takes a fresh first listing.
+     */
+    reconnectMcpServer(server: string): Promise<import("./mcp.js").McpReconnectResult>;
     /**
      * Hard-**interrupt** the running task — a real abort (not a best-effort hint), equivalent to firing the
      * task's `signal` (design/47). Refused typed (`steering.not_running`, the steer-family liveness code —

package/dist/core/tool-spec.d.ts

@@ -95,8 +95,12 @@ export interface ReversibilityVerdict {
  * spelled, which is the only one derivable from the text.
  */
 export interface ReadRootGrantCandidate {
-    /** An absolute, lexically folded directory in the boundary's own spelling; never a file or a pattern. */
+    /** An absolute, lexically folded path in the boundary's own spelling; never a pattern. A DIRECTORY
+     *  unless {@link covers} says otherwise. */
     readonly dir: string;
+    /** `"exact"` ⇒ {@link dir} is the path the command NAMED, offered verbatim rather than a directory
+     *  containing it. A consumer ADDS the string itself: expanding it into a pattern grants nothing. */
+    readonly covers?: "exact";
     /** Always the literal `true` — a shape, not a value, so the seat cannot be widened into a "maybe this
      *  helps" hint without a visible type change. It claims THIS ask: not the deny layer (judged by pattern
      *  rather than by root, and unmoved by any grant), and not another ask the same call may raise. */

package/dist/core/trace.d.ts

@@ -548,6 +548,11 @@ export type TraceEvent = {
     verdict: "allow" | "block" | "unavailable" | "parse_error";
     /** Present iff `verdict === "unavailable"`: `error` / `timeout`. */
     cause?: "error" | "timeout";
+    /** Present exactly when NO MODEL WAS ASKED because the question did not assemble: `timeout` = the
+     *  assembly outran its cap, `failed` = it threw. The verdict reads `unavailable` / `error` either way
+     *  (nothing was dispatched), and `ms` is then time spent BUILDING, not waiting on a provider — which is
+     *  what separates "the transcript store is slow" from "the provider is down". */
+    notAsked?: "failed" | "timeout";
     ts: number;
 } | {
     /** C1 — the failover brain served this call from a FALLBACK entry (`createFailoverBrain`): the

package/dist/core/types.d.ts

@@ -18,7 +18,7 @@ export type { BeforeWriteRequest, BeforeWriteResult, BeforeWriteHook, TrackEditR
 export type { AgentDefinition, SkillManifest, SkillSpec } from "./agent-definition.js";
 export type { McpServerSpec, A2aServerSpec, McpElicitRequest, McpElicitResponse, OnElicit } from "./mcp-server-spec.js";
 export type { TaskLimits } from "./task-limits.js";
-export type { TaskStatus, RemoteEnvFailureNote, EffectiveMemoryScopes, TaskResult } from "./task-result.js";
+export type { TaskStatus, RemoteEnvFailureNote, EffectiveMemoryScopes, TaskResult, HumanReviewGateRow } from "./task-result.js";
 export type { TerminalCause, PausedCause } from "./terminal-cause.js";
 export type { TaskEventIdentity, BrainStatusPhase, BrainRetryErrClass, BrainStatus, ToolActivity, HumanInputSource, HumanInputDelivery, DelegationTaskType, TaskEvent, HumanInputEvent, CompactOutcome } from "./task-event.js";
 export type { TaskStream } from "./task-stream.js";
@@ -27,6 +27,6 @@ export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js"
 export type { BackgroundChildEvent, DelegationLifecycleEvent } from "./delegation-frames.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
 export type { ProjectMemoryLoad, ResumePreflightInfo, ResumePreflightVerdict, RunnerDeps } from "./runner-deps.js";
-export type { EngineNotice } from "./engine-notice.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, undrainedUserInputNotices } from "./engine-notice.js";
+export type { EngineNotice, OwedUserInputAccount } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, settleOwedUserInput, undrainedUserInputNotices } from "./engine-notice.js";
 export type { AgentTool, Model, StreamFn, ThinkingLevel, ToolInputValidationContext, ToolInputVerdict };

package/dist/core/types.js

@@ -1,3 +1,3 @@
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, undrainedUserInputNotices } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, settleOwedUserInput, undrainedUserInputNotices } from "./engine-notice.js";

package/dist/core/wiring-manifest.d.ts

@@ -347,6 +347,26 @@ export interface WiringManifest {
     writeProtection?: {
         targetView: WriteProtectionTargetView;
     };
+    /**
+     * EFFECTIVE half only; the present-iff law is the contract sentence below. `builtinTiers` names the
+     * tiers that MATERIALLY activate rows, in {@link
+     * import("../tools/fs/read-deny.js").READ_DENY_BUILTIN_TIERS} order — not the tiers the operator
+     * typed: one whose every row `readDenyBuiltinExclude` removed is not named. Deliberately NOT
+     * reported: `readDenyPatterns`, deployment-supplied TEXTS rather than an enum, so absence means "no
+     * BUILT-IN row judges", never "no read is deny-judged". IN the fingerprint (the
+     * {@link WiringManifest.writeProtection} class): the selection follows the deployment seat, so legs
+     * of one assembly agree.
+     *
+     * @contract read_deny.builtin_activation_disclosed — WHETHER the built-in sensitive-path read deny
+     * table judges a leg is DISCLOSED, never inferred: the table is a deployment opt-in whose default
+     * selection is empty, the leg that compiles the judge relays the tiers its own resolution materially
+     * activated, and the manifest carries that section iff at least one built-in row is active (absence
+     * = no built-in row judges; an empty array is never emitted — "off" and "on to nothing" are one
+     * fact). The disclosure changes no verdict.
+     */
+    readDeny?: {
+        builtinTiers: readonly string[];
+    };
     /**
      * EFFECTIVE half only. PRESENT IFF auto-consolidation is EFFECTIVELY armed on this
      * deployment (`autoRunOnRecommendationEffective`: an explicit `true`, or an absent seat under the
@@ -441,6 +461,9 @@ export interface WiringFacts {
     /** Effective half only — the compiled write-protection judge's OWN target-view word
      *  ({@link WiringManifest.writeProtection}); absent ⇒ this leg compiled no judge (an emptied table). */
     writeProtectionTargetView?: WriteProtectionTargetView;
+    /** Effective half only — the built-in read-deny TIERS this leg's configuration materially activated
+     *  ({@link WiringManifest.readDeny}); empty and absent derive the same thing (no section). */
+    readDenyBuiltinTiersActive?: readonly string[];
     /** Effective half only — `RunnerDeps.autoRunOnRecommendation === true`
      *  ({@link WiringManifest.autoConsolidation}); false ⇒ no section (byte-identical manifest). */
     autoConsolidationOnRecommendation?: boolean;

package/dist/core/wiring-manifest.js

@@ -142,6 +142,9 @@ export function deriveWiringManifest(facts) {
         ...(facts.half === "effective" && facts.hooks !== undefined && facts.hooks.length > 0 ? { hooks: facts.hooks.map((h) => ({ ...h })) } : {}),
         ...(facts.half === "effective" && facts.lsp !== undefined ? { lsp: { ...facts.lsp } } : {}),
         ...(facts.half === "effective" && facts.writeProtectionTargetView !== undefined ? { writeProtection: { targetView: facts.writeProtectionTargetView } } : {}),
+        ...(facts.half === "effective" && facts.readDenyBuiltinTiersActive !== undefined && facts.readDenyBuiltinTiersActive.length > 0
+            ? { readDeny: { builtinTiers: [...facts.readDenyBuiltinTiersActive] } }
+            : {}),
         ...(facts.half === "effective" && facts.autoConsolidationOnRecommendation === true ? { autoConsolidation: { onRecommendation: true } } : {}),
     };
     if (facts.half === "effective") {