@zackbart/connecta 0.26.3 → 0.28.0

package/dist/server.js

@@ -52,10 +52,6 @@ export function createFetchHandler(opts) {
             ...(opts.executorName !== undefined
                 ? { executor: { name: opts.executorName } }
                 : {}),
-            // Whether a program's write pauses for resume_execution or fails E4.
-            // The tool is listed either way; this is the only place an operator
-            // can see which answer it gives (#565).
-            resumableWrites: opts.resumable !== undefined,
             // Counts only, from refreshes that already happened — the endpoint
             // asks no downstream anything, and `connecta doctor` reads it to
             // report a stale allowlist without a probe of its own (#343).

package/dist/skills.js

@@ -1,24 +1,17 @@
 import { boundedEchoText } from "./errors.js";
-const ROUTE = "Choose a route before discovery. A known-address read needs only call_tool. Unknown-address read-only work starts with execute_code to discover, call, and return the answer; use the same route for reduction, multiple or dependent calls, loops, joins, or branches. Keep discovery and calls together when schemas suffice; do not return catalog matches alone. Inspect unfamiliar read results with a small sample before proceeding.";
+const ROUTE = "Choose a route before discovery. A known-address read needs only call_tool. Unknown-address read-only work starts with execute_code to discover, call, and return the answer; use the same route for reduction, multiple or dependent calls, loops, joins, or branches. Keep discovery and calls together when schemas suffice; do not return catalog matches alone. Sample unfamiliar reads.";
 const RECOVERY = 'After auth_required use authorize_connector. After a truncated direct result use get_result. Guidance is on demand: fetch skills({ name: "usage" }) only when these instructions and the tool description are insufficient or a run needs repair.';
 /**
- * The MCP instructions of a deployment whose programs pause at writes. The
- * route sentence is its own, not ROUTE's: with writes in programs, "one known
- * write" is the only work left for call_destructive_tool, and an agent told
- * only that programs *may* write reads each write after a lookup as a known
- * one and sends them one prompt at a time.
+ * The always-loaded MCP `instructions` string. A program runs reads and the
+ * writes config exempts from approval; every other write is its own top-level
+ * call_destructive_tool, where the host's permission prompt is the approval.
  */
-export const CONNECTA_INSTRUCTIONS = `Choose a route before discovery. One known read: call_tool; one known write: call_destructive_tool. Everything else starts with execute_code to discover, call, and return the answer: unknown addresses, reduction, multiple or dependent calls, and writes that follow reads. Keep authorized batches in one program. Sample unfamiliar reads. Reduce a one-time write's full result there or page a direct call with get_result; never repeat it to recover output. Non-exempt program writes pause unsent; resume_execution with the returned token, address, and args approves the call and continues the program. Approval "tool" covers later same-address calls in this run; other approval-required writes need their own approval. ${RECOVERY}`;
-/**
- * The instructions of a deployment without resumable writes, whose programs
- * refuse every write: the routing it always had.
- */
-export const READ_ONLY_PROGRAM_INSTRUCTIONS = `${ROUTE} Only readOnlyHint: true tools run there. Keep catalog inspection and unannotated, write-capable, or destructive work top level: search_tools then call_destructive_tool when a call is needed. ${RECOVERY}`;
+export const CONNECTA_INSTRUCTIONS = `${ROUTE} Only readOnlyHint: true tools and config-exempt writes run there. Keep catalog inspection and other unannotated, write-capable, or destructive work top level: search_tools then call_destructive_tool when a call is needed. Never repeat a write to recover its output. ${RECOVERY}`;
 const USAGE_SKILL_BASE = `# Connecta usage
 
 ## The surface
 
-Eight tools: \`execute_code\`, \`resume_execution\`, \`search_tools\`, \`call_tool\`, \`call_destructive_tool\`, \`authorize_connector\`, \`get_result\`, \`skills\`. Discovery and multi-call work live in a program. Top-level search remains for catalog inspection and approval-required work.
+Seven tools: \`execute_code\`, \`search_tools\`, \`call_tool\`, \`call_destructive_tool\`, \`authorize_connector\`, \`get_result\`, \`skills\`. Discovery and multi-call work live in a program. Top-level search remains for catalog inspection and approval-required work.
 
 Follow the MCP instructions for routing. Read at most once for syntax or repair.
 
@@ -48,16 +41,14 @@ For top-level catalog inspection or approval-required discovery, omit \`limit\`
 - Preserve the schema's JSON types exactly: a numeric id is a number, not a numeric-looking string.
 - Validate tabular headers, row arrays, and row widths before mapping them. Never let a header or partial row become data.
 
-Only explicitly \`readOnlyHint: true\` or config-exempt calls run unasked. With resumable writes, non-exempt approval-required calls pause unsent; \`resume_execution\` repeats the pending address, args, and token. Without them, use \`call_destructive_tool\` for writes. Keep each authorized batch in one resumable program, final post included. \`approval: "call"\` covers one write; \`approval: "tool"\` covers later same-address calls in this run. Other approval-required writes need approval. Replay requires the same call order. Sandbox code cannot widen host gates.
+Only explicitly \`readOnlyHint: true\` calls and writes the deployment's config exempts from approval run in a program. Any other write is refused before it is sent: send it through top-level \`call_destructive_tool\`, where the host asks. Sandbox code cannot widen host gates.
 
 ## Errors and repair
 
 Caught Connecta errors expose \`message\`, \`code\`, \`retryable\`, and \`details\`. Promise rejections retain these fields. Branch on fields, never prose. After a shared argument failure, repair one call before repeating it across other records. Do not retry \`retryable: false\`, and do not retry \`rate_limited\` immediately because portable code has no timer.
 
 - \`destructive_tool_requires_approval\`: stop and send the returned address through top-level \`call_destructive_tool\`.
-- \`execution_paused\`: the run already stopped at a write; let it end.
-- \`write_outcome_unknown\`: sent but unanswered, never re-sent; check the target.
-- \`execution_expired\`, \`_diverged\`, \`_interrupted\`: check \`writes\`, then rerun.
+- \`write_outcome_unknown\`: an exempt write was sent but unanswered and is never re-sent; check the target.
 - \`auth_required\`: let the failure reach the model, then use top-level \`authorize_connector\`, give its handoff to the operator, and retry after recovery.
 - Truncated direct call: page with \`get_result\`, never repeat a write. A program result has no page handle; reduce a read in a new program. After a write, check the target or report the gap.
 - Unknown addresses and tools carry scoped search recovery. Use it inside the current run. Do not invent an address.
@@ -72,8 +63,6 @@ The \`execute_code\` description states this deployment's host-call and write bu
 
 Portable code uses standard JavaScript builtins, \`connecta\`, and \`console.*\`. QuickJS blocks imports and lacks fetch, process, timers, crypto, and WebSocket. Dynamic Workers must use only \`{ loader }\`; bindings, modules, or globalOutbound grant ambient authority. With loader only, environment maps are empty; node:fs/http/https are absent; outbound fetch, WebSocket, node:net, and node:tls are denied; DNS is unresolved. Runtime builtins remain through \`import()\` and \`process.getBuiltinModule()\`, including node:path and cloudflare:workers; this set can drift. Timers, process, crypto, WebSocket, and data: fetch remain. Avoid every runtime-only capability because QuickJS fails.
 
-\`Date.now()\` is the run's start and does not advance; \`Math.random()\` is seeded per run.
-
 ## Examples
 
 One read-only call at a known address:
@@ -113,10 +102,6 @@ Connector guides appear in \`skills({})\` and discovery with an exact \`guide\`
 `;
 /** Shared Connecta routing guidance, byte-identical across deployments. */
 export const USAGE_SKILL = USAGE_SKILL_BASE + CONNECTOR_GUIDES_SECTION;
-/** The always-loaded MCP `instructions` string. */
-export function instructionsFor(resumableWrites) {
-    return resumableWrites ? CONNECTA_INSTRUCTIONS : READ_ONLY_PROGRAM_INSTRUCTIONS;
-}
 /** True when at least one of `connectors` carries a usage guide. */
 export function hasConnectorGuides(connectors) {
     return connectors.some((connector) => connectorGuide(connector) !== undefined);

package/dist/storage/file.js

@@ -2,6 +2,23 @@ import { chmodSync, closeSync, existsSync, futimesSync, mkdirSync, openSync, rea
 import { randomUUID } from "node:crypto";
 import { hostname } from "node:os";
 import { dirname, resolve } from "node:path";
+function validEntry(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) &&
+        "value" in value && typeof value.value === "string" &&
+        (!("exp" in value) || (typeof value.exp === "number" && Number.isFinite(value.exp)));
+}
+function makeEntry(value, ttlSeconds) {
+    if (ttlSeconds !== undefined && !Number.isFinite(ttlSeconds)) {
+        throw new RangeError("ttlSeconds must produce a finite expiration timestamp");
+    }
+    if (!ttlSeconds)
+        return { value };
+    const exp = Date.now() + ttlSeconds * 1000;
+    if (!Number.isFinite(exp)) {
+        throw new RangeError("ttlSeconds must produce a finite expiration timestamp");
+    }
+    return { value, exp };
+}
 const HEARTBEAT_MS = 15_000;
 const STALE_LOCK_MS = 60_000;
 const localLocks = new Map();
@@ -272,12 +289,19 @@ export function fileStorage(path, opts = {}) {
             // Non-POSIX filesystem or a race on the file — leave the mode as-is.
         }
     };
-    let data = {};
+    let data = Object.create(null);
     try {
         if (existsSync(path)) {
             tighten();
             try {
-                data = JSON.parse(readFileSync(path, "utf8"));
+                const loaded = JSON.parse(readFileSync(path, "utf8"));
+                if (loaded === null || typeof loaded !== "object" || Array.isArray(loaded)) {
+                    throw new TypeError("Expected a state object");
+                }
+                if (!Object.values(loaded).every(validEntry)) {
+                    throw new TypeError("Expected string values and finite expiry timestamps");
+                }
+                data = Object.assign(Object.create(null), loaded);
             }
             catch (error) {
                 // Never let a damaged state file be silently replaced by an empty one:
@@ -299,7 +323,7 @@ export function fileStorage(path, opts = {}) {
                     `moved to ${quarantine}, starting from empty state. Downstream ` +
                     `OAuth connectors must be re-authorized and stored credentials ` +
                     `re-entered.`);
-                data = {};
+                data = Object.create(null);
             }
         }
     }
@@ -315,13 +339,14 @@ export function fileStorage(path, opts = {}) {
         // Reads only prune memory; they do not rewrite the state file.
         const now = Date.now();
         for (const [key, entry] of Object.entries(data)) {
-            if (entry.exp && now > entry.exp)
+            if (entry.exp !== undefined && now >= entry.exp)
                 delete data[key];
         }
         const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
         // 0o600 on the tmp file; the atomic rename below preserves it, so the live
         // state file is never briefly world-readable.
         const fd = openSync(tmp, "wx", 0o600);
+        let committed = false;
         try {
             try {
                 writeFileSync(fd, JSON.stringify(data));
@@ -331,9 +356,13 @@ export function fileStorage(path, opts = {}) {
             }
             lock.assertHeld();
             renameSync(tmp, path);
+            committed = true;
         }
         finally {
-            rmSync(tmp, { force: true });
+            // A successful rename already removed the temp path. Cleanup must not
+            // turn a committed snapshot into a failure that callers roll back.
+            if (!committed)
+                rmSync(tmp, { force: true });
         }
         tighten();
     };
@@ -341,7 +370,7 @@ export function fileStorage(path, opts = {}) {
         const e = data[key];
         if (!e)
             return null;
-        if (e.exp && Date.now() > e.exp) {
+        if (e.exp !== undefined && Date.now() >= e.exp) {
             delete data[key];
             return null;
         }
@@ -358,19 +387,32 @@ export function fileStorage(path, opts = {}) {
         async set(key, value, opts) {
             assertOpen();
             lock.assertHeld();
-            data[key] = {
-                value,
-                ...(opts?.ttlSeconds
-                    ? { exp: Date.now() + opts.ttlSeconds * 1000 }
-                    : {}),
-            };
-            persist();
+            const previous = fresh(key);
+            data[key] = makeEntry(value, opts?.ttlSeconds);
+            try {
+                persist();
+            }
+            catch (error) {
+                if (previous)
+                    data[key] = previous;
+                else
+                    delete data[key];
+                throw error;
+            }
         },
         async delete(key) {
             assertOpen();
             lock.assertHeld();
+            const previous = fresh(key);
             delete data[key];
-            persist();
+            try {
+                persist();
+            }
+            catch (error) {
+                if (previous)
+                    data[key] = previous;
+                throw error;
+            }
         },
         async list(prefix) {
             assertOpen();
@@ -395,12 +437,7 @@ export function fileStorage(path, opts = {}) {
                 delete data[key];
             }
             else {
-                data[key] = {
-                    value: next,
-                    ...(opts?.ttlSeconds
-                        ? { exp: Date.now() + opts.ttlSeconds * 1000 }
-                        : {}),
-                };
+                data[key] = makeEntry(next, opts?.ttlSeconds);
             }
             try {
                 persist();

package/dist/storage/memory.js

@@ -13,6 +13,13 @@ export function memoryStorage() {
         return e;
     };
     const write = (key, value, ttlSeconds) => {
+        if (ttlSeconds !== undefined && !Number.isFinite(ttlSeconds)) {
+            throw new RangeError("ttlSeconds must produce a finite expiration timestamp");
+        }
+        const exp = ttlSeconds ? Date.now() + ttlSeconds * 1000 : undefined;
+        if (exp !== undefined && !Number.isFinite(exp)) {
+            throw new RangeError("ttlSeconds must produce a finite expiration timestamp");
+        }
         // Rotate through at most 16 existing keys. Live entries cannot keep an
         // expired tail resident forever, and no request starts a background job.
         for (let i = 0; i < 16; i++) {
@@ -25,7 +32,7 @@ export function memoryStorage() {
         }
         map.set(key, {
             value,
-            ...(ttlSeconds ? { exp: Date.now() + ttlSeconds * 1000 } : {}),
+            ...(exp !== undefined ? { exp } : {}),
         });
     };
     return {

package/dist/tool-safety.d.ts

@@ -20,7 +20,7 @@ export interface ApprovalPolicy {
 }
 export declare const NO_EXEMPTIONS: ApprovalPolicy;
 /**
- * Whether a program may call this tool without pausing for approval.
+ * Whether a program may call this tool without asking for approval.
  *
  * Only a tool that is *not* explicitly read-only can be exempt — a read-only
  * tool needs no exemption, and reporting one would blur the two classes an

package/dist/tool-safety.js

@@ -14,7 +14,7 @@ export const NO_EXEMPTIONS = {
     tools: new Map(),
 };
 /**
- * Whether a program may call this tool without pausing for approval.
+ * Whether a program may call this tool without asking for approval.
  *
  * Only a tool that is *not* explicitly read-only can be exempt — a read-only
  * tool needs no exemption, and reporting one would blur the two classes an

package/dist/types.d.ts

@@ -253,8 +253,8 @@ export interface Connector {
     /**
      * This connector's own default for its tools that are not explicitly
      * read-only, inside `execute_code`: `"never"` lets a program call them
-     * without pausing for approval. Reserved for connectors connecta ships
-     * whose writes are cheap to undo (the planned artifacts connector, whose
+     * without asking for approval. Reserved for connectors connecta ships
+     * whose writes are cheap to undo (the artifacts connector, whose
      * every write is a new immutable version); a deployment's own connectors
      * leave it unset and exempt through `execute.approval`, which overrides
      * this either way. Never read from a downstream catalog — a server cannot

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export declare const CONNECTA_VERSION = "0.26.3";
+export declare const CONNECTA_VERSION = "0.28.0";

package/dist/version.js

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.26.3";
+export const CONNECTA_VERSION = "0.28.0";

package/documentation/architecture.md

@@ -61,7 +61,7 @@ top to bottom.
 | 2 | MCP preflight | Allowed `OPTIONS` on `/mcp*`: 204 without admission or auth. |
 | 2 | Other `OPTIONS` | Auth metadata first, otherwise compatibility CORS preflight. |
 | 3 | `/.well-known/*` | Auth metadata, or 404. |
-| 4 | `/health` | Open and payload-free: health, executor, whether resumable writes are on, admission, and deployment metadata, with drift as stable short hashes. |
+| 4 | `/health` | Open and payload-free: health, executor, admission, and deployment metadata, with drift as stable short hashes. |
 | 5 | `/oauth/callback/<connectorId>` | Core downstream OAuth completion, state and personal-ownership checked, independent of the UI. |
 | 6 | `/mcp`, `/mcp/<pool>` | Admission, then auth, then a request-local MCP server. An undeclared pool, a refusing grant, and a throwing grant are one identical 404; see [pools](./auth.md#pools). |
 | 7 | Other paths | 404. Custom HTTP routes belong to the deployment. |
@@ -94,7 +94,7 @@ An admitted non-preflight `/mcp` request then takes five steps in
 5. **Serve.** Refuse `?toolkit=` with a 404 — the toolkits are gone
    ([#178](https://github.com/zackbart/connecta/issues/178)) but their URLs were
    handed out, and retiring a scoping boundary into fail-open is worse than any
-   404 — then register the eight meta-tools on a fresh `McpServer`
+   404 — then register the seven meta-tools on a fresh `McpServer`
    (`test/server.test.ts`, `test/code-first-surface.test.ts`).
 
 ## Layers below the meta-tools
@@ -109,7 +109,7 @@ or hands out, and a change usually belongs in exactly one of them:
 | `src/invocation.ts` | One tool call: argument validation, call admission, one-attempt timeout, provider retry hints, result unwrapping, size capping, and the activity record. |
 | `src/catalog.ts` | Ranking, description summarizing, and the compact and TypeScript schema renderers discovery shows. |
 | `src/result-shapes.ts` | Bounded runtime-only inference and merging for output shapes learned from successful read-only calls whose providers declared none. |
-| `src/resumable.ts`, `src/run-journal.ts` | Resumable writes: a program's host-call numbering, the write gate that pauses it, the journal a paused run becomes, the replay `resume_execution` plays from it, and the claim and write-ahead marks that keep an approved write to at most one send. |
+| `src/exempt-writes.ts` | The writes a program may send, which config exempted from asking: the write budget's default, what a dispatched write's outcome says about whether it landed, and the tracking that lets one outlive the program without hiding an unknown outcome. Every other program write is refused before it reaches this. |
 
 `src/meta-tools.ts` and `src/execute.ts` are two front doors onto the same two
 services, `CatalogService` and `InvocationService`. That is the point: a
@@ -222,12 +222,10 @@ successful call's preview and a paging-unavailable notice rather than a result i
 A second optional method, `compareAndSet(key, expected, next, options?)`, is an
 atomic claim: `null` means absent (expired counts) on the way in and delete on
 the way out. A successful write accepts the same optional `ttlSeconds` as
-`set`. Resumable writes require it: of two `resume_execution` calls racing
-for one paused run exactly one may win, and every write that run sends is
-marked on its header first, so a read and a write standing in for the claim
-could send an approved write twice. Omitted, `execute.resumableWrites` is on
-exactly when the store has it, and asking for it over a store without it
-refuses to construct. Downstream OAuth uses it where the store has it, so
+`set`. Artifacts require it, because every write commits by swapping a head,
+and so does issuing access tokens; a read and a write standing in for the
+claim would let two writers both win. Downstream OAuth uses it where the store
+has it, so
 resealing legacy plaintext and discarding a refused grant cannot overwrite a
 consent that landed in between, and falls back to a read and a write where it
 does not.
@@ -330,7 +328,7 @@ owner admitted to `set_refresh` is stored with the program. Every run rechecks
 that identity's current `connectorAccess` and pool grant, including continued
 access to `artifacts.set_refresh`, then intersects those grants with shared
 connectors. Revoking either grant stops later runs.
-Resumable writes and approval exemptions are off. A refused call fails the
+Approval exemptions are off, so a refresh writes nothing. A refused call fails the
 entire refresh even if its program catches the error. The head CAS claims one
 run per artifact; the data commit checks the claim ID and program version in
 the same CAS. The claim deadline starts before executor admission and aborts
@@ -407,7 +405,8 @@ shape from building, in someone else's repository rather than this one.
 
 ## Effect inside
 
-The core runs on Effect v4; no API a deployment touches does. `createConnecta`,
+The core runs on stable Effect v4, exact-pinned to `4.0.0`; no API a deployment
+touches does. `createConnecta`,
 `remoteMcp()`, `api()`, the `Connector` contract, and every shipped `.d.ts`
 are Promise-shaped and name no Effect type, so a connector author never meets a
 second async paradigm. The reason for the rewrite is the first section of this
@@ -482,7 +481,6 @@ would be another partition's.
 | Admission (`executor-admission.ts`, `call-admission.ts`) | Queued waiters are Deferreds settled by whoever removes them from the queue; a wait is one flat race of grant, Clock timeout, and signal. The uncontended path stays synchronous. Two controllers, as [#453](https://github.com/zackbart/connecta/issues/453) requires. |
 | One tool call (`invocation.ts`) | One fiber: resolution, the read-only and schema refusals, admission, and the downstream attempt sit under a single `withDeadlineEffect`, whose expiry interrupts the call wherever it is. The permit is an `acquireRelease`; the connector call is `Effect.tryPromise` over the unchanged `Connector`. |
 | `execute_code` (`execute.ts`) | One fiber whose Scope owns the run's signal and executor lease, so a result, a throw, the watchdog, and cancellation all release the lease and abort the signal the same way. The executor's `acquire()` and `execute()` stay Promises raced against the signal and `execute.watchdogMs`. Each guest host call is a fiber of its own. |
-| Resumable writes (`resumable.ts`) | A play's stop is a Deferred its write gate completes, raced against the executor like the watchdog; the gate for call n awaits the decision Deferreds of every lower-numbered call; header writes are one compare-and-set at a time on a per-play turn. A paused run holds nothing request-bound — its journal is data, and the next play is a new request's. |
 | Discovery (`catalog-service.ts`) | A request-scoped cache: one shared read per connector (`runtime/shared-read.ts`), settled by the read itself and carrying its own signal and the probe timeout whichever asker starts it. Each asker waits under its own deadline and signal, so one that times out or is cancelled fails alone, and the read is cancelled only once every asker has gone. Fan-out is `Effect.forEach` under the discovery concurrency. |
 | Registry (`registry.ts`) | Catalog persistence and the result stash are programs over `Storage`. A refresh flight is a Deferred its publishing request completes, bounded by its owner's deadline (the default probe timeout when it has none); persisted-catalog writes take per-connector turns, each a Deferred its own request completes. Same-request loads share one read the way discovery's do. |
 | Remote MCP (`connectors/remote-mcp.ts`) | Each request scope's state holds a Scope, each connection is a lease forked from it, and a connect in flight is a Deferred carrying the client it connected. Closing a session and the transport are each bounded to a second. |
@@ -569,8 +567,47 @@ the operator and activity routes cost about +100 KB gzip on `./ui` and +130 KB
 on `./activity`, and matching the wire format meant opting out of most of what
 it does: unowned paths fall through rather than 404, a wrong method is a JSON
 405, and the content-type and size checks run before a body is read. The root
-entry may import only `effect` itself (`test/purity.test.ts`); nothing in
-`src/` uses `effect/unstable/*`, which would have to stay behind a subpath.
+entry may import only `effect` itself (`test/purity.test.ts`). Effect v4's
+area imports, such as `effect/http-api` and `effect/ai`, would have to stay
+behind a subpath. APIs tagged `@stability unstable` can still change in minor
+releases, so stable v4 keeps the exact pin.
+
+The stable `4.0.0` release was re-evaluated on 2026-10-01 with
+[`scripts/probes/effect-v4-evaluation.mjs`](https://github.com/zackbart/connecta/blob/main/scripts/probes/effect-v4-evaluation.mjs).
+Run `npm run build`, then `node scripts/probes/effect-v4-evaluation.mjs output.json`.
+The [raw observations](https://github.com/zackbart/connecta/blob/main/scripts/probes/effect-v4-evaluation-2026-10-01.json)
+are synthetic Node requests and neutral esbuild bundles, not live-client or
+workerd lifetime verification. Bundle figures add representative prototypes
+alongside the current code; they do not claim savings from removing old code.
+
+Two native input schemas with validation and JSON Schema rendering add 62,148
+bytes gzip to the root, taking it from 303,083 to 365,231 against a 339,526
+cap. Effect can reject excess properties when both decoding and rendering use
+`onExcessProperty: "error"`; its default strips them. The generated schemas
+still differ from the exact meta-tool goldens, including record rendering and
+composed numeric bounds. A Schema replacement would need to preserve that
+contract and memoized rendering. Both MCP SDK packages still depend on Zod,
+so changing our inputs alone does not remove Zod from an installation.
+
+A one-endpoint `HttpApi` prototype adds 106,634 bytes gzip to `./ui` and 106,453
+to `./activity`. Even plain `HttpRouter` adds 45,324 to `./ui`, taking it to
+130,023 against a 128,983 cap. Both default handlers return an empty 404 for a
+wrong method and an unowned path; our routes need a JSON 405 for the former
+and module fallthrough for the latter. Their `toWebHandler` also builds its
+layer immediately and owns a runner, so adopting it would require proving
+global-scope safety and preserving our scheduler and response-lifetime rules.
+The existing Effect route programs keep those rules without this routing layer.
+
+Effect's MCP server has a separate compatibility gate. Its `2026-07-28`
+adapter accepted a stateless `tools/list`, but its `2025-06-18` adapter refused
+a fresh request with 400. Initialization issued a session, and that session's
+next request returned 404 on a fresh handler; Connecta served the same fresh
+legacy list with 200 JSON and no session. The stable package exports no MCP
+client, so it also cannot replace our downstream SDK and OAuth implementation.
+[Issue #622](https://github.com/zackbart/connecta/issues/622) records the server
+parity requirements. These measurements support keeping the current MCP,
+validation, and routing implementations; stable v4 alone does not establish a
+replacement's benefit or compatibility.
 
 The core's cost is recorded rather than guessed. Against 0.24.4 the root entry
 grew from 235,346 to 279,526 bytes gzip, the Worker example from 263,949 to

package/documentation/auth.md

@@ -64,9 +64,10 @@ also work on older adapters without `compareAndSet`; **new issuance requires
 atomic `compareAndSet`**, because counting records before writing admits too many
 concurrent creates. Active capacity defaults to 100, configurable with
 `accessTokens(storage, { maxActive: 200 })`, up to 1,000. A durable reservation
-counts before a secret is written. An interrupted create can consume capacity
-without returning a token; it is never automatically retried or released after
-an uncertain write. Avoid creating new tokens through old-version instances once
+counts before a secret is written. Failures before lookup publication release
+their reservation; an uncertain lookup write retains its metadata and capacity
+so an operator can revoke it, even when creation returned no secret. Creation is
+never automatically retried. Avoid creating new tokens through old-version instances once
 new-version issuance has started, since those instances do not honor reservations.
 
 Secrets contain 256 random bits and only their SHA-256 digests persist. Creation
@@ -285,7 +286,9 @@ remoteMcp("linear", { url: "https://mcp.linear.app/mcp", authScope: "personal",
 A personal connector is absent — not refused — from any request without a
 stable namespaced principal. For a principal that can see one, connecta
 partitions connector storage, vault records, catalog caches, OAuth generations,
-and observed result shapes under an opaque SHA-256 identity key. Keep namespaces
+and observed result shapes under an opaque SHA-256 identity key. Refreshes
+coalesce within one owner; another owner's authorization epoch cannot retire
+that refresh. Keep namespaces
 and principal ids stable across upgrades; changing either selects different
 partitions. Literal `auth: { type: "headers" }` cannot be personal, because its
 secret lives in deployment code; `remoteMcp()` refuses that combination at