Design: mcpx elicitation era edges — downgrade rich enums for old hosts, complete the -32042 circuit, close the stale url row #2077

No Drew direction decision needed — origin #1935's acceptance is explicit; the judgment calls (multi-select refused to old hosts rather than flattened; -32042 production gated on a declared, undeliverable URL question; the script hook stays a documented question) are recorded in the design doc with their reasons.

Summary

Design originated by the repo design architect (pass 11, 2026-10-28) from origin umbrella #1935 (relocated from dezren39/darwin-nix#214) and its compare-register rows ELI-04 / ELI-09 / ELI-12 / ELI-21 in pkgs/mcpx/docs/compare/register/elicitation.md, audited against current main 26221fcc. Full design doc: files/designs/code-mcpx-elicitation-era-edges.md in the keep-the-four-repos-healthy goal workspace.

Audit verdict per row:

• ELI-04 — OPEN. Question.paramsFor (pkgs/mcpx/internal/mcpserver/conn.go ~L465-507) strips mode/elicitationId per era but never rewrites requestedSchema: a 2025-11-25 upstream's rich enums (titled/untitled, single/multi-select, SEP-1330) reach a 2025-06-18 host verbatim, and a strict old host rejects the whole elicitation/create.
• ELI-09 — LANDED (register is stale). Client.capabilities (pkgs/mcpx/internal/mcpclient/modern.go ~L71-84) declares elicitation.url whenever a server-request handler is installed, in both eras; the pool installs that handler for every upstream connection (pkgs/mcpx/internal/pool/pool.go:508); elicitModeDeclared gates url questions on the negotiated revision. mcpx: elicitation edges — enum downgrade for 2025-06-18, url mode upstream, -32042, and a script-side answer hook #1935's ELI-09 acceptance bullet is met — what remains is the register truth-up (Phase 3), not code.
• ELI-12 — OPEN, both directions. -32042 appears nowhere in internal/mcpclient or internal/daemon (grep-verified): an upstream's -32042 propagates as an opaque rpcError and the call fails — no URL flow, no retry. Server-side, conformance gap elicitation-server-must-return-32042 (internal/conformance/coverage_clientfeatures.go) stands against the 2025-11-25 MUST.
• ELI-21 — OPEN, deliberately NOT a phase. docs/elicitation.md §5.2 designs an onElicit script global and marks it "NOT BUILT" itself; mcpx: elicitation edges — enum downgrade for 2025-06-18, url mode upstream, -32042, and a script-side answer hook #1935's acceptance offers the alternative ending "or the broker-only path is documented as the deliberate design". The unsettled core is routing precedence (broker Route sends credential/consent questions to a human on purpose — may a script handler answer those?) plus the call-vs-script correlation docs/protocol.md ~L379-382 names. Recorded as an open question in the design doc with the evidence assembled; no phase filed for it.

Proposal (recorded decisions)

• Phase 1 — enum downgrade at the rendering seam. In paramsFor, for a pre-2025-11-25 peer: titled single-select (oneOf[{const,title}]) → enum+enumNames; untitled/legacy shapes pass through. Multi-select has no 2025-06-18 representation (form schemas are flat primitives — no array type), and flattening would change the answer's type (string[]→string) so the upstream's own validation rejects what mcpx elicited — so a multi-select question is not sendable to that peer (the Sendable refusal pattern url mode already uses) and stays with the era-less broker. No answer back-mapping is needed for downgraded single-selects (host answers the const, the value in both eras).
• Phase 2 — client-side -32042: complete the circuit. On a connection negotiated at 2025-11-25, a -32042 call error's data.elicitations (url-mode + elicitationId, per the spec MUSTs) are opened as broker URL questions through the existing elicitViaBroker path — full URL shown, consent, completion notification already handled (internal/daemon/hooks.go ~L57-68) — and on completion the original call is retried exactly once. Decline/expiry/second -32042 surface as errors; malformed data passes the original error through. Era-scoped to exactly the revision that defines the code (2026 reserves it; pre-2025-11-25 doesn't have it).
• Phase 3 — server-side -32042 + truth-up + mcpx: elicitation edges — enum downgrade for 2025-06-18, url mode upstream, -32042, and a script-side answer hook #1935 closure. Produce -32042 only when all hold: host negotiated 2025-11-25, host declared elicitation.url, a URL question from that call is pending, and it cannot be delivered inline; data.elicitations lists exactly the blocking questions with ids. Never for form, never when inline delivery works, never at 2026. An unhandled upstream -32042 is relayed only to url-declared hosts. Plus: register rows ELI-04/09/12 updated to as-built (ELI-09 landed, with evidence), gap elicitation-server-must-return-32042 retired or recorded partial, and completion evidence on mcpx: elicitation edges — enum downgrade for 2025-06-18, url mode upstream, -32042, and a script-side answer hook #1935 against every acceptance bullet — closing it iff all are met, ELI-21's bullet answered by the documented-question record.

Alternatives considered and risks are in the design doc (flattening multi-select — rejected, corrupts answer type; downgrading at broker intake — rejected, era translation belongs at the era boundary; generic all-era -32042 handling — rejected, era discipline; unbounded retry — rejected; filing onElicit as a phase — rejected this run, genuine open question).

Phased breakdown

• Phase 1: enum downgrade for pre-2025-11-25 hosts (internal/mcpserver/conn.go: paramsFor rewrite + multi-select Sendable refusal). Filed as a sub-issue of this issue, triage packet enqueued.
• Phase 2: client-side -32042 — broker URL questions + one retry (internal/mcpclient call path + internal/daemon). Independent of Phase 1 in code. Filed as a sub-issue, triage packet enqueued.
• Phase 3: server-side -32042 production + register truth-up + mcpx: elicitation edges — enum downgrade for 2025-06-18, url mode upstream, -32042, and a script-side answer hook #1935 closure. Gated on Phases 1–2. Filed as a sub-issue (status/blocked), triage packet enqueued.

Open questions stay in the design doc, not as issues: ELI-21 routing precedence + script correlation; ELI-05 defaults across the same boundary (Phase 1 triage checks the downgrade interaction); mcpx-originated URL elicitation; ELI-11's unexercised completion emitter.

Distinct from neighbours: #1753 (capability gating — its CanElicit shape reading is a reused seam), #1675 (broker storage/UI hygiene), #1481/#1484 (schema validation of answers), #1834 (sampling relay).

🤖 agent-note:v1 — filed by the design-architect job (pass 11, developing-today/code) per the design doc above. Origin: #1935 (ex dezren39/darwin-nix#214). Audit basis: main 26221fcc, 2026-10-28.

Acceptance criteria

• Phases 1–3 are filed and implemented: mcpx: Phase 1 of #2077 — downgrade rich enum schemas for pre-2025-11-25 hosts (multi-select withheld, not flattened) #2078 (enum downgrade / multi-select withheld), mcpx: Phase 2 of #2077 — handle upstream -32042: open the URL elicitations at the broker and retry the call once #2079 (upstream -32042 handling + single retry), mcpx: Phase 3 of #2077 — produce -32042 where it is true, register truth-up (ELI-04/09/12), and #1935 closure #2080 (-32042 production + register truth-up).
• Register rows ELI-04, ELI-09, ELI-12, ELI-21 in pkgs/mcpx/docs/compare/register/elicitation.md match as-built state (ELI-09's staleness corrected).
• Umbrella mcpx: elicitation edges — enum downgrade for 2025-06-18, url mode upstream, -32042, and a script-side answer hook #1935's acceptance is met and mcpx: elicitation edges — enum downgrade for 2025-06-18, url mode upstream, -32042, and a script-side answer hook #1935 is closed via Phase 3 (mcpx: Phase 3 of #2077 — produce -32042 where it is true, register truth-up (ELI-04/09/12), and #1935 closure #2080).