Structured retry Conversation reuse, AgentAsTool parent bounds, durable sandbox
HITL lease, Bash process-group kill, shared nested usage, unified env_deny, and
MCP connect absolute deadline.