Four MCP Tools Died the Same Day. One Unpinned SDK Dependency Killed Three.

Three servers in different repos, different languages, different purposes, all dead on the same morning. Independent failures don't synchronize — a shared unpinned dependency does. Plus why pinning everything is the wrong fix, and the delegation rule that let a subagent dump eight secrets into its own transcript.