@assuredloop/orca-bot-kit 0.19.0 → 0.21.0

package/README.md

@@ -344,6 +344,12 @@ settings ([ADR 0022](docs/adr/0022-kit-hooks-live-in-the-bot-folder.md)). Your o
 settings in those files are kept. Codex asks you to trust a hooks file the first
 time it sees one; answer its question in the tab.
 
+A Claude bot gets one more hook there. Claude Code's own messaging reaches every
+Claude session on the machine, so after a session sends a native message to an
+address that is none of your bots folder's sessions, the hook tells it so, and
+names the address `obk message to` would have given. The message goes either
+way ([ADR 0032](docs/adr/0032-a-native-message-outside-the-fleet-is-warned-about.md)).
+
 So: kill a tab, or reboot, and `obk up` brings the session back with the
 conversation it was having, rather than starting a new one. Clear a session —
 `/clear` on Claude Code, `/new` on Codex — and the kit writes down the new id,
@@ -615,7 +621,9 @@ real Orca and the real harnesses on your own machine. No CI runner can do that,
 so these are run by hand before a change that touches Orca or a harness is
 merged. A system test touches only what it creates and removes it afterwards,
 except the mailbox Runs Orca gives no way to delete, which the run names; it
-never closes a tab it did not open.
+never closes a tab it did not open. The trust its harnesses write into your
+`~/.codex/config.toml` and `~/.claude.json` for the run's own throwaway folders
+is taken out again after the run, and named; nothing else in them is changed.
 
 They run on the machine the command is typed on, so the command will not start
 them by itself. On its own it says what it is about to drive — whose machine,

package/SETUP.md

@@ -194,10 +194,10 @@ waiting for:
 | On screen | Send | Which is | Proven on |
 |---|---|---|---|
 | Claude Code's folder trust list | `\x1b[B\r` | down, then return: its selection starts on **No, exit** | Claude Code 2.1.283 |
-| Codex's directory trust, `1. Trust and continue` (older: `1. Yes, continue`) | `\r` | return: its selection starts on **Trust and continue** | Codex 0.158.0 |
-| Codex's `Hooks need review` | `\x1b[B\r` | down, then return, to **Trust all and continue**; if the selection already starts there, return alone | Codex 0.158.0 |
-| Codex's `/new`: `Where should the new conversation run?` | `\r` | return: its selection starts on **Current checkout** (bot home) | Codex 0.158.0 |
-| Codex's update offer, `1. Update now` | `\r` | return: its selection starts on **Update now**, which accepts it | Codex 0.156.1; seen on 0.157.1 (offering 0.158.0) with the selection on **Update now**, not pressed; 0.158.0 has had no newer release to offer |
+| Codex's directory trust, `1. Trust and continue` (older: `1. Yes, continue`) | `\r` | return: its selection starts on **Trust and continue** | Codex 0.160.0 |
+| Codex's `Hooks need review` | `\x1b[B\r` | down, then return, to **Trust all and continue**; if the selection already starts there, return alone | Codex 0.160.0 |
+| Codex's `/new`: `Where should the new conversation run?` | `\r` | return: its selection starts on **Current checkout** (bot home) | Codex 0.160.0 |
+| Codex's update offer, `1. Update now` | `\r` | return: its selection starts on **Update now**, which accepts it | Codex 0.156.1; seen on 0.157.1 (offering 0.158.0) with the selection on **Update now**, not pressed; 0.158.0 offered 0.160.0, taken on 2026-10-02 by Bot Father's restarts |
 | `[oh-my-zsh] Would you like to update?` | `n` | they update their own shell | oh-my-zsh bf77e35 |
 | Claude Code's `Teach auto mode about your environment?` | `\x1b` | Esc, which cancels it (**Not now**). On 2.1.283 it is a form, not a list: `How you use Claude here`, `Also scan shell history`, `Also scan your other repos`, `Continue`, and `Enter to continue · Esc to cancel`. **Never send a return**: Enter is **Continue**, which starts a scan of the project, recent Claude sessions and, by default, the machine's shell history | Not yet proven: Esc cancels in Claude Code 2.1.283's code, not yet seen live (#370); the form was seen live twice on 2.1.283, in #261's live test and #239's live run 1 (#416); 2.1.278 showed a numbered list, answered with 2. Not now |
 
@@ -217,7 +217,7 @@ empty book and nothing says why.
 Codex's trust question applies to the **repository root**, which for a bot means
 the whole bots folder rather than the one bot. That is what they are agreeing to.
 
-Codex's `/new` question (seen on 0.156.1, 0.157.1 and 0.158.0) is always answered with the current checkout, which is the bot
+Codex's `/new` question (seen on 0.156.1, 0.157.1, 0.158.0 and 0.160.0) is always answered with the current checkout, which is the bot
 home. The kit never makes a git worktree, so
 `2. New worktree` is never the answer.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assuredloop/orca-bot-kit",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -35,7 +35,8 @@
     "yaml": "2.9.0"
   },
   "devDependencies": {
-    "@stryker-mutator/core": "10.0.0"
+    "@stryker-mutator/core": "10.0.0",
+    "smol-toml": "1.9.0"
   },
   "overrides": {
     "typed-rest-client": {

package/rules/temporary.md

@@ -4,18 +4,17 @@ title: Temporary sessions of your own
 applies: all
 ---
 
-For a piece of work that wants a helper, a long-lived session may make a
-temporary session of its own bot, without asking Bot Father:
+For a piece of work that wants a helper, a session may make a temporary
+session of its own bot, without asking Bot Father:
 `"${OBK_CLI:-obk}" temp make --bots <bots> --name <name> --prompt <the task>`,
 run in your own tab. It takes your settings unless you say otherwise, and gets
-a work dir, a tab and a mailbox.
+a work dir, a tab and a mailbox. A temporary session may make one of its own,
+one at a time; one made by a temporary session makes none.
 
 A new tab can stop on a first-run screen. Answer it yourself, from the table
 the command's output points to.
 
-Retire it when its work is done:
+Retire it when its work is done, and what it made goes with it:
 `"${OBK_CLI:-obk}" temp retire --bots <bots> --name <name>`. Before you make
-another, first retire any of yours whose work is done.
-
-You manage only the temporary sessions you made; a temporary session makes
-none of its own. Every other session is Bot Father's to make, change or retire.
+another, first retire any of yours whose work is done. You manage only the
+temporary sessions you made; every other session is Bot Father's.

package/skills/obk-bot-building/SKILL.md

@@ -288,9 +288,9 @@ otherwise `/Applications/Orca.app/Contents/Resources/bin/orca`. A bare
 | On screen | Send | Which is | Proven on |
 |---|---|---|---|
 | Claude Code's trust list | `\x1b[B\r` | down, return: off **No, exit** | Claude Code 2.1.283 |
-| Codex's `Trust this folder?` | `\r` | return: it starts on yes | Codex 0.158.0 |
-| Codex's `Hooks need review` | `\x1b[B\r` | **Trust all and continue** | Codex 0.158.0 |
-| Codex's `Where should the new conversation run?` | `\r` | **Current checkout** | Codex 0.158.0 |
+| Codex's `Trust this folder?` | `\r` | return: it starts on yes | Codex 0.160.0 |
+| Codex's `Hooks need review` | `\x1b[B\r` | **Trust all and continue** | Codex 0.160.0 |
+| Codex's `Where should the new conversation run?` | `\r` | **Current checkout** | Codex 0.160.0 |
 | Codex's update offer, `1. Update now` | `\r` | **Update now**, where it starts | Codex 0.156.1 |
 | `[oh-my-zsh] Would you like to update?` | `n` | no: the user updates it | oh-my-zsh bf77e35 |
 | Claude Code's `Teach auto mode…` | `\x1b` | Esc: Not now; no return | Not yet proven, below |
@@ -302,7 +302,8 @@ return: on Codex's update offer that took the highlighted **Update now**,
 whatever the digit was. Codex's trust said `1. Yes, continue` on older
 versions. Its hooks review sometimes starts on `2` already: then return alone.
 Its update offer was proven on 0.156.1; 0.157.1 showed it with the selection on
-Update now, not pressed, and 0.158.0 has had no newer release to offer.
+Update now, not pressed, and 0.158.0 offered 0.160.0, taken on 2026-10-02 by
+Bot Father's restarts.
 Claude Code's `Teach auto mode` on 2.1.283 is a form, not a list, ending
 `Enter to continue · Esc to cancel`: never send it a return, since
 Enter is Continue, which scans the project, recent sessions and the machine's
@@ -313,7 +314,7 @@ question matters most. The kit's hook is how the book learns which
 conversation the session is running, and until it is answered the
 conversation has not started. Codex's trust applies to the repository root,
 which is the whole bots folder. Codex's `/new` may ask where the new
-conversation runs (0.156.1, 0.157.1 and 0.158.0 all did); the answer is
+conversation runs (0.156.1, 0.157.1, 0.158.0 and 0.160.0 all did); the answer is
 always the current checkout, the bot home, and never `2. New worktree`:
 the kit never makes a git worktree.
 

package/src/cli.js

@@ -24,6 +24,7 @@ import { pauseSessions, unpauseSessions } from './pause.js';
 import { recordSession, SHELL_ENV, TAB_ENV } from './record.js';
 import { restartSessions } from './restart.js';
 import { retireBot, retireSession } from './retire.js';
+import { sentWarning } from './sent.js';
 import { readRoster } from './roster.js';
 import { buildAgents, buildRules, CODEX_CAP } from './rules.js';
 import { addSkill, buildSkills, linkSkills, removeSkill } from './skills.js';
@@ -90,28 +91,34 @@ Usage:
                             session with the conversation it was having.
   obk retire --bots <path> --bot <bot> [--session <name>]
                             End a session: close its tab and take it off the
-                            bot, keeping its conversations in the book. Or end
-                            a bot: close its tabs, remove its Orca project and
-                            move its folder to retired/. It will not retire a
-                            bot whose Orca project holds a tab your book does
-                            not name, and moves the folder only once Orca no
-                            longer lists the project.
+                            bot, keeping its conversations in the book, and
+                            first do the same for the temporary sessions it
+                            made, and theirs. Or end a bot: close its tabs,
+                            remove its Orca project and move its folder to
+                            retired/. It will not retire a bot whose Orca
+                            project holds a tab your book does not name, and
+                            moves the folder only once Orca no longer lists
+                            the project.
   obk temp make --bots <path> --name <session>
                 (--prompt <text> | --prompt-file <path>) [--harness claude|codex]
                 [--model <m>] [--effort <e>] [--context <c>]
                 [--approval ${APPROVALS.join('|')}] [--extra-arg=<arg>]...
-                            Run in a long-lived session's own tab: make a
-                            temporary session of that session's bot for a piece
-                            of work, and bring it up. It takes your harness,
-                            model, effort, context and approval unless you say
-                            otherwise; on another harness than yours it takes
-                            only your approval. It works in work/<session>, and
-                            has the task as its start prompt. The book records
-                            it as temporary, made by you.
+                            Run in a session's own tab: make a temporary
+                            session of that session's bot for a piece of work,
+                            and bring it up. A temporary session makes one at
+                            a time, and one it made makes none. It takes your
+                            harness, model, effort, context and approval unless
+                            you say otherwise; on another harness than yours
+                            it takes only your approval. It works in
+                            work/<session>, and has the task as its start
+                            prompt. The book records it as temporary, made by
+                            you.
   obk temp retire --bots <path> --name <session>
                             Run in the maker's own tab: retire a temporary
                             session it made, as obk retire does. It refuses a
                             long-lived session, or one another session made.
+                            Like obk retire, it first retires the temporary
+                            sessions that session made.
   obk temp trust-hooks --bots <path> --name <session>
                             Run in the maker's own tab: answer the hooks review
                             of a Codex temporary session it made with "Trust
@@ -217,19 +224,24 @@ Usage:
   obk usage --bots <path> [--bot <bot>] [--session <name>] [--since <time>] [--until <time>]
                             Say what your sessions have used: the conversations
                             each one had, their calls and tokens (their
-                            subagents' included, and how many were theirs), the
-                            models and efforts they ran at, and how often they
-                            were compacted. --since counts the calls made from
-                            that moment on, and --until the calls made before
-                            that one: a daily run asks from the last run's end
-                            up to its own, and the next starts where it stopped,
-                            so no call is counted twice. It counts tokens and
-                            never money: what a token costs is looked up live by
-                            whoever is asking.
+                            subagents' and Codex's auto-reviews included, and
+                            how many were whose), the models and efforts they
+                            ran at, and how often they were compacted. --since
+                            counts the calls made from that moment on, and
+                            --until the calls made before that one: a daily run
+                            asks from the last run's end up to its own, and the
+                            next starts where it stopped, so no call is counted
+                            twice. It counts tokens and never money: what a
+                            token costs is looked up live by whoever is asking.
   obk session record --bots <path> --bot <bot>
                             For the kit's own hook, not for typing: it reads
                             what the harness says about a session starting on
                             standard input and writes it into the book.
+  obk session sent --bots <path> --bot <bot>
+                            For the kit's own hook, not for typing: after a
+                            Claude session's native message, it warns the
+                            session when the address was none of this bots
+                            folder's own. It never stops a message.
   obk session mailbox --bots <path> --bot <bot> --session <name>
                             For the kit's own launch line, not for typing: run
                             in the session's own tab, it gives the session its
@@ -269,6 +281,7 @@ const COMMANDS = {
   'message send': ['bots', 'to', 'subject'],
   'message check': ['bots'],
   'session record': ['bots', 'bot'],
+  'session sent': ['bots', 'bot'],
   'session mailbox': ['bots', 'bot', 'session'],
   'temp make': ['bots', 'name'],
   'temp retire': ['bots', 'name'],
@@ -394,6 +407,10 @@ async function run(argv) {
     throw new Error(`--harness is ${HARNESSES.join(' or ')}, and got: ${values.harness}`);
   }
 
+  // The send hook is quiet whatever it is given, a bots folder that is not
+  // there included, so it goes before anything that can complain (ADR 0032).
+  if (command === SENT) return sent(path.resolve(values.bots));
+
   // One fleet, one identity, whatever spelling of its path was given (#164).
   const bots = command === 'init' ? path.resolve(values.bots) : sameFleet(path.resolve(values.bots));
   if (command === RECORD) return record(bots, values.bot);
@@ -457,8 +474,26 @@ const ANSWER_IT = [
   '             Anything you do not recognise gets no keypress: take it to the user.',
 ];
 
-/** The one command a harness runs rather than a person: the kit's hook. */
+/** The commands a harness runs rather than a person: the kit's hooks. */
 const RECORD = 'session record';
+const SENT = 'session sent';
+
+/**
+ * What the kit's send hook says after a native message: a warning the session
+ * reads, as Claude Code's `additionalContext`, or nothing. Never a decision,
+ * and never anything but exit 0 (ADR 0032).
+ */
+function sent(bots) {
+  try {
+    const warning = sentWarning(bots, JSON.parse(readFileSync(0, 'utf8')));
+    if (warning !== undefined) {
+      process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: warning } })}\n`);
+    }
+  } catch {
+    // Nothing: a hook does not disturb the session it runs in.
+  }
+  return 0;
+}
 
 /**
  * What the kit's hook does with what the harness told it, and what it answers.
@@ -571,6 +606,7 @@ const commands = {
       return {
         answer: { bots, ...retired },
         lines: [
+          ...withLines(retired.retiredWith, retired.session),
           ...closedLines(retired.closed),
           `retired    ${retired.bot} ${retired.session}: off ${path.join('bots', retired.bot, 'bot.yaml')}, and its conversations kept in the book under retired`,
           ...leftLines(retired.promptsLeft),
@@ -633,6 +669,7 @@ const commands = {
     return {
       answer: { bots, ...retired },
       lines: [
+        ...withLines(retired.retiredWith, retired.session),
         ...closedLines(retired.closed),
         `retired    ${retired.bot} ${retired.session}, a temporary session of ${retired.maker}'s: off ${path.join('bots', retired.bot, 'bot.yaml')}, and its conversations kept in the book under retired`,
         ...leftLines(retired.promptsLeft),
@@ -1106,6 +1143,13 @@ function settingsOf(values) {
 /** The tabs a command closed, one line each. */
 const closedLines = (closed) => closed.map((tab) => `closed     ${tab.bot} ${tab.name}  tab ${tab.tabId}  terminal ${tab.terminal}`);
 
+/** The temporary sessions a retire took along with the one it named, each as it went (#464). */
+const withLines = (retiredWith, session) => retiredWith.flatMap((gone) => [
+  ...closedLines(gone.closed),
+  `retired    ${gone.bot} ${gone.session}, a temporary session of ${gone.maker}'s, along with ${session}: off ${path.join('bots', gone.bot, 'bot.yaml')}, and its conversations kept in the book under retired`,
+  ...leftLines(gone.promptsLeft),
+]);
+
 /** What a retire could not remove, and how to: nothing reads these files now (#393). */
 const leftLines = (left = []) => left.flatMap(({ file, reason }) => [
   `left       ${file}: it could not be removed (${reason}). Nothing reads it now.`,
@@ -1247,6 +1291,7 @@ function conversationLine(one) {
     .join('  ');
   return `             ${one.id}  ${one.calls} call${one.calls === 1 ? '' : 's'}`
     + `${one.subagent_calls > 0 ? `  of which subagents: ${one.subagent_calls} call${one.subagent_calls === 1 ? '' : 's'}` : ''}`
+    + `${one.review_calls > 0 ? `  of which Codex's auto-review: ${one.review_calls} call${one.review_calls === 1 ? '' : 's'}` : ''}`
     + `${ran === '' ? '' : `  ${ran}`}`
     + `${used === '' ? '' : `  ${used}`}`
     + `${one.compactions > 0 ? `  compacted ${one.compactions}` : ''}`;

package/src/conversations.js

@@ -115,7 +115,8 @@ export function claudeSubagentTranscripts(file) {
 /**
  * The same conversations, each with the file the harness keeps it in, for a
  * caller that has to read what is inside one rather than only know it is there,
- * and whether the harness marks it as a subagent's.
+ * whether the harness marks it as a subagent's, and, for a Codex subagent, the
+ * conversation it was started for and whether it is Codex's auto-review.
  */
 export function transcriptsIn(harness, home, since) {
   const from = since === undefined ? 0 : Date.parse(since);
@@ -123,7 +124,13 @@ export function transcriptsIn(harness, home, since) {
   return found
     .filter((one) => Number.isNaN(from) || one.at >= from)
     .sort((left, right) => left.at - right.at)
-    .map((one) => ({ id: one.id, at: new Date(one.at).toISOString(), file: one.file, subagent: one.subagent === true }));
+    .map((one) => ({
+      id: one.id,
+      at: new Date(one.at).toISOString(),
+      file: one.file,
+      subagent: one.subagent === true,
+      ...(one.parent === undefined ? {} : { parent: one.parent, review: one.review }),
+    }));
 }
 
 /**
@@ -209,11 +216,29 @@ function codexConversations(home, from) {
     .flatMap((file) => {
       const meta = sessionMeta(file);
       return meta?.cwd === home && typeof meta.id === 'string'
-        ? [{ id: meta.id, at: Date.parse(meta.timestamp ?? '') || startedAt(file) || 0, file, subagent: isSubagent(meta) }]
+        ? [{ id: meta.id, at: Date.parse(meta.timestamp ?? '') || startedAt(file) || 0, file, subagent: isSubagent(meta), ...codexParent(meta) }]
         : [];
     });
 }
 
+/**
+ * Every Codex subagent on record, wherever it ran, with the conversation it was
+ * started for: `{ id, file, parent, review }` (#449). Found by the link in its
+ * own record, not by folder: a session's worker can run in a folder of its own.
+ * Read once per process, since every bot asks the same question of the same
+ * files.
+ */
+let subagents;
+export function codexSubagents() {
+  subagents ??= rollouts(codexDir()).flatMap((file) => {
+    const meta = sessionMeta(file);
+    if (meta === undefined || typeof meta.id !== 'string') return [];
+    const link = codexParent(meta);
+    return link.parent === undefined ? [] : [{ id: meta.id, file, ...link }];
+  });
+  return subagents;
+}
+
 /** Every rollout file under Codex's sessions folder, however deep it files them. */
 function rollouts(dir, depth = 0) {
   if (depth > 4) return [];
@@ -243,6 +268,21 @@ function sessionMeta(file) {
 const isSubagent = (meta) =>
   meta.source !== null && typeof meta.source === 'object' && 'subagent' in meta.source;
 
+/**
+ * The conversation a Codex subagent was started for, as its own record names
+ * it, and whether it is Codex's auto-review: `{ parent, review }`, or nothing
+ * for a session's own (#449). A session's spawned subagent names it under
+ * `source.subagent.thread_spawn.parent_thread_id`; Codex's auto-review, which
+ * is `{ subagent: { other: 'guardian' } }`, names the conversation it reviewed
+ * as a top-level `parent_thread_id` (tech notes, section 3).
+ */
+function codexParent(meta) {
+  if (!isSubagent(meta)) return {};
+  const parent = meta.source.subagent?.thread_spawn?.parent_thread_id ?? meta.parent_thread_id;
+  if (typeof parent !== 'string' || parent === '') return {};
+  return { parent, review: meta.source.subagent?.other === 'guardian' };
+}
+
 /** When a file was last written, for leaving out what is plainly too old. */
 function lastTouched(file) {
   try {

package/src/hooks.js

@@ -42,6 +42,18 @@ const TIMEOUT = 10;
 export const hookCommand = (bots, bot, cli = ownCli()) =>
   `${shellWord(cli)} session record --bots ${shellWord(bots)} --bot ${shellWord(bot)} 2>/dev/null || true`;
 
+/**
+ * Claude Code's second kit hook: after a native `SendMessage`, a warning when
+ * it went outside the bots folder (ADR 0032). Claude Code only, since Codex has
+ * no native messaging.
+ */
+const SENT_EVENT = 'PostToolUse';
+const SENT_MATCHER = 'SendMessage';
+
+/** What the send hook runs, by the kit's own path, as `hookCommand` does. */
+export const sentCommand = (bots, bot, cli = ownCli()) =>
+  `${shellWord(cli)} session sent --bots ${shellWord(bots)} --bot ${shellWord(bot)} 2>/dev/null || true`;
+
 /**
  * Make sure the bot at `home` has the kit's SessionStart hook for `harness`.
  * Returns the file it wrote, relative to the bot home, or undefined when the
@@ -63,7 +75,9 @@ export function installHook(home, harness, { bots, bot }) {
   // path is corrected rather than doubled, an entry under an event the kit no
   // longer asks about is taken out, and a hook of the user's beside the kit's
   // stays where they put it.
-  const wanted = { ...settings, hooks: withKitHook(settings.hooks, file, mine) };
+  const started = withKitHook(settings.hooks, file, mine);
+  const sentHook = { type: 'command', command: sentCommand(bots, bot), timeout: TIMEOUT };
+  const wanted = { ...settings, hooks: harness === 'claude' ? withSentHook(started, sentHook) : started };
 
   // Compared as documents, not as text: how the user laid their file out is
   // theirs, and a run that changes nothing writes nothing.
@@ -110,6 +124,27 @@ export function hookTrouble(home, harness, { bots, bot }) {
     }
     const program = running ?? ownCli();
     wanted = { ...settings, hooks: withKitHook(settings.hooks, file, { type: 'command', command: hookCommand(bots, bot, program), timeout: TIMEOUT }) };
+    // The send hook is judged on its own: the session hook may be right while
+    // the warning after a native message is missing (ADR 0032).
+    if (harness === 'claude' && isDeepStrictEqual(settings, wanted)) {
+      const sentRunning = sentProgramIn(settings);
+      // A send hook that runs a kit no longer there is as quiet as a missing
+      // one: `|| true` hides it, and no warning is ever given (#451 review).
+      if (sentRunning !== undefined && sentRunning !== BARE && !existsSync(sentRunning)) {
+        return {
+          where: file,
+          says: `${file} holds the kit's PostToolUse hook for SendMessage, but it runs ${sentRunning}, which is not there any more, so a session is never warned when its native message goes outside this bots folder (ADR 0032). obk up puts back one that runs the kit you have.`,
+        };
+      }
+      const sentProgram = sentRunning ?? program;
+      const withSent = { ...settings, hooks: withSentHook(settings.hooks, { type: 'command', command: sentCommand(bots, bot, sentProgram), timeout: TIMEOUT }) };
+      if (!isDeepStrictEqual(settings, withSent)) {
+        return {
+          where: file,
+          says: `${file} does not hold the kit's PostToolUse hook for SendMessage, which warns a session when its native message went outside this bots folder (ADR 0032). obk up puts it back.`,
+        };
+      }
+    }
   } catch (error) {
     return { where: file, says: `${error.message} ${stale}` };
   }
@@ -180,6 +215,58 @@ function withKitHook(hooks, file, mine) {
   return { ...events, [EVENT]: [...(events[EVENT] ?? []), { hooks: [mine] }] };
 }
 
+/**
+ * The hooks with the kit's send hook in a `PostToolUse` group matched to
+ * `SendMessage`, and everything else as the user left it, as `withKitHook`
+ * keeps the session hook: one entry of the kit's, written in place where it
+ * already sits in such a group, taken out of anywhere else, and added in a
+ * group of its own when there is none. A group the kit empties goes.
+ */
+function withSentHook(hooks, mine) {
+  let placed = false;
+  const events = Object.fromEntries(Object.entries(hooks).flatMap(([event, groups]) => {
+    if (!Array.isArray(groups)) return [[event, groups]];
+    const kept = groups.flatMap((group) => {
+      if (!Array.isArray(group?.hooks)) return [group];
+      const entries = group.hooks.flatMap((hook) => {
+        if (!isSentHook(hook)) return [hook];
+        if (event !== SENT_EVENT || group.matcher !== SENT_MATCHER || placed) return [];
+        placed = true;
+        return [mine];
+      });
+      return entries.length === 0 ? [] : [{ ...group, hooks: entries }];
+    });
+    return kept.length === 0 ? [] : [[event, kept]];
+  }));
+  if (placed) return events;
+  return { ...events, [SENT_EVENT]: [...(events[SENT_EVENT] ?? []), { matcher: SENT_MATCHER, hooks: [mine] }] };
+}
+
+
+/** Whether a hook entry is the kit's send hook, run by a kit, for any bots folder and bot. */
+const isSentHook = (hook) => sentProgramOf(hook?.command) !== undefined;
+
+function sentProgramOf(command) {
+  const found = typeof command === 'string' ? KIT_SENT.exec(command) : null;
+  if (found === null) return undefined;
+  const program = unquoted(found[1]);
+  return isKitCli(program) ? program : undefined;
+}
+
+/** What the kit's send hook in these settings runs, or undefined when there is none. */
+function sentProgramIn(settings) {
+  for (const groups of Object.values(settings.hooks ?? {})) {
+    if (!Array.isArray(groups)) continue;
+    for (const group of groups) {
+      for (const hook of Array.isArray(group?.hooks) ? group.hooks : []) {
+        const program = sentProgramOf(hook?.command);
+        if (program !== undefined) return program;
+      }
+    }
+  }
+  return undefined;
+}
+
 /**
  * The kit's own hook entry, wherever it sits and whatever sits beside it: a
  * command of exactly the shape `hookCommand` writes, for any bots folder and
@@ -194,6 +281,7 @@ const isKitHook = (hook) => kitProgramOf(hook?.command) !== undefined;
 /** One word as `shellWord` writes it: bare, or single-quoted with `'\''` inside. */
 const WORD = String.raw`(?:[A-Za-z0-9,._+:@%/=-]+|'(?:[^']|'\\'')*')`;
 const KIT_HOOK = new RegExp(String.raw`^(${WORD}) session record --bots ${WORD} --bot ${WORD} 2>/dev/null \|\| true$`);
+const KIT_SENT = new RegExp(String.raw`^(${WORD}) session sent --bots ${WORD} --bot ${WORD} 2>/dev/null \|\| true$`);
 
 /** The program a bot made before the kit named itself by path runs. */
 const BARE = 'obk';

package/src/retire.js

@@ -25,6 +25,7 @@ import path from 'node:path';
 import { readBook, tabIdsIn, updateBook } from './book.js';
 import { botDir, dropSession, readBot } from './bot.js';
 import { deleteProject, findProject, projects, reloadWindow, tabs } from './orca.js';
+import { shellWord } from './launch.js';
 import { fleetMember } from './pause.js';
 import { closeTabs, commandLine, tabsToClose } from './restart.js';
 import { unlinkSkills } from './skills.js';
@@ -34,26 +35,57 @@ import { promptPath, sessionsOf } from './up.js';
 export const retiredDir = (bots) => path.join(bots, 'retired');
 
 /**
- * Retire the session `session` of the bot `bot`. Returns `{ bot, session,
- * closed }`, and `promptsLeft` when its prompt file could not be removed.
+ * Retire the session `session` of the bot `bot`, and first the temporary
+ * sessions it made, and theirs (#464, ADR 0033). Returns `{ bot, session,
+ * closed, retiredWith }`, and `promptsLeft` when its prompt file could not be
+ * removed. `retiredWith` holds one `{ bot, session, maker, closed }` for each
+ * session that went with it, deepest first, with its own `promptsLeft`.
  */
 export async function retireSession(bots, { bot, session }) {
   const home = fleetMember(bots, bot, 'retire', session);
-  const sessions = sessionsOf(readBot(home, bot), session);
+  const known = readBot(home, bot);
+  const sessions = sessionsOf(known, session);
 
-  const closed = await closeTabs(home, tabsToClose(bots, bot, home, sessions, { keepless: true }), bots, bot, commandLine('retire', bots, bot, session));
-  dropSession(bots, bot, session);
+  const retiredWith = [];
+  const book = readBook(home);
+  const made = known.sessions.filter((one) => book.sessions[one.name]?.temporary?.maker === session);
+  let closed;
+  try {
+    for (const { name } of made) {
+      const { retiredWith: theirs, ...gone } = await retireSession(bots, { bot, session: name });
+      retiredWith.push(...theirs, { ...gone, maker: session });
+    }
 
-  const at = new Date().toISOString();
-  await updateBook(home, (book) => {
-    const entry = book.sessions[session];
-    if (entry === undefined) return;
-    delete book.sessions[session];
-    book.retired = [...(Array.isArray(book.retired) ? book.retired : []), { name: session, ...entry, retired: at }];
-  });
+    closed = await closeTabs(home, tabsToClose(bots, bot, home, sessions, { keepless: true }), bots, bot, commandLine('retire', bots, bot, session));
+    dropSession(bots, bot, session);
+
+    const at = new Date().toISOString();
+    await updateBook(home, (book) => {
+      const entry = book.sessions[session];
+      if (entry === undefined) return;
+      delete book.sessions[session];
+      book.retired = [...(Array.isArray(book.retired) ? book.retired : []), { name: session, ...entry, retired: at }];
+    });
+  } catch (error) {
+    // What already went stays gone, and is named: a retire run again finds
+    // nothing of it left to name (#464).
+    if (retiredWith.length > 0) error.message = `${error.message} ${goneBefore(session, retiredWith)}`;
+    throw error;
+  }
   const left = removePrompts([promptPath(bots, bot, session)]);
 
-  return { bot, session, closed, ...left };
+  return { bot, session, closed, retiredWith, ...left };
+}
+
+/**
+ * The sessions retired along with `session` before its own retire failed, in
+ * words, with any prompt file of theirs left and how to remove it.
+ */
+function goneBefore(session, retiredWith) {
+  const names = retiredWith.map((gone) => `${gone.bot}/${gone.session}, a temporary session of ${gone.maker}'s`);
+  const left = retiredWith.flatMap((gone) => gone.promptsLeft ?? [])
+    .map(({ file, reason }) => ` ${file} could not be removed (${reason}), and nothing reads it. Remove it with  rm ${shellWord(file)}`);
+  return `Retired along with ${session} before that, and still retired: ${names.join('; ')}.${left.join('')}`;
 }
 
 /**

package/src/sent.js

@@ -0,0 +1,111 @@
+// `obk session sent`: what the kit's PostToolUse hook says after a session's
+// native message (#451, ADR 0032).
+//
+// Claude Code's own messaging reaches every Claude session on the machine, not
+// only the sessions of one bots folder. After a send to another session, this
+// looks at where it went: to a session address none of the fleet's books name,
+// the session is told so, with the road the kit would have given it. The send
+// has gone either way. Nothing here decides anything about it, and anything it
+// cannot read is silence (ADR 0022: a hook never disturbs the session).
+//
+// It reads the send from its fields, never from its wording. Seen on Claude
+// Code 2.1.283: a send to an in-process teammate answers with a `routing`
+// object, and one to another session without it; the input's `to` names the
+// target, as a session's name with an optional ` [xxxxxx]` reference, or as a
+// `uds:` socket path when answering a message, which no book can map.
+
+import { readBook } from './book.js';
+import { botDir, botNames } from './bot.js';
+import { isAddressOf, ownCli, shellWord } from './launch.js';
+import { lookUp } from './message.js';
+import { TAB_ENV } from './record.js';
+
+/**
+ * The warning for a send the hook was told about, or undefined when there is
+ * nothing to say. `said` is what Claude Code handed the hook.
+ */
+export function sentWarning(bots, said) {
+  if (said?.tool_name !== 'SendMessage') return undefined;
+  const to = said.tool_input?.to;
+  if (typeof to !== 'string') return undefined;
+  const result = resultOf(said);
+  // A teammate in the same session, or a send that did not go: not this.
+  if (result === undefined || result.success !== true || 'routing' in result) return undefined;
+  if (/^(uds|bridge):/.test(to)) return undefined;
+
+  const name = to.replace(/\s*\[[^\]]*\]\s*$/, '').trim();
+  if (name === '') return undefined;
+  const fleet = addressesIn(bots);
+  if (fleet === undefined || fleet.all.has(name)) return undefined;
+
+  const meant = fleet.byName.get(name.split('.').slice(0, 2).join('.'));
+  const ask = (to) => `\`${shellWord(ownCli())} message to --bots ${shellWord(bots)} --to ${to}\``;
+  const road = meant === undefined
+    ? `${ask('<bot>/<session>')} gives the road to a session of this fleet.`
+    : roadTo(bots, meant, ask(`${meant.bot}/${meant.session}`));
+  return `That message went to ${name}, which is not one of the sessions of your bots folder, ${bots}: Claude Code's messaging reaches every session on this machine. ${road} Check before you send to it again.`;
+}
+
+/**
+ * The road to the session the sender probably meant, as `obk message to` would
+ * answer it from the sender's own tab: native to its address only between
+ * sessions of one approval class, the kit's mailbox otherwise (PRD 6.9). Where
+ * the sender cannot be told by its tab, the session's address and the question
+ * to ask, without claiming the address is the answer (#451 review).
+ */
+function roadTo(bots, meant, ask) {
+  let found;
+  try {
+    found = lookUp(bots, { to: `${meant.bot}/${meant.session}`, tab: process.env[TAB_ENV] });
+  } catch {
+    found = undefined;
+  }
+  const who = `${meant.bot}/${meant.session}`;
+  if (found?.transport === 'native' && typeof found.address === 'string') {
+    return `If you meant ${who}, ${ask} gives the road from your session: write to ${found.address} with your own messaging.`;
+  }
+  if (found?.transport === 'orca' && typeof found.address === 'string') {
+    return `If you meant ${who}, ${ask} gives the road from your session: its mailbox, ${found.address}, by \`${shellWord(ownCli())} message send\`, not your own messaging.`;
+  }
+  return `If you meant ${who}, its session address is ${meant.address}; ${ask} says which road to take from your session.`;
+}
+
+/** What the send answered, as an object: Claude Code hands it over as one, or as its JSON. */
+function resultOf(said) {
+  const raw = said.tool_output ?? said.tool_response;
+  if (raw !== null && typeof raw === 'object' && !Array.isArray(raw)) return raw;
+  if (typeof raw !== 'string') return undefined;
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Every session address the fleet's books name, retired sessions' included, and
+ * each live one by `<bot>.<session>`: `{ all, byName }`. Undefined when a book
+ * cannot be read, since an address missing from it would be warned about wrongly.
+ */
+function addressesIn(bots) {
+  const all = new Set();
+  const byName = new Map();
+  try {
+    for (const bot of botNames(bots)) {
+      const book = readBook(botDir(bots, bot));
+      for (const [session, entry] of Object.entries(book.sessions ?? {})) {
+        const address = entry?.address;
+        if (typeof address !== 'string') continue;
+        all.add(address);
+        if (isAddressOf(bot, session, address)) byName.set(`${bot}.${session}`, { bot, session, address });
+      }
+      for (const entry of Array.isArray(book.retired) ? book.retired : []) {
+        if (typeof entry?.address === 'string') all.add(entry.address);
+      }
+    }
+  } catch {
+    return undefined;
+  }
+  return { all, byName };
+}

package/src/temp.js

@@ -4,7 +4,8 @@
 //
 // Any long-lived session can make a temporary session of its own bot for a
 // piece of work, and retire it when the work is done, without Bot Father, who
-// stays the manager of long-lived sessions. A temporary session is an ordinary
+// stays the manager of long-lived sessions. A temporary session can make one
+// of its own, one level deep and one at a time (#464, ADR 0033). A temporary session is an ordinary
 // session in every other way: in bot.yaml, brought up with a tab and a mailbox,
 // its conversations kept in the book. What makes it temporary is one field of
 // its book entry, `temporary: { maker, made }`, and the book is the one place
@@ -44,9 +45,9 @@ const INHERITED = ['model', 'effort', 'context', 'approval'];
  */
 export async function makeTemp(bots, { tab, ...given }) {
   const caller = callerIn(bots, tab, 'make');
-  if (caller.temporary !== undefined) {
-    throw new Error(`${caller.bot}/${caller.session} is a temporary session, and only a long-lived session makes one. Nothing was made.`);
-  }
+  // Checked here, before anything is written, and again under the book's lock
+  // below, where two makes at once cannot both pass it.
+  refuseNested(bots, caller, readBook(caller.home));
   // The name is a folder under work/ and a file beside the bots folder, so it
   // is held to the rule a bot's name is: one plain name, never a path.
   if (!NAME.test(given.name)) {
@@ -77,38 +78,44 @@ export async function makeTemp(bots, { tab, ...given }) {
   settings.work_dir = `work/${given.name}`;
 
   const written = bot.sessions.some((session) => session.name === given.name) ? undefined : writePromptFirst(bots, caller, settings);
-  // Refuses a name the bot already has, and a setting that will not work,
-  // before it writes anything; the prompt written first goes with a refusal.
-  let added;
-  try {
-    added = addSession(bots, caller.bot, settings);
-  } catch (error) {
-    if (written !== undefined) rmSync(written, { force: true });
-    throw error;
-  }
+  // bot.yaml and the book are written under the book's lock, so that a second
+  // make from the same maker waits, and then sees this one (#464). addSession
+  // refuses a name the bot already has, and a setting that will not work,
+  // before it writes anything.
   const made = new Date().toISOString();
+  let locked = false;
+  let added;
   try {
     await updateBook(caller.home, (book) => {
+      locked = true;
+      refuseNested(bots, caller, book);
+      added = addSession(bots, caller.bot, settings);
       book.sessions[given.name] = { ...book.sessions[given.name], temporary: { maker: caller.session, made } };
     });
   } catch (error) {
+    // A refusal under the lock has written nothing but the prompt file.
+    const refused = locked && added === undefined;
+    const failed = `${caller.bot}/${given.name} could not be recorded in the book as temporary (${error.message})`;
     // A session in bot.yaml that the book does not call temporary would be a
     // long-lived one to everything that reads it, its maker's retire included,
     // so it is taken back off rather than left that way.
-    const failed = `${caller.bot}/${given.name} could not be recorded in the book as temporary (${error.message})`;
-    try {
-      dropSession(bots, caller.bot, given.name);
-    } catch (undo) {
-      throw new Error(`${failed}, and taking it back off bot.yaml failed too (${undo.message}). It is in bot.yaml as a session the book does not call temporary. Take it off with  ${shellWord(ownCli())} retire --bots ${shellWord(bots)} --bot ${caller.bot} --session ${given.name}`);
+    if (added !== undefined) {
+      try {
+        dropSession(bots, caller.bot, given.name);
+      } catch (undo) {
+        throw new Error(`${failed}, and taking it back off bot.yaml failed too (${undo.message}). It is in bot.yaml as a session the book does not call temporary. Take it off with  ${shellWord(ownCli())} retire --bots ${shellWord(bots)} --bot ${caller.bot} --session ${given.name}`);
+      }
     }
     // Off bot.yaml, nothing is made; a prompt file that stays is only a file,
     // and nothing reads it (#393).
+    const why = refused ? error.message.replace(/ ?Nothing was made\.$/, '') : `${failed}${added === undefined ? '.' : ', so it was taken back off bot.yaml.'}`;
     try {
       if (written !== undefined) rmSync(written, { force: true });
     } catch (left) {
-      throw new Error(`${failed}, so it was taken back off bot.yaml and nothing was made. Its start prompt ${written} could not be removed (${left.message}), and nothing reads it. Remove it with  rm ${shellWord(written)}`);
+      throw new Error(`${why} Nothing was made. Its start prompt ${written} could not be removed (${left.message}), and nothing reads it. Remove it with  rm ${shellWord(written)}`);
     }
-    throw new Error(`${failed}, so it was taken back off bot.yaml and nothing was made. Run this again once the book can be written.`);
+    if (refused) throw error;
+    throw new Error(`${why} Nothing was made. Run this again once the book can be written.`);
   }
 
   let up;
@@ -121,6 +128,23 @@ export async function makeTemp(bots, { tab, ...given }) {
   return { bot: caller.bot, session: given.name, maker: caller.session, settings: added.session, up };
 }
 
+/**
+ * Refuse a make by a temporary session that may not make one now, against
+ * `book`: one made by a temporary session makes none, and a temporary session
+ * has one of its own open at a time (#464, ADR 0033).
+ */
+function refuseNested(bots, caller, book) {
+  if (caller.temporary === undefined) return;
+  const maker = caller.temporary.maker;
+  if (book.sessions[maker]?.temporary !== undefined) {
+    throw new Error(`${caller.bot}/${caller.session} is a temporary session ${maker} made, and ${maker} is temporary itself, so it makes none of its own: temporary sessions go one level deep. Nothing was made.`);
+  }
+  const open = Object.keys(book.sessions).filter((name) => book.sessions[name]?.temporary?.maker === caller.session);
+  if (open.length > 0) {
+    throw new Error(`${caller.bot}/${caller.session} is a temporary session, and it already has ${open.join(', ')} open; a temporary session has one of its own at a time. Retire it first with  ${shellWord(ownCli())} temp retire --bots ${shellWord(bots)} --name ${open[0]}  Nothing was made.`);
+  }
+}
+
 /**
  * Write the start prompt's file where bringing the session up will write it,
  * when its prompt goes to the harness out of a file at all, and say where. A

package/src/usage.js

@@ -43,7 +43,7 @@ import { realpathSync } from 'node:fs';
 
 import { botDir, botNames, readBot } from './bot.js';
 import { readBook, sessionIdsIn } from './book.js';
-import { claudeSubagentTranscripts, claudeTranscriptAnywhere, codexRollout, transcriptsIn } from './conversations.js';
+import { claudeSubagentTranscripts, claudeTranscriptAnywhere, codexRollout, codexSubagents, transcriptsIn } from './conversations.js';
 import { eachLine } from './lines.js';
 import { HARNESSES, harnessOf } from './launch.js';
 
@@ -91,11 +91,41 @@ export function readUsage(bots, { bot: only, session: onlySession, since, until
     throw new Error(`--until is before --since, so there is no window between them: ${until} comes before ${since}.`);
   }
 
-  return (only === undefined ? names : [only]).map((name) => forBot(bots, name, onlySession, { from, to }));
+  // Who owns a Codex subagent is a question about the whole fleet, asked once:
+  // one can run in another bot's folder, or be claimed by another bot's book.
+  const fleet = subagentOwners(bots, names);
+  return (only === undefined ? names : [only]).map((name) => forBot(bots, name, onlySession, { from, to }, fleet));
+}
+
+/**
+ * Every conversation any bot's book names, the Codex subagents that hang off
+ * each by their own links, and the ones so attached (#449). A subagent a book
+ * names is that book's, and is never attached under another: the book's word
+ * comes first (ADR 0012). One claimed or attached anywhere is no bot's
+ * unclaimed.
+ */
+function subagentOwners(bots, names) {
+  const claimed = new Set();
+  for (const name of names) for (const id of sessionIdsIn(readBook(realHome(botDir(bots, name))))) claimed.add(id);
+  const childrenOf = new Map();
+  for (const one of codexSubagents()) {
+    if (claimed.has(one.id)) continue;
+    if (!childrenOf.has(one.parent)) childrenOf.set(one.parent, []);
+    childrenOf.get(one.parent).push(one);
+  }
+  const attached = new Set();
+  const waiting = [...claimed].flatMap((id) => childrenOf.get(id) ?? []);
+  while (waiting.length > 0) {
+    const child = waiting.shift();
+    if (attached.has(child.id)) continue;
+    attached.add(child.id);
+    waiting.push(...(childrenOf.get(child.id) ?? []));
+  }
+  return { claimed, childrenOf, attached };
 }
 
 /** One bot: what each of its sessions used, and what nobody claims. */
-function forBot(bots, name, onlySession, window) {
+function forBot(bots, name, onlySession, window, fleet) {
   // The folder as the file system knows it, not as the caller spelled it: a
   // bots folder reached through a symlink is the same fleet, and the harnesses
   // file their transcripts under the real path (as `restart` and `message` do).
@@ -138,6 +168,31 @@ function forBot(bots, name, onlySession, window) {
     }
   }
 
+  // A Codex subagent names the conversation it was started for, and what it
+  // spent is that conversation's, at any depth, as a Claude Code subagent's is
+  // (#449). It is found by that link wherever it ran, and joined only through
+  // links that end at a conversation the book names, as the fleet's owners
+  // say: a parent no session claims leaves its children where they were, and
+  // nothing is guessed from timing or folder. The book's word is enough
+  // without the parent's own file, whose calls are then said to be unreadable.
+  const { childrenOf } = fleet;
+  const attached = new Set();
+  for (const id of claimed) {
+    const own = onRecord.get(id);
+    if (own !== undefined && own.harness !== 'codex') continue;
+    const found = [];
+    const waiting = [...(childrenOf.get(id) ?? [])];
+    while (waiting.length > 0) {
+      const child = waiting.shift();
+      if (attached.has(child.id)) continue;
+      attached.add(child.id);
+      // A review of a subagent is still the harness's approval, not the work.
+      found.push({ file: child.file, kind: child.review ? 'review' : 'subagent' });
+      waiting.push(...(childrenOf.get(child.id) ?? []));
+    }
+    if (found.length > 0) onRecord.set(id, { id, harness: 'codex', subagent: false, ...own, children: found });
+  }
+
   // Two entries can name the same conversation, one resumed after its session
   // was retired, and one entry can name it twice, now and in its history: it is
   // counted once, in the first block asked for that names it.
@@ -155,7 +210,9 @@ function forBot(bots, name, onlySession, window) {
     .filter(({ name }) => onlySession === undefined || name === onlySession)
     .map(({ name, entry, ...was }) => ({ name, ...('retired' in was ? { retired: was.retired } : {}), ...block(entry) }));
 
-  const unclaimed = all([...onRecord.values()].filter((one) => !claimed.has(one.id)), window);
+  // What any bot's book names, or any claim gathered in, is not unclaimed here,
+  // wherever its record lies (#449 review).
+  const unclaimed = all([...onRecord.values()].filter((one) => !fleet.claimed.has(one.id) && !fleet.attached.has(one.id)), window);
 
   return { bot: name, home, sessions, unclaimed: unclaimed.conversations, unclaimed_not_counted: unclaimed.gaps };
 }
@@ -187,6 +244,7 @@ function counted(one, window) {
   const tally = {
     calls: 0,
     subagentCalls: 0,
+    reviewCalls: 0,
     compactions: 0,
     tokens: Object.fromEntries(KINDS.map((kind) => [kind, 0])),
     models: new Set(),
@@ -203,7 +261,10 @@ function counted(one, window) {
   // own, and what they spent is the conversation's.
   const subagents = one.harness === 'claude' ? claudeSubagentTranscripts(one.file) : { files: [], unreadable: 0 };
   tally.gaps.unreadable_transcripts += subagents.unreadable;
-  const sources = [one.file, ...subagents.files]
+  // A Codex conversation the book names, whose own record is gone but whose
+  // subagents' are not: its own calls cannot be counted, and that is said (#449).
+  if (one.file === undefined) tally.gaps.unreadable_transcripts += 1;
+  const sources = [...(one.file === undefined ? [] : [one.file]), ...subagents.files]
     .map((file, index) => {
       const { entries, unreadable, broken } = transcript(file, countable);
       tally.gaps.unreadable_transcripts += unreadable;
@@ -212,8 +273,19 @@ function counted(one, window) {
     });
   if (one.harness === 'claude') fromClaude(sources, window, tally);
   else {
-    const copied = originOf(sources[0].entries, tally);
-    if (copied !== null) fromCodex(sources[0].entries, window, tally, copied);
+    if (one.file !== undefined) {
+      const copied = originOf(sources[0].entries, tally);
+      if (copied !== null) fromCodex(sources[0].entries, window, tally, copied);
+    }
+    // Each subagent's rollout keeps its own running total, so each is counted
+    // on its own, from its own records (#449).
+    for (const child of one.children ?? []) {
+      const { entries, unreadable, broken } = transcript(child.file, countable);
+      tally.gaps.unreadable_transcripts += unreadable;
+      tally.gaps.broken_lines += broken;
+      const itsCopied = originOf(entries, tally);
+      if (itsCopied !== null) fromCodex(entries, window, tally, itsCopied, child.kind);
+    }
   }
   if (tally.calls === 0 && KINDS.every((kind) => tally.tokens[kind] === 0)) return { gaps: tally.gaps };
 
@@ -221,6 +293,7 @@ function counted(one, window) {
     id: one.id,
     calls: tally.calls,
     subagent_calls: tally.subagentCalls,
+    review_calls: tally.reviewCalls,
     tokens: tally.tokens,
     by_model: [...tally.byModel].map(([model, its]) => ({ model, calls: its.calls, tokens: its.tokens })),
     models: [...tally.models],
@@ -309,7 +382,7 @@ function fromClaude(sources, window, tally) {
     if (!isNew && KINDS.every((kind) => grew[kind] === 0)) continue;
 
     const subagent = records.every((record) => record.subagent);
-    count(tally, grew, atEnd.entry.message?.model, atEnd.entry.effort, isNew ? made : atEnd.when, isNew ? 1 : 0, subagent);
+    count(tally, grew, atEnd.entry.message?.model, atEnd.entry.effort, isNew ? made : atEnd.when, isNew ? 1 : 0, subagent ? 'subagent' : undefined);
   }
 }
 
@@ -380,7 +453,7 @@ const CODEX_FIELDS = [
  * A leading record with a figure missing may be a copy or the fork's own call;
  * it is not counted, and is said to be.
  */
-function fromCodex(entries, window, tally, copied) {
+function fromCodex(entries, window, tally, copied, kind) {
   let model;
   let effort;
   let running;
@@ -451,7 +524,7 @@ function fromCodex(entries, window, tally, copied) {
       continue;
     }
 
-    count(tally, used, model, effort, when);
+    count(tally, used, model, effort, when, 1, kind);
   }
 }
 
@@ -546,9 +619,10 @@ function kindsOf(raw) {
  * the total that has to be complete, and a row headed by nothing would be worse
  * than no row.
  */
-function count(tally, used, model, effort, when, calls = 1, subagent = false) {
+function count(tally, used, model, effort, when, calls = 1, kind = undefined) {
   tally.calls += calls;
-  if (subagent) tally.subagentCalls += calls;
+  if (kind === 'subagent') tally.subagentCalls += calls;
+  if (kind === 'review') tally.reviewCalls += calls;
   for (const kind of KINDS) tally.tokens[kind] += used[kind];
   add(tally.models, model);
   add(tally.efforts, effort);