@bastani/atomic 0.9.19-alpha.1 → 0.9.19-alpha.3

package/CHANGELOG.md

@@ -2,6 +2,114 @@
 
 ## [Unreleased]
 
+## [0.9.19-alpha.3] - 2026-09-09
+
+### Fixed
+
+- Fixed `Failed to initialize class constructor` when npm-installed Node sessions create multiple task supervisors, preventing shell commands and subagent launches from failing during task-host initialization.
+- Fixed foreground subagent launches and explicit waits blocking parent user steering and incoming Intercom asks/sends. Admitted messages now release the waiting parent's observations in main and workflow-stage chat without cancelling children or affecting other owners.
+- Fixed PowerShell internal-URL path quoting so apostrophes and smart single quotes in resolved paths remain literal instead of allowing injected commands. Bash quoting, deliberate shell commands, and balanced command prefixes are unchanged.
+- Capped agent retry backoff with `retry.maxAgentDelayMs` (60 seconds by default), preserving independent provider retry limits ([#8826](https://github.com/earendil-works/pi/issues/8826)).
+- Rejected extension tools with missing or non-object parameter schema containers during registration instead of breaking provider requests ([#9300](https://github.com/earendil-works/pi/issues/9300)).
+- Workflow-stage pause now blocks new task launches, cancels active and admitted queued agents and commands, and waits for in-flight command admission and resource cleanup. Main-chat and sibling tasks stay unaffected; queued user and Intercom messages survive, and resume permits fresh work without restarting cancelled executions.
+- Fixed npm-installed Node startup failing with a missing upstream AI package after the retry-policy update. Core retry imports now use Atomic's declared AI dependency.
+- Fixed an unhandled rejection when session cancellation interrupts an in-flight stage-chat pause, while preserving pause error reporting and rejection for callers awaiting completion.
+- Fixed Windows extension reloads re-evaluating Atomic's host modules, avoiding duplicate host classes and long reload delays while preserving edits to extension dependencies. The supported `@earendil-works/pi-coding-agent` import also shares host identity with `@bastani/atomic` after reload.
+
+## [0.9.19-alpha.2] - 2026-09-08
+
+### Added
+
+- Added host-side workflow activity observation with ordered snapshots, publisher epochs, bounded observer queues and diagnostics, plus workflow_lifecycle, workflow_activity_changed, workflow_stage_completed, and workflow_heartbeat extension hooks typed as `WorkflowLifecycleEvent`, `WorkflowActivityChangedEvent`, `WorkflowStageCompletedEvent`, and `WorkflowHeartbeatEvent`. Initialization-time publications are retained until runner binding. Publisher and observer leases are fenced on reload, including pending hook handlers when an earlier handler is awaiting. Workflow runtime publication is a separate integration ([#2891](https://github.com/bastani-inc/atomic/issues/2891)).
+- Added the built-in Herdr reporter for eligible interactive panes, combining settled agent activity, approval prompts, and observed workflow roots under custom:atomic. Pane ownership and ordered sequences survive in-process reload/replacement; direct CLI delivery is serialized, coalesced, and bounded by a five-second timeout. Supports herdr.enabled opt-out, loaded reporter conflict deferral, and one-time parent session identity reporting. The full activity path is integration-tested against a fake Herdr CLI that records argv, proving the ordered working, blocked, working, idle reports and strictly increasing sequence numbers for a real workflow with a tool-only execution and a human-input prompt. The Herdr documentation gains a compatibility matrix for the tested minimum Herdr 0.8.2 / protocol 20: custom-source authority, equal/older sequence handling, the sequence high-water mark surviving release, release requiring a sequence, idle-after-working surfacing as done, unretained message and session identity for custom sources, and the fail-safe behaviour for missing environment variables, a stopped server, or an older CLI ([#2891](https://github.com/bastani-inc/atomic/issues/2891)).
+- Editable workflow stage chats now discover source-qualified skills from their own session catalog and expand `/skill:` submissions once through stage admission, preserving Enter/Ctrl+F delivery and literal human-input answers. Skill diagnostics remain in the stage chat; blocked, archived, and replayed stages stay read-only.
+- Added a searchable `/agents` catalog with source grouping and agent configuration details.
+- Added per-call `bash.wait` selection for immediate background or foreground-first observation with an optional millisecond budget. Omitted waits keep owner-configured automatic backgrounding, and execution timeouts remain independent. Unsupported background requests fail before launching a command.
+- Added the SDK-only owner-bound task foundation: opaque host/task/wait capabilities, one execution per admitted attempt, observation-only yields, independent cleanup acknowledgement, and snapshot-reconciled subscriptions. Existing CLI, workflow and subagent runners are unchanged; output storage and real-runner integration remain later work ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Added trusted command start/input/output doors and an owner-aware bash/PTY execution seam. Commands remain alive after the 10000 ms foreground observation budget and are reaped with their owner; stdin distinguishes empty bytes from EOF and refuses backpressure before admission ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Added a narrow trusted-host agent task adapter with per-launch runner factories, owner-scoped observation and cancellation, and workflow generation ownership that survives fallback session replacement. Real subagent producers and completion delivery remain unintegrated ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Added owner-bound agent task hosts to runtime-created session contexts, single-subagent observation waits, and terminal completion intents delivered nonvisually through existing model admission with stable retry identity ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Added an owner-bound task projection and shared compact task rows for main and attached stage chats, with stable live anchors after tool/turn completion, snapshot reattachment, bounded activity previews and a compact background-task footer. Host adapters opt in by binding their session's task store; producer migration remains separate ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Added SDK task transcript references bound by the admitted runner, with task-scoped paging, original message/tool-call identities, and explicit unavailable history. Hidden reasoning is excluded; production subagent runners bind child history for the shared host inspector ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Added a shared focused task inspector for owner-store hosts: stable grouped selection, retained transcript rendering, foreground waits, confirmed cancellation, and explicit stdin focus without replacing composer drafts ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Added `reason: "project_trust"` to `UIPromptStartEvent` and `UIPromptEndEvent` for the built-in `/trust` selector in both interactive modes, so status integrations can observe the wait. Isolated mode retains paired notifications until the current engine binds, keeping separate completed dialogs distinct without delaying the trust decision. ([#2873](https://github.com/bastani-inc/atomic/issues/2873))
+- Added supervised native Windows ConPTY shell execution with Job Object containment before resume, confirmed cleanup, and no unsupervised spawn fallback.
+- Added optional direct-executable `shell: { program, args }` and `inheritEnv` controls to the command SDK, including operation replay identity.
+
+### Changed
+
+- Built-in read, edit, write and shell tools now prefer strict JSON-schema sampling by default, falling back on providers without strict support. Atomic's other experimental tool hints retain their existing opt-in gate.
+- `/tasks` now opens as a compact inline picker like `/workflow connect`, with fullscreen detail, transcript, input, and confirmation pages. Returning from detail preserves selection.
+- Foreground and background subagent rows, task lists, and completion cards now display resolved model and reasoning settings, retaining them after completion.
+- `/tasks` in an attached stage chat is now a local inspection command, never a model message, including while an Escape interruption settles. Hosts without a task inspector report that it is unavailable.
+- Task lists and subagent detail views now use grouped counts, semantic status styling, pinned status/metrics/actions, recent tool activity, bounded response and shell-output previews, and narrow-terminal layouts. Finished tasks remain discoverable through `/tasks`; background bash receipts distinguish observation time from execution completion.
+- Default guidance now routes all user questions, including confirmations and approvals, through `ask_user_question` or an equivalent available question tool rather than prose-only prompts. Sessions without a usable question tool continue autonomously using best judgment.
+- Model-choice guidance now consults the eval docs and Artificial Analysis benchmark charts. Automation guidance uses PyAutoGUI for desktop CUA, playwright-cli for browsers, and prefers Herdr across macOS, Linux and Windows with installation guidance and tmux/psmux fallback.
+- Native Windows owner-bound `bash` and `powershell` calls now automatically yield after the owner's command observation budget (normally 10 seconds). Explicit per-call budgets override it; execution timeouts and the 30-second explicit foreground subagent default remain separate. PowerShell uses encoded command transport while retaining original command descriptions. Owned legacy Windows WSL `bash.exe` stdin transport remains refused; Atomic inside WSL stays on POSIX/Bash.
+- On native Windows, Suspend opens a PowerShell subshell and restores the same session on exit instead of freezing the process; background tasks continue running.
+
+### Fixed
+
+- Fixed Herdr registration disappearing during resource reload or in-process session replacement while workflow activity is recovering or unavailable. Reporter handoffs now preserve registration and release it only on quit, without requiring another prompt.
+- Fixed Herdr turning red again after every response for an already-observed workflow block. Interactive messages now acknowledge existing pane attention without resuming workflows; new blocks and open approval prompts still report blocked.
+- Prevented internal-URL shell expansion from turning quoted paths into executable syntax. Expansion now rejects commands containing quotes, substitutions, escapes, heredocs or other non-plain syntax; bare URLs remain safely quoted, and commands without resolved URLs are unchanged.
+- Fixed Herdr reporting idle while standalone subagents or background shell tasks are running. The parent reporter now observes owner-scoped task activity and reattaches on reload, retaining working status until all tasks settle without granting children pane ownership.
+- Open subagent transcripts now refresh from live session events, including streaming text and partial/final tool results. Shell transcript reads coalesce pending state updates instead of requiring the view to be reopened.
+- Discarded stale command detail results and read errors after task selection, focus, or inspector lifetime changes, preventing another task's output from appearing in the current view ([#2908](https://github.com/bastani-inc/atomic/pull/2908)).
+- Connected isolated interactive sessions to the engine's compact background-task indicator below the prompt box and command-opened `/tasks` inspector instead of opening an empty host-local task owner. Added `/tasks` autocomplete and live subagent activity, tool/token counts, and response previews inside task details.
+- Connected top-level POSIX model bash executions to their task owner so long-running shells appear in task inspection after their observation yields. Preserved cleared session environment variables in the supervised shell path; native Windows and child-agent bash retain their existing execution path.
+- Replaced raw JSON task-completion content with readable names, outcomes, errors, and available response excerpts. Background completions now show a visible notification in main and owning workflow-stage chat, using the existing persisted delivery identity rather than relying on a model reply.
+- Connected native shell settlement to completion delivery using retained receipts and snapshot reconciliation. Background shell cards show bounded output and exit status; foreground-only shells do not trigger duplicate notifications or model turns. Initial bash observation now designates the host so yielded commands update background counts.
+- Preserved pending transcript navigation and historical pages across background updates, and honored configured task keys before fallback navigation and stop shortcuts.
+- Restricted `/tasks` to background work and its retained results, and below-prompt counts to active background work. Workflow-stage chat now uses the same footer-only status and completion notifications as main chat. Transcript inspection has a separate bounded viewport with position and paging controls instead of nested chat boxes.
+- Kept active task status below MCP and above workflow background cards, including isolated sessions regardless of widget arrival order. Workflow-stage `/tasks` now appears in slash suggestions; selected skill suggestions use main-chat-style terminal-default backgrounds and accent text. Active counts and `/tasks` remain visible at narrow widths.
+- Pausing main or workflow-stage chat keeps background agents and shells running with the same identities. Closing a stage generation cancels only that owner's remaining work.
+- Remounted active task rows after session transcript replacement and cleared prior-session task rows and footer state before a replacement owner store binds ([#2907](https://github.com/bastani-inc/atomic/pull/2907)).
+- Honored owner command wait budgets and `until-settled` in supervised bash/PTY execution, disclosed retained output gaps, and bounded output pages to 1 MiB. Supervised file-spool writes now share a hard disk cap rather than overshooting between polls ([#2905](https://github.com/bastani-inc/atomic/pull/2905)).
+- Stopped task subscription event delivery when a reconciliation callback disposes observation, including events retained by the active drain ([#2902](https://github.com/bastani-inc/atomic/pull/2902)).
+- Failed `/tasks` inspection now displays a diagnostic and preserves the input for retry instead of leaving an unhandled editor submission rejection.
+- Workflow skill autocomplete no longer reattaches and checkpoints the stage for every completion request. Concurrent lazy discovery requests share one attachment.
+- Prepare resume trust before disposing the outgoing session, preserve it on failed preflight, and allow pending prompt observers up to 1,000 ms to settle without delaying dialog display or answers. Isolated resume uses child-local trust UI and forwards missing-directory overrides without serializing callbacks. ([#2873](https://github.com/bastani-inc/atomic/issues/2873))
+- Startup trust waits now reach existing prompt lifecycle handlers with a live session context, including isolated-engine and borrowed-source dialogs. Only trust-safe extensions load before authorization; approval retains their session and factories, starts newly authorized extensions once, and does not replay earlier waits. ([#2873](https://github.com/bastani-inc/atomic/issues/2873))
+- Intercom now hides internal workflow routing/control connections and refuses messages to non-agent recipients, including model-less `ctx.ui` prompts and `ctx.tool` nodes, without hiding agents busy in tools or awaiting human input. Connected agent aliases remain reachable after pending capability changes or stage completion, even with same-name non-agent nodes.
+- Preserved duplicate-agent routing beside same-name prompt/tool nodes, rejected malformed Intercom recipient purposes without breaking older hosts, and synchronized workflow roster-update completion with broker processing ([#2895](https://github.com/bastani-inc/atomic/pull/2895)).
+- Fixed Herdr parent session identity being dropped after a failed first report. Later activity includes the identity until CLI delivery succeeds, while shutdown still attempts release after failed delivery ([#2891](https://github.com/bastani-inc/atomic/issues/2891)).
+- Fixed child shutdown clearing the parent's Herdr indicator when a resource loader shares the reporter across sessions. Only the bound session can change activity or release the pane, including while acquisition waits for a predecessor. Owning shutdown permits an eligible successor to reuse the already-loaded reporter, with serialized retirement before the new identity reports and stale predecessor events fenced; genuine quit still releases the pane.
+- Fixed retiring reload runners releasing the new Herdr reporter when both share one `SessionManager`. Transaction commit retains the started runner, and stale shutdown, activity, approval, and start events cannot mutate or reclaim its binding. Candidate reporting is staged until preparation succeeds, so a rejected reload preserves the live reporter's approval state, continued work, and final quit cleanup ([#2925](https://github.com/bastani-inc/atomic/pull/2925)).
+- Corrected S1 SDK waits, foregrounding and cancellation to return promised Results, restored watch cursors and opaque subscription leases, applied configured agent wait budgets, and fixed cleanup/disposal races including external owner closure of settled tasks ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Preserved S1 cancellation attention consistently with native snapshots, made subscription overflow/reset observable through iterator completion without a required callback, and safely recorded non-Error runner/setup/cleanup rejections without blocking confirmed cleanup ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Contained arbitrary S1 reconciliation callback exceptions, including unprintable values, as safe `subscription.failure` diagnostics without interrupting native wake delivery or fallback polling ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Preserved exact JavaScript strings in S1 snapshots, titles and report replay, including isolated UTF-16 surrogates and embedded NUL, without changing the SDK's ordinary string types ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Bounded S1 activity replay to the latest 256 accepted report identities per task without retaining their full payload history. Identical retained reports remain duplicates, conflicts remain refused, and evicted IDs are fresh reports; terminal receipts never expire while the task record exists ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Prevented accepted S1 activity IDs such as `runner-outcome` from blocking runner settlement, independent cleanup and owner closure. Internal terminal IDs are allocated atomically without reserving caller IDs or changing report conflict/replay and cancellation rules ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Prevented accepted NaN S1 wait budgets, including owner-configured agent budgets, from panicking native scheduling. Observations remain releasable by yield, settlement, disposal and owner closure without changing other budgets or per-call precedence ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Restored task completion outboxes now retry unacknowledged terminal intents on initialization instead of waiting for another task to settle, retaining completion identity and current admission checks ([#2906](https://github.com/bastani-inc/atomic/pull/2906)).
+- Fixed unrelated settings changes copying inherited `.pi` fields into primary `.atomic` settings and changing their resource provenance. Scoped writes preserve newer primary-file edits, explicit Atomic overrides (including empty arrays), and inherited builtin-resource precedence ([#2299](https://github.com/bastani-inc/atomic/issues/2299)).
+- Automatic and summary retry countdowns now use Atomic's theme-aware `∀` indicator instead of a braille spinner, preserving cancellation and countdown updates.
+- Settled tasks now leave the compact footer immediately while remaining inspectable in `/tasks` and completion cards, so retained failures do not keep the live indicator red.
+- Opening `/tasks` in isolated mode no longer emits an approval prompt or incorrectly changes Herdr to blocked. Genuine approval reporting remains unchanged.
+- Filled theme backgrounds now survive nested and truncation resets, keeping long task-completion titles, previews, and expand hints shaded through the last column.
+- Owner-bound task notifications now order queued same-child Intercom messages before completion through the delivery outbox. Failed delivery keeps the terminal intent retryable without changing the execution outcome, replaying successful earlier messages, or relaunching the task.
+- Fixed `/workflow connect` falsely marking Herdr blocked, including after hiding the graph. Custom UI supports `purpose: "navigation"` without suppressing genuine approval events.
+- Parallel subagent communication now preserves active and queued siblings while only a blocking requester waits for its correlated reply. Foreground observation yielding no longer discards queued work or changes execution concurrency; cancellation and owner cleanup remain explicit.
+- Fixed leaked parallel subagent worktrees and branches when a queued child is cancelled before starting, including session/workflow-stage owner closure after observation yields. Live siblings retain their worktrees until execution finishes.
+- Fixed Anthropic Messages tool requests advertising root object-union parameter schemas without fields by projecting their branch fields into Anthropic-compatible object schemas ([#2190](https://github.com/bastani-inc/atomic/pull/2190) by [@elefthei](https://github.com/elefthei)).
+- Matched main and workflow-stage `/tasks` compact pickers, retaining model, reasoning, session cwd/branch, and MCP context even while the owner streams. Task navigation no longer produces a false main-chat input notice; genuine pending prompts keep their routing and clear the notice when answered or the graph is hidden.
+- Fixed concurrent inline approvals hiding one another when completed or canceled out of order. The surviving prompt or task picker stays visible and regains input after leaving the workflow graph, in both local and isolated interactive modes. Canceled isolated approvals no longer leave a dead loading component behind.
+- Released alternate-folder Git branch watchers, polling and retry timers when their last chat footer closes or changes folders, while preserving concurrent main/stage updates and ignoring stale refreshes after replacement ([#2926](https://github.com/bastani-inc/atomic/pull/2926)).
+- Finished workflow failures now let Herdr return to idle while retaining attention and the failed outcome. Pending decisions, budget approvals, and live execution keep their existing states.
+- Fixed resume requests for ended recoverable workflow blocks falling through to a snapshot-only response. Non-resumable targets and unchanged blocked snapshots no longer report success.
+- Fixed macOS background-command cleanup failing immediately when a terminated process group temporarily contains an unreaped zombie. Cleanup remains bounded and still requires confirmed group disappearance.
+- Updated the locked Hono and js-yaml dependencies to patched releases and refreshed provider SDKs against upstream Pi. Google's consecutive tool-call limit now returns an error stop reason.
+- Extension model registries now expose authenticated streaming calls through their configured custom providers, preserving runtime provider ownership ([#9272](https://github.com/earendil-works/pi/pull/9272)).
+- Tree navigation rejects active compaction or branch summarization before replacing the current operation's UI, leaving the active branch intact ([#9179](https://github.com/earendil-works/pi/pull/9179)).
+- Radius login now prefers the discovered balanced model and falls back to the account's first available model after catalog refresh.
+- Direct steering and follow-up calls now run extension input handlers before queue admission, preserving transformed text/images and RPC input-source attribution while consuming handled inputs.
+- Fixed subagents stopped with `x` in `/tasks` failing to notify the parent chat. Running and queued cancellations now deliver their confirmed terminal receipt once, without requiring a final child response, duplicating completion notices, or overwriting an outcome that already settled.
+- Fixed premature Herdr idle reports between repeated output-cap continuations by keeping the original prompt active until the complete continuation chain settles, including quiet provider waits. No heartbeat or inactivity timer is required.
+- Fixed false Herdr blocked status after an answered prompt when an earlier notification observer is slow, and while browsing the read-only `/agents` catalog. Genuine user decisions still report blocked.
+- Fixed Escape in `/tasks` and subagent transcript navigation cancelling a pending `ask_user_question`. Questionnaires now wait behind navigation and resume with their selection intact; ordinary questionnaire cancellation is unchanged.
+
 ## [0.9.19-alpha.1] - 2026-09-06
 
 ### Fixed

package/dist/builtin/intercom/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to the `pi-intercom` extension will be documented in this fi
 
 ## [Unreleased]
 
+## [0.9.19-alpha.3] - 2026-09-09
+
+### Fixed
+
+- Session listings display host-provided live/terminal reply capability separately from idle activity. Closed workflow generations publish `closed` with post-mortem-only or unavailable reply routing rather than remaining misleadingly idle; group isolation and ask rejection rules are unchanged.
+- Canonical workflow-path asks correlate replies from connected retained stages even after their active roster rows disappear. Closed stages without post-mortem routing reject asks with lifecycle guidance rather than attempting a model turn.
+
+## [0.9.19-alpha.2] - 2026-09-08
+
+### Breaking Changes
+
+- Removed the model-facing `retryToken` parameter and result field. Callers must stop carrying tokens between calls; Intercom now owns bounded reconnect retries. Each new call remains a distinct operation, including identical messages.
+
+### Fixed
+
+- Reject asks to terminal noninteractive subagent children with an explicit error instead of waiting on retained idle registrations. Termination also settles exact pending asks, including socket-write races; live interactive idle asks, workflow post-mortem conversations, and send delivery remain unchanged.
+- Excluded internal workflow route-owner/control connections, model-less `ctx.ui` prompts, and `ctx.tool` nodes from recipient discovery. Broker checks refuse known non-agent targets before delivery or queueing, including retained completed prompts. Genuine agents busy in tools or awaiting human input remain eligible, and connected aliases survive pending-capability changes and completion without same-name controls changing agent ambiguity diagnostics.
+- Reject malformed session/roster recipient purposes while preserving omitted-purpose legacy agents. Workflow roster updates now wait for broker processing before reporting completion, preventing stale discovery across connections ([#2895](https://github.com/bastani-inc/atomic/pull/2895)).
+- `send`, `ask`, and `reply` now retry recoverable disconnects inside one tool invocation, preserving delivery identity and reply correlation for up to three retries. Cancellation stops retries, unresolved outcomes warn against automatic resending, and client retry state is released on exit. Broker deduplication and durable acceptance safeguards remain unchanged.
+- Busy non-interactive recipients now return correlated delivery errors instead of a stale "still working" auto-reply. Unclaimed refusals bypass the parent's idle queue as timestamped delivery feedback without starting another turn; waiting asks retain exact error correlation.
+- Owner-bound subagent task completion now participates in same-child message ordering, preserving unrelated queued messages and retrying failed delivery without repeating task execution.
+- Parallel child-to-parent requests now use correlated replies instead of terminal fresh-child handoffs, preserving accepted empty parent questions, omitted decision notes, and ordered attachments. Sends and progress updates remain nonblocking; single-child claimed handoffs are unchanged.
+
 ## [0.9.18] - 2026-09-05
 
 Cumulative release of the `0.9.18-alpha.3` through `0.9.18-alpha.7` prereleases. Per-change details remain in the unchanged prerelease sections below.

package/dist/builtin/intercom/README.md

@@ -55,7 +55,7 @@ A session becomes intercom-connected when all of these are true:
 - the model or user has invoked an Intercom tool, `/intercom`, or the `ALT+M` overlay in that session
 - the local broker is running or can be auto-started
 
-The session list only shows intercom-connected sessions, not every open Pi process on the machine.
+The session list, ALT+M picker, and group counts include connected agent sessions only. Internal workflow routing/control connections, model-less `ctx.ui` prompts, and `ctx.tool` nodes are hidden and cannot receive ordinary messages, even by a known ID or through a supervisor route. This includes run-level prompts and retained completed synthetic prompt stages. An agent executing a tool, including `tool:workflow`, or awaiting human input remains visible and messageable.
 
 If a session is unnamed, intercom exposes a runtime-only fallback alias like `subagent-chat-1a2b3c4d-1111-4222-8333-123456789abc` so other sessions can still target it. That alias is not persisted as the session title, so resume pickers can keep showing the transcript snippet instead of a generic `session-...` name.
 
@@ -133,6 +133,8 @@ The reply hint (enabled by default) points to `intercom({ action: "reply", ... }
 
 When a blocking `intercom.ask` targets a workflow stage that has already completed, Atomic uses the stage's retained conversation as a post-mortem chat. It automatically schedules a new turn in that exact conversation, preserving the original ask text and sender/thread correlation, so the target can answer with ordinary `intercom.reply` and the waiting sibling continues without a manual workflow follow-up. The completed stage and workflow DAG remain terminal. The workflow router has single-owner completion semantics: once it claims the ask, later late-message listeners preserve its completion promise regardless of bundled extension registration order. Parent and unrelated sessions cannot satisfy the child-to-child waiter. Deleted, unavailable, non-resumable, or failed-to-reopen targets return a bounded actionable ask error.
 
+Noninteractive subagent children are different: after completion, failure, interruption, or cancellation they cannot reopen to answer an ask. New asks fail immediately with an explicit terminal-child error, even if a retained registration still shows `idle`; asks already admitted fail on termination unless their reply has settled. Launch a fresh child with explicit context for follow-up work. Live interactive idle sessions remain askable, and all `send` transport semantics remain unchanged.
+
 When a blocking ask reaches a sibling workflow stage during an active model/tool turn, the target reserves it synchronously in the open stage generation before any asynchronous foreground-owner detach handshake. Queue insertion waits inside that reservation, and stage finalization drains it before publishing the terminal snapshot. This prevents a structured-output or other terminal tool call from overtaking a mid-turn ask. If destination-side admission genuinely cannot complete, the asker receives an exact-thread actionable error instead of consuming the full 10-minute timeout.
 
 For delegated children, queued messages and terminal lifecycle notices are ordered per child. Intercom claims the terminal child's pre-terminal ordinary entries in FIFO order and atomically admits that prelude together with the interrupted, completed, or failed notice. A process-local companion bridge covers lazily loaded extensions whose event buses are distinct, while exact terminal-identity deduplication prevents double admission even when the successful terminal dispatch has no queued prelude. Failed dispatches remain retryable, and each terminal child identity is admitted only once. Other children's entries remain independently queued, messages are not discarded, terminal admission does not wait for a separate model turn, and correlated ask replies still bypass unrelated queued sends.
@@ -250,21 +252,21 @@ This workflow uses Atomic's in-process subagent admission. When the runtime admi
 
 `contact_supervisor` is registered from the typed admission record. The record binds the supervisor target, canonical child identity, child index, session name, and broker-issued capability to the child session; these values are not inherited from environment variables. If the parent does not grant supervisor coordination, the session falls back to the regular `intercom` tool.
 
-Parent-targeted decisions, interviews, and `intercom.ask` make the current child terminal for continuation. The parent receives the original question, ordered attachments, agent identity, and a dynamic `[TASK_CONTEXT]` handoff for a fresh child with a new run identity. Ordinary Intercom detach for sends, progress updates, and non-parent asks remains separate.
+Parallel blocking requests wait only in their requesting child and continue that same execution after the supervisor's correlated Intercom reply. Active and queued siblings retain their identities and execution capacity. A single-child claimed parent request instead retains the terminal `[TASK_CONTEXT]` handoff for a fresh child.
 
 ### Three Reasons
 
 | Reason | Behavior | Use When |
 |--------|----------|----------|
-| `need_decision` | In a claimed foreground run, ends the child and returns a fresh-child handoff; otherwise uses the normal ask fallback | The subagent is blocked, uncertain, needs approval, or faces a product/API/scope decision |
-| `interview_request` | In a claimed foreground run, ends the child and returns structured questions in a fresh-child handoff | The subagent needs multiple machine-readable answers from the supervisor in one exchange |
+| `need_decision` | In parallel, waits for a correlated reply in the same child; a single-child claimed request retains its fresh-child handoff | The subagent is blocked, uncertain, needs approval, or faces a product/API/scope decision |
+| `interview_request` | In parallel, waits for structured answers in the same child; a single-child claimed request retains its fresh-child handoff | The subagent needs multiple machine-readable answers from the supervisor in one exchange |
 | `progress_update` | Fire-and-forget update to the supervisor | Meaningful progress or unexpected discoveries that change the plan |
 
 Do not use `contact_supervisor` for routine completion handoffs. Return the final subagent result normally.
 
 Cross-group delivery uses a dedicated broker protocol. Ordinary raw `send` frames always remain group-isolated and are rejected if they include a forged `channel: "supervisor"` marker. A child can cross groups only after its broker-issued capability has bound its registered socket to the exact supervisor. The broker adds the `supervisor` channel marker to validated inbound traffic so parent relays can distinguish it. Replies cross back only when `replyTo` matches a recorded supervisor message in the exact reverse direction; fabricated thread IDs do not bypass isolation.
 
-During a foreground subagent run, parent-targeted decisions, interviews, and asks are claimed before broker delivery or reply-waiter admission. The current child ends and its parent tool call receives the fresh-start handoff. Parallel claims interrupt active siblings, prevent queued tasks from launching, and retain no sibling set for later bare-run-ID continuation. Sends, progress updates, and asks to other peers retain the exact-child probe/commit detach path and ordinary Intercom delivery behavior.
+Parallel asks, decisions, interviews, sends, and progress updates use ordinary Intercom delivery. The exact-child probe/commit handshake may release foreground observations so the parent can reply; it never cancels the batch or discards queued siblings. Only blocking requests wait for a reply. Targeted cancellation and owner/batch cleanup remain separate. Single-child claimed parent asks retain their source-side terminal fresh-start handoff.
 
 ### Example: Blocked Subagent Asks for Guidance
 
@@ -273,7 +275,8 @@ contact_supervisor({
   reason: "need_decision",
   message: "The auth service returns 403 instead of 401 for expired tokens. Should I treat 403 as a re-auth trigger or a hard failure?"
 })
-// → Parent receives a [TASK_CONTEXT] handoff and launches a fresh child with the answer.
+// → In parallel, the supervisor replies through Intercom and this child continues.
+// → A single-child claimed request instead returns a [TASK_CONTEXT] handoff.
 ```
 
 ### Example: Structured Supervisor Interview
@@ -290,7 +293,7 @@ contact_supervisor({
     ]
   }
 })
-// → Parent includes the structured supervisor answer in a fresh child's task.
+// → In parallel, the structured Intercom reply returns to this child's tool call.
 ```
 
 ### Example: Progress Update
@@ -344,7 +347,6 @@ The supervisor can reply with plain JSON or a fenced `json` block. If the reply
 | `message` | string | Message text (for send/ask/reply) |
 | `attachments` | array | Optional `file`, `snippet`, or `context` attachments |
 | `replyTo` | string | Optional message ID for threading or replying to an `ask` |
-| `retryToken` | string | Opaque claim returned by a retryable `send`/`ask`/`reply` failure; valid only with the exact same caller arguments. Omit it for fresh operations. |
 | `group` | string | Group name for `join` or optional targeted `leave`; read-only filter for `list`/`status`. `send`/`ask` require a shared membership. |
 
 ### contact_supervisor
@@ -375,6 +377,8 @@ Only registered in sessions where `pi-subagents` supplied the required child bri
 
 Live target lookup accepts only an exact full Intercom session ID or an exact case-insensitive session name. Join `workflow:<rootRunId>` and use `intercom list` to see materialized `PENDING`/`RUNNING` workflow stages with canonical `workflow:<rootRunId>/<segment>[/<segment>...]` paths, plus possible future literals, globs, nested paths, and their queued counts. `*` matches one segment and `**` any depth. `workflow:<rootRunId>/**` reaches live stages now and remains sticky for every future stage until root termination; narrower patterns behave the same for their matches. A valid path outside the known set queues with `notInKnownSet` and settles undeliverable at terminal only if never delivered. Use `ask` only on live targets. An eligible invocation member has directional list/send/live-ask control over stages in owned `workflow:<rootRunId>/...` subgroups. A subgroup stage or another workflow root cannot turn a mutable join into parent control; sibling subgroups stay isolated, and explicit `group: "default"` remains non-owned.
 
+When multiple live agent stages share a name, `ask` refuses the ambiguous target and recommends an exact stage-ID path. Name-based `send` keeps sticky delivery to matching agents, even when a prompt or tool shares the same name. Custom hosts may set `recipientPurpose` to exactly `"agent"` or `"control"` on registration and workflow roster entries; omission means legacy agent behavior. Malformed values (including `null`) are rejected, and presence updates cannot change a session's registered purpose. Host roster-update completion includes a same-connection broker round trip before subsequent discovery.
+
 **`send`** — Sends through ordinary Intercom. Live workflow-stage sessions receive messages immediately and return `delivered`. Known pending invocation-owned stages queue durably and return the distinct `queued` result with its FIFO position; a main-chat session that explicitly joined the owning invocation group may use that route. Pending `group: "default"` stages remain ineligible, and an ineligible attempt is refused with `Target workflow run is in a different intercom group`. Each exact run/stage key retains at most 50 queued messages; the next send is refused rather than evicting an older one. Delivery occurs before the first model turn under **Messages received before you started**, with sender identity and `Sent:` timestamp separate from the task prompt. Resume/replay, broker restart, and stage-attempt restart preserve exactly-once delivery by logical message ID. Skipped, cancelled, and terminal-before-initialization destinations make pending messages undeliverable and notify the sender. If the sender reconnects with a new broker UUID, notification fallback requires one unique same-group match for the immutable registration-time name; mutable presence names/groups, cross-group matches, and ambiguous duplicates are rejected. The broker trusts that initial name/group as host-orchestration metadata, while the original display/provenance remains unchanged in the durable record. Live sends remain immediate by default; `confirmSend: true` still enables confirmation for non-reply sends.
 
 **`ask`** — Sends a message and waits for a live recipient to reply (10-minute timeout). Invocation control supports a live ask into an owned isolated subgroup, and the exact broker-recorded reply resolves the waiting tool call at the asker without opening reverse or lateral group access. Ask to an uninitialized stage remains refused with `pending_stage_ask_unsupported`; use queued `send` instead, because holding a reply waiter until a stage eventually starts would be unbounded. A recipient disconnect after live delivery fails only that peer's exact wait promptly; the timeout remains the backstop while the recipient stays connected. Up to `maxPendingAsks` blocking asks (default: 6) may run concurrently, including same-target and mixed-target fan-out. Replies resolve by exact sender and message ID, so out-of-order replies cannot cross-settle another call. When capacity is full, new asks receive a structured refusal.
@@ -459,20 +463,26 @@ graph TB
 
 The broker is a standalone TypeScript process that manages session registration and message routing. It auto-spawns when the first session that invokes Intercom needs it and exits after 5 seconds when it last has no registered sessions, including brokers that never received a connection and sockets that close before register. Clients reconnect automatically if the broker disappears and later comes back. A failed reconnect schedules the next attempt on a bounded backoff (1s, 2s, 5s, 10s, then 30s) once it releases reconnect ownership, so a transient failure never leaves a live session with nothing owning recovery; a failed explicit tool or overlay connection still returns its error to the caller and leaves the retry behind. A reconnect that fails after the broker already accepted it closes that connection first, so a session never appears twice in `intercom list`.
 
-An explicit `send`, `ask`, or `reply` that reports the typed `Client disconnected` failure returns an opaque `retryToken`. Retry the exact action and arguments with that token, up to three claimed attempts. A tokenless call is always a fresh intentional operation even if byte-identical, and concurrent failures receive separate tokens. Tokens are unguessable and process-local, scoped to this tool registration/session and one canonical operation; invalid, expired, foreign, mismatched, in-flight, exhausted, and settled claims fail before sending. Attachment object member order is canonical, but omission is distinct from an explicit empty array and attachment array order/duplicates remain exact. The identity expires at the original 11-minute deadline (the 10-minute `ask` window plus one minute), which retries never extend.
+Each `send`, `ask`, or `reply` invocation retries typed recoverable disconnects internally up to three times, after delays of 1, 2, and 5 seconds. Retries keep the same message ID, exact arguments, attachment order and presence, and reply route. The model does not supply or receive a retry token; existing integrations must remove `retryToken`, which is now refused without sending. Every new invocation remains a fresh operation, even with identical text. Confirmation happens once, and neither retries nor renewed reply waits extend the original 11-minute operation deadline.
+
+Lazy initialization before delivery has a separate limit of three reconnect retries on the same schedule. If that phase stops, the tool reports `outcome: "not_sent"`. The initialization wrapper never re-executes a delivery that has already started.
 
-A token-claimed retry preserves the same token and message ID after `delivered: false`, `Session not found`, durable-authority uncertainty/capacity refusal, or another typed disconnect; each claim consumes one of the three attempts. It settles on delivered/queued success or a genuinely conclusive non-recoverable outcome. Initial tokenless nondelivery and unrelated/non-recoverable error classification stay unchanged.
+Once recovery starts, intermediate nondelivery or authority uncertainty/capacity refusal preserves that identity for the remaining attempts. Delivered/queued success ends recovery; unrelated errors and cancellation stop it. A receipt received during cancellation remains success. Unresolved recovery, or an accepted ask ending without a reply, returns a terminal error with `outcome: "unknown"` and a warning not to repeat automatically because delivery may already have occurred. Check with the recipient before intentionally sending again. Initial nondelivery and unrelated pre-delivery failures do not start recovery.
 
 The broker keeps accepted-operation authority for 12 minutes in `delivered-messages.sqlite`. It stores canonical signatures only as fixed keyed SHA-256 HMAC digests, with the random key in `delivered-messages.key`; message text and attachment contents never reach SQLite, and the key prevents offline guesses for low-entropy messages by other local users. On POSIX the Intercom directory is corrected to `0700` and database/WAL/SHM/key artifacts to `0600`; missing or malformed key/database pairs and corrupt digest records fail closed. The broker retains at most 10,000 live authority records and 64 MiB of digest/routing authority.
 
 The broker reserves an identity durably before forwarding, then marks it accepted after confirmed write and before acknowledging the sender. This survives broker replacement without redelivery. A deduplicated ask remains answerable after reconnect: implicit public `reply` uses the exact recorded sender ID while it is live, even alongside a same-name peer; only a departed ID falls back to authorized reconnect/name resolution, where ambiguity and changed identity/groups fail without sending. An implicit reply retry also retains its original sender/question snapshot, so later inbound asks cannot redirect or invalidate it. Explicit `to` and `replyTo` remain verbatim and `requirePendingReply` still binds the exact pending thread. Legacy sends without logical-target metadata retain transport-target behavior.
 
-Retry state is independently bounded and fails closed at pressure. A fresh client operation reserves one of 1,000 identity slots before consuming an ID, showing confirmation UI, resolving its target/reply route, or sending; existing token claims remain available when full. Capacity reopens when an in-flight or retained identity is released or expires, and settled tombstones are discarded without evicting live authority. The broker likewise refuses new delivery rather than evicting live authority, then accepts again after TTL cleanup. The local subagent result relay applies the same order in memory—reserve before its chat side effect, accept before positive acknowledgement—and refuses the 10,001st live ID or an uncertain replay without performing the side effect. SQLite transactions serialize replacement-broker access.
+Retry state is independently bounded and fails closed at pressure. A fresh client operation reserves one of 1,000 identity slots before consuming an ID, showing confirmation UI, resolving its target/reply route, or sending; existing internal retries remain available when full. The invocation releases its client retry state on exit without deleting broker authority. The broker refuses new delivery rather than evicting live authority, then accepts again after TTL cleanup. The local subagent result relay reserves before its chat side effect and accepts before positive acknowledgement. It refuses the 10,001st live ID or an uncertain replay without performing the side effect. SQLite transactions serialize replacement-broker access.
 
 A workflow stage warming up before its heavy module exists is the one case the reconnect backoff cannot own, so the lightweight wrapper retries that warm-up on the same bounded schedule. When those attempts run out it writes nothing to the console: it hands the stage's pending delivery a typed terminal reason through the delivery contract's required `fail(reason)`, and the workflow side fails that stage with a stage-scoped, non-retryable error instead of leaving it waiting on `pendingStageDelivery.ready()`. No model retry or fallback candidate is spent on it, since every candidate would be refused the same instructions. Queued messages are left queued rather than delivered to a stage that will not read them.
 
 Messages use length-prefixed JSON over a local socket/pipe transport (4-byte length + JSON payload) to handle fragmentation properly. The protocol includes request correlation for session listing, explicit delivery failures, and validation for malformed or out-of-order messages.
 
+Host registrations may declare the immutable `recipientPurpose` as `"agent"` or `"control"`; omission retains legacy agent behavior. Dedicated pending-stage route clients register as controls. Presence, name, status, and membership updates cannot change that purpose. The broker keeps control connections for route ownership while excluding them from recipient discovery and ordinary delivery. Known `ctx.ui` prompt and `ctx.tool` paths are rejected before speculative future-stage queueing; wildcard queues remain available for future agents.
+
+Workflow roster announcements keep node `recipientPurpose` separate from `routeEligible`: a hidden pending row does not make a genuine live agent ineligible. Internal run-parent metadata carries the uniquely resolved boundary names and IDs, so nested tool paths are refused by the broker before invoking their route owner. Materialized run-ID segments retain their existing precedence and may occur at any depth.
+
 Async extension work (startup, inbound flushes, reconnects, overlays, and relays) no-ops if the session shuts down or reloads before it settles.
 
 Runtime files live under the active agent directory. Atomic defaults to `~/.atomic/agent/intercom/`; setting `ATOMIC_CODING_AGENT_DIR` moves the broker socket, PID, spawn lock, Windows launcher, and config below that directory. The legacy `PI_CODING_AGENT_DIR` alias remains supported when the Atomic variable is unset. Legacy pi-compatible defaults use `~/.pi/agent/intercom/`.

package/dist/builtin/intercom/broker/broker.ts

@@ -4,7 +4,7 @@ import "./bounded-stderr-install.js";
 import net from "net";
 import { chmodSync, writeFileSync, unlinkSync, mkdirSync, readFileSync } from "fs";
 import { randomUUID } from "crypto";
-import { createMessageReader } from "./framing.js";
+import { createMessageReader, type JsonWireValue } from "./framing.js";
 import { writeMessageIfOpen, writeMessageWithOutcome } from "./socket-writes.js";
 import {
 	getBrokerDeliveredMessagesPath,
@@ -21,6 +21,7 @@ import type {
 	WorkflowStageRosterEntry,
 	WorkflowPossibleStageAnnouncement,
 	WorkflowFutureStageRosterEntry,
+	WorkflowRunParentAnnouncement,
 } from "../types.js";
 import {
 	formatWorkflowStageTarget,
@@ -50,6 +51,7 @@ import {
 import { PendingQuestionIndex } from "./pending-question-index.js";
 import { matchStagePathSegments } from "../workflow-stage-path-matching.js";
 import { DELIVERED_MESSAGE_TTL_MS } from "../retry-policy.js";
+import { isAgentRecipient } from "../recipient-purpose.js";
 
 const INTERCOM_DIR = getIntercomDirPath();
 const SOCKET_PATH = getBrokerSocketPath();
@@ -68,6 +70,7 @@ interface WorkflowRosterRegistration {
 	readonly group: string;
 	readonly stages: WorkflowStageRosterAnnouncement[];
 	readonly possibleStages?: readonly WorkflowPossibleStageAnnouncement[];
+	readonly parent?: WorkflowRunParentAnnouncement;
 }
 
 
@@ -83,6 +86,7 @@ interface PendingStageAcknowledgment {
 	readonly message: Message;
 	readonly liveTargetId?: string;
 	readonly signature?: string;
+	readonly resolveReplyTarget?: true;
   readonly timeout: NodeJS.Timeout;
 }
 
@@ -135,7 +139,11 @@ function isSessionRegistration(value: unknown): value is Omit<SessionInfo, "id">
     return false;
   }
 
-
+  if (session.replyCapability !== undefined && session.replyCapability !== "live" && session.replyCapability !== "terminal") return false;
+  if (session.recipientPurpose !== undefined &&
+    session.recipientPurpose !== "agent" && session.recipientPurpose !== "control") {
+    return false;
+  }
   if (session.groups !== undefined &&
     (!Array.isArray(session.groups) || !session.groups.every((group) => typeof group === "string"))) {
     return false;
@@ -155,6 +163,16 @@ function invocationOwnsGroup(invocationGroup: string, candidateGroup: string): b
 	return candidate === owner || candidate.startsWith(`${owner}/`);
 }
 
+function readWorkflowRunParentAnnouncement(value: JsonWireValue | undefined): WorkflowRunParentAnnouncement | undefined {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return undefined;
+	if (
+		typeof value.runId !== "string" ||
+		!Array.isArray(value.stageKeys) ||
+		!value.stageKeys.every((key) => typeof key === "string")
+	) return undefined;
+	return { runId: value.runId, stageKeys: value.stageKeys };
+}
+
 function isWorkflowStageRosterAnnouncements(
 	value: unknown,
 	runId: string,
@@ -183,6 +201,9 @@ function isWorkflowStageRosterAnnouncements(
 					parsed.segments.slice(0, -1).includes(runId)) &&
 				(announcement.lifecycle === "pending" || announcement.lifecycle === "running") &&
 				typeof announcement.routeEligible === "boolean" &&
+				(announcement.recipientPurpose === undefined ||
+					announcement.recipientPurpose === "agent" ||
+					announcement.recipientPurpose === "control") &&
 				typeof announcement.group === "string"
 			);
 		})
@@ -371,6 +392,35 @@ class IntercomBroker {
 		const matches = roster.stages.filter((stage) => stage.stageId === stageKey || stage.stageName === stageKey);
 		return matches.length === 1 ? matches[0]!.target : undefined;
 	};
+	private isNonAgentWorkflowTarget = (target: string): boolean => {
+		const parsed = parseWorkflowStageTarget(target);
+		if (parsed?.kind !== "path") return false;
+		// A connected agent's registered alias outlives its pending roster row.
+		// A same-name control announcement must not revoke that live identity.
+		if (this.resolveLiveWorkflowStage(target) !== undefined) return false;
+		const rosters = [...this.workflowRosters].filter(([, roster]) => roster.group === `workflow:${parsed.rootRunId}`);
+		let runId: string | undefined = parsed.rootRunId;
+		for (const segment of parsed.segments.slice(0, -1)) {
+			// Match the host's materialized-stage traversal: run IDs can jump at any
+			// depth; otherwise follow a uniquely resolved boundary ID/name edge.
+			if (rosters.some(([id]) => id === segment)) {
+				runId = segment;
+				continue;
+			}
+			const children = rosters.filter(([, roster]) => roster.parent?.runId === runId && roster.parent.stageKeys.includes(segment));
+			runId = children.length === 1 ? children[0]![0] : undefined;
+			if (runId === undefined) break;
+		}
+		const stageKey = parsed.segments.at(-1);
+		const stages = rosters.find(([id]) => id === runId)?.[1].stages;
+		const byId = stages?.filter((stage) => stage.stageId === stageKey) ?? [];
+		// Hosts without parent-edge metadata still support their advertised literal targets.
+		const matches = stages === undefined ? rosters.flatMap(([, roster]) => roster.stages.filter((stage) =>
+			stage.target === target || withWorkflowStageTargetFinalSegment(stage.target, stage.stageName) === target,
+		)) : byId.length > 0 ? byId : stages.filter((stage) => stage.stageName === stageKey);
+		return matches.some((stage) => !isAgentRecipient(stage)) && !matches.some(isAgentRecipient);
+	};
+
 
 	private resolveLiveWorkflowStage = (target: string): ConnectedSession | undefined => {
 		const registration = this.liveWorkflowStageRoutes.get(target);
@@ -392,7 +442,7 @@ class IntercomBroker {
 			return undefined;
 		}
 		const session = this.sessions.get(registration.sessionId);
-		if (session !== undefined) return session;
+		if (session !== undefined && isAgentRecipient(session.info)) return session;
 		this.liveWorkflowStageRoutes.delete(target);
 		return undefined;
 	};
@@ -440,7 +490,7 @@ class IntercomBroker {
 	const entries: WorkflowStageRosterEntry[] = [];
 	for (const [runId, roster] of this.workflowRosters) {
 		for (const stage of roster.stages) {
-			if (!stage.routeEligible) continue;
+			if (!stage.routeEligible || !isAgentRecipient(stage)) continue;
 			const parentControl =
 				this.canControlWorkflowInvocation(requester, roster.group) && invocationOwnsGroup(roster.group, stage.group);
 			const directMembership = requesterGroups.has(stage.group);
@@ -485,6 +535,7 @@ class IntercomBroker {
 			if (![...requesterGroups].some((group) => invocationOwnsGroup(roster.group, group))) continue;
 			if (selected !== undefined && selected !== roster.group) continue;
 			for (const row of roster.possibleStages) {
+				if (this.isNonAgentWorkflowTarget(row.target)) continue;
 				entries.push({
 					kind: "workflow-future-stage",
 					runId,
@@ -528,6 +579,10 @@ class IntercomBroker {
 		// swaps its final segment. Without a roster entry, fall back to the flat run-id prefix
 		// (still an accepted resolver input).
 		const roster = this.workflowRosters.get(runId);
+		if (uniqueStageKeys.some((key) => {
+			const matches = roster?.stages.filter((stage) => stage.stageId === key || stage.stageName === key) ?? [];
+			return matches.length > 0 && matches.every((stage) => !isAgentRecipient(stage));
+		})) return false;
 		const targets = uniqueStageKeys.map((stageKey) => {
 			const entry = roster?.stages.find((stage) => stage.stageId === stageKey || stage.stageName === stageKey);
 			const entryTarget = entry === undefined ? undefined : parseWorkflowStageTarget(entry.target);
@@ -627,6 +682,7 @@ class IntercomBroker {
 		message: route.message,
 		...(route.liveTargetId === undefined ? {} : { liveTargetId: route.liveTargetId }),
 		...(route.signature === undefined ? {} : { signature: route.signature }),
+		...(route.resolveReplyTarget === true ? { resolveReplyTarget: true } : {}),
       timeout,
     });
     if (
@@ -774,6 +830,8 @@ class IntercomBroker {
 						return;
 					}
 					this.pendingQuestions.record(from.info.id, target.info.id, pending.messageId);
+					if (pending.resolveReplyTarget === true && pending.attemptId !== undefined)
+						writeMessageIfOpen(pending.senderSocket, { type: "question_target", messageId: pending.messageId, attemptId: pending.attemptId, sessionId: target.info.id });
 				}
 				writeMessageIfOpen(pending.senderSocket, {
 					type: "delivered",
@@ -826,6 +884,8 @@ class IntercomBroker {
 					return;
 				}
 				this.pendingQuestions.record(from.info.id, target.info.id, pending.messageId);
+				if (pending.resolveReplyTarget === true && pending.attemptId !== undefined)
+					writeMessageIfOpen(pending.senderSocket, { type: "question_target", messageId: pending.messageId, attemptId: pending.attemptId, sessionId: target.info.id });
 			}
 			writeMessageIfOpen(pending.senderSocket, {
 				type: "delivered",
@@ -849,6 +909,8 @@ class IntercomBroker {
 			});
 			return;
 		}
+		if (pending.message.expectsReply === true && pending.resolveReplyTarget === true && pending.attemptId !== undefined)
+			writeMessageIfOpen(pending.senderSocket, { type: "question_target", messageId: pending.messageId, attemptId: pending.attemptId, sessionId: target.info.id });
 		if (!writeMessageIfOpen(target.socket, { type: "message", from: pending.sender, message: pending.message })) {
 			this.deliveredMessages.forget(pending.messageId, pending.signature);
 			writeMessageIfOpen(pending.senderSocket, {
@@ -1029,6 +1091,7 @@ class IntercomBroker {
 		}
 		if (
 			target === undefined ||
+			!isAgentRecipient(target.info) ||
 			target.info.id === currentId ||
 			normalizeGroup(target.registrationGroup) !== routeGroup ||
 			!hasGroup(sessionGroups(target.info), routeGroup)
@@ -1164,15 +1227,15 @@ class IntercomBroker {
 
   private handleMessage(
     socket: net.Socket,
-    msg: unknown,
+    msg: JsonWireValue,
     currentId: string | null,
     setId: (id: string | null) => void,
   ): void {
-    if (typeof msg !== "object" || msg === null || !("type" in msg) || typeof msg.type !== "string") {
+    if (typeof msg !== "object" || msg === null || Array.isArray(msg) || typeof msg.type !== "string") {
       throw new Error("Invalid client message");
     }
 
-    const clientMessage = msg as { type: string } & Record<string, unknown>;
+    const clientMessage = msg;
 
     if (currentId === null && clientMessage.type !== "register") {
       throw new Error(`Received ${clientMessage.type} before register`);
@@ -1248,7 +1311,7 @@ class IntercomBroker {
         writeMessageIfOpen(socket, supervisorId
           ? { type: "registered", sessionId: id, supervisorSessionId: supervisorId }
           : { type: "registered", sessionId: id });
-        this.broadcastToMemberships({ type: "session_joined", session: info }, sessionGroups(info), id);
+        if (isAgentRecipient(info)) this.broadcastToMemberships({ type: "session_joined", session: info }, sessionGroups(info), id);
         break;
       }
 
@@ -1377,6 +1440,10 @@ class IntercomBroker {
           clientMessage.possibleStages !== undefined
             ? clientMessage.possibleStages
             : this.workflowRosters.get(clientMessage.runId)?.possibleStages;
+		// Optional path metadata is advisory for old hosts; omission retains a
+		// previously announced edge during two-session route replay.
+		const parent = readWorkflowRunParentAnnouncement(clientMessage.parent)
+			?? this.workflowRosters.get(clientMessage.runId)?.parent;
         if (activeExisting !== undefined && activeExisting.sessionId !== currentId) {
           // A stage replays the process-shared owner announcement before registering its live aliases.
           // It may publish the materialized roster, but the original workflow owner must continue to
@@ -1387,6 +1454,7 @@ class IntercomBroker {
               group: ownerGroup,
               stages: clientMessage.stages ?? [],
               ...(possibleStages === undefined ? {} : { possibleStages }),
+              ...(parent === undefined ? {} : { parent }),
             });
           }
           break;
@@ -1402,6 +1470,7 @@ class IntercomBroker {
             group: ownerGroup,
             stages: clientMessage.stages ?? [],
             ...(possibleStages === undefined ? {} : { possibleStages }),
+            ...(parent === undefined ? {} : { parent }),
           });
         }
         break;
@@ -1437,6 +1506,7 @@ class IntercomBroker {
         if (
           ownerRegistration === undefined ||
           registeringSession === undefined ||
+		  !isAgentRecipient(registeringSession.info) ||
           ownerRegistration.capability !== clientMessage.capability ||
 		  !invocationOwnsGroup(
 			ownerRegistration.group,
@@ -1509,6 +1579,7 @@ class IntercomBroker {
 				this.canControlLiveWorkflowStage,
 				this.resolveLegacyWorkflowStageTarget,
 				writeMessageWithOutcome,
+				this.isNonAgentWorkflowTarget,
 			);
 			break;
 		}
@@ -1535,6 +1606,7 @@ class IntercomBroker {
           currentId,
           this.sessions,
           (target, message) => writeMessageIfOpen(target, message),
+          this.pendingQuestions,
         );
         break;
       }
@@ -1597,7 +1669,7 @@ class IntercomBroker {
 		if (activation.sessionId === sessionId) this.liveWorkflowStageRouteActivations.delete(requestId);
 	}
 	this.sessions.delete(sessionId);
-	this.broadcastToMemberships({ type: "session_left", sessionId }, sessionGroups(departed.info), sessionId);
+	if (isAgentRecipient(departed.info)) this.broadcastToMemberships({ type: "session_left", sessionId }, sessionGroups(departed.info), sessionId);
 	}
   /** Deliver a broadcast once to each session represented in any given group. */
   private broadcastToMemberships(msg: BrokerMessage, groups: ReadonlySet<string>, exclude?: string): void {