@bingjiang0611/rotom 0.1.24 → 0.1.26

package/THIRD_PARTY_NOTICES.md

@@ -6,13 +6,13 @@ rotom 的根产品许可证尚未确定（当前 `UNLICENSED`）；此状态不
 
 | Package | Version | Declared license | Distribution |
 |---|---|---|---|
-| `@earendil-works/pi-coding-agent`, `pi-agent-core`, `pi-ai`, `pi-tui`, `pi-telemetry`, `pi-codemode`, `pi-mcp` (all under `@earendil-works`) | `1.3.0-rotom.1` | MIT | In-repository Pi fork (`packages/rotom-pi/`), built into integrity-pinned archives and installed under `runtime/pi/node_modules/` |
+| `@earendil-works/pi-coding-agent`, `pi-agent-core`, `pi-ai`, `pi-tui`, `pi-telemetry`, `pi-codemode`, `pi-mcp` (all under `@earendil-works`) | `1.3.0-rotom.2` | MIT | In-repository Pi fork (`packages/rotom-pi/`), built into integrity-pinned archives and installed under `runtime/pi/node_modules/` |
 | `@injaneity/pi-computer-use` | `0.5.1-rotom.0` | MIT | Independently maintained fork (`packages/rotom-computer-use/`), included from its integrity-pinned vendor archive |
 | `@juicesharp/rpiv-ask-user-question` | `2.6.2` | MIT | Included under `extensions/third-party/node_modules/` |
 | `@narumitw/pi-goal` | `0.54.4-rotom.8` | MIT | Independently maintained fork (`packages/rotom-goal/`), included from its integrity-pinned vendor archive |
 | `pi-context-view` | `0.7.1` | MIT | Included unmodified under `extensions/third-party/node_modules/` |
 | `pi-subagents` | `0.52.1-rotom.7` | MIT | Independently maintained Subagent source, included from its integrity-pinned vendor archive |
-| `sol-pi` (SoL-Pi, Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES) | `0.1.0-rotom.0` | MIT | Maintained import (`packages/rotom-sol-pi/`), included from its integrity-pinned vendor archive |
+| `sol-pi` (SoL-Pi, Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES) | `0.1.0-rotom.2` | MIT | Maintained import (`packages/rotom-sol-pi/`), included from its integrity-pinned vendor archive |
 
 Each included extension retains its original `LICENSE` and package metadata; transitive dependency notices remain in their installed package directories. The modified Subagent, Computer Use, Goal and SoL-Pi archives' origin and scope are documented in `extensions/third-party/vendor/README.md` and each fork's `package/UPSTREAM.md`. Shipping the complete dependency does not enable its unselected tools, templates, or skills.
 

package/extensions/observability/index.ts

@@ -20,7 +20,10 @@ const QODER_TRACE_ERROR_MESSAGES = new Map([
 	["Qoder: upstream_error_event", "upstream_error_event"],
 	["Qoder: upstream_error_frame", "upstream_error_frame"],
 	["Qoder: request_failed", "transport_failure"],
+	["Qoder: connection_failed", "transport_failure"],
 	["Qoder: stream_failed", "transport_failure"],
+	["Qoder: invalid_tool_id", "invalid_tool_id"],
+	["Qoder: model_refusal", "model_refusal"],
 ]);
 
 const EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u;
@@ -34,7 +37,7 @@ const PROVIDER_ERROR_CATEGORIES: ReadonlyArray<readonly [category: string, patte
 	["websocket", /^WebSocket (?:error|closed)\b/u],
 	["aborted", /^This operation was aborted$/u],
 	["overloaded", /overloaded/iu],
-	["network", /^(?:fetch failed|terminated|Connection error\.)$|^Qoder: (?:request|stream)_failed$|\b(?:ECONNRESET|ECONNREFUSED|ENOTFOUND|EAI_AGAIN)\b|socket hang up|^upstream connect error/u],
+	["network", /^(?:fetch failed|terminated|Connection error\.)(?: \(caused by: .*\))?$|^Qoder: (?:request|stream|connection)_failed$|\b(?:ECONNRESET|ECONNREFUSED|ENOTFOUND|EAI_AGAIN)\b|socket hang up|^upstream connect error/u],
 	["auth", /^API key auth failed\b/u],
 	["provider_error", /^Codex error:|^\{"type":"error"|^Qoder: /u],
 ];
@@ -376,8 +379,23 @@ function assistantAttributes(message: any): TraceAttributes {
 
 function qoderDiagnosticAttributes(value: unknown): TraceAttributes {
 	const diagnostic = record(value);
-	const allowedCodes = ["upstream_error_frame", "legacy_error", "transport_failure"];
+	const allowedCodes = ["upstream_error_frame", "legacy_error", "transport_failure", "invalid_tool_id"];
 	if (!diagnostic || !allowedCodes.includes(String(diagnostic.code))) return {};
+	if (diagnostic.code === "invalid_tool_id") {
+		// Event payloads are untrusted: persist only fixed categories and the
+		// parser's bounded wire index, never identities, arguments or prose.
+		return {
+			"pi.ai.qoder.diagnostic_code": "invalid_tool_id",
+			...(["non_string", "oversized", "changed"].includes(diagnostic.reason)
+				? { "pi.ai.qoder.tool_id_reason": diagnostic.reason } : {}),
+			...(diagnostic.reason === "changed" && ["extension", "fragment", "distinct"].includes(diagnostic.relation)
+				? { "pi.ai.qoder.tool_id_relation": diagnostic.relation } : {}),
+			...(diagnostic.reason === "changed" && typeof diagnostic.previousArgumentsComplete === "boolean"
+				? { "pi.ai.qoder.previous_arguments_complete": diagnostic.previousArgumentsComplete } : {}),
+			...(Number.isSafeInteger(diagnostic.wireIndex) && diagnostic.wireIndex >= 0 && diagnostic.wireIndex < 64
+				? { "pi.ai.qoder.tool_wire_index": diagnostic.wireIndex } : {}),
+		};
+	}
 	const status = Number.isSafeInteger(diagnostic.status) && (diagnostic.status as number) >= 0
 		? diagnostic.status as number
 		: undefined;

package/extensions/qoder/messages.mjs

@@ -257,7 +257,7 @@ export function buildQoderPayload(model, context, { maxTokens, reasoningMode } =
     messages: convertMessages(model, context),
     stream: true,
     stream_options: { include_usage: true },
-    max_tokens: maxTokens,
+    ...(maxTokens !== undefined ? { max_tokens: maxTokens } : {}),
   };
   if (reasoningMode) payload.reasoning_effort = reasoningMode.effort;
   const tools = context.tools ?? [];

package/extensions/qoder/provider.mjs

@@ -19,8 +19,9 @@ export const MODEL = {
   // "openai-completions" identity. Older sessions fail model_scope by design.
   api: 'qoder', provider: PROVIDER_ID, baseUrl: BASE_URL,
   reasoning: false, input: ['text'],
-  // Conservative adapter limits, not a claim about the service's capacity.
-  contextWindow: 32000, maxTokens: 4096,
+  // Managed input window; zero means no declared output maximum in Pi.
+  // The service owns the default output budget, not a guessed adapter cap.
+  contextWindow: 32000, maxTokens: 0,
   // Pi requires numeric prices. These placeholders are NOT zero-cost evidence.
   cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
   compat: { supportsStore: false, supportsDeveloperRole: false, supportsReasoningEffort: false, supportsStrictMode: false, maxTokensField: 'max_tokens' },
@@ -109,7 +110,7 @@ export async function createQoderProvider({ piAI, clampMaxTokens, getToken, getC
       messages: transcript.messages.filter(message => message.role !== 'system'),
     };
     const reasoning = REASONING_MODEL_IDS.includes(model.id);
-    if (!SUPPORTED_MODEL_IDS.includes(model.id) || model.provider !== PROVIDER_ID || model.baseUrl !== BASE_URL || model.api !== MODEL.api || model.reasoning !== reasoning || !Number.isSafeInteger(model.contextWindow) || model.contextWindow < 4096 || model.contextWindow > (EXPANDED_INPUT_MODEL_IDS.includes(model.id) ? 272000 : 32000) || model.maxTokens > 4096) throw new QoderError('model_scope_rejected');
+    if (!SUPPORTED_MODEL_IDS.includes(model.id) || model.provider !== PROVIDER_ID || model.baseUrl !== BASE_URL || model.api !== MODEL.api || model.reasoning !== reasoning || !Number.isSafeInteger(model.contextWindow) || model.contextWindow < 4096 || model.contextWindow > (EXPANDED_INPUT_MODEL_IDS.includes(model.id) ? 272000 : 32000) || !Number.isSafeInteger(model.maxTokens) || model.maxTokens < 0) throw new QoderError('model_scope_rejected');
     if (options.signal?.aborted) throw new QoderError('aborted');
     // Refresh through the session's native registry before building any payload,
     // including tool continuations and compaction. Never retry an inference.
@@ -173,8 +174,15 @@ export async function createQoderProvider({ piAI, clampMaxTokens, getToken, getC
     // the agent lifecycle; only request encoding and response translation move
     // in-house here.
     const nativeModel = { ...model, contextWindow: input.contextWindow, input: input.images ? ['text', 'image'] : ['text'], ...(controls ? { thinkingLevelMap: thinkingMap(controls.levels), compat: { ...MODEL.compat, supportsReasoningEffort: true } } : {}) };
-    clampMaxTokens ??= await nativeOutputBudget();
-    const maxTokens = clampMaxTokens(nativeModel, context, Math.min(options.maxTokens ?? MODEL.maxTokens, MODEL.maxTokens));
+    // Omit the default output limit, including for resumed models that still
+    // carry the former 4096 metadata. Explicit caller budgets (e.g. compaction)
+    // still use Pi's context headroom rather than an independent fixed ceiling.
+    let maxTokens;
+    if (options.maxTokens !== undefined) {
+      if (!Number.isSafeInteger(options.maxTokens) || options.maxTokens < 1) throw new QoderError('request_limits_rejected');
+      clampMaxTokens ??= await nativeOutputBudget();
+      maxTokens = clampMaxTokens(nativeModel, context, options.maxTokens);
+    }
     let payload = buildQoderPayload(nativeModel, context, { maxTokens, reasoningMode });
     // Preserve Pi's BeforeProviderRequest hook: an extension may rewrite the
     // payload, but openQoderStream re-validates the result against the bound
@@ -186,7 +194,7 @@ export async function createQoderProvider({ piAI, clampMaxTokens, getToken, getC
     // encoding and HTTP dispatch, then yields validated chunk records; a
     // pre-stream failure rejects here and lazyStream turns it into an error
     // event carrying the stable "Qoder: <code>" message the session-policy reads.
-    const { chunks } = await openQoderStream({ payload, getToken: requestToken, getLegacyCredential: () => requestCredential, legacyModel: entry, reasoningMode, fetchImpl, signal: options.signal, modelId: model.id, timeoutMs: reasoning ? 180000 : 60000, onDiagnostic, sessionId: options.sessionId, onMetering(data) {
+    const { chunks } = await openQoderStream({ payload, getToken: requestToken, getLegacyCredential: () => requestCredential, legacyModel: entry, reasoningMode, fetchImpl, signal: options.signal, modelId: model.id, timeoutMs: reasoning ? 180000 : 60000, onDiagnostic, sessionId: options.sessionId, onResponse: options.onResponse && (response => options.onResponse(response, model)), onMetering(data) {
       for (const notify of [() => recordMetering?.({ ...data, fingerprint: requestCredential?.fingerprint }), () => onMetering?.(data)]) {
         try { void Promise.resolve(notify()).catch(() => {}); } catch { /* Scoped metadata only; never retry a model request. */ }
       }

package/extensions/qoder/transport.mjs

@@ -35,9 +35,9 @@ export function inputCapabilities(entry) {
   // so it is a managed budget, not the upstream limit. The maintainer aligned it
   // with the Codex-declared 272000 to keep one compaction percentage across
   // providers; the fixed 400K wire selector still is not an advertised capacity.
-  // Consequence, measured: full 4096 output needs input <= window - 8192, so the
-  // researched >=272K single-request input is upstream capability, not product
-  // capacity, and oversized single turns lose answer budget instead of failing.
+  // Explicit output budgets retain Pi's native context headroom clamp. With
+  // no requested budget, the service decides output length; the managed input
+  // window and native compaction reserve remain unchanged.
   return Object.freeze({ images: reviewed && entry.reportedImages === true, contextWindow: expanded ? 272000 : Math.min(32000, entry?.reportedContextWindow ?? 32000), contextLength: expanded ? 400000 : Math.min(32000, entry?.reportedContextWindow ?? 32000) });
 }
 // Only inline, canonical base64 in the three exercised codecs.
@@ -261,6 +261,9 @@ export async function* qoderChunks(body, { signal, toolNames = [], onDiagnostic,
     if (chunk.choices.length > 1) fail('multiple_choices_unsupported');
     const choices = chunk.choices.map(choice => {
       if (choice.index !== undefined && choice.index !== 0) fail('invalid_choice_index');
+      // A refusal may omit delta and even precede later tool frames. Never
+      // reinterpret that explicit refusal as a malformed delta or execute tools.
+      if (choice.finish_reason === 'refusal') fail('model_refusal');
       // Observed Sonus/Ultimate COSY frames use function_call with modern
       // tool_calls deltas. Still require complete tools and validated EOF;
       // never reinterpret the direct HTTP route or legacy function_call deltas.
@@ -297,11 +300,12 @@ export async function* qoderChunks(body, { signal, toolNames = [], onDiagnostic,
           let index = wireIndexes.get(wireIndex);
           if (index === undefined) { index = calls.has(wireIndex) ? freeIndex() : wireIndex; wireIndexes.set(wireIndex, index); }
           let call = calls.get(index) ?? { id: '', name: '', arguments: '' };
-          // Observed Ultimate batches restart index 0 for each serial tool.
+          // Observed Ultimate batches restart index 0 for each serial tool,
+          // including on the fixed COSY route after unwrapping its envelope.
           // Rebase only a new full, unique identity after a complete prior call
           // and with an explicit declared function name. Never concatenate IDs,
           // alias a correction, or guess an interleaved/unfinished call's owner.
-          if (allowOpaqueReasoning && opaqueModelId === 'ultimate' && !allowLegacyEnvelope && wireIndex === 0 && t.index === 0 && call.id && typeof t.id === 'string' && t.id && call.id !== t.id) {
+          if (allowOpaqueReasoning && opaqueModelId === 'ultimate' && wireIndex === 0 && t.index === 0 && call.id && typeof t.id === 'string' && t.id && call.id !== t.id) {
             let args; try { args = JSON.parse(call.arguments); } catch { /* Incomplete predecessor: reject the identity change below. */ }
             if (record(args) && toolNames.includes(call.name) && toolNames.includes(t.function.name) && t.id.length <= 512 && !t.id.startsWith(call.id) && !call.id.startsWith(t.id) && ![...calls.values()].some(c => c.id === t.id)) {
               index = freeIndex(); wireIndexes.set(wireIndex, index); call = { id: '', name: '', arguments: '' };
@@ -309,7 +313,23 @@ export async function* qoderChunks(body, { signal, toolNames = [], onDiagnostic,
           }
           const out = { index, type: 'function', function: {} };
           if (t.id !== undefined && t.id !== '') {
-            if (typeof t.id !== 'string' || t.id.length > 512 || (call.id && call.id !== t.id)) fail('invalid_tool_id');
+            if (typeof t.id !== 'string' || t.id.length > 512 || (call.id && call.id !== t.id)) {
+              let reason = 'changed';
+              if (typeof t.id !== 'string') reason = 'non_string';
+              else if (t.id.length > 512) reason = 'oversized';
+              const diagnostic = { code: 'invalid_tool_id', reason, wireIndex };
+              if (reason === 'changed') {
+                // Describe identity/argument structure only; never emit IDs or arguments.
+                diagnostic.relation = 'distinct';
+                if (t.id.startsWith(call.id)) diagnostic.relation = 'extension';
+                else if (call.id.startsWith(t.id) || call.id.endsWith(t.id)) diagnostic.relation = 'fragment';
+                let previousArguments;
+                try { previousArguments = JSON.parse(call.arguments); } catch { /* Partial JSON is not a complete tool argument object. */ }
+                diagnostic.previousArgumentsComplete = record(previousArguments);
+              }
+              try { void Promise.resolve(onDiagnostic?.(diagnostic)).catch(() => {}); } catch { /* Optional metadata must not replace the validation error. */ }
+              fail('invalid_tool_id');
+            }
             call.id = out.id = t.id;
           }
           for (const field of ['name', 'arguments']) {
@@ -399,7 +419,22 @@ export async function* normalizeSSE(body, options) {
 // stream-time failures. It never yields STREAM_DONE, so normal completion of
 // `chunks` is itself proof of clean termination because qoderChunks fails
 // closed on any incomplete or malformed stream ending.
-export async function openQoderStream({ payload, getToken, getLegacyCredential, legacyModel, fetchImpl = globalThis.fetch, modelId = 'lite', sessionId = randomUUID(), timeoutMs = 60000, onDiagnostic, onMetering, reasoningMode, signal } = {}) {
+// Same connect-phase rule as Pi's `connectFailureCause` (this module stays
+// dependency-free): socket codes that only occur while connecting, or a proxy
+// tunnel / TLS setup that failed before any request bytes were sent. undici
+// nests these in `cause`, as an AggregateError for multi-address connects.
+const UNSENT_CONNECT_ERROR_CODES = new Set(['ENOTFOUND', 'EAI_AGAIN', 'ECONNREFUSED', 'ENETUNREACH', 'ENETDOWN', 'EHOSTUNREACH', 'EADDRNOTAVAIL', 'UND_ERR_CONNECT_TIMEOUT']);
+const UNSENT_CONNECT_ERROR_MESSAGE = /before secure TLS connection was established|when HTTP Tunneling/;
+function neverSent(error) {
+  let current = error;
+  for (let depth = 0; depth < 5 && current instanceof Error; depth++) {
+    if (UNSENT_CONNECT_ERROR_CODES.has(current.code) || UNSENT_CONNECT_ERROR_MESSAGE.test(current.message)) return true;
+    current = current.cause ?? (current instanceof AggregateError ? current.errors[0] : undefined);
+  }
+  return false;
+}
+
+export async function openQoderStream({ payload, getToken, getLegacyCredential, legacyModel, fetchImpl = globalThis.fetch, modelId = 'lite', sessionId = randomUUID(), timeoutMs = 60000, onDiagnostic, onMetering, onResponse, reasoningMode, signal } = {}) {
   // Models.json, onPayload and SDK overrides must never redirect credentials.
   const input = inputCapabilities(legacyModel?.id === modelId ? legacyModel : undefined);
   if (signal?.aborted) fail('aborted');
@@ -450,9 +485,8 @@ export async function openQoderStream({ payload, getToken, getLegacyCredential,
     payload.reasoning_effort = 'none';
   }
   if (payload.tools !== undefined && (!Array.isArray(payload.tools) || payload.tools.some(t => !record(t) || t.type !== 'function' || !record(t.function) || typeof t.function.name !== 'string'))) fail('request_scope_rejected');
-  const maxTokens = payload.max_tokens ?? 4096;
-  if (!Number.isSafeInteger(maxTokens) || maxTokens < 1 || maxTokens > 4096) fail('request_limits_rejected');
-  payload.max_tokens = maxTokens;
+  const maxTokens = payload.max_tokens;
+  if (maxTokens !== undefined && (!Number.isSafeInteger(maxTokens) || maxTokens < 1)) fail('request_limits_rejected');
   const requestId = randomUUID();
   payload.metadata = { context: { request_id: requestId, request_set_id: requestId, session_id: sessionId, task_id: 'common', client_type: 'rotom' } };
   const legacy = LEGACY_MODEL_IDS.includes(modelId);
@@ -491,6 +525,9 @@ export async function openQoderStream({ payload, getToken, getLegacyCredential,
       if (controller.signal.aborted) { void result.body?.cancel().catch(() => {}); fail('aborted'); }
       return result;
     }, controller.signal);
+    // Response-header timing for observability (status only matters there); the
+    // body is untouched, so this cannot alter the stream.
+    await onResponse?.({ status: response.status, headers: Object.fromEntries(response.headers) });
     if (!response.ok) {
       void response.body?.cancel().catch(() => {});
       fail(`http_${response.status}`);
@@ -502,7 +539,12 @@ export async function openQoderStream({ payload, getToken, getLegacyCredential,
     if (!controller.signal.aborted) {
       try { void Promise.resolve(onDiagnostic?.({ code: 'transport_failure', phase: 'request' })).catch(() => {}); } catch { /* Allowlisted metadata only. */ }
     }
-    throw new QoderError(controller.signal.aborted ? 'aborted' : 'request_failed');
+    // Only failures that prove the request never left this machine (offline,
+    // DNS, refused/unroutable connect) become connection_failed, which Pi waits
+    // out without a retry limit. A reset after the body was sent may already be
+    // billed upstream, so it stays the generic, non-retried request_failed.
+    const unreachable = dispatchStarted && neverSent(error);
+    throw new QoderError(controller.signal.aborted ? 'aborted' : unreachable ? 'connection_failed' : 'request_failed');
   }
   const frames = qoderChunks(response.body, { signal: controller.signal, onDiagnostic, onCreditUsage: usage => meter.observe(usage), allowReasoning: allowReasoning && reasoningMode?.enabled !== false, allowOpaqueReasoning: OPAQUE_MODEL_IDS.includes(modelId), opaqueModelId: modelId, allowLegacyEnvelope: legacy, allowLegacyMetricsDone: ['mmodel', 'smodel', 'ultimate'].includes(modelId), toolNames: (payload.tools ?? []).map(t => t.function?.name) });
   async function* chunks() {

package/extensions/third-party/node_modules/.package-lock.json

@@ -131,9 +131,9 @@
       }
     },
     "node_modules/pi-subagents": {
-      "version": "0.52.1-rotom.7",
-      "resolved": "file:vendor/pi-subagents-0.52.1-rotom.7.tgz",
-      "integrity": "sha512-6hbdcuDAqFSsYxlGzVptP1vbQc+x6Zxu4VAtSQVke6ZZWn+T+MWGvaLV06qATmCWo2bVfj0CNjJb8egQj96FPg==",
+      "version": "0.52.1-rotom.10",
+      "resolved": "file:vendor/pi-subagents-0.52.1-rotom.10.tgz",
+      "integrity": "sha512-5mXSC3zXponiWE+NP16rJ4zo1j1mHS04bbFO+fOc31RVVHA8rKvZ3nvemDOHT9qCBqINAiRcXJuhpZCNNNeoHg==",
       "license": "MIT",
       "dependencies": {
         "acorn": "8.18.0",
@@ -166,9 +166,9 @@
       }
     },
     "node_modules/sol-pi": {
-      "version": "0.1.0-rotom.0",
-      "resolved": "file:vendor/sol-pi-0.1.0-rotom.0.tgz",
-      "integrity": "sha512-flcySXo03haUIopXUtuJCOcDevQiOGclTcDeHSOArGltmnbb++0tkf/EFycVB/MB3FmD56g/5UUV81Ll8LP2aw==",
+      "version": "0.1.0-rotom.2",
+      "resolved": "file:vendor/sol-pi-0.1.0-rotom.2.tgz",
+      "integrity": "sha512-9SOaxYtxnfbnU+IByPpz8dmk95eDsGs4dvi1sq9i2g3VrGxIok0sGatlhPLhiOUgETWZyRBtRHULCm+yZiOu2g==",
       "license": "MIT",
       "engines": {
         "node": ">=22.19.0"

package/extensions/third-party/node_modules/pi-subagents/README.md

@@ -38,6 +38,23 @@ macOS 的 mount device ID 可能在重启后重新编号。store 现在只在 Da
 
 在 `.4` 的精简基础上，终态投影出错时保留已观察到的受控进程关闭证据与错误说明，将结果明确标记为 unknown，而不是推断任务成功或授权重放。本版重新归档当前源码，使后续终态修复实际进入产品；不覆盖旧 `.4` 归档，不迁移存活安装。它属于后续开发，不包含在已冻结的 rotom `0.1.17` 安装包中。
 
+## `0.52.1-rotom.9`：父运行时退出前等待关闭证明
+
+正常退出、reload、new/resume 或 SDK dispose 时，先暂停当前扩展运行时实际启动的异步 runner，等待真实 `close` 回调完成终态证据处理，再清理运行时。只保留当前进程中的 ChildProcess 对象，不按历史 PID 补发信号；其他运行时的任务不受影响。回收开始后拒绝新 writer，正常关闭后可由新运行时恢复原 canonical session。后台任务不再跨越其所属运行时的销毁继续执行。任务结果先于 close 回调到达时，仅在本进程仍持有该 run/runner 实例的真实观察者期间保留 pending；不会提前将其改成 observer-unavailable，也不会把观察者登记当成关闭证明。
+
+强杀、异常 owner loss、缺失/写入失败的证据仍是 unknown，不从候选记录或 PID 消失推断历史退出；不补写旧任务的成功证明、不自动恢复旧任务。源码版本不会热更新当前安装。验证、首次失败与剩余限制见[父运行时关闭修复](../../docs/agent/subagent-parent-shutdown.md)。
+
+## `0.52.1-rotom.10`：内置角色可在 owned scope 启动
+
+会话复盘发现 `delegate` 在 owned scope 下 6/6 启动失败、`researcher` 1/1 失败，原因都是缺少显式 `extensions`。本版调整内置角色：
+
+- `delegate` 声明空 `extensions` 与 `defaultContext: fresh`，工具白名单不变。
+- `oracle`（别名 `advisor`）改为 `defaultContext: fresh`、空 `extensions`，任务由父会话写成决策简报（目标/验收、已定决策、约束、方案、相关文件、具体问题）；仍只读，不再依赖 fork。
+- `reviewer` 增加 `bash`，提示词限定只读检查（diff/log/rg、运行现有测试与类型检查），禁止写文件、Git 写操作、安装和网络；这是提示约束，不是沙箱。
+- 删除 `researcher`：它依赖的 `web_search`/`fetch_content` 在 rotom 中不存在。需要网页检索时由父会话自行完成，或配置显式声明 web 工具与 `extensions` 的自定义 agent。
+
+自定义 agent、显式 fork 请求与 admission 拒绝规则不变。
+
 ## 开发
 
 在本目录运行；依赖是固定版本及本目录 lockfile，勿复制维护者 node_modules：

package/extensions/third-party/node_modules/pi-subagents/agents/delegate.md

@@ -4,6 +4,8 @@ description: Lightweight subagent that inherits the parent model with no default
 systemPromptMode: append
 inheritProjectContext: true
 tools: read, grep, find, ls, bash, edit, write, contact_supervisor
+extensions:
+defaultContext: fresh
 inheritSkills: false
 ---
 

package/extensions/third-party/node_modules/pi-subagents/agents/oracle.md

@@ -1,41 +1,44 @@
 ---
 name: oracle
 aliases: advisor
-description: High-context decision-consistency oracle that protects inherited state and prevents drift
+description: Read-only decision-consistency oracle; checks a parent-written decision brief against the code and prevents drift
 tools: read, grep, find, ls, bash
+extensions:
 thinking: high
 systemPromptMode: replace
 inheritProjectContext: true
 inheritSkills: false
-defaultContext: fork
+defaultContext: fresh
 ---
 
-You are the oracle: a high-context decision-consistency subagent.
+You are the oracle: a read-only decision-consistency subagent.
 
-Your primary job is to prevent the main agent from making hidden, conflicting, or inconsistent decisions by treating the inherited forked context as the authoritative contract. You are not the primary executor. You do not silently become a second decision-maker.
+Your primary job is to prevent the main agent from making hidden, conflicting, or inconsistent decisions. You start with a fresh context: you do not see the parent conversation. The task is a decision brief written by the main agent, and it is your authoritative contract together with the code. You are not the primary executor. You do not silently become a second decision-maker.
 
-Before you do anything else, reconstruct the key inherited decisions, constraints, and open questions from the forked conversation, codebase state, and task. Those decisions form your baseline contract. Preserve them unless there is strong evidence they should be overturned.
+A useful brief contains: the goal and acceptance criteria, decisions already made and why, hard constraints, the current plan or proposed move, the files or documents that matter, and the specific question. Before you do anything else, restate the decisions, constraints, and open questions from the brief and verify the claims that matter against the named files and the codebase. Those decisions form your baseline contract. Preserve them unless there is strong evidence they should be overturned.
 
-Match search scope to the question. For runtime behavior, begin with specific source symbols, types, methods, and paths. For product, plan, policy, or decision drift, treat supplied documents and inherited context as first-class evidence. If source conflicts with docs about runtime behavior, trust source and report the conflict.
+If the brief omits something that changes the answer (a missing constraint, an unstated decision, no acceptance criteria), do not invent it. Ask the main agent through `contact_supervisor` when available; otherwise name the gap in "Need from main agent" and state which assumption you used.
 
-If the task asks about asking or consulting the oracle, or asks to ask, consult, discuss with, or come to agreement with the oracle about a plan, design, or architecture decision, treat it as a short live consultation unless the parent explicitly requests a one-shot report. In a first response, return the strongest challenge point or focused follow-up question when a material tradeoff remains, so the parent can resume this same session for one targeted round. A one-shot response remains suitable for an explicit one-shot request, a trivial question, or a fully settled first answer. When runtime bridge instructions provide `contact_supervisor`, ask one focused question or challenge if a material unknown, contradiction, or unapproved decision would make a final recommendation guessy. If no supervisor channel is available, return the best recommendation and name the decision that still needs the main agent.
+Match search scope to the question. For runtime behavior, begin with specific source symbols, types, methods, and paths. For product, plan, policy, or decision drift, treat the brief and the documents it names as first-class evidence. If source conflicts with docs about runtime behavior, trust source and report the conflict.
+
+If the task asks about asking or consulting the oracle, or asks to ask, consult, discuss with, or come to agreement with the oracle about a plan, design, or architecture decision, treat it as a short live consultation unless the parent explicitly requests a one-shot report. In a first response, return the strongest challenge point or focused follow-up question when a material tradeoff remains, so the parent can send one targeted follow-up round. A one-shot response remains suitable for an explicit one-shot request, a trivial question, or a fully settled first answer. When runtime bridge instructions provide `contact_supervisor`, ask one focused question or challenge if a material unknown, contradiction, or unapproved decision would make a final recommendation guessy. If no supervisor channel is available, return the best recommendation and name the decision that still needs the main agent.
 
 If you need clarification from the main agent and bridge instructions provide `contact_supervisor`, use it with `reason: "need_decision"` and wait for the reply. Use `reason: "progress_update"` only for concise updates when blocked, explicitly asked for progress, or when a recommendation or concern would benefit from immediate discussion. Keep coordination traffic tight and purposeful. Do not narrate your whole review through `contact_supervisor`.
 
 Do not send routine completion handoffs. If no coordination is needed, or after needed coordination is answered, return the final oracle recommendation normally. If `contact_supervisor` is unavailable, return the best recommendation and name the decision that still needs the main agent. Use generic `intercom` only when an external intercom provider explicitly supplies that tool and the task identifies a safe target.
 
 Core responsibilities:
-- reconstruct inherited decisions, constraints, and open questions from the context
-- identify drift between the current trajectory and those inherited decisions
+- restate the decisions, constraints, and open questions from the brief and check them against the code
+- identify drift between the current trajectory and those decisions
 - surface contradictions and hidden assumptions the main agent may be missing
 - call out when a proposed move conflicts with an earlier decision or constraint
 - protect consistency over novelty; prefer the path that honors existing decisions unless the context clearly supports a pivot
 - when you do recommend a pivot, explain exactly which prior assumption or decision should be revised and why
-- exploit your clean forked context to spot things the main agent may have missed due to context rot, accumulated reasoning, or errors in the original instruction
+- use your clean context to spot things the main agent may have missed due to context rot, accumulated reasoning, or errors in the original instruction
 - look beyond the explicit question and suggest guidance based on the overall agent trajectory, even when not directly asked
 
 What you do not do by default:
-- do not edit files or write code
+- do not edit files, write code, or change any state (no writes, installs, commits, or network calls)
 - do not propose additional parallel decision-makers or new subagent trees unless explicitly asked
 - do not assume a `worker` implementation handoff is the default outcome
 - do not propose broad pivots unless the context clearly supports them
@@ -50,21 +53,22 @@ Working rules:
 
 Your output should follow this shape. If no executor handoff is warranted, say so plainly.
 
-Inherited decisions:
+Decisions in the brief:
 - the key decisions, constraints, and assumptions already in play
+- any brief claim the code contradicts
 
 Diagnosis:
 - what is actually going on
 - what the main agent may be missing
 
 Drift / contradiction check:
-- where the current trajectory conflicts with inherited decisions or constraints
+- where the current trajectory conflicts with the brief's decisions or constraints
 - what assumptions have quietly changed
 
 Recommendation:
 - the best next move
 - why it is the best move
-- if recommending a pivot, which inherited decision is being revised and why
+- if recommending a pivot, which decision from the brief is being revised and why
 
 Risks:
 - what could still go wrong

package/extensions/third-party/node_modules/pi-subagents/agents/reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: reviewer
 description: Versatile review specialist for code diffs, plans, proposed solutions, codebase health, and PR/issue validation
-tools: read, grep, find, ls
+tools: read, grep, find, ls, bash
 extensions:
 defaultContext: fresh
 thinking: high
@@ -55,7 +55,9 @@ Review a PR or issue by understanding the context, then verifying:
 - Start from the exact diff and named source seam for code-behavior review. Use specific source, symbol, type, method, and path searches for discovery. Use broad or unscoped `grep` only when exhaustive verification is required, such as checking call sites, imports, removed names, or absence of a pattern.
 - Read the relevant files first. Read plan and progress when the task supplies them.
 - Repo-local `progress.md` files are allowed scratch/memory files. Do not flag them as repo noise, delete them, or ask to remove them just because they are untracked. If they appear in a coding repo, they should remain untracked and be covered by `.gitignore`.
-- Do not use shell commands or write files. Report any test or Git command that a supervisor must run.
+- Use `bash` only for read-only inspection: `git diff`/`git log`/`git show`/`git status`, `rg`, listing files, and running existing tests, type checks or linters that do not modify tracked files.
+- Never change the workspace or anything outside it: no file writes or redirects, no formatters with write mode, no `git add`/`commit`/`checkout`/`reset`/`stash`/`push`, no package installs, no network calls or deploys. If a check would need any of these, report the exact command for the supervisor instead of running it.
+- Report the commands you ran and their results; a check you did not run stays unverified.
 - Do not invent issues. Only report problems you can justify from evidence.
 - Prefer small corrective edits over broad rewrites.
 - If everything looks good, say so plainly.
@@ -73,7 +75,7 @@ Structure your findings clearly:
 ```
 ## Review
 - Correct: what is already good (with evidence)
-- Fixed: issue, location, and resolution (if you applied a fix)
+- Fix: issue, location, and suggested resolution
 - Blocker: critical issue that must be resolved before proceeding
 - Note: observation, risk, or follow-up item
 ```

package/extensions/third-party/node_modules/pi-subagents/docs/models.md

@@ -109,7 +109,7 @@ Project settings win over user settings. Use `agentOverrides.<name>.extensions`
   "subagents": {
     "defaultExtensions": [],
     "agentOverrides": {
-      "researcher": {
+      "scout": {
         "extensions": ["./tools/research.ts"]
       }
     }

package/extensions/third-party/node_modules/pi-subagents/docs/tool-reference.md

@@ -36,7 +36,7 @@ Chaining is code-driven through `workflowScript`. Use `await runs.run(...)` for
 | `action` | string | - | Agent management (including `guide`, `children.list`, and `refine`/`refine.show`/`refine.rollback`), mission (`mission.create/list/show/update/resolve-decision/attach-run/close`), Herdr inspector (`inspector.open/status/close`), status/control, watchdog, or doctor action. Scheduling is retired in the maintained component. |
 | `topic` | `overview \| workflows \| agents \| missions \| observability \| tool-reference \| configuration \| models \| watchdog \| extension-api` | `overview` | Packaged guide topic for `action: "guide"`. |
 | `config` | object/string | - | Agent config for management create/update. |
-| `context` | `fresh \| fork` | global or per-agent default, else `fresh` | Explicit `fresh` or `fork` overrides every workflow child. When omitted, [`defaultSubagentContext`](configuration.md#defaultsubagentcontext) wins over each agent's `defaultContext`; explicit `"fork"` requires a persisted parent session and current leaf or fails; only an implicit fork default can fall back to `fresh` when those prerequisites are absent. Packaged `worker`, `scout`, and `reviewer` default to `fresh`; `oracle` and its `advisor` alias default to `fork` (unsupported in owned scope). |
+| `context` | `fresh \| fork` | global or per-agent default, else `fresh` | Explicit `fresh` or `fork` overrides every workflow child. When omitted, [`defaultSubagentContext`](configuration.md#defaultsubagentcontext) wins over each agent's `defaultContext`; explicit `"fork"` requires a persisted parent session and current leaf or fails; only an implicit fork default can fall back to `fresh` when those prerequisites are absent. All packaged agents, including `oracle` and its `advisor` alias, default to `fresh`. |
 | `missionId` | string | - | Attach a workflow to an existing project mission instead of creating its default enclosing mission. |
 | `mission` | object/false | auto-create | Override the default enclosing mission with `{ title \| summary, objective?, goal?, budget?, labels? }`. Set exactly one non-empty `title` or `summary`; `objective` and `labels` are optional. `goal` may only be `true`, requires `budget.tokens`, and enables continuation notices. Pass `false` for an intentionally ephemeral workflow with no mission for it or its children and no `state` global. Explicit mission persistence failures are strict. |
 | `handoffPath` | string | - | Aggregate handoff manifest required by `action: "worktree.discard"`. |
@@ -73,7 +73,7 @@ Explicit `context: "fork"` fails fast when the parent session is not persisted,
 
 When the inherited transcript contains signed Anthropic `thinking` / `redacted_thinking` blocks, `pi-subagents` strips those provider-private blocks from the forked child session. It forces thinking `off` only when the child's effective primary or fallback model resolves through the model registry to the Anthropic provider or `anthropic-messages` API; unresolved models are treated conservatively. The result reports every affected child, including on failed runs. Use `context: "fresh"` when an Anthropic child needs thinking. Explicit `context: "fork"` never silently downgrades to `fresh`.
 
-In workflow runs that omit `context`, each `runs.run` child follows the global `defaultSubagentContext` when set, then its own `defaultContext`. Without the global setting, a fresh-default scout can run fresh beside a fork-default oracle in legacy scope. If the parent session file or current leaf is not available yet, implicit fork-default children run fresh. Pass explicit `context: "fork"` or `context: "fresh"` when you intentionally want one context for every child.
+In workflow runs that omit `context`, each `runs.run` child follows the global `defaultSubagentContext` when set, then its own `defaultContext`. Without the global setting, a fresh-default scout can run fresh beside a fork-default custom agent in legacy scope. If the parent session file or current leaf is not available yet, implicit fork-default children run fresh. Pass explicit `context: "fork"` or `context: "fresh"` when you intentionally want one context for every child.
 
 ### Workflow steering
 

package/extensions/third-party/node_modules/pi-subagents/docs/workflows.md

@@ -12,7 +12,7 @@ Use orchestration as parent-agent guidance, not as a runtime workflow mode. For
 clarify → scout → worker → fresh reviewers → worker
 ```
 
-Packaged `worker`, `scout`, and `reviewer` default to fresh context. `oracle` and its `advisor` alias default to forked context when a launch omits `context`. If the parent has no persisted session file or current leaf yet, that implicit default falls back to `fresh`. Pass `context: "fresh"` when you intentionally want a fresh child run, or `context: "fork"` when fork must remain strict.
+All packaged agents (`worker`, `scout`, `reviewer`, `delegate`, `oracle` and its `advisor` alias) default to fresh context; `oracle` works from a decision brief the parent writes into the task. A custom agent's implicit `defaultContext: fork` falls back to `fresh` when the parent has no persisted session file or current leaf yet. Pass `context: "fresh"` when you intentionally want a fresh child run, or `context: "fork"` when fork must remain strict.
 
 Child-safety boundaries are enforced at runtime:
 
@@ -29,7 +29,7 @@ The package includes reusable prompt templates for common workflows. You do not
 |--------|------------|
 | `/parallel-review` | Launch fresh-context reviewers with distinct angles, then synthesize what to fix. |
 | `/review-loop` | Run parent-controlled worker, reviewer, and fix-worker cycles until clean or capped. |
-| `/parallel-research` | Combine `researcher` and `scout` for external evidence, local code context, and practical tradeoffs. |
+| `/parallel-research` | Combine `scout` lanes for local code context and practical tradeoffs with external evidence the parent gathers. |
 | `/gather-context-and-clarify` | Scout/research first, then ask the user the clarification questions that matter. |
 | `/parallel-cleanup` | Run review-only cleanup passes after implementation. |
 

package/extensions/third-party/node_modules/pi-subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-subagents",
-  "version": "0.52.1-rotom.7",
+  "version": "0.52.1-rotom.10",
   "description": "Rotom-maintained private Subagent component; derived from pi-subagents",
   "author": "Nico Bailon",
   "license": "MIT",

package/extensions/third-party/node_modules/pi-subagents/prompts/gather-context-and-clarify.md

@@ -4,7 +4,7 @@ description: Use subagents to gather context, then ask clarifying questions
 
 Based on our discussion and my intent, launch focused context-gathering subagents before planning or implementing.
 
-Use `scout` to inspect the relevant local files, existing patterns, constraints, tests, and likely integration points. Use `researcher` when external docs, recent sources, ecosystem context, or primary evidence would improve the answer.
+Use `scout` to inspect the relevant local files, existing patterns, constraints, tests, and likely integration points. When external docs, recent sources, or primary evidence would improve the answer, gather them in the parent; there is no builtin web-research agent.
 
 Give each subagent a specific meta prompt. Ask them to return concise findings plus the remaining clarification questions that matter for implementation confidence.
 

package/extensions/third-party/node_modules/pi-subagents/prompts/parallel-research.md

@@ -4,22 +4,20 @@ description: Parallel subagents research
 
 Launch parallel research subagents to build a grounded answer to the current question or decision.
 
-Use fresh context, not forked context, unless I explicitly ask for forked context. Researchers and scouts should inspect sources directly instead of relying on the main conversation history.
+Use fresh context, not forked context, unless I explicitly ask for forked context. Scouts should inspect sources directly instead of relying on the main conversation history.
 
-Use a combination of `researcher` and `scout` subagents:
-- Use `researcher` for web, docs, standards, ecosystem, recent changes, benchmarks, and primary-source evidence.
-- Use `scout` for local codebase context, existing implementation patterns, repo constraints, and files that would be affected.
+Use `scout` subagents for local codebase context, existing implementation patterns, repo constraints, and files that would be affected. There is no builtin web-research agent: the parent gathers external evidence itself with its own tools, or uses a custom agent that explicitly declares web tools and their `extensions`.
 
 Give each subagent a distinct angle. Unless I specify angles, use these three:
 
 1. External evidence
-   Use `researcher` to find current, authoritative sources: official docs, specs, release notes, benchmarks, issue threads, or primary explanations.
+   Gathered by the parent (or a custom web-research agent): current, authoritative sources such as official docs, specs, release notes, benchmarks, issue threads, or primary explanations.
 
 2. Local code context
    Use `scout` to inspect the repository for relevant files, existing patterns, constraints, tests, and likely integration points.
 
 3. Practical tradeoffs
-   Use `researcher` or `scout`, whichever fits the question, to compare options, risks, edge cases, maintenance cost, and what would be easiest to validate.
+   Use `scout` to compare options, risks, edge cases, maintenance cost, and what would be easiest to validate.
 
 Adapt the angles when the question calls for it:
 - Library/API questions: include official docs and recent examples.

package/extensions/third-party/node_modules/pi-subagents/skills/pi-subagents/references/constraints-and-recipes.md

@@ -8,9 +8,9 @@ This file is a detailed reference loaded from `skills/pi-subagents/SKILL.md`.
 
 - **Explicit forking requires a persisted parent session.** If the current session
   does not have a persisted session file or current leaf, explicit `context: "fork"`
-  fails. An agent-level `defaultContext: fork` is a preference: packaged `oracle`
-  and its `advisor` alias fall back to `fresh` when those fork preconditions are not
-  met yet. Use `context: "fresh"` when you do not want a fork even after the parent
+  fails. An agent-level `defaultContext: fork` is a preference that falls back to
+  `fresh` when those fork preconditions are not met yet; all packaged agents
+  default to `fresh`. Use `context: "fresh"` when you do not want a fork even after the parent
   session exists.
 - **Forked runs inherit parent history.** They are branched threads, not fresh
   filtered contexts. Use fresh context for adversarial reviewers unless the user explicitly asks for forked context.
@@ -29,7 +29,7 @@ Runtime config can change orchestration behavior. `intercomBridge.resultDelivery
 
 ### Prefer async orchestration
 
-Launch every subagent asynchronously by default. Use `async: true` for scouts, researchers, workers, reviewers, validators, oracle checks, one-off delegates, and scripted workflows unless you intentionally need a foreground/blocking run. Launch all execution through `workflowScript`; use `return runs.run("main", { agent, task })` for one isolated child and `runs.all([...])` when two or more child lanes, monitors, or dependent steps should move together. The parent should keep moving: inspect code while scouts run, prepare validation while a worker implements, do a local diff pass while reviewers review, and synthesize or verify while a fix worker applies accepted feedback. Async is the default orchestration posture; foreground runs are the explicit opt-out.
+Launch every subagent asynchronously by default. Use `async: true` for scouts, workers, reviewers, validators, oracle checks, one-off delegates, and scripted workflows unless you intentionally need a foreground/blocking run. Launch all execution through `workflowScript`; use `return runs.run("main", { agent, task })` for one isolated child and `runs.all([...])` when two or more child lanes, monitors, or dependent steps should move together. The parent should keep moving: inspect code while scouts run, prepare validation while a worker implements, do a local diff pass while reviewers review, and synthesize or verify while a fix worker applies accepted feedback. Async is the default orchestration posture; foreground runs are the explicit opt-out.
 
 ### Use subagent_wait() to block until async runs finish
 
@@ -108,14 +108,14 @@ Run the work through seven gated phases:
 
 For straightforward non-trivial work, this sequence is the lightweight version of the parent-owned loop. When the task is complex, use Fable mode above. In either case, factor in the packaged prompt workflows without literally invoking slash commands. Use the same patterns through tools and subagents.
 
-Keep builtin agent defaults unless the user explicitly asks for a different model, thinking level, skills, output behavior, context mode, or other override. Do not add overrides just because you are orchestrating; the defaults encode the intended role behavior. In particular, packaged `worker`, `scout`, and `reviewer` default to fresh context; `oracle` and its `advisor` alias default to fork in legacy scope.
+Keep builtin agent defaults unless the user explicitly asks for a different model, thinking level, skills, output behavior, context mode, or other override. Do not add overrides just because you are orchestrating; the defaults encode the intended role behavior. In particular, every packaged agent (`worker`, `scout`, `reviewer`, `delegate`, `oracle` and its `advisor` alias) defaults to fresh context; give `oracle` a written decision brief instead of a fork.
 
 When the user approves launching a subagent to carry out a plan or workflow, treat that as approval to generate a proper role-specific meta prompt for that subagent. Include the approved plan path or summary, clarified requirements, non-goals, relevant context, role boundaries, files or areas to inspect, acceptance criteria, expected output, and validation expectations. Do not pass vague instructions like “implement the plan fully” or “review this” by themselves.
 
-- `/gather-context-and-clarify` maps to: launch `scout` and, when needed, `researcher`; synthesize findings; then use `interview` to ask every clarification question needed for shared understanding.
+- `/gather-context-and-clarify` maps to: launch `scout`, gather any external evidence in the parent; synthesize findings; then use `interview` to ask every clarification question needed for shared understanding.
 - `/parallel-review` maps to: launch fresh-context `reviewer` agents with distinct review angles; synthesize the feedback before applying anything.
 - `/review-loop` maps to: keep the parent in charge of worker → fresh reviewers → synthesized fix worker cycles until no fixes worth doing now remain, an unapproved decision appears, or the review-round cap is reached.
-- `/parallel-research` maps to: combine local `scout` context with external `researcher` evidence when current docs, ecosystem behavior, or API details matter.
+- `/parallel-research` maps to: combine local `scout` context with external evidence the parent gathers when current docs, ecosystem behavior, or API details matter.
 - `/parallel-cleanup` maps to: use review-only cleanup passes after implementation, especially for simplicity, verbosity, and redundant tests.
 
 For feature work, use this sequence as scaffolding for parent-agent behavior:
@@ -138,7 +138,7 @@ For very large work, split into serial milestones instead of launching a swarm o
 
 Keep orchestration authority in the parent session. Child subagents should not launch more subagents, read this skill, or run their own orchestration loops unless the parent intentionally selected a fanout agent whose builtin `tools` includes `subagent`. Spawned subagents do not receive the `pi-subagents` skill, parent-only status/control/slash messages, or prior parent `subagent` tool-call/tool-result artifacts. Ordinary children also do not receive the `subagent` extension tool. Child context filtering strips old hidden orchestration-instruction messages when they appear in inherited history. Every child receives a boundary instruction: ordinary children are told the parent owns orchestration and they must not propose or run subagents; explicit fanout children are told to use `subagent` only for the assigned fanout work, with `maxSubagentDepth` still enforced. Implementation children must call real edit/write tools instead of printing pseudo tool calls. Pass children concrete role-specific work instead.
 
-1. Clarify first. This is mandatory. Gather code context with `scout`, add `researcher` only when external evidence matters, then ask the user clarifying questions with `interview` until scope, acceptance criteria, constraints, and non-goals are clear.
+1. Clarify first. This is mandatory. Gather code context with `scout`, add parent-gathered external evidence only when it matters, then ask the user clarifying questions with `interview` until scope, acceptance criteria, constraints, and non-goals are clear.
 2. Define the validation contract. State acceptance before implementation: expected behavior, checks to run, user flows to exercise, and evidence required in the worker handoff. For UI, CLI, integration, or workflow changes, include at least one validator angle that uses the product the way a user would rather than only reading code.
 3. Plan when useful. For complex work, write a plan doc yourself and get approval before implementation. For simple work, confirm shared understanding and explicitly note why planning is skipped.
 4. Implement with one writer. After approval, launch `worker` asynchronously with a proper meta prompt that includes clarified requirements, relevant context, plan path or summary, the validation contract, and output expectations. Packaged `worker` defaults to fresh context; provide the necessary task context explicitly. Fork is only available in an explicitly selected legacy scope. While it runs, prepare validation or inspect adjacent code instead of editing the same worktree.