@deepseek-ai/dsh-subagent 0.1.0-rc.7 → 0.1.1-rc.1

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/subagent/subagent/README.md
-README.md: ed4a9123a2dfa5b2fa5abc67f4513547feb3d140
-README.zh.md: 3ad2ee5738a210a776d1f0b2746dcbd21d46144c
+README.md: e84a6b486253e81ccf7e7df12c4149e6df4ed9f2
+README.zh.md: e289863531c1686cedeccadfa76e2661dfa9bfc8

package/README.md

@@ -16,12 +16,13 @@ The [subagent family overview](../README.md) maps implementations and model-faci
 | `getProvider(name)` | Return the provider, or `undefined` when absent. |
 | `list()` | Return provider names in insertion order. |
 | `start(name, request)` | Validate an ordinary caller request, resolve its detached `one-shot` descriptor, then await the provider until a real one-shot child is published. Fulfillment returns a holder-owned `SubagentRun`; rejection means the provider has already cleaned every unpublished startup resource, while post-publication turn or infrastructure faults settle through the run. Continuable children never enter through this operation. |
-| `startContinuable(spec)` | Establish one durable continuable child and deliver its initial prompt. Resolves with `{ childId, messageId }` when the child's inbox accepts that prompt, without waiting for the turn to start or for the message to reach the Session log; any earlier failure rejects with no ids and rolls the child back entirely. Requires `ctx.agents`, session persistence, and a provider with the `prepareContinuable` capability. |
+| `startContinuable(spec)` | Establish one durable continuable child and deliver its initial prompt. Resolves with `{ childId, messageId }` when the child's inbox accepts that prompt, without waiting for the turn to start or for the message to reach the Session log; any earlier failure rejects with no ids and rolls the child back entirely. A caller-reserved `childId` is rejected when the live registries or configured persistence already own it. Requires `ctx.agents`, session persistence, and a provider with the `prepareContinuable` capability. |
 | `followup(parent, childId, content, { source, signal })` | Deliver one later message from the exact live direct parent as the child's next FIFO turn, matching `Agent.followup()` terminology, and return the accepted `MessageId`. A resident child's inbox accepts it directly (waking a waiting Activation); an absent one cold-resumes from its persisted Session. Requires `ctx.agents`; cold resume also requires session persistence. |
 | `interrupt(targetSessionId, authority)` | Interrupt one live continuable child's current turn under a human durable parent address (`{ kind: 'user', parentSessionId }`) or an exact live ancestor Agent (`{ kind: 'ancestor', agent }`). Admission is synchronous and the effect asynchronous: it issues `Agent.cancel(cause, { keepInbox: true })` and returns without waiting for the target to observe the signal. Unclaimed pending inbox work, the Activation, and published descendants are preserved; work already claimed into the interrupted turn is not requeued. An absent target is an accepted no-op; a wrong parent address or a stale, self-targeting, or non-ancestor caller rejects with `UNAUTHORIZED`. |
-| `reportFrom(child, content, { delivery, signal })` | Deliver one selected message from the exact live continuable child to its exact live direct parent and return the accepted stable `MessageId`. Quiet delivery injects context; waking delivery submits one later parent turn. |
+| `reportFrom(child, content, { delivery, signal })` | Deliver one selected message from the exact live continuable child to its exact live direct parent and return the accepted stable `MessageId`. Quiet delivery injects next-step context without waking; next-step delivery steers and wakes the parent. |
 | `registerContinuableSetup(contribution)` | Compose an optional deployment capability into each continuable child's unpublished scope, with immediate revocation from resident children. |
 | `drainContinuableDescendants(parents)` | Close admission below exact live host-owned parent Agents, stop only their visible continuable descendants, await materializations admitted below those roots through publication or rollback, then release the selected forests child-first. The cutoff lasts until each exact parent leaves the registry; unrelated parent forests and manager-wide admission remain live. |
+| `drainContinuableChildren(parent, childIds)` | Release only the named resident continuable direct children of one exact live parent, recursively and child-first. It does not close admission or touch siblings, accepts absent ids as no-ops, and rejects a resident child owned by another parent. This is teardown, so unlike `interrupt()` it does not preserve pending inbox work. |
 | `listChildren(parentSessionId, signal?)` | List direct session-backed subagents with their `one-shot`/`continuable` mode, `running`/`inactive` activity, origin-classified one-level `hasChildren` hint, and per-child diagnostics, ordered by `createdAt` then id, without loading or resuming them. Reads the live session store and optional session persistence directly (live-only enumeration when persistence is absent) and requires the mounted `sessionProjections` registry; it does not require `ctx.agents`, the continuation manager, or any query service. |
 | `listDescendants(rootSessionId, signal?)` | Flatten the root's complete session tree in stable pre-order from the same live-preferred corpus, adding each subagent entry's durable `parentId` and root-relative `depth`. Ordinary sessions and one-shot children remain traversal nodes so continuable descendants below them are discovered. Identity, diagnostics, dependencies, and cancellation follow `listChildren()`. |
 
@@ -64,7 +65,7 @@ Both in-process delegation paths fix the child's permission scope at the delegat
 
 `provider.start(request): Promise<SubagentRun>` is the ownership-transfer boundary; the delegation tool also uses it inside its one-shot Task-backed background path. Before fulfillment, the provider owns setup and must cancel, roll back, and quiesce unpublished resources on every failure. After fulfillment, the caller owns the run and must call `dispose()` on every path; remaining prompt and turn work belongs to `SubagentRun.result`.
 
-`SubagentRun.result` resolves to `{ output, structured?, stopReason }`. Child-level failures resolve with a non-`completed` reason; only an infrastructure fault that the seam cannot represent may reject. `dispose()` is idempotent, cancels remaining work, and waits for both result settlement and child-resource quiescence. A result rejection remains on `result`; `dispose()` rejects only for an independent resource-release failure. `output` and the `subagent/end` event's `lastAssistantMessage` use the exported `AssistantOutputFold`/`finalAssistantOutput` helpers to select the child's last non-empty assistant message, or its accumulated assistant text when no such message exists. `output` is `[]` and the event field is absent when the child produced neither ([`SubagentResult.output`](../../../docs/subsystems/subagent.md#the-terminal-result-subagentresult) owns the result contract).
+`SubagentRun.result` resolves to `{ output, structured?, diagnostic?, stopReason }`. Child-level failures resolve with a non-`completed` reason; only an infrastructure fault that the seam cannot represent may reject. A provider may add a safe `diagnostic` to a non-completed result after removing tool inputs, file contents, environment values, credentials, and raw protocol payloads and limiting the complete text to 4096 UTF-8 bytes. The common result type does not define provider categories or lifecycle stages: an out-of-process provider may derive fixed display text from its version-pinned structured product facts and an observed process outcome, while consumers render that text without parsing it. The field is not assistant output: consumers present it separately, and it does not enter `subagent/end.lastAssistantMessage`. `dispose()` is idempotent, cancels remaining work, and waits for both result settlement and child-resource quiescence. A result rejection remains on `result`; `dispose()` rejects only for an independent resource-release failure. `output` and the `subagent/end` event's `lastAssistantMessage` use the exported `AssistantOutputFold`/`finalAssistantOutput` helpers to select the child's last non-empty assistant message, or its accumulated assistant text when no such message exists. `output` is `[]` and the event field is absent when the child produced neither ([`SubagentResult`](../../../docs/subsystems/subagent.md#the-terminal-result-subagentresult) owns the terminal result contract).
 
 A local run publishes an ordinary child agent/session before `start()` fulfills, returns that shared session id as `SubagentRun.id`, exposes the exact child as `SubagentRun.localAgent`, records `request.parent.session.id` in the child's `parentSession` header, and appends the resolved descriptor inside its initial turn. Remote providers instead mint a parent-scoped lifecycle id and return `localAgent: undefined`; without a local child session, their one-shot runs are not part of trace-backed enumeration.
 
@@ -146,7 +147,7 @@ Prefix-stable within a child: the statement never changes during the child's lif
 
 - **ACP children remain one-shot and are not trace-enumerable** — an ACP run has no local child session in the parent's session corpus. An ACP `prepareContinuable` requires persisting the remote session id in provider-specific descriptor data and a per-child continuation advertisement, since ACP `loadSession` support is negotiated per child rather than established by the method's presence. Remote providers also require a separate Activation ownership contract with equivalent authenticated control and child-first quiescence before they support continuable children.
 - **No host-user continuation** — `followup()` requires the exact live direct parent. Only `interrupt()` accepts a durable parent-address user authority, because stopping a turn is idempotent and delivers no content; a future host adapter needs a concrete authenticated interaction before the seam gains a user delivery capability.
-- **No current-turn steering** — continuable messages and waking reports enqueue later turns; neither redirects an open turn.
+- **Continuation messages never steer** — parent-to-child continuation messages enqueue later child turns. Child-to-parent reports are independent next-step input and may extend the parent's open turn.
 - **Wake gap during cancellation convergence** — a waking follow-up accepted after the interrupt signal is issued but before the active driver becomes idle remains queued until another waking send. Issue #1838 owns the agent-loop wake latch, which also affects ordinary session cancellation.
 - **Process-local residency** — the Activation inbox and ownership graph do not coordinate two harness processes; concurrent access to one persistence store still requires a durable mailbox and cross-process lease protocol.
 - **No replay of accepted-but-unlogged messages** — only messages written to the child Session log are reconstructable with the source that supplied them. A crash may lose an accepted initial prompt or follow-up that never reached the log; a later authorized message can cold-resume the child, but the lost message is not replayed automatically.

package/README.zh.md

@@ -4,7 +4,7 @@
 
 subagent seam 允许一个 agent（智能体）通过具名提供方把工作委派给子 agent。调用方统一使用 `ctx.subagents` 服务 API；提供方决定子 agent 在当前进程、其他进程，还是通过未来的传输方式运行。
 
-[subagent 家族概述](../README.md)列出了实现和面向模型的消费方。本包负责提供方注册表、共享请求和结果约定、持久描述符以及可继续子级编排。多个具名提供方可以在该约定背后共存。
+[subagent 家族概述](../README.zh.md)列出了实现和面向模型的消费方。本包负责提供方注册表、共享请求和结果约定、持久描述符以及可继续子级编排。多个具名提供方可以在该约定背后共存。
 
 ## 服务 API
 
@@ -16,12 +16,13 @@ subagent seam 允许一个 agent（智能体）通过具名提供方把工作委
 | `getProvider(name)` | 返回提供方；不存在时返回 `undefined`。 |
 | `list()` | 按插入顺序返回提供方名称。 |
 | `start(name, request)` | 校验普通调用方请求，解析其已分离的 `one-shot` 描述符，然后等待提供方发布真正的一次性子 agent。兑现时返回由持有方拥有的 `SubagentRun`；如果调用被拒绝，提供方已经清理所有尚未发布的启动资源。发布后的轮次故障或基础设施故障则通过该 run 结算。可继续子 agent 绝不通过此操作进入。 |
-| `startContinuable(spec)` | 建立一个持久化的可继续子 agent，并投递其初始提示词。子 agent 的 inbox 一接受该提示词，调用就会兑现为 `{ childId, messageId }`，无需等待轮次开始，也无需等待消息写入会话日志。在此之前发生的任何失败都会使调用被拒绝，不返回任何 id，并完全回滚该子 agent。要求 `ctx.agents`、会话持久化以及具备 `prepareContinuable` 能力的提供方。 |
+| `startContinuable(spec)` | 建立一个持久化的可继续子 agent，并投递其初始提示词。子 agent 的 inbox 一接受该提示词，调用就会兑现为 `{ childId, messageId }`，无需等待轮次开始，也无需等待消息写入会话日志。在此之前发生的任何失败都会使调用被拒绝，不返回任何 id，并完全回滚该子 agent。如果在线注册表或已配置的持久化已经占用调用方预留的 `childId`，则拒绝该身份。要求 `ctx.agents`、会话持久化以及具备 `prepareContinuable` 能力的提供方。 |
 | `followup(parent, childId, content, { source, signal })` | 将来自确切在线直接父级的一条后续消息作为子 agent 的下一个 FIFO 轮次投递，术语与 `Agent.followup()` 一致，并返回被接受的 `MessageId`。驻留中的子 agent 由其 inbox 直接接受（唤醒处于 waiting 的 Activation）；不驻留的则从其持久化会话冷恢复。要求 `ctx.agents`；冷恢复还要求会话持久化。 |
 | `interrupt(targetSessionId, authority)` | 凭人类出示的持久化父级地址 `{ kind: 'user', parentSessionId }`，或确切在线的祖先 Agent `{ kind: 'ancestor', agent }` 进行授权，中断一个在线可继续子级的当前轮次。准入判定同步完成，但取消异步生效：该操作发出 `Agent.cancel(cause, { keepInbox: true })` 后立即返回，不等待目标观察到信号。尚未领取的待处理 inbox 工作、Activation 和已发布的后代均会保留；已经领取到被中断轮次中的工作不会重新入队。目标不存在时视为已接受的空操作；错误的父级地址，或陈旧、指向自身、并非祖先的调用方，会以 `UNAUTHORIZED` 被拒绝。 |
-| `reportFrom(child, content, { delivery, signal })` | 从确切在线可继续 child 向其确切在线直接 parent 投递一条选中消息，并返回已接受的稳定 `MessageId`。静默投递会注入上下文；唤醒投递会提交一个后续 parent 轮次。 |
+| `reportFrom(child, content, { delivery, signal })` | 从确切在线可继续 child 向其确切在线直接 parent 投递一条选中消息，并返回已接受的稳定 `MessageId`。静默投递会注入不唤醒的 next-step 上下文；next-step 投递会 steering 并唤醒 parent。 |
 | `registerContinuableSetup(contribution)` | 把一项可选部署能力组合到每个可继续 child 尚未发布的作用域中，并支持从驻留 child 立即撤销。 |
 | `drainContinuableDescendants(parents)` | 在由 host 拥有的确切在线父级 Agent 之下关闭准入，只停止这些父级可见的可继续后代；等待已在这些根节点下获准的物化过程完成发布或回滚后，再按子级优先顺序释放所选的各棵树。该截止状态会持续到每个确切父级离开注册表；无关的父级树仍在线，管理器全局准入仍保持开放。 |
+| `drainContinuableChildren(parent, childIds)` | 只释放一个确切在线父级的具名驻留可继续直接子级，并递归保持子级优先顺序。它不关闭准入、不影响同级子级，缺失的 id 视为空操作；若驻留子级属于其他父级，则拒绝。这是拆卸操作，因此与 `interrupt()` 不同，它不会保留待处理的 inbox 工作。 |
 | `listChildren(parentSessionId, signal?)` | 按 `createdAt`、再按 id 的顺序列出由会话支撑的直接 subagent，包括其 `one-shot`／`continuable` 模式、`running`／`inactive` 活动状态、根据 origin 分类得出的一层 `hasChildren` 提示，以及每个子级的诊断信息，且不会加载或恢复它们。该操作直接读取在线会话存储和可选的会话持久化（没有持久化时只枚举在线子级），并要求已挂载 `sessionProjections` 注册表；不要求 `ctx.agents`、继续执行管理器或任何查询服务。 |
 | `listDescendants(rootSessionId, signal?)` | 从同一份在线优先语料按稳定 pre-order 展平根的完整会话树，并为每个 subagent 条目附加持久 `parentId` 与相对根的 `depth`。普通会话与一次性 child 仍作为遍历节点，因此其下的可继续后代仍可发现。身份、diagnostic、依赖与取消约定均沿用 `listChildren()`。 |
 
@@ -40,7 +41,7 @@ subagent seam 允许一个 agent（智能体）通过具名提供方把工作委
 - `toolFilter`：应用请求的子 agent 工具限制；
 - `persona`：应用每个子 agent 独立的 persona。
 
-每个进程内子 agent 都通过一次 `applyChildComposition(childCtx, parent, composition)` 调用完成组装：先加入父级的 agent-preset 组合，再应用子 agent 自己的 persona 和工具限制。加入父级组合正是子 agent 获得能力的途径：所有面向模型的行都位于 agent 平面，完全没有加入任何组合的子 agent 抵达模型时会看到空的工具注册表（见 [`dsh-agent-presets`](../../preset/agent-presets/README.md)）。将父级作为参数是刻意设计：这让“组装子 agent 却不做该加入”在各调用点无法表达，而这正是这一次调用所要杜绝的缺陷。未组装 preset roster 的部署不加入任何组合、也不需要加入；其面向模型的行位于宿主组合中，子 agent 已能通过工具注册表的全局层解析到它们。
+每个进程内子 agent 都通过一次 `applyChildComposition(childCtx, parent, composition)` 调用完成组装：先加入父级的 agent-preset 组合，再应用子 agent 自己的 persona 和工具限制。加入父级组合正是子 agent 获得能力的途径：所有面向模型的行都位于 agent 平面，完全没有加入任何组合的子 agent 抵达模型时会看到空的工具注册表（见 [`dsh-agent-presets`](../../preset/agent-presets/README.zh.md)）。将父级作为参数是刻意设计：这让“组装子 agent 却不做该加入”在各调用点无法表达，而这正是这一次调用所要杜绝的缺陷。未组装 preset roster 的部署不加入任何组合、也不需要加入；其面向模型的行位于宿主组合中，子 agent 已能通过工具注册表的全局层解析到它们。
 
 `childSessionMeta()` 把所加入的 preset id 记在子 agent 的持久化 header 上，理由与顶层会话记录自己的那一个相同：preset 决定了模型所见的工具 schema 与提示段，因此冷读子 agent 的历史时必须重建那份组装，而不是部署默认值。该值从父方**活着的** scope 链读取，而不是从父方 header 读取，因为在空白期切换过 preset 的父方运行在更新的那份组装上，而它的 header 仍写着旧的那个。
 
@@ -56,15 +57,17 @@ subagent seam 允许一个 agent（智能体）通过具名提供方把工作委
 
 `inheritsParentContext` 只用于描述，不能强制执行。它仅说明子 agent 是否能看到父级已完成的对话历史（`fork` 可以；`spawn` 和各进程外一次性提供方不可以），不表示是否继承工具、服务或权限。
 
+<a id="delegated-policy"></a>
+
 ## 委派策略
 
-两条进程内委派路径都会通过共享的子 agent 辅助函数，在委派边界固定子 agent 的权限范围。`captureDelegatedPolicyOverrides(parent)` 会为父会话的显式沙箱覆盖项（`sandboxPolicy.overrideOf()`）创建快照，并在审批能力已组合时将子 agent 的审批策略固定为 `'never'`，无论父级自身采用何种策略。这样，被委派的子 agent 只能在继承的沙箱范围内行动，每次审批请求（例如 `sandbox_permissions` 升权）都会被确定性拒绝，而不会等待无人处理的提示（这两个服务都是可选的 `ctx.get` 消费方）。`appendDelegatedPolicyOverrides()` 则在未发布的设置阶段、在任何 fork 种子之后，把每个值作为一条 `source: 'delegation'` 的 `sandbox/mode` 或 `approval/policy` 事件写入子 agent 自己的日志。因此，新捕获的策略会覆盖种子中的陈旧状态，而子 agent 的生效策略始终可以仅凭其日志重建。沙箱的部署默认值绝不复制：未切换的父级不会记录 `sandbox/mode`，其子 agent 会动态跟随部署默认值。可继续启动会在第一次 await 前捕获策略，并且只为全新物化写入这些委派事件；冷恢复只会重放已持久化的委派事件，不会重新捕获父级策略，因此创建之后的父级切换绝不会追溯性地改变持久化子 agent。每个进程内子 agent 还会收到一条作用域内的运行时上下文声明（`subagent:delegation`），告知其权限范围已固定，需要更宽访问的任务应以上报限制收尾，而不是重试。参见[一次性](../../../.agents/notes/implemented/feature/2026-07-25-subagent-policy-inheritance.md)与[可继续](../../../.agents/notes/implemented/feature/2026-08-10-continuable-subagent-policy-inheritance.md)两篇委派策略 Agent Note。
+两条进程内委派路径都会通过共享的子 agent 辅助函数，在委派边界固定子 agent 的权限范围。`captureDelegatedPolicyOverrides(parent)` 会为父会话的显式沙箱覆盖项（`sandboxPolicy.overrideOf()`）创建快照，并在审批能力已组合时将子 agent 的审批策略固定为 `'never'`，无论父级自身采用何种策略。这样，被委派的子 agent 只能在继承的沙箱范围内行动，每次审批请求（例如 `sandbox_permissions` 升权）都会被确定性拒绝，而不会等待无人处理的提示（这两个服务都是可选的 `ctx.get` 消费方）。`appendDelegatedPolicyOverrides()` 则在未发布的设置阶段、在任何 fork 种子之后，把每个值作为一条 `source: 'delegation'` 的 `sandbox/mode` 或 `approval/policy` 事件写入子 agent 自己的日志。因此，新捕获的策略会覆盖种子中的陈旧状态，而子 agent 的生效策略始终可以仅凭其日志重建。沙箱的部署默认值绝不复制：未切换的父级不会记录 `sandbox/mode`，其子 agent 会动态跟随部署默认值。可继续启动会在第一次 await 前捕获策略，并且只为全新物化写入这些委派事件；冷恢复只会重放已持久化的委派事件，不会重新捕获父级策略，因此创建之后的父级切换绝不会追溯性地改变持久化子 agent。每个进程内子 agent 还会收到一条作用域内的运行时上下文声明（`subagent:delegation`），告知其权限范围已固定，需要更宽访问的任务应以上报限制收尾，而不是重试。参见[一次性](../../../.agents/notes/implemented/feature/2026-07-25-subagent-policy-inheritance.zh.md)与[可继续](../../../.agents/notes/implemented/feature/2026-08-10-continuable-subagent-policy-inheritance.zh.md)两篇委派策略 Agent Note。
 
 ## 一次性所有权与生命周期
 
 `provider.start(request): Promise<SubagentRun>` 是所有权转移边界；委派工具也会在其由 Task 支撑的一次性后台路径中使用它。兑现前，提供方拥有设置过程，并且在任何失败路径上都必须取消、回滚并使尚未发布的资源完全停稳。兑现后，run 的所有权转移给调用方；调用方必须在每条路径上调用 `dispose()`。剩余提示词和轮次工作属于 `SubagentRun.result`。
 
-`SubagentRun.result` 兑现为 `{ output, structured?, stopReason }`。子 agent 级失败会以非 `completed` 原因兑现；只有 seam 无法表示的基础设施故障才可以拒绝。`dispose()` 是幂等的，会取消剩余工作，并等待结果结算以及子 agent 资源完全停稳。result 的拒绝只通过 `result` 本身报告；只有独立的资源释放失败，才会使 `dispose()` 被拒绝。`output` 与 `subagent/end` 事件的 `lastAssistantMessage` 使用导出的 `AssistantOutputFold`／`finalAssistantOutput` 辅助函数选取子 agent 最后一条非空 assistant 消息；若没有这类消息，则选取其累积的 assistant 文本。子 agent 两种输出均未产生时，`output` 为 `[]`，该事件字段缺省（结果约定归 [`SubagentResult.output`](../../../docs/subsystems/subagent.md#the-terminal-result-subagentresult) 所有）。
+`SubagentRun.result` 兑现为 `{ output, structured?, diagnostic?, stopReason }`。子 agent 级失败会以非 `completed` 原因兑现；只有 seam 无法表示的基础设施故障才可以拒绝。提供方可以为非完成结果附加安全的 `diagnostic`：它会先排除工具输入、文件内容、环境值、凭证与原始协议载荷，并把完整文本限制在 4096 个 UTF-8 字节以内。共享结果类型不定义提供方类别或生命周期阶段：进程外提供方可以从锁定版本产品提供的结构化事实与已观测的进程结果派生固定展示文本，而消费方只负责原样呈现，不解析该文本。该字段不是 assistant 输出；消费方会将它分开呈现，它也不会进入 `subagent/end.lastAssistantMessage`。`dispose()` 是幂等的，会取消剩余工作，并等待结果结算以及子 agent 资源完全停稳。result 的拒绝只通过 `result` 本身报告；只有独立的资源释放失败，才会使 `dispose()` 被拒绝。`output` 与 `subagent/end` 事件的 `lastAssistantMessage` 使用导出的 `AssistantOutputFold`／`finalAssistantOutput` 辅助函数选取子 agent 最后一条非空 assistant 消息；若没有这类消息，则选取其累积的 assistant 文本。子 agent 两种输出均未产生时，`output` 为 `[]`，该事件字段缺省（终态结果约定归 [`SubagentResult`](../../../docs/subsystems/subagent.zh.md#the-terminal-result-subagentresult) 所有）。
 
 本地运行会在 `start()` 兑现前发布普通的子 agent／会话，把该共享会话 id 作为 `SubagentRun.id` 返回，以 `SubagentRun.localAgent` 公开准确的子 agent，把 `request.parent.session.id` 记录到子 agent 的 `parentSession` header，并在其初始轮次内追加已解析的描述符。远程提供方则生成 parent 作用域的生命周期 id，并返回 `localAgent: undefined`；由于没有本地 child 会话，其一次性运行不会进入基于追踪的枚举结果。
 
@@ -102,12 +105,14 @@ subagent seam 允许一个 agent（智能体）通过具名提供方把工作委
 
 ## 收集模型
 
-面向模型的工具默认同步收集：先等待子 agent 结果，再 dispose 运行，然后才返回。一次性后台委派会在工具中注册普通 Task，其通用状态、收集和取消工具负责后续交互，并将模型提供的 `description` 持久化为可选显示标签。可继续后台委派会调用 `ctx.subagents.startContinuable()`，只返回持久化子 agent id；子 agent 自 inbox 接受起就拥有自己的轮次，因此没有 Task、也没有结果 promise——调用方通过 `send_message` 后续操作工具发送后续工作，`interrupt()` 只停止当前轮次而不 dispose 子 agent，而持久化子 agent 会话仍是子 agent 详细输出的来源。只有 `ctx.agents` 可用时，继续执行管理器才会存在，而会话持久化按每项继续执行操作解析。与此独立，`listChildren()` 枚举在线会话存储与可选会话持久化的在线优先合并——持久化缺席时仅枚举在线 child，因为那时冷 child 本就无法恢复——并由已注册的 `subagent` 投影单元供给每个 child 的持久化模式与标签：在线 child 取注册表的水位快照；冷 child 先取可选投影缓存的持久化行，且仅当其 `seq` 门证明该值折叠自 child 自身后缀（fork 种子之后——自有描述符一经追加即不可变）才直接采用，否则经一次有界并发的持久化 inspect 再经注册表折叠，且 inspect 结果必须仍指向枚举时的生命周期（同 id 被重新发布的会话降级为 `corrupt` diagnostic）。缓存读取抛出异常时，不会据此作出分类判断，因为缓存只是派生数据；静默落到该权威重折。分类结果完全以投影折叠为准；列表操作本身不解析描述符。取得身份值即产出 child 行；已定局而折叠未产出身份的候选是 `corrupt` diagnostic，inspect 失败是瞬时的 `unavailable`（下次列表重试），运行中而暂无身份值的候选整行省略（描述符尚未追加的创建窗口）。它不查询继续执行管理器、Agent 注册信息、Activation 或提供方。每个 child 行都会根据合并结果中携带持久化 `origin: 'subagent'` 的 header 派生读取时的 `hasChildren` 提示；它不会读取后代事件日志，展开后仍以描述符支撑的 child 目录为权威依据。UI 等服务消费方可以保留两种模式，并为无标签的一次性 child 选择回退展示；面向模型的 `list_agents` 工具只投影 `continuable` 条目，通过在线 Agent 注册表细化状态，并把仅存于存储的状态映射为可恢复而非终态的 `ready`（`running`／`idle`／`ready`），并在 `descendants` scope 下遍历 `listDescendants()`。列表操作会把调用方的取消信号转发到每次持久化读取，在这些 await 前后检查取消，并将每次检测到的中止报告为 `SubagentError` 错误码 `CANCELLED`；投影注册表未挂载则以 `SUBAGENT_CONTROL_PROJECTIONS_UNAVAILABLE` 响亮失败，会话存储缺失则以 `SUBAGENT_CONTROL_SESSION_STORE_UNAVAILABLE` 响亮失败。完整约定见[后台 subagent 任务 Agent Note](../../../.agents/notes/implemented/feature/2026-07-08-background-subagent-tasks.md)、[可继续后台 subagent Agent Note](../../../.agents/notes/implemented/feature/2026-07-21-continuable-background-subagents.md)、[持久化目录 Agent Note](../../../.agents/notes/implemented/feature/2026-07-22-durable-subagent-catalog-and-list-agents.md)、[服务合并 Agent Note](../../../.agents/notes/implemented/simplification/2026-07-26-merge-subagent-control-service.md)、[能力 seam Agent Note](../../../.agents/notes/implemented/feature/2026-06-21-subagent-capability-seam.md)和 `src/types.ts`。
+面向模型的工具默认同步收集：先等待子 agent 结果，再 dispose 运行，然后才返回。一次性后台委派会在工具中注册普通 Task，其通用状态、收集和取消工具负责后续交互，并将模型提供的 `description` 持久化为可选显示标签。可继续后台委派会调用 `ctx.subagents.startContinuable()`，只返回持久化子 agent id；子 agent 自 inbox 接受起就拥有自己的轮次，因此没有 Task、也没有结果 promise——调用方通过 `send_message` 后续操作工具发送后续工作，`interrupt()` 只停止当前轮次而不 dispose 子 agent，而持久化子 agent 会话仍是子 agent 详细输出的来源。只有 `ctx.agents` 可用时，继续执行管理器才会存在，而会话持久化按每项继续执行操作解析。与此独立，`listChildren()` 枚举在线会话存储与可选会话持久化的在线优先合并——持久化缺席时仅枚举在线 child，因为那时冷 child 本就无法恢复——并由已注册的 `subagent` 投影单元供给每个 child 的持久化模式与标签：在线 child 取注册表的水位快照；冷 child 先取可选投影缓存的持久化行，且仅当其 `seq` 门证明该值折叠自 child 自身后缀（fork 种子之后——自有描述符一经追加即不可变）才直接采用，否则经一次有界并发的持久化 inspect 再经注册表折叠，且 inspect 结果必须仍指向枚举时的生命周期（同 id 被重新发布的会话降级为 `corrupt` diagnostic）。缓存读取抛出异常时，不会据此作出分类判断，因为缓存只是派生数据；静默落到该权威重折。分类结果完全以投影折叠为准；列表操作本身不解析描述符。取得身份值即产出 child 行；已定局而折叠未产出身份的候选是 `corrupt` diagnostic，inspect 失败是瞬时的 `unavailable`（下次列表重试），运行中而暂无身份值的候选整行省略（描述符尚未追加的创建窗口）。它不查询继续执行管理器、Agent 注册信息、Activation 或提供方。每个 child 行都会根据合并结果中携带持久化 `origin: 'subagent'` 的 header 派生读取时的 `hasChildren` 提示；它不会读取后代事件日志，展开后仍以描述符支撑的 child 目录为权威依据。UI 等服务消费方可以保留两种模式，并为无标签的一次性 child 选择回退展示；面向模型的 `list_agents` 工具只投影 `continuable` 条目，通过在线 Agent 注册表细化状态，并把仅存于存储的状态映射为可恢复而非终态的 `ready`（`running`／`idle`／`ready`），并在 `descendants` scope 下遍历 `listDescendants()`。列表操作会把调用方的取消信号转发到每次持久化读取，在这些 await 前后检查取消，并将每次检测到的中止报告为 `SubagentError` 错误码 `CANCELLED`；投影注册表未挂载则以 `SUBAGENT_CONTROL_PROJECTIONS_UNAVAILABLE` 响亮失败，会话存储缺失则以 `SUBAGENT_CONTROL_SESSION_STORE_UNAVAILABLE` 响亮失败。完整约定见[后台 subagent 任务 Agent Note](../../../.agents/notes/implemented/feature/2026-07-08-background-subagent-tasks.zh.md)、[可继续后台 subagent Agent Note](../../../.agents/notes/implemented/feature/2026-07-21-continuable-background-subagents.zh.md)、[持久化目录 Agent Note](../../../.agents/notes/implemented/feature/2026-07-22-durable-subagent-catalog-and-list-agents.zh.md)、[服务合并 Agent Note](../../../.agents/notes/implemented/simplification/2026-07-26-merge-subagent-control-service.zh.md)、[能力 seam Agent Note](../../../.agents/notes/implemented/feature/2026-06-21-subagent-capability-seam.zh.md)和 `src/types.ts`。
 
 可继续 Activation 会等待 best-effort 的最终会话 flush，但不会把 listener 参与视为持久性确认。一次性运行保留尽力执行的会话检查点，因此已完成的一次性 child 只有在其会话确实进入持久化存储时，才可在 dispose 后继续被发现；如果该检查点缺失，服务不会根据 Task 历史虚构目录条目。
 
 ## 模型体验
 
+<a id="settlement-notice"></a>
+
 ### 结算通知
 
 #### 模型看到的内容
@@ -146,7 +151,7 @@ You are a delegated subagent: your permission scope was fixed when you were star
 
 - **ACP 子 agent 仍为一次性，且无法通过追踪枚举**：ACP 运行在 parent 会话语料中没有本地 child 会话。ACP 的 `prepareContinuable` 需要在提供方专用描述符数据中持久化远端会话 id，以及逐子 agent 的继续执行能力声明，因为 ACP 的 `loadSession` 支持按子 agent 协商，而不是通过方法是否存在来确定。远程提供方还需要一份独立的 Activation 所有权约定，具备等效的经认证控制和子先于父的完全停稳保证，才能支持可继续子 agent。
 - **无 host-user 继续执行**：`followup()` 要求确切在线直接父级。只有 `interrupt()` 接受持久化 parent 地址形式的用户授权，因为停止一个轮次是幂等的且不投递任何内容；未来 host 适配器需要具体的经认证交互，才能让该 seam 获得用户投递能力。
-- **不对当前轮次进行 steering**：可继续消息和唤醒式 report 会排入后续轮次，均不会重定向正在进行的轮次。
+- **继续执行消息绝不 steering**：parent 到 child 的继续执行消息会排入后续 child 轮次。child 到 parent 的 report 是独立的 next-step 输入，可能延长 parent 已打开的轮次。
 - **取消收敛期间存在唤醒缺口**：中断信号发出后、活动 driver 进入 idle 前被接受的唤醒型 follow-up 会保持排队，直到另一条唤醒发送到达。Issue #1838 负责 agent-loop 的唤醒锁存；普通会话取消也受此影响。
 - **驻留仅限进程内**：Activation inbox 与所有权图不会在两个 harness 进程之间协调；对单个持久化存储的并发访问仍然需要持久化邮箱和跨进程租约协议。
 - **不回放已接受但未记录的消息**：只有写入子 agent 会话日志的消息才能连同提供该消息的来源一起重建。崩溃可能丢失从未写入日志、已被接受的初始提示词或后续消息；此后一条经授权的消息可以冷恢复该子 agent，但丢失的消息不会自动回放。

package/lib/index.js

@@ -772,9 +772,10 @@ var SubagentContinuationManager = class {
 		const request = spec.request;
 		const parent = request.parent;
 		this.assertAdmitting(parent);
-		this.requirePersistence();
+		const persistence = this.requirePersistence();
 		assertSubagentMaxDepth(request.maxDepth);
-		const childId = SessionId(randomUUID());
+		const childId = spec.childId ?? SessionId(randomUUID());
+		this.assertChildIdAvailable(childId);
 		const childDepth = resolveChildDepth(parent, request.maxDepth);
 		const agentProvider = request.agentOptions?.provider ?? parent.options.provider;
 		const agentModel = request.agentOptions?.model ?? parent.options.model;
@@ -800,6 +801,16 @@ var SubagentContinuationManager = class {
 		return {
 			childId,
 			messageId: await this.locks.run(childId, async () => {
+				spec.signal.throwIfAborted();
+				this.assertAdmitting(parent);
+				this.assertChildIdAvailable(childId);
+				if (spec.childId !== void 0) {
+					const persisted = await persistence.listSnapshots(spec.signal);
+					spec.signal.throwIfAborted();
+					this.assertAdmitting(parent);
+					this.assertChildIdAvailable(childId);
+					if (persisted.some((snapshot) => snapshot.header.id === childId)) throw new SubagentError(`subagent "${childId}" already exists`, "DUPLICATE_CHILD");
+				}
 				const activation = await this.materialize({
 					childId,
 					provider: spec.provider,
@@ -820,6 +831,10 @@ var SubagentContinuationManager = class {
 			})
 		};
 	}
+	/** Reject one child identity already owned by a live Agent or Session. */
+	assertChildIdAvailable(childId) {
+		if (this.ctx.agents.get(childId) !== void 0 || this.ctx.get("sessions")?.get(childId) !== void 0) throw new SubagentError(`subagent "${childId}" already exists`, "DUPLICATE_CHILD");
+	}
 	/**
 	* Deliver one later message to a known continuable child as its next FIFO
 	* turn. Routing depends only on Activation residency: a `running` Activation
@@ -941,7 +956,7 @@ var SubagentContinuationManager = class {
 				senderSessionId: activation.childId
 			}
 		});
-		if (delivery === "wakeup") this.sendWaking(parent, message, () => {
+		if (delivery === "next-step") this.sendWaking(parent, message, () => {
 			this.sendReport(parent, message, delivery);
 		});
 		else this.sendReport(parent, message, delivery);
@@ -951,7 +966,7 @@ var SubagentContinuationManager = class {
 	* Perform one waking send to a parent, accounted against that parent's own
 	* Activation when it has one. Registering the id before the send is what
 	* keeps a continuation-managed parent from being judged quiescent in the
-	* window between `followup()` and the microtask that admits it.
+	* window between a waking send and the microtask that admits it.
 	* @param parent - the exact live parent receiving the waking message.
 	* @param message - the message whose id is accounted.
 	* @param send - the synchronous waking send to perform.
@@ -964,7 +979,7 @@ var SubagentContinuationManager = class {
 	/** Send one report while translating only the parent's own rejection. */
 	sendReport(parent, message, delivery) {
 		try {
-			if (delivery === "wakeup") parent.followup(message);
+			if (delivery === "next-step") parent.steer(message);
 			else parent.inject(message);
 		} catch (error) {
 			throw new SubagentError("direct parent is not live; report was not delivered", "PARENT_UNAVAILABLE", { cause: error });
@@ -1027,6 +1042,28 @@ var SubagentContinuationManager = class {
 		await Promise.all(materializations.map((materialization) => materialization.settled));
 		await this.disposeRoots(targetRoots, "scoped activation(s)");
 	}
+	/**
+	* Release selected resident direct children of one exact live parent without
+	* closing admission for the parent's other continuable children. Owned
+	* descendants are released recursively through the same lifecycle.
+	* @param parent - exact live direct parent authorizing the selected release.
+	* @param childIds - durable direct-child ids to release when resident.
+	* @returns once every selected Activation released its handle.
+	* @throws {SubagentError} `UNAUTHORIZED` when a resident target is not the
+	*   parent's direct continuable child or the parent identity is stale.
+	*/
+	async drainChildren(parent, childIds) {
+		if (this.ctx.agents.get(parent.id) !== parent) throw new SubagentError("selected child teardown requires the exact live parent agent", "UNAUTHORIZED");
+		const targets = [];
+		for (const childId of new Set(childIds)) {
+			const activation = this.activations.get(childId);
+			if (activation === void 0) continue;
+			if (activation.parentSession !== parent.id || !activation.ancestry.has(parent)) throw new SubagentError(`subagent "${childId}" is not a direct child of agent "${parent.id}"`, "UNAUTHORIZED");
+			targets.push(activation);
+		}
+		for (const activation of targets) this.dispose(activation).catch(() => void 0);
+		await this.disposeRoots(targets, "selected activation(s)");
+	}
 	/** Dispose independent roots and report every branch failure after all settle. */
 	async disposeRoots(roots, failureSubject) {
 		const reasons = (await Promise.all(roots.map(async (activation) => {
@@ -1911,6 +1948,25 @@ function sameLifecycle(meta, expected) {
 function assertListingNotCancelled(signal) {
 	if (signal?.aborted) throw new SubagentError("subagent listing was cancelled", "CANCELLED");
 }
+//#endregion
+//#region lib/types/projection.js
+/**
+* Pure session projections for subagent identity (mode/label) and active-turn
+* duration.
+*
+* @module @deepseek-ai/dsh-subagent/projection
+*/
+const activeIntervalSchema = z.object({
+	since: z.number().int().nonnegative(),
+	through: z.number().int().nonnegative()
+}).strict();
+const projectionSchema = z.object({
+	settledMs: z.number().int().nonnegative(),
+	active: activeIntervalSchema.optional()
+}).strict().transform(({ settledMs, active }) => ({
+	settledMs,
+	...active === void 0 ? {} : { active }
+}));
 /**
 * Fold turn boundaries around the child's own durable descriptor.
 *
@@ -1921,12 +1977,11 @@ function assertListingNotCancelled(signal) {
 */
 const subagentTimingProjectionDefinition = {
 	key: "subagentTiming",
-	schema: z.object({
+	stateSchema: z.object({
 		settledMs: z.number().int().nonnegative(),
-		active: z.object({
-			since: z.number().int().nonnegative(),
-			through: z.number().int().nonnegative()
-		}).strict().optional()
+		active: activeIntervalSchema.optional(),
+		pendingTurnStart: z.number().int().nonnegative().optional(),
+		descriptorSeen: z.boolean()
 	}).strict(),
 	init: () => ({
 		descriptorSeen: false,
@@ -1976,13 +2031,16 @@ const subagentTimingProjectionDefinition = {
 			}
 		};
 	},
-	view: (state) => ({
-		settledMs: state.settledMs,
-		...state.active === void 0 ? {} : { active: state.active }
-	}),
+	wire: {
+		viewSchema: projectionSchema,
+		view: (state) => ({
+			settledMs: state.settledMs,
+			...state.active === void 0 ? {} : { active: state.active }
+		})
+	},
 	stateVersion: 2
 };
-const identitySchema = z.discriminatedUnion("mode", [z.object({
+const identityValueSchema = z.discriminatedUnion("mode", [z.object({
 	mode: z.literal("one-shot"),
 	label: z.string().optional(),
 	seq: z.number().int().nonnegative()
@@ -1990,7 +2048,9 @@ const identitySchema = z.discriminatedUnion("mode", [z.object({
 	mode: z.literal("continuable"),
 	label: z.string(),
 	seq: z.number().int().nonnegative()
-}).strict()]).nullable();
+}).strict()]);
+const identitySchema = identityValueSchema.nullable();
+const identityStateSchema = z.object({ identity: identityValueSchema.optional() }).strict();
 /** Interpret one `subagent/descriptor` event's identity; no value when the payload cannot be trusted. */
 function descriptorIdentity(event) {
 	let descriptor;
@@ -2023,14 +2083,17 @@ function descriptorIdentity(event) {
 */
 const subagentIdentityProjectionDefinition = {
 	key: "subagent",
-	schema: identitySchema,
+	stateSchema: identityStateSchema,
 	init: () => ({}),
 	apply: (state, event) => {
 		if (event.type !== "subagent/descriptor") return state;
 		const identity = descriptorIdentity(event);
 		return identity === void 0 ? {} : { identity };
 	},
-	view: (state) => state.identity ?? null,
+	wire: {
+		viewSchema: identitySchema,
+		view: (state) => state.identity ?? null
+	},
 	stateVersion: 2
 };
 //#endregion
@@ -2047,6 +2110,23 @@ const subagentIdentityProjectionDefinition = {
 *
 * @module @deepseek-ai/dsh-subagent/out-of-process
 */
+/** Maximum UTF-8 size of {@link SubagentResult.diagnostic}. */
+const MAX_SUBAGENT_DIAGNOSTIC_BYTES = 4096;
+const DIAGNOSTIC_TRUNCATION_SUFFIX = "\n[diagnostic truncated]";
+const utf8Encoder = new TextEncoder();
+const utf8Decoder = new TextDecoder();
+/**
+* Limit provider-authored failure detail without splitting a UTF-8 sequence.
+* @param diagnostic - safe diagnostic text produced by the provider.
+* @returns the original text, or a visibly truncated value within the limit.
+*/
+function limitSubagentDiagnostic(diagnostic) {
+	const bytes = utf8Encoder.encode(diagnostic);
+	if (bytes.byteLength <= MAX_SUBAGENT_DIAGNOSTIC_BYTES) return diagnostic;
+	let prefixBytes = MAX_SUBAGENT_DIAGNOSTIC_BYTES - utf8Encoder.encode(DIAGNOSTIC_TRUNCATION_SUFFIX).byteLength;
+	while ((bytes[prefixBytes] & 192) === 128) prefixBytes -= 1;
+	return utf8Decoder.decode(bytes.subarray(0, prefixBytes)) + DIAGNOSTIC_TRUNCATION_SUFFIX;
+}
 /**
 * The capability advertisement of an out-of-process backend: NONE. A child in
 * another process cannot honor parent-enforced start features
@@ -2160,8 +2240,11 @@ async function settleRunResult(parts) {
 		try {
 			parts.onError?.(toError(error), "error");
 		} catch {}
+		const collected = parts.collectDiagnostic?.();
+		const diagnostic = collected === void 0 ? void 0 : limitSubagentDiagnostic(collected);
 		return {
 			output: parts.collectOutput(),
+			...diagnostic === void 0 ? {} : { diagnostic },
 			stopReason: "error"
 		};
 	} finally {
@@ -2204,6 +2287,11 @@ function subprocessRunHandle(parts) {
 function finalText(blocks) {
 	return blocks.filter((block) => block.type === "text").map((block) => block.text).join("");
 }
+/** Render a failed stop reason with optional provider-authored detail. */
+function failureDetail(result) {
+	const stopReason = result.stopReason;
+	return result.diagnostic === void 0 ? stopReason : `${stopReason}; diagnostic: ${result.diagnostic}`;
+}
 /**
 * Map a child result to the task outcome: completed carries final text,
 * aborted is killed, and every other reason is failed without partial output.
@@ -2221,11 +2309,11 @@ function runOutcome(result) {
 		case "max-tokens":
 		case "refusal": return {
 			status: "failed",
-			detail: result.stopReason
+			detail: failureDetail(result)
 		};
 		default: return {
 			status: "failed",
-			detail: String(result.stopReason)
+			detail: failureDetail(result)
 		};
 	}
 }
@@ -2409,6 +2497,21 @@ var SubagentRuntime = class extends Service {
 		await manager.drainDescendants(parents);
 	}
 	/**
+	* Release selected resident continuable direct children of one exact live
+	* parent. Other children of the same parent remain admitted and resident.
+	* Absent targets and a manager-less composition are accepted no-ops.
+	* @param parent - exact live direct parent authorizing the selected release.
+	* @param childIds - durable direct-child ids to release when resident.
+	* @returns once every selected Activation released its `AgentHandle`.
+	* @throws {SubagentError} `UNAUTHORIZED` when a resident target belongs to a
+	*   different parent or the supplied parent identity is stale.
+	*/
+	async drainContinuableChildren(parent, childIds) {
+		const manager = this.continuations;
+		if (manager === void 0) return;
+		await manager.drainChildren(parent, childIds);
+	}
+	/**
 	* Enumerate the parent's direct session-backed subagents without loading or
 	* resuming an Agent and without any query service: the listing merges the live
 	* session store with optional session persistence (live-preferred) and

package/lib/types/continuation.d.ts

@@ -68,7 +68,7 @@ declare module '@deepseek-ai/dsh-llm' {
     }
 }
 /** Deployment scheduling policy for accepted child reports. */
-export type SubagentReportDelivery = 'quiet' | 'wakeup';
+export type SubagentReportDelivery = 'quiet' | 'next-step';
 /** Options for one continuable child's report to its direct parent. */
 export interface SubagentReportOptions {
     /** Already-resolved parent scheduling policy. */
@@ -82,6 +82,12 @@ export interface ContinuableStartSpec {
     readonly provider: string;
     /** The initial delegation's short `description`, persisted as the child's creation label. */
     readonly label: string;
+    /**
+     * Optional caller-reserved child identity. Omission preserves the manager's
+     * UUID allocation; supplying one lets a durable parent record provisioning
+     * before child materialization without a second identity handshake.
+     */
+    readonly childId?: SessionId;
     /**
      * The delegation request. The manager reserves the stable child id, resolves
      * the durable descriptor, and composes the child itself.
@@ -182,6 +188,8 @@ export declare class SubagentContinuationManager {
      * @returns the durable child id and the accepted initial prompt's message id.
      */
     startContinuable(spec: ContinuableStartSpec): Promise<ContinuableStart>;
+    /** Reject one child identity already owned by a live Agent or Session. */
+    private assertChildIdAvailable;
     /**
      * Deliver one later message to a known continuable child as its next FIFO
      * turn. Routing depends only on Activation residency: a `running` Activation
@@ -245,7 +253,7 @@ export declare class SubagentContinuationManager {
      * Perform one waking send to a parent, accounted against that parent's own
      * Activation when it has one. Registering the id before the send is what
      * keeps a continuation-managed parent from being judged quiescent in the
-     * window between `followup()` and the microtask that admits it.
+     * window between a waking send and the microtask that admits it.
      * @param parent - the exact live parent receiving the waking message.
      * @param message - the message whose id is accounted.
      * @param send - the synchronous waking send to perform.
@@ -273,6 +281,17 @@ export declare class SubagentContinuationManager {
      * @throws an aggregate error after all scoped branches settle when any failed.
      */
     drainDescendants(parents: readonly Agent[]): Promise<void>;
+    /**
+     * Release selected resident direct children of one exact live parent without
+     * closing admission for the parent's other continuable children. Owned
+     * descendants are released recursively through the same lifecycle.
+     * @param parent - exact live direct parent authorizing the selected release.
+     * @param childIds - durable direct-child ids to release when resident.
+     * @returns once every selected Activation released its handle.
+     * @throws {SubagentError} `UNAUTHORIZED` when a resident target is not the
+     *   parent's direct continuable child or the parent identity is stale.
+     */
+    drainChildren(parent: Agent, childIds: readonly SessionId[]): Promise<void>;
     /** Dispose independent roots and report every branch failure after all settle. */
     private disposeRoots;
     /** Return the retained member set for one exact scoped-teardown root. */

package/lib/types/continuation.js

@@ -154,9 +154,10 @@ export class SubagentContinuationManager {
         const request = spec.request;
         const parent = request.parent;
         this.assertAdmitting(parent);
-        this.requirePersistence();
+        const persistence = this.requirePersistence();
         assertSubagentMaxDepth(request.maxDepth);
-        const childId = SessionId(randomUUID());
+        const childId = spec.childId ?? SessionId(randomUUID());
+        this.assertChildIdAvailable(childId);
         const childDepth = resolveChildDepth(parent, request.maxDepth);
         // Snapshot before any await: invalid descriptor JSON rejects the call
         // before a child exists, and the detached value is what reaches the log.
@@ -184,6 +185,18 @@ export class SubagentContinuationManager {
         const lineageSeedLength = prepared.seed?.length ?? 0;
         const seed = seedDescriptorTurn(childId, prepared.seed, descriptor);
         const messageId = await this.locks.run(childId, async () => {
+            spec.signal.throwIfAborted();
+            this.assertAdmitting(parent);
+            this.assertChildIdAvailable(childId);
+            if (spec.childId !== undefined) {
+                const persisted = await persistence.listSnapshots(spec.signal);
+                spec.signal.throwIfAborted();
+                this.assertAdmitting(parent);
+                this.assertChildIdAvailable(childId);
+                if (persisted.some(snapshot => snapshot.header.id === childId)) {
+                    throw new SubagentError(`subagent "${childId}" already exists`, 'DUPLICATE_CHILD');
+                }
+            }
             const activation = await this.materialize({
                 childId,
                 provider: spec.provider,
@@ -197,6 +210,12 @@ export class SubagentContinuationManager {
         });
         return { childId, messageId };
     }
+    /** Reject one child identity already owned by a live Agent or Session. */
+    assertChildIdAvailable(childId) {
+        if (this.ctx.agents.get(childId) !== undefined || this.ctx.get('sessions')?.get(childId) !== undefined) {
+            throw new SubagentError(`subagent "${childId}" already exists`, 'DUPLICATE_CHILD');
+        }
+    }
     /**
      * Deliver one later message to a known continuable child as its next FIFO
      * turn. Routing depends only on Activation residency: a `running` Activation
@@ -347,7 +366,7 @@ export class SubagentContinuationManager {
                 senderSessionId: activation.childId,
             },
         });
-        if (delivery === 'wakeup') {
+        if (delivery === 'next-step') {
             this.sendWaking(parent, message, () => { this.sendReport(parent, message, delivery); });
         }
         else {
@@ -359,7 +378,7 @@ export class SubagentContinuationManager {
      * Perform one waking send to a parent, accounted against that parent's own
      * Activation when it has one. Registering the id before the send is what
      * keeps a continuation-managed parent from being judged quiescent in the
-     * window between `followup()` and the microtask that admits it.
+     * window between a waking send and the microtask that admits it.
      * @param parent - the exact live parent receiving the waking message.
      * @param message - the message whose id is accounted.
      * @param send - the synchronous waking send to perform.
@@ -376,8 +395,8 @@ export class SubagentContinuationManager {
     /** Send one report while translating only the parent's own rejection. */
     sendReport(parent, message, delivery) {
         try {
-            if (delivery === 'wakeup')
-                parent.followup(message);
+            if (delivery === 'next-step')
+                parent.steer(message);
             else
                 parent.inject(message);
         }
@@ -471,6 +490,38 @@ export class SubagentContinuationManager {
         await Promise.all(materializations.map(materialization => materialization.settled));
         await this.disposeRoots(targetRoots, 'scoped activation(s)');
     }
+    /**
+     * Release selected resident direct children of one exact live parent without
+     * closing admission for the parent's other continuable children. Owned
+     * descendants are released recursively through the same lifecycle.
+     * @param parent - exact live direct parent authorizing the selected release.
+     * @param childIds - durable direct-child ids to release when resident.
+     * @returns once every selected Activation released its handle.
+     * @throws {SubagentError} `UNAUTHORIZED` when a resident target is not the
+     *   parent's direct continuable child or the parent identity is stale.
+     */
+    async drainChildren(parent, childIds) {
+        if (this.ctx.agents.get(parent.id) !== parent) {
+            throw new SubagentError('selected child teardown requires the exact live parent agent', 'UNAUTHORIZED');
+        }
+        const targets = [];
+        for (const childId of new Set(childIds)) {
+            const activation = this.activations.get(childId);
+            if (activation === undefined)
+                continue;
+            if (activation.parentSession !== parent.id || !activation.ancestry.has(parent)) {
+                throw new SubagentError(`subagent "${childId}" is not a direct child of agent "${parent.id}"`, 'UNAUTHORIZED');
+            }
+            targets.push(activation);
+        }
+        // Open every transaction before the first await so cancellation propagates
+        // across the selected roots in one synchronous span.
+        for (const activation of targets) {
+            const disposal = this.dispose(activation);
+            void disposal.catch(() => undefined);
+        }
+        await this.disposeRoots(targets, 'selected activation(s)');
+    }
     /** Dispose independent roots and report every branch failure after all settle. */
     async disposeRoots(roots, failureSubject) {
         const failures = await Promise.all(roots.map(async (activation) => {
@@ -814,7 +865,7 @@ export class SubagentContinuationManager {
      * @returns the accepted message id.
      */
     admitWaking(activation, messageId, send) {
-        // `Agent.followup()` publishes inbox events synchronously, so observers must
+        // Waking Agent sends publish inbox events synchronously, so observers must
         // see this Activation as busy before the call begins.
         activation.accepted.add(messageId);
         try {

package/lib/types/index.d.ts

@@ -182,6 +182,17 @@ export declare class SubagentRuntime extends Service {
      * @throws an aggregate error after all branches settle when any failed.
      */
     drainContinuableDescendants(parents: readonly Agent[]): Promise<void>;
+    /**
+     * Release selected resident continuable direct children of one exact live
+     * parent. Other children of the same parent remain admitted and resident.
+     * Absent targets and a manager-less composition are accepted no-ops.
+     * @param parent - exact live direct parent authorizing the selected release.
+     * @param childIds - durable direct-child ids to release when resident.
+     * @returns once every selected Activation released its `AgentHandle`.
+     * @throws {SubagentError} `UNAUTHORIZED` when a resident target belongs to a
+     *   different parent or the supplied parent identity is stale.
+     */
+    drainContinuableChildren(parent: Agent, childIds: readonly SessionId[]): Promise<void>;
     /**
      * Enumerate the parent's direct session-backed subagents without loading or
      * resuming an Agent and without any query service: the listing merges the live

package/lib/types/index.js

@@ -173,6 +173,22 @@ export class SubagentRuntime extends Service {
             return;
         await manager.drainDescendants(parents);
     }
+    /**
+     * Release selected resident continuable direct children of one exact live
+     * parent. Other children of the same parent remain admitted and resident.
+     * Absent targets and a manager-less composition are accepted no-ops.
+     * @param parent - exact live direct parent authorizing the selected release.
+     * @param childIds - durable direct-child ids to release when resident.
+     * @returns once every selected Activation released its `AgentHandle`.
+     * @throws {SubagentError} `UNAUTHORIZED` when a resident target belongs to a
+     *   different parent or the supplied parent identity is stale.
+     */
+    async drainContinuableChildren(parent, childIds) {
+        const manager = this.continuations;
+        if (manager === undefined)
+            return;
+        await manager.drainChildren(parent, childIds);
+    }
     /**
      * Enumerate the parent's direct session-backed subagents without loading or
      * resuming an Agent and without any query service: the listing merges the live

package/lib/types/out-of-process.d.ts

@@ -69,6 +69,8 @@ export interface RunResultSettlement {
     attempt: () => Promise<SubagentResult>;
     /** Snapshot the provider exposes when cancellation or failure wins settlement. */
     collectOutput: () => ContentBlock[];
+    /** Snapshot safe provider-authored detail when a failure wins settlement. */
+    collectDiagnostic?: (() => string | undefined) | undefined;
     /** Whether local cancellation settled before the attempt's outcome is observed. */
     cancelled: () => boolean;
     /** Diagnostic sink for a failure flattened to a stop reason; a throw from it is contained. */

package/lib/types/out-of-process.js

@@ -12,6 +12,28 @@
  */
 import { accessSync, constants, statSync } from 'node:fs';
 import { isAbsolute, resolve } from 'node:path';
+/** Maximum UTF-8 size of {@link SubagentResult.diagnostic}. */
+const MAX_SUBAGENT_DIAGNOSTIC_BYTES = 4_096;
+const DIAGNOSTIC_TRUNCATION_SUFFIX = '\n[diagnostic truncated]';
+const utf8Encoder = new TextEncoder();
+const utf8Decoder = new TextDecoder();
+/**
+ * Limit provider-authored failure detail without splitting a UTF-8 sequence.
+ * @param diagnostic - safe diagnostic text produced by the provider.
+ * @returns the original text, or a visibly truncated value within the limit.
+ */
+function limitSubagentDiagnostic(diagnostic) {
+    const bytes = utf8Encoder.encode(diagnostic);
+    if (bytes.byteLength <= MAX_SUBAGENT_DIAGNOSTIC_BYTES)
+        return diagnostic;
+    const suffixBytes = utf8Encoder.encode(DIAGNOSTIC_TRUNCATION_SUFFIX).byteLength;
+    let prefixBytes = MAX_SUBAGENT_DIAGNOSTIC_BYTES - suffixBytes;
+    while ((bytes[prefixBytes] & 0b1100_0000) === 0b1000_0000) {
+        prefixBytes -= 1;
+    }
+    return utf8Decoder.decode(bytes.subarray(0, prefixBytes))
+        + DIAGNOSTIC_TRUNCATION_SUFFIX;
+}
 /**
  * The capability advertisement of an out-of-process backend: NONE. A child in
  * another process cannot honor parent-enforced start features
@@ -148,7 +170,15 @@ export async function settleRunResult(parts) {
         catch {
             // The diagnostic sink cannot reject the run result.
         }
-        return { output: parts.collectOutput(), stopReason: 'error' };
+        const collected = parts.collectDiagnostic?.();
+        const diagnostic = collected === undefined
+            ? undefined
+            : limitSubagentDiagnostic(collected);
+        return {
+            output: parts.collectOutput(),
+            ...diagnostic === undefined ? {} : { diagnostic },
+            stopReason: 'error',
+        };
     }
     finally {
         parts.signal.removeEventListener('abort', parts.onAbort);

package/lib/types/projection.d.ts

@@ -4,21 +4,29 @@
  *
  * @module @deepseek-ai/dsh-subagent/projection
  */
-import type { ProjectionDefinition } from '@deepseek-ai/dsh-session-projection';
-import type { SubagentIdentityProjection } from './projection-types.ts';
-interface TimingState {
+import { z } from 'zod';
+import type { SessionEvent } from '@deepseek-ai/dsh-session';
+import type { SubagentIdentityProjection, SubagentTimingProjection } from './projection-types.ts';
+/** Fold state for a subagent's latest timing snapshot. */
+export interface TimingState {
     /** Milliseconds accumulated across completed post-descriptor turns. */
     settledMs: number;
     /** Current open interval kept paired inside the fold. */
     active?: {
         since: number;
         through: number;
-    };
+    } | undefined;
     /** Latest pre-descriptor turn start, promoted when the child's own descriptor arrives. */
-    pendingTurnStart?: number;
+    pendingTurnStart?: number | undefined;
     /** Whether the fold has crossed a descriptor in this logical log. */
     descriptorSeen: boolean;
 }
+declare module '@deepseek-ai/dsh-session-projection/types' {
+    interface SessionProjectionStateMap {
+        subagentTiming: TimingState;
+        subagent: IdentityState;
+    }
+}
 /**
  * Fold turn boundaries around the child's own durable descriptor.
  *
@@ -27,10 +35,39 @@ interface TimingState {
  * admits only a child with exactly one descriptor in its own suffix, making
  * the final reset the child's authoritative timing origin.
  */
-export declare const subagentTimingProjectionDefinition: ProjectionDefinition<'subagentTiming', TimingState>;
+export declare const subagentTimingProjectionDefinition: {
+    key: "subagentTiming";
+    stateSchema: z.ZodType<TimingState, unknown, z.core.$ZodTypeInternals<TimingState, unknown>>;
+    init: () => {
+        descriptorSeen: false;
+        settledMs: number;
+    };
+    apply: (state: NoInfer<TimingState>, event: SessionEvent) => {
+        /** Milliseconds accumulated across completed post-descriptor turns. */
+        settledMs: number;
+        /** Current open interval kept paired inside the fold. */
+        active?: {
+            since: number;
+            through: number;
+        } | undefined;
+        /** Whether the fold has crossed a descriptor in this logical log. */
+        descriptorSeen: boolean;
+    };
+    wire: {
+        viewSchema: z.ZodType<SubagentTimingProjection, unknown, z.core.$ZodTypeInternals<SubagentTimingProjection, unknown>>;
+        view: (state: NoInfer<TimingState>) => {
+            active?: {
+                since: number;
+                through: number;
+            };
+            settledMs: number;
+        };
+    };
+    stateVersion: number;
+};
 interface IdentityState {
     /** Identity from the last valid descriptor; absent before one, and after an invalid one. */
-    identity?: SubagentIdentityProjection;
+    identity?: SubagentIdentityProjection | undefined;
 }
 /**
  * Fold the durable mode/label identity from `subagent/descriptor` events,
@@ -43,6 +80,16 @@ interface IdentityState {
  * holding the earlier identity replaces it instead of keeping it stale;
  * `null` ⟺ no valid descriptor, with the causes deliberately undistinguished.
  */
-export declare const subagentIdentityProjectionDefinition: ProjectionDefinition<'subagent', IdentityState>;
+export declare const subagentIdentityProjectionDefinition: {
+    key: "subagent";
+    stateSchema: z.ZodType<IdentityState, unknown, z.core.$ZodTypeInternals<IdentityState, unknown>>;
+    init: () => {};
+    apply: (state: NoInfer<IdentityState>, event: SessionEvent) => IdentityState;
+    wire: {
+        viewSchema: z.ZodNullable<z.ZodType<SubagentIdentityProjection, unknown, z.core.$ZodTypeInternals<SubagentIdentityProjection, unknown>>>;
+        view: (state: NoInfer<IdentityState>) => SubagentIdentityProjection | null;
+    };
+    stateVersion: number;
+};
 export {};
 //# sourceMappingURL=projection.d.ts.map

package/lib/types/projection.js

@@ -6,14 +6,22 @@
  */
 import { z } from 'zod';
 import { foldSubagentDescriptor } from "./descriptor.js";
-// Zod's optional output includes explicit `undefined`; with
-// exactOptionalPropertyTypes the public interface permits omission only.
+const activeIntervalSchema = z.object({
+    since: z.number().int().nonnegative(),
+    through: z.number().int().nonnegative(),
+}).strict();
 const projectionSchema = z.object({
     settledMs: z.number().int().nonnegative(),
-    active: z.object({
-        since: z.number().int().nonnegative(),
-        through: z.number().int().nonnegative(),
-    }).strict().optional(),
+    active: activeIntervalSchema.optional(),
+}).strict().transform(({ settledMs, active }) => ({
+    settledMs,
+    ...active === undefined ? {} : { active },
+}));
+const timingStateSchema = z.object({
+    settledMs: z.number().int().nonnegative(),
+    active: activeIntervalSchema.optional(),
+    pendingTurnStart: z.number().int().nonnegative().optional(),
+    descriptorSeen: z.boolean(),
 }).strict();
 /**
  * Fold turn boundaries around the child's own durable descriptor.
@@ -25,7 +33,7 @@ const projectionSchema = z.object({
  */
 export const subagentTimingProjectionDefinition = {
     key: 'subagentTiming',
-    schema: projectionSchema,
+    stateSchema: timingStateSchema,
     init: () => ({ descriptorSeen: false, settledMs: 0 }),
     apply: (state, event) => {
         if (event.type === 'turn/start') {
@@ -62,10 +70,13 @@ export const subagentTimingProjectionDefinition = {
             return state;
         return { ...state, active: { ...state.active, through: event.time } };
     },
-    view: state => ({
-        settledMs: state.settledMs,
-        ...(state.active === undefined ? {} : { active: state.active }),
-    }),
+    wire: {
+        viewSchema: projectionSchema,
+        view: state => ({
+            settledMs: state.settledMs,
+            ...(state.active === undefined ? {} : { active: state.active }),
+        }),
+    },
     stateVersion: 2,
 };
 // The cast bridges only the optional-label arm: Zod's optional output
@@ -73,7 +84,7 @@ export const subagentTimingProjectionDefinition = {
 // from the public interface. The no-value state itself is the serializable
 // `null` arm — never `undefined` — so every registry read and push frame
 // survives JSON.stringify losslessly.
-const identitySchema = z.discriminatedUnion('mode', [
+const identityValueSchema = z.discriminatedUnion('mode', [
     z.object({
         mode: z.literal('one-shot'),
         label: z.string().optional(),
@@ -84,7 +95,11 @@ const identitySchema = z.discriminatedUnion('mode', [
         label: z.string(),
         seq: z.number().int().nonnegative(),
     }).strict(),
-]).nullable();
+]);
+const identitySchema = identityValueSchema.nullable();
+const identityStateSchema = z.object({
+    identity: identityValueSchema.optional(),
+}).strict();
 /** Interpret one `subagent/descriptor` event's identity; no value when the payload cannot be trusted. */
 function descriptorIdentity(event) {
     let descriptor;
@@ -119,7 +134,7 @@ function descriptorIdentity(event) {
  */
 export const subagentIdentityProjectionDefinition = {
     key: 'subagent',
-    schema: identitySchema,
+    stateSchema: identityStateSchema,
     init: () => ({}),
     apply: (state, event) => {
         if (event.type !== 'subagent/descriptor')
@@ -127,7 +142,7 @@ export const subagentIdentityProjectionDefinition = {
         const identity = descriptorIdentity(event);
         return identity === undefined ? {} : { identity };
     },
-    view: state => state.identity ?? null,
+    wire: { viewSchema: identitySchema, view: state => state.identity ?? null },
     // Bumped when the identity gained its `seq` field: an older checkpoint row
     // would replay into a value the schema rejects, so it must refold instead.
     stateVersion: 2,

package/lib/types/run-settlement.js

@@ -12,6 +12,13 @@ function finalText(blocks) {
         .map(block => block.text)
         .join('');
 }
+/** Render a failed stop reason with optional provider-authored detail. */
+function failureDetail(result) {
+    const stopReason = result.stopReason;
+    return result.diagnostic === undefined
+        ? stopReason
+        : `${stopReason}; diagnostic: ${result.diagnostic}`;
+}
 /**
  * Map a child result to the task outcome: completed carries final text,
  * aborted is killed, and every other reason is failed without partial output.
@@ -27,10 +34,10 @@ function runOutcome(result) {
         case 'error':
         case 'max-tokens':
         case 'refusal':
-            return { status: 'failed', detail: result.stopReason };
-        // Merge-extensible reasons remain failures with their raw detail.
+            return { status: 'failed', detail: failureDetail(result) };
+        // Merge-extensible reasons remain failures with provider-authored detail.
         default:
-            return { status: 'failed', detail: String(result.stopReason) };
+            return { status: 'failed', detail: failureDetail(result) };
     }
 }
 /**

package/lib/types/types.d.ts

@@ -218,6 +218,13 @@ export interface SubagentResult {
      * schema-agnostic.
      */
     readonly structured?: unknown;
+    /**
+     * Provider-authored, non-assistant failure detail for a non-`completed`
+     * result. Providers keep this text free of tool inputs, file contents,
+     * environment values, credentials, and raw protocol payloads, and limit it
+     * to 4096 UTF-8 bytes. Consumers present it separately from {@link output}.
+     */
+    readonly diagnostic?: string;
     /** Why the run ended. A non-`completed` reason means `output` may be partial. */
     readonly stopReason: SubagentStopReason;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-subagent",
   "description": "Abstract subagent seam (ctx.subagents): named-provider registry for delegating to child agents",
-  "version": "0.1.0-rc.7",
+  "version": "0.1.1-rc.1",
   "publishConfig": {
     "access": "public"
   },
@@ -40,22 +40,22 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-agent": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-agent-presets": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-sandbox": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-scope": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-session-persistence": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-session-projection-cache": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-session-projection": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-jobs": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-user-approval": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-brand": "^0.1.0-rc.7",
-    "@deepseek-ai/cordis": "^4.0.1"
+    "@deepseek-ai/dsh-agent-presets": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-agent": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-brand": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-invariants": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-sandbox": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-sandbox-policy": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-scope": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-session": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-session-persistence": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-session-projection-cache": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-jobs": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-tools": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-user-approval": "^0.1.1-rc.1",
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-session-projection": "^0.1.1-rc.1"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-agent-presets": {
@@ -84,23 +84,23 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-agent-presets": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-brand": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-sandbox": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-agent": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-session-persistence": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-session-projection": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-scope": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-session-projection-cache": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-storage": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-user-approval": "^0.1.0-rc.7",
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-storage-domain": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-jobs": "^0.1.0-rc.7"
+    "@deepseek-ai/dsh-agent": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-agent-presets": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-brand": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-invariants": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-sandbox": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-sandbox-policy": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-session": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-scope": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-session-persistence": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-session-projection": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-session-projection-cache": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-storage": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-storage-domain": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-tools": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-user-approval": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-jobs": "^0.1.1-rc.1",
+    "@deepseek-ai/cordis": "^4.0.1"
   }
 }