@deepseek-ai/dsh-subagent 0.1.2-alpha.2 → 0.1.2-alpha.4

package/lib/types/continuation.d.ts

@@ -27,27 +27,18 @@ import type { SessionId } from '@deepseek-ai/dsh-session';
 import type { SubagentDescriptorData } from './descriptor.ts';
 import type { ContinuableCreateRequest, ContinuableCreateSpec, SubagentStartRequest } from './types.ts';
 import type { ActivationObserver } from './lifecycle.ts';
-import type SubagentActivationSetupRegistry from './activation-setup-registry.ts';
-/** Attribution for a model coordinator's follow-up to one of its children. */
-export interface CoordinatorMessageSource {
-    readonly kind: 'coordinator';
+/** Durable attribution for one model-authored message between adjacent Agents. */
+export interface AgentMessageSource {
+    readonly kind: 'agent-message';
     /** A message another agent addressed to this one (`relay` context form). */
     readonly form: 'relay';
-    /** Session id of the agent whose tool call produced the follow-up. */
-    readonly senderSessionId: SessionId;
-}
-/** Durable attribution for a continuable child's explicit parent report. */
-export interface SubagentReportMessageSource {
-    readonly kind: 'subagent-report';
-    /** A message another agent addressed to this one (`relay` context form). */
-    readonly form: 'relay';
-    /** Session id of the reporting child. */
+    /** Session id of the Agent whose tool call produced the message. */
     readonly senderSessionId: SessionId;
 }
 /**
  * Durable attribution for the runtime's own account of a continuable child
  * settling. Deliberately a different kind from
- * {@link SubagentReportMessageSource}: a report is content the child chose,
+ * {@link AgentMessageSource}: an Agent message is content the sender chose,
  * while this message is the manager stating what became of the child, and a
  * transcript that merged them would credit the child with words it never wrote.
  */
@@ -62,20 +53,10 @@ export interface SubagentSettledMessageSource {
 }
 declare module '@deepseek-ai/dsh-llm' {
     interface MessageSourceMap {
-        coordinator: CoordinatorMessageSource;
-        'subagent-report': SubagentReportMessageSource;
+        'agent-message': AgentMessageSource;
         'subagent-settled': SubagentSettledMessageSource;
     }
 }
-/** Deployment scheduling policy for accepted child reports. */
-export type SubagentReportDelivery = 'quiet' | 'next-step';
-/** Options for one continuable child's report to its direct parent. */
-export interface SubagentReportOptions {
-    /** Already-resolved parent scheduling policy. */
-    readonly delivery: SubagentReportDelivery;
-    /** Caller cancellation, owning authorization and admission until acceptance. */
-    readonly signal: AbortSignal;
-}
 /** What a caller asks for when starting a continuable background child. */
 export interface ContinuableStartSpec {
     /** The `ctx.subagents` provider whose continuable-creation capability establishes the child. */
@@ -115,10 +96,8 @@ export type SubagentInterruptAuthority = {
     readonly kind: 'ancestor';
     readonly agent: Agent;
 };
-/** Options for following up with one continuable child. */
-export interface SubagentFollowupOptions {
-    /** Durable attribution retained on the delivered message; it grants no authority. */
-    readonly source: MessageSource;
+/** Options for one model-authored message between adjacent Agents. */
+export interface SubagentSendMessageOptions {
     /** Caller cancellation, owning the operation only until inbox acceptance. */
     readonly signal: AbortSignal;
 }
@@ -155,7 +134,6 @@ interface ContinuationHost {
 export declare class SubagentContinuationManager {
     private readonly ctx;
     private readonly host;
-    private readonly setupRegistry;
     /** Child session id → its live Activation. Process-local, never durable. */
     private activations;
     /** Materializations admitted before drain, tracked through publication or rollback. */
@@ -171,7 +149,7 @@ export declare class SubagentContinuationManager {
      */
     private readonly closingScopes;
     private draining;
-    constructor(ctx: Context, host: ContinuationHost, setupRegistry: SubagentActivationSetupRegistry);
+    constructor(ctx: Context, host: ContinuationHost);
     /**
      * Start one continuable background child: reserve its durable identity,
      * resolve the provider's detached creation spec, create the child Agent
@@ -191,23 +169,31 @@ export declare class SubagentContinuationManager {
     /** Reject one child identity already owned by a live Agent or Session. */
     private assertChildIdAvailable;
     /**
-     * Deliver one later message to a known continuable child as its next FIFO
-     * turn. Routing depends only on Activation residency: a `running` Activation
-     * enqueues, a `waiting` one wakes the same Agent, and an absent one
-     * cold-resumes a new Activation from the persisted Session. The Agent inbox
-     * is the only queue, so every accepted message has one observable order.
-     *
-     * The caller signal owns lookup, materialization, and admission only until
-     * inbox acceptance; afterwards the accepted turn cannot be cancelled through
-     * this service.
-     * @param parent - the exact live direct parent authorizing this delivery.
-     * @param childId - the durable child session id.
-     * @param content - the user-role content to deliver.
-     * @param options - the message source fields and caller cancellation.
+     * Deliver one model-authored message to a direct continuable child or to the
+     * sender's direct parent. Both directions use Steer: a running target admits
+     * the message at its nearest step boundary, while an idle target starts a
+     * turn. A missing direct child cold-resumes through the ordinary continuation
+     * lifecycle. The caller signal owns the operation only until inbox acceptance.
+     * @param sender - exact live Agent authorizing and originating the message.
+     * @param targetId - durable direct-parent or direct-child session id.
+     * @param content - model-authored content to deliver.
+     * @param options - caller cancellation before acceptance.
+     * @returns the accepted message's inbox id.
+     * @throws when adjacency, availability, or admission rejects delivery.
+     */
+    sendMessage(sender: Agent, targetId: SessionId, content: ContentBlock[], options: SubagentSendMessageOptions): Promise<MessageId>;
+    /**
+     * Queue one human-authored prompt as a distinct direct-child turn.
+     * @param parent - exact live direct parent authorizing delivery.
+     * @param childId - durable direct-child session id.
+     * @param content - human-authored content to deliver.
+     * @param source - durable host-protocol provenance.
+     * @param signal - caller cancellation before inbox acceptance.
      * @returns the accepted message's inbox id.
-     * @throws when parent authority, availability, or admission rejects the delivery.
      */
-    followup(parent: Agent, childId: SessionId, content: ContentBlock[], options: SubagentFollowupOptions): Promise<MessageId>;
+    queuePrompt(parent: Agent, childId: SessionId, content: ContentBlock[], source: MessageSource, signal: AbortSignal): Promise<MessageId>;
+    /** Route one parent-originated delivery through residency and cold resume. */
+    private deliverToChild;
     /**
      * Interrupt one live continuable child's current turn. Admission is
      * synchronous and the effect is asynchronous: this authorizes the caller,
@@ -230,25 +216,8 @@ export declare class SubagentContinuationManager {
      *   an ancestor outside the target's recorded live lineage.
      */
     interrupt(targetSessionId: SessionId, authority: SubagentInterruptAuthority): void;
-    /**
-     * Deliver explicitly selected content from one resident continuable child to
-     * its durable direct parent. Sender authorization, parent resolution, and
-     * send acceptance share one no-await span. Reporting neither concludes the
-     * child's turn nor changes its Activation lifetime.
-     * @param child - exact live reporting child; this is the authority credential.
-     * @param content - selected model-facing content.
-     * @param options - scheduling policy and pre-acceptance cancellation.
-     * @returns the stable identity of the message accepted by the parent.
-     * @throws {SubagentError} when the sender is unauthorized, the parent is not
-     *   live, or continuation admission is closing.
-     */
-    reportFrom(child: Agent, content: ContentBlock[], options: SubagentReportOptions): Promise<MessageId>;
-    /** Authorize only the exact Agent of one resident Activation. */
-    private authorizeReporter;
-    /** Resolve the reporting child's live direct parent from durable lineage. */
-    private resolveReportParent;
-    /** Deliver one framed report through the selected parent scheduling preset. */
-    private deliverReport;
+    /** Deliver one resident continuable child's message to its live direct parent. */
+    private sendToParent;
     /**
      * Perform one waking send to a parent, accounted against that parent's own
      * Activation when it has one. Registering the id before the send is what
@@ -259,8 +228,8 @@ export declare class SubagentContinuationManager {
      * @param send - the synchronous waking send to perform.
      */
     private sendWaking;
-    /** Send one report while translating only the parent's own rejection. */
-    private sendReport;
+    /** Send one Agent message while translating only the target's own rejection. */
+    private sendAgentMessage;
     /**
      * Close admission, await every already-admitted materialization through
      * publication or rollback, then dispose the stable live Activation forest
@@ -334,12 +303,24 @@ export declare class SubagentContinuationManager {
      * Submit to a freshly materialized Activation or roll it back completely.
      * @param activation - the just-published Activation to admit or release.
      * @param content - the initial or resumed message content.
-     * @param source - durable fields naming who supplied the accepted message.
+     * @param options - durable source, scheduling, and pre-acceptance cancellation.
      * @param parent - the live direct parent authorizing admission.
-     * @param signal - caller cancellation owning admission until acceptance.
      * @returns the accepted inbox message id.
      */
     private submitMaterialized;
+    /**
+     * Refuse image content addressed to a child whose model accepts text only.
+     * Callers guard with `contentHasImage`, so text-only delivery never awaits.
+     * The check runs inside the per-child delivery lock, before the message
+     * exists, so a rejection leaves no partial user message. When the child's
+     * route is not fixed by its options (a request-waterfall listener owns it)
+     * or no LLM registry is composed, delivery proceeds and the LLM layer's
+     * text-only projection replaces each image with its stable placeholder.
+     * @param agent - the live or freshly materialized child agent.
+     * @param signal - caller cancellation bounding the model-info read.
+     * @throws {SubagentError} `MODEL_DOES_NOT_SUPPORT_IMAGES` when the child's resolved model declines image input.
+     */
+    private assertImageCapable;
     /**
      * Create or resume the child Agent through the private activation-owner
      * scope, install the handle in a fresh Activation, and register ownership on

package/lib/types/continuation.js

@@ -74,12 +74,14 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
 });
 import { randomUUID } from 'node:crypto';
 import { brandString } from '@deepseek-ai/dsh-brand';
-import { ReasoningEffortId, boundContextSummary, createUserMessage, errorChain } from '@deepseek-ai/dsh-llm';
+import { ReasoningEffortId, boundContextSummary, contentHasImage, createUserMessage, errorChain } from '@deepseek-ai/dsh-llm';
+import { SessionLogOffset } from '@deepseek-ai/dsh-session';
 import { foldSubagentDescriptor, snapshotSubagentDescriptor } from "./descriptor.js";
 import { appendDelegatedPolicyOverrides, applyChildComposition, captureDelegatedPolicyOverrides, childSessionMeta, resolveChildAgentOptions, resolveChildDepth, } from "./child-agent.js";
 import { assertSubagentMaxDepth } from "./depth.js";
 import { seedDescriptorTurn } from "./descriptor-seed.js";
 import { SubagentError } from "./error.js";
+import { isAdjacentAgentSendMessageTool } from "./internal.js";
 /**
  * Read one Activation's current disposal transaction. This indirection exists
  * because TypeScript would otherwise narrow repeated reads of the mutable field
@@ -90,6 +92,39 @@ import { SubagentError } from "./error.js";
 function disposalOf(activation) {
     return activation.disposal;
 }
+/** Build durable attribution for one adjacent-Agent message. */
+function agentMessageSource(sender) {
+    return {
+        kind: 'agent-message',
+        form: 'relay',
+        senderSessionId: sender.id,
+    };
+}
+/** Build the model-visible and durable representation of one adjacent-Agent message. */
+function agentMessage(sender, content) {
+    return createUserMessage({
+        content: [
+            { type: 'text', text: `Agent ${sender.id} sent a message:` },
+            ...content,
+        ],
+        source: agentMessageSource(sender),
+    });
+}
+/** Append adjacent-Agent return guidance to a continuable child's initial task. */
+function continuableInitialPrompt(parentId, prompt) {
+    const encodedParentId = JSON.stringify(parentId);
+    return [
+        ...prompt,
+        {
+            type: 'text',
+            text: `Your parent agent id is ${encodedParentId}. Before you finish, send your result to that agent with `
+                + `send_message({ agent_id: ${encodedParentId}, message: "<self-contained result>" }). The parent shares `
+                + 'your workspace but does not automatically receive your transcript, tool output, or reasoning. Send '
+                + 'earlier messages as well when a finding changes what the parent should do next; sending a message '
+                + 'does not end your turn.',
+        },
+    ];
+}
 /**
  * One line telling a parent that a background child is finished and why, in
  * the parent's own task vocabulary.
@@ -151,7 +186,6 @@ class ChildLock {
 export class SubagentContinuationManager {
     ctx;
     host;
-    setupRegistry;
     /** Child session id → its live Activation. Process-local, never durable. */
     activations = new Map();
     /** Materializations admitted before drain, tracked through publication or rollback. */
@@ -167,10 +201,9 @@ export class SubagentContinuationManager {
      */
     closingScopes = new Map();
     draining = false;
-    constructor(ctx, host, setupRegistry) {
+    constructor(ctx, host) {
         this.ctx = ctx;
         this.host = host;
-        this.setupRegistry = setupRegistry;
         // Ordinary Cordis owner effects unwind in reverse registration order, which
         // cannot express the dynamic child graph. Register the private scope's
         // structural disposer FIRST and the drain SECOND, so reverse unwind invokes
@@ -237,7 +270,7 @@ export class SubagentContinuationManager {
         });
         spec.signal.throwIfAborted();
         this.assertAdmitting(parent);
-        const lineageSeedLength = prepared.seed?.length ?? 0;
+        const inheritedEventCount = SessionLogOffset(prepared.seed?.length ?? 0);
         const seed = seedDescriptorTurn(childId, prepared.seed, descriptor);
         const messageId = await this.locks.run(childId, async () => {
             spec.signal.throwIfAborted();
@@ -256,12 +289,19 @@ export class SubagentContinuationManager {
                 childId,
                 provider: spec.provider,
                 parent,
-                create: { seed, meta: childSessionMeta(parent, childDepth, lineageSeedLength), delegatedPolicies },
+                create: {
+                    seed,
+                    meta: childSessionMeta(parent, childDepth, prepared.seed !== undefined),
+                    inheritedEventCount,
+                    delegatedPolicies,
+                },
                 agentOptions,
                 composition: { persona: request.persona, toolFilter: request.toolFilter },
                 signal: spec.signal,
             });
-            return this.submitMaterialized(activation, request.prompt, { kind: 'user' }, parent, spec.signal);
+            return this.submitMaterialized(activation, isAdjacentAgentSendMessageTool(this.ctx.get('tools')?.get('send_message', activation.handle.agent))
+                ? continuableInitialPrompt(parent.id, request.prompt)
+                : request.prompt, { source: { kind: 'user' }, signal: spec.signal, delivery: 'queue' }, parent);
         });
         return { childId, messageId };
     }
@@ -272,23 +312,52 @@ export class SubagentContinuationManager {
         }
     }
     /**
-     * Deliver one later message to a known continuable child as its next FIFO
-     * turn. Routing depends only on Activation residency: a `running` Activation
-     * enqueues, a `waiting` one wakes the same Agent, and an absent one
-     * cold-resumes a new Activation from the persisted Session. The Agent inbox
-     * is the only queue, so every accepted message has one observable order.
-     *
-     * The caller signal owns lookup, materialization, and admission only until
-     * inbox acceptance; afterwards the accepted turn cannot be cancelled through
-     * this service.
-     * @param parent - the exact live direct parent authorizing this delivery.
-     * @param childId - the durable child session id.
-     * @param content - the user-role content to deliver.
-     * @param options - the message source fields and caller cancellation.
+     * Deliver one model-authored message to a direct continuable child or to the
+     * sender's direct parent. Both directions use Steer: a running target admits
+     * the message at its nearest step boundary, while an idle target starts a
+     * turn. A missing direct child cold-resumes through the ordinary continuation
+     * lifecycle. The caller signal owns the operation only until inbox acceptance.
+     * @param sender - exact live Agent authorizing and originating the message.
+     * @param targetId - durable direct-parent or direct-child session id.
+     * @param content - model-authored content to deliver.
+     * @param options - caller cancellation before acceptance.
      * @returns the accepted message's inbox id.
-     * @throws when parent authority, availability, or admission rejects the delivery.
+     * @throws when adjacency, availability, or admission rejects delivery.
      */
-    async followup(parent, childId, content, options) {
+    async sendMessage(sender, targetId, content, options) {
+        if (this.ctx.agents.get(sender.id) !== sender) {
+            throw new SubagentError('message delivery requires the exact live sender agent', 'UNAUTHORIZED');
+        }
+        this.assertAdmitting(sender);
+        const senderActivation = this.activations.get(sender.id);
+        if (senderActivation !== undefined
+            && senderActivation.handle.agent === sender
+            && senderActivation.parentSession === targetId) {
+            options.signal.throwIfAborted();
+            return this.sendToParent(senderActivation, sender, content);
+        }
+        if (sender.session.header.parentSession === targetId) {
+            throw new SubagentError(`agent "${sender.id}" is not a resident continuable child and cannot send to parent "${targetId}"`, 'UNAUTHORIZED');
+        }
+        return this.deliverToChild(sender, targetId, content, {
+            signal: options.signal,
+            delivery: 'steer',
+        });
+    }
+    /**
+     * Queue one human-authored prompt as a distinct direct-child turn.
+     * @param parent - exact live direct parent authorizing delivery.
+     * @param childId - durable direct-child session id.
+     * @param content - human-authored content to deliver.
+     * @param source - durable host-protocol provenance.
+     * @param signal - caller cancellation before inbox acceptance.
+     * @returns the accepted message's inbox id.
+     */
+    async queuePrompt(parent, childId, content, source, signal) {
+        return this.deliverToChild(parent, childId, content, { source, signal, delivery: 'queue' });
+    }
+    /** Route one parent-originated delivery through residency and cold resume. */
+    async deliverToChild(parent, childId, content, options) {
         this.assertAdmitting(parent);
         while (true) {
             const live = await this.locks.run(childId, async () => {
@@ -297,14 +366,27 @@ export class SubagentContinuationManager {
                     return this.coldResume(parent, childId, content, options);
                 // A delivery that arrives after the disposal transaction began must not
                 // reach a handle being torn down; wait for release, then cold-resume.
+                const disposal = activation.disposal;
                 /* v8 ignore next 3 -- the send-versus-dispose cutoff: reaching this arm needs a
                  * delivery to observe the transaction inside the same critical section that opened it,
                  * which no test can schedule deterministically. The behavior is covered end-to-end by
                  * "cold-resumes a delivery that lost the race with final disposal". */
-                if (activation.disposal !== undefined) {
-                    return activation.disposal.then(() => undefined, () => undefined);
+                if (disposal !== undefined) {
+                    return disposal.then(() => undefined, () => undefined);
                 }
-                return this.submitAdmitted(activation, content, options.source, parent, options.signal);
+                // Text-only delivery stays await-free, so the disposal-cutoff check
+                // above and the submit share one critical window. The image path
+                // awaits a capability read, so it re-checks the cutoff afterwards; a
+                // disposal that began during the read is waited out and retried like
+                // one observed on entry.
+                if (contentHasImage(content)) {
+                    await this.assertImageCapable(activation.handle.agent, options.signal);
+                    if (activation.disposal !== undefined) {
+                        await Promise.allSettled([activation.disposal]);
+                        return undefined;
+                    }
+                }
+                return this.submitAdmitted(activation, content, options, parent);
             });
             /* v8 ignore start -- only the lost-cutoff arm above returns undefined, so only that
              * race reaches the retry below, which then cold-resumes a new Activation. */
@@ -365,68 +447,19 @@ export class SubagentContinuationManager {
             return;
         activation.handle.agent.cancel(authority.kind === 'user' ? { kind: 'user' } : { kind: 'parent' }, { keepInbox: true });
     }
-    /**
-     * Deliver explicitly selected content from one resident continuable child to
-     * its durable direct parent. Sender authorization, parent resolution, and
-     * send acceptance share one no-await span. Reporting neither concludes the
-     * child's turn nor changes its Activation lifetime.
-     * @param child - exact live reporting child; this is the authority credential.
-     * @param content - selected model-facing content.
-     * @param options - scheduling policy and pre-acceptance cancellation.
-     * @returns the stable identity of the message accepted by the parent.
-     * @throws {SubagentError} when the sender is unauthorized, the parent is not
-     *   live, or continuation admission is closing.
-     */
-    // oxlint-disable-next-line typescript/require-await -- keep rejection semantics without yielding during admission
-    async reportFrom(child, content, options) {
-        options.signal.throwIfAborted();
-        this.assertAdmitting(child);
-        const activation = this.authorizeReporter(child);
-        const parent = this.resolveReportParent(child);
-        return this.deliverReport(activation, parent, content, options.delivery);
-    }
-    /** Authorize only the exact Agent of one resident Activation. */
-    authorizeReporter(child) {
-        const activation = this.activations.get(child.id);
-        if (activation === undefined || activation.handle.agent !== child) {
-            throw new SubagentError(`agent "${child.id}" is not a live continuable subagent and cannot report`, 'UNAUTHORIZED');
-        }
-        /* v8 ignore next 6 -- only a synchronous re-entrant disposer can open this
-         * transaction between exact-agent authorization and this no-await cutoff. */
+    /** Deliver one resident continuable child's message to its live direct parent. */
+    sendToParent(activation, sender, content) {
+        /* v8 ignore next 6 -- only synchronous re-entrant teardown can open this
+         * transaction between exact-agent authorization and this no-await span. */
         if (activation.disposal !== undefined) {
-            throw new SubagentError(`subagent "${child.id}" activation is being disposed; the report was not delivered`, 'ACTIVATION_CLOSING');
+            throw new SubagentError(`subagent "${sender.id}" activation is being disposed; the message was not delivered`, 'ACTIVATION_CLOSING');
         }
-        return activation;
-    }
-    /** Resolve the reporting child's live direct parent from durable lineage. */
-    resolveReportParent(child) {
-        const parentId = child.session.header.parentSession;
-        /* v8 ignore next -- every continuation-managed child has direct-parent metadata. */
-        const parent = parentId === undefined ? undefined : this.ctx.agents.get(parentId);
+        const parent = this.ctx.agents.get(activation.parentSession);
         if (parent === undefined) {
-            throw new SubagentError('direct parent is not live; report was not delivered', 'PARENT_UNAVAILABLE');
-        }
-        return parent;
-    }
-    /** Deliver one framed report through the selected parent scheduling preset. */
-    deliverReport(activation, parent, content, delivery) {
-        const message = createUserMessage({
-            content: [
-                { type: 'text', text: `Background subagent ${activation.childId} reported:` },
-                ...content,
-            ],
-            source: {
-                kind: 'subagent-report',
-                form: 'relay',
-                senderSessionId: activation.childId,
-            },
-        });
-        if (delivery === 'next-step') {
-            this.sendWaking(parent, message, () => { this.sendReport(parent, message, delivery); });
-        }
-        else {
-            this.sendReport(parent, message, delivery);
+            throw new SubagentError('direct parent is not live; the message was not delivered', 'PARENT_UNAVAILABLE');
         }
+        const message = agentMessage(sender, content);
+        this.sendWaking(parent, message, () => { this.sendAgentMessage(parent, message); });
         return message.id;
     }
     /**
@@ -447,16 +480,13 @@ export class SubagentContinuationManager {
             send();
         }
     }
-    /** Send one report while translating only the parent's own rejection. */
-    sendReport(parent, message, delivery) {
+    /** Send one Agent message while translating only the target's own rejection. */
+    sendAgentMessage(parent, message) {
         try {
-            if (delivery === 'next-step')
-                parent.steer(message);
-            else
-                parent.inject(message);
+            parent.steer(message);
         }
         catch (error) {
-            throw new SubagentError('direct parent is not live; report was not delivered', 'PARENT_UNAVAILABLE', { cause: error });
+            throw new SubagentError('direct parent is not live; the message was not delivered', 'PARENT_UNAVAILABLE', { cause: error });
         }
     }
     /**
@@ -693,10 +723,9 @@ export class SubagentContinuationManager {
             // Fold only the child's own suffix: a fork seed replays the parent's log,
             // which may carry an ANCESTOR's descriptor when the parent is itself a
             // continuable child.
-            const descriptor = foldSubagentDescriptor(source.events.slice(source.header.seedLength ?? 0));
+            const descriptor = foldSubagentDescriptor(source.events.slice(source.inheritedEventCount));
             if (descriptor === undefined || descriptor.mode !== 'continuable') {
-                throw new SubagentError(`subagent "${childId}" has no supported continuation state and cannot be resumed; `
-                    + 'do not retry send_message with this id', 'NOT_RESUMABLE');
+                throw new SubagentError(`subagent "${childId}" has no supported continuation state and cannot be resumed; choose a different target`, 'NOT_RESUMABLE');
             }
             let activation;
             try {
@@ -721,7 +750,7 @@ export class SubagentContinuationManager {
                     throw error;
                 throw new SubagentError(`subagent "${childId}" is unavailable`, 'NOT_RESUMABLE', { cause: error });
             }
-            return await this.submitMaterialized(activation, content, options.source, parent, options.signal);
+            return await this.submitMaterialized(activation, content, options, parent);
         }
         catch (e_1) {
             env_1.error = e_1;
@@ -735,14 +764,22 @@ export class SubagentContinuationManager {
      * Submit to a freshly materialized Activation or roll it back completely.
      * @param activation - the just-published Activation to admit or release.
      * @param content - the initial or resumed message content.
-     * @param source - durable fields naming who supplied the accepted message.
+     * @param options - durable source, scheduling, and pre-acceptance cancellation.
      * @param parent - the live direct parent authorizing admission.
-     * @param signal - caller cancellation owning admission until acceptance.
      * @returns the accepted inbox message id.
      */
-    async submitMaterialized(activation, content, source, parent, signal) {
+    async submitMaterialized(activation, content, options, parent) {
         try {
-            return this.submitAdmitted(activation, content, source, parent, signal);
+            if (contentHasImage(content)) {
+                // The capability read awaits with the activation already published, so
+                // the disposal cutoff is re-checked before the submit; a drain that
+                // began during the read turns into a clean closing rejection.
+                await this.assertImageCapable(activation.handle.agent, options.signal);
+                if (activation.disposal !== undefined) {
+                    throw new SubagentError(`subagent "${activation.childId}" is closing`, 'ACTIVATION_CLOSING');
+                }
+            }
+            return this.submitAdmitted(activation, content, options, parent);
         }
         catch (error) {
             /* v8 ignore next -- rollback disposal failures must not mask the
@@ -751,6 +788,32 @@ export class SubagentContinuationManager {
             throw error;
         }
     }
+    /**
+     * Refuse image content addressed to a child whose model accepts text only.
+     * Callers guard with `contentHasImage`, so text-only delivery never awaits.
+     * The check runs inside the per-child delivery lock, before the message
+     * exists, so a rejection leaves no partial user message. When the child's
+     * route is not fixed by its options (a request-waterfall listener owns it)
+     * or no LLM registry is composed, delivery proceeds and the LLM layer's
+     * text-only projection replaces each image with its stable placeholder.
+     * @param agent - the live or freshly materialized child agent.
+     * @param signal - caller cancellation bounding the model-info read.
+     * @throws {SubagentError} `MODEL_DOES_NOT_SUPPORT_IMAGES` when the child's resolved model declines image input.
+     */
+    async assertImageCapable(agent, signal) {
+        const { provider, model } = agent.options;
+        if (provider === undefined || model === undefined)
+            return;
+        const llm = this.ctx.get('llm');
+        /* v8 ignore next -- a deployment without the LLM registry serves no model
+         * to refuse against; delivery then defers to the text-only projection. */
+        if (llm === undefined)
+            return;
+        const info = await llm.resolveModelInfo(provider, model, signal);
+        if (info.inputModalities !== undefined && !info.inputModalities.includes('image')) {
+            throw new SubagentError(`Model "${model}" does not support image input.`, 'MODEL_DOES_NOT_SUPPORT_IMAGES');
+        }
+    }
     /**
      * Create or resume the child Agent through the private activation-owner
      * scope, install the handle in a fresh Activation, and register ownership on
@@ -791,7 +854,6 @@ export class SubagentContinuationManager {
                 appendDelegatedPolicyOverrides(childCtx.agent.session, create.delegatedPolicies);
             }
             applyChildComposition(childCtx, parent, inputs.composition);
-            return this.setupRegistry.apply(childCtx);
         };
         const observer = this.host.observeActivation(provider, childId, parent);
         // Agent creation owns rollback before handle transfer. A rejection leaves
@@ -807,6 +869,7 @@ export class SubagentContinuationManager {
                 sessionId: childId,
                 meta: create.meta,
                 seed: create.seed,
+                inheritedEventCount: create.inheritedEventCount,
                 agentOptions: inputs.agentOptions,
                 signal: inputs.signal,
                 setup,
@@ -914,13 +977,18 @@ export class SubagentContinuationManager {
      * inbox id. Acceptance is the operation's success boundary; the manager owns
      * the Activation independently afterwards.
      */
-    submit(activation, content, source, parent) {
+    submit(activation, content, options, parent) {
         // Parent-originated delivery keeps the parent live through ownership, so
         // establish it before the message can enter the child's inbox.
         this.acquireOwnership(parent, activation.childId);
-        const message = createUserMessage({ content, source });
+        const message = options.delivery === 'steer'
+            ? agentMessage(parent, content)
+            : createUserMessage({ content, source: options.source });
         const accepted = this.admitWaking(activation, message.id, () => {
-            activation.handle.agent.followup(message);
+            if (options.delivery === 'steer')
+                activation.handle.agent.steer(message);
+            else
+                activation.handle.agent.followup(message);
         });
         // Past this point the caller has an id for this child, so its eventual
         // settlement is something the parent is owed an account of.
@@ -955,8 +1023,8 @@ export class SubagentContinuationManager {
      * manager drain, or Activation disposal that wins before this synchronous
      * span rejects without inbox acceptance.
      */
-    submitAdmitted(activation, content, source, parent, signal) {
-        signal.throwIfAborted();
+    submitAdmitted(activation, content, options, parent) {
+        options.signal.throwIfAborted();
         this.assertAdmitting(parent);
         /* v8 ignore next 6 -- only a synchronous re-entrant disposer can change
          * this field between the caller's live check and this no-await boundary. */
@@ -964,7 +1032,7 @@ export class SubagentContinuationManager {
             throw new SubagentError(`subagent "${activation.childId}" activation is being disposed; the message was not accepted`, 'ACTIVATION_CLOSING');
         }
         this.authorizeLineage(parent, activation.childId, activation.handle.agent.session.header.parentSession);
-        return this.submit(activation, content, source, parent);
+        return this.submit(activation, content, options, parent);
     }
     /**
      * Authorize one operation against the durable direct-parent lineage. Other