@deepseek-ai/dsh-subagent 0.1.2-alpha.5 → 0.1.3-alpha.2

package/lib/index.js

@@ -1,13 +1,13 @@
-import { AttachmentError, admitPromptContent } from "@deepseek-ai/dsh-attachment";
 import { scopeTarget } from "@deepseek-ai/dsh-scope";
 import { assertObjectJsonSchema } from "@deepseek-ai/dsh-tools";
 import { canonicalClientTimeZone } from "@deepseek-ai/dsh-util-time";
 import { Remote, RemoteError, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
+import { AttachmentError } from "@deepseek-ai/dsh-attachment";
 import { z } from "zod";
-import { HarnessError, ReasoningEffortId, boundContextSummary, contentHasImage, createUserMessage, errorChain } from "@deepseek-ai/dsh-llm";
+import { HarnessError, ReasoningEffortId, boundContextSummary, contentHasImage, createUserMessage, errorChain, joinAssistantStreamText } from "@deepseek-ai/dsh-llm";
 import { randomUUID } from "node:crypto";
 import { foldConsumedWork } from "@deepseek-ai/dsh-agent";
-import { Session, SessionLogOffset, SessionSeq } from "@deepseek-ai/dsh-session";
+import { SessionLogOffset, SessionSeq } from "@deepseek-ai/dsh-session";
 import { brandString } from "@deepseek-ai/dsh-brand";
 import { snapshotJsonValue } from "@deepseek-ai/dsh-util-values";
 import { accessSync, constants, statSync } from "node:fs";
@@ -40,7 +40,8 @@ const CONTROL_ID_SCHEMAS = {
 	"subagent.prompt": z.object({
 		parentSessionId: SESSION_ID_SCHEMA,
 		childSessionId: SESSION_ID_SCHEMA,
-		mode: z.literal("continuable")
+		mode: z.literal("continuable"),
+		delivery: z.enum(["queue", "steer"])
 	}),
 	"subagent.interrupt": z.object({
 		parentSessionId: SESSION_ID_SCHEMA,
@@ -175,15 +176,16 @@ var AssistantOutputFold = class {
 	partial = [];
 	/**
 	* Fold one session event: a non-empty assistant message becomes the
-	* candidate final answer, and a `text-delta` chunk extends the streamed
-	* fallback; every other event contributes nothing.
+	* candidate final answer, while its embedded stream and any log-only attempt
+	* extend the streamed fallback; every other event contributes nothing.
 	* @param event - the next observed session event.
 	*/
 	push(event) {
 		if (event.type === "assistant/message") {
 			const content = event.data.message.content;
 			if (content.length > 0) this.message = content;
-		} else if (event.type === "assistant/chunk" && event.data.chunk.type === "text-delta") this.pushText(event.data.chunk.text);
+		}
+		if (event.type === "assistant/message" || event.type === "assistant/attempt") this.pushText(joinAssistantStreamText(event.data.stream));
 	}
 	/**
 	* Extend the streamed fallback with text observed outside session events.
@@ -395,166 +397,6 @@ function renderThrown(value) {
 	}
 }
 //#endregion
-//#region lib/types/descriptor.js
-/**
-* The durable subagent-child descriptor: the versioned, model-hidden
-* `subagent/descriptor` session event that identifies every session-backed
-* subagent and records whether it is one-shot or continuable. Continuable
-* descriptors additionally preserve the declared composition required for
-* cold resume. Providers append it turn-enclosed in the child's initial turn.
-*
-* The descriptor deliberately snapshots explicit fields rather than the
-* merge-extensible `AgentOptions` object: an unrelated extension value cannot
-* make continuation fail merely because it is not JSON, and later composition
-* inputs require a deliberate {@link SUBAGENT_DESCRIPTOR_VERSION} change. It
-* omits `subagentDepth` — cold resume trusts the persisted header's
-* `delegationDepth` as the monotone floor — and `outputSchema`, which belongs
-* to one activation's result contract rather than durable child composition.
-* Per-activation knobs such as `maxTokens` are omitted for the same reason as
-* `outputSchema`: they budget one activation. Cold resume requires the exact
-* live parent for authorization but reconstructs child options only from the
-* durable descriptor, so it neither restores the prior budget nor inherits
-* the parent's current one; the resumed route's defaults apply instead.
-*
-* @module @deepseek-ai/dsh-subagent/descriptor
-*/
-/**
-* The current descriptor format version, stamped into every appended
-* `subagent/descriptor` event and required verbatim by {@link foldSubagentDescriptor}.
-* Supporting another composition input is a deliberate version change, never
-* an implicit extra field.
-*/
-const SUBAGENT_DESCRIPTOR_VERSION = 3;
-const DESCRIPTOR_BASE_KEYS = [
-	"version",
-	"mode",
-	"provider",
-	"label"
-];
-const ONE_SHOT_DESCRIPTOR_KEYS = new Set(DESCRIPTOR_BASE_KEYS);
-const CONTINUABLE_DESCRIPTOR_KEYS = new Set([
-	...DESCRIPTOR_BASE_KEYS,
-	"agentProvider",
-	"agentModel",
-	"agentReasoningEffort",
-	"persona",
-	"toolFilter"
-]);
-const TOOL_FILTER_KEYS = new Set(["allow", "deny"]);
-/** Whether a persisted JSON value is an object record. */
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/** Reject fields outside one versioned record's declared schema. */
-function assertKnownKeys(value, keys, path) {
-	const unknown = Object.keys(value).find((key) => !keys.has(key));
-	if (unknown !== void 0) throw new Error(`persisted subagent descriptor ${path} has unknown field "${unknown}"`);
-}
-/** Read one optional string field from a persisted descriptor record. */
-function optionalString(value, key) {
-	if (!Object.hasOwn(value, key)) return void 0;
-	const field = value[key];
-	if (typeof field !== "string") throw new Error(`persisted subagent descriptor ${key} must be a string`);
-	return field;
-}
-/** Read one optional string-array field from a persisted tool restriction. */
-function optionalStringArray(value, key) {
-	if (!Object.hasOwn(value, key)) return void 0;
-	const field = value[key];
-	if (!Array.isArray(field)) throw new Error(`persisted subagent descriptor toolFilter.${key} must be an array of strings`);
-	const items = field;
-	if (items.some((item) => typeof item !== "string")) throw new Error(`persisted subagent descriptor toolFilter.${key} must be an array of strings`);
-	return items;
-}
-/** Validate and reconstruct a persisted tool restriction. */
-function parseToolFilter(value) {
-	if (!isRecord(value)) throw new Error("persisted subagent descriptor toolFilter must be an object");
-	assertKnownKeys(value, TOOL_FILTER_KEYS, "toolFilter");
-	const allow = optionalStringArray(value, "allow");
-	const deny = optionalStringArray(value, "deny");
-	if (allow === void 0 && deny === void 0) throw new Error("persisted subagent descriptor toolFilter must declare allow and/or deny");
-	return {
-		...allow !== void 0 ? { allow } : {},
-		...deny !== void 0 ? { deny } : {}
-	};
-}
-/** Validate one persisted descriptor payload for the current runtime. */
-function parseSubagentDescriptor(value) {
-	if (!isRecord(value)) throw new Error("persisted subagent descriptor payload must be an object");
-	const version = value["version"];
-	if (typeof version !== "number") throw new Error("persisted subagent descriptor version must be a number");
-	if (version !== 3) return void 0;
-	const mode = value["mode"];
-	if (mode !== "one-shot" && mode !== "continuable") throw new Error("persisted subagent descriptor mode must be \"one-shot\" or \"continuable\"");
-	assertKnownKeys(value, mode === "one-shot" ? ONE_SHOT_DESCRIPTOR_KEYS : CONTINUABLE_DESCRIPTOR_KEYS, "payload");
-	const provider = value["provider"];
-	if (typeof provider !== "string") throw new Error("persisted subagent descriptor provider must be a string");
-	if (mode === "one-shot") {
-		const label = optionalString(value, "label");
-		return {
-			version: 3,
-			mode,
-			provider,
-			...label !== void 0 ? { label } : {}
-		};
-	}
-	const label = value["label"];
-	if (typeof label !== "string") throw new Error("persisted subagent descriptor label must be a string");
-	const agentProvider = optionalString(value, "agentProvider");
-	const agentModel = optionalString(value, "agentModel");
-	const agentReasoningEffort = optionalString(value, "agentReasoningEffort");
-	const persona = optionalString(value, "persona");
-	const toolFilter = Object.hasOwn(value, "toolFilter") ? parseToolFilter(value["toolFilter"]) : void 0;
-	return {
-		version: 3,
-		mode,
-		provider,
-		label,
-		...agentProvider !== void 0 ? { agentProvider } : {},
-		...agentModel !== void 0 ? { agentModel } : {},
-		...agentReasoningEffort !== void 0 ? { agentReasoningEffort } : {},
-		...persona !== void 0 ? { persona } : {},
-		...toolFilter !== void 0 ? { toolFilter } : {}
-	};
-}
-function snapshotSubagentDescriptor(input) {
-	const snapshot = snapshotJsonValue(input.mode === "one-shot" ? {
-		version: 3,
-		mode: input.mode,
-		provider: input.provider,
-		...input.label !== void 0 ? { label: input.label } : {}
-	} : {
-		version: 3,
-		mode: input.mode,
-		provider: input.provider,
-		label: input.label,
-		...input.agentProvider !== void 0 ? { agentProvider: input.agentProvider } : {},
-		...input.agentModel !== void 0 ? { agentModel: input.agentModel } : {},
-		...input.agentReasoningEffort !== void 0 ? { agentReasoningEffort: input.agentReasoningEffort } : {},
-		...input.persona !== void 0 ? { persona: input.persona } : {},
-		...input.toolFilter !== void 0 ? { toolFilter: input.toolFilter } : {}
-	});
-	if (snapshot === void 0) throw new Error("subagent descriptor is not losslessly JSON-serializable");
-	return snapshot;
-}
-/**
-* Fold a persisted child log to its supported descriptor. The first
-* `subagent/descriptor` event is authoritative — the establishing provider
-* appends exactly one, so a later same-type event cannot rewrite the declared
-* composition.
-* @param events - the loaded child session events.
-* @returns the descriptor, or `undefined` when the log has none or its
-*   version is not {@link SUBAGENT_DESCRIPTOR_VERSION} (the child cannot be
-*   classified by this runtime).
-* @throws when a current-version persisted payload does not match its complete
-*   declared schema.
-*/
-function foldSubagentDescriptor(events) {
-	const event = events.find((candidate) => candidate.type === "subagent/descriptor");
-	if (event === void 0) return void 0;
-	return parseSubagentDescriptor(event.data);
-}
-//#endregion
 //#region lib/types/child-agent.js
 /**
 * Shared in-process child composition: the delegation-depth budget, the
@@ -704,8 +546,8 @@ function applyChildComposition(childCtx, parent, composition) {
 		text: SUBAGENT_DELEGATION_CONTEXT
 	});
 	if (composition.persona !== void 0) childCtx.systemPrompt.section({
-		name: "deployment:persona",
-		order: childCtx.systemPrompt.getSectionOrder("DEPLOYMENT_PERSONA"),
+		name: "deployment:persona-prefix",
+		order: childCtx.systemPrompt.getSectionOrder("DEPLOYMENT_PERSONA_PREFIX"),
 		text: composition.persona
 	});
 	if (composition.toolFilter !== void 0) childCtx.tools.restrict(composition.toolFilter);
@@ -746,144 +588,12 @@ function appendDelegatedPolicyOverrides(childSession, overrides) {
 	});
 }
 //#endregion
-//#region lib/types/descriptor-seed.js
-/**
-* Seeding of a continuable child's durable descriptor event: the model-hidden
-* record of the child's declared composition before its first request, so a
-* later cold resume can reconstruct it from its own log.
-*
-* @module @deepseek-ai/dsh-subagent/descriptor-seed
-*/
-/**
-* Build the child's creation seed: any inherited parent-history prefix followed
-* by one model-hidden, between-turn `descriptor` event. Staging through a
-* `Session` assigns the sequence number and enforces the same lossless-JSON
-* rules the durable log does.
-* @param childId - the reserved child session id the staged log belongs to.
-* @param seed - the inherited completed-turn prefix, or `undefined` for a fresh child.
-* @param descriptor - the snapshotted composition record to persist.
-* @returns the complete seed events, contiguous from sequence zero.
-*/
-function seedDescriptorTurn(childId, seed, descriptor) {
-	const staged = Session.create(childId, seed);
-	staged.append("subagent/descriptor", descriptor);
-	return staged.snapshotEvents();
-}
-//#endregion
-//#region lib/types/internal.js
-/**
-* Continuation integration markers and host adapters outside the public
-* Service Definition and model-facing Agent messaging contract.
-* @module @deepseek-ai/dsh-subagent/internal
-*/
-/** Process-stable identity carried only by the standard adjacent-Agent messaging tool. */
-const adjacentAgentSendMessageTool = Symbol.for("dsh.subagent.adjacentAgentSendMessageTool");
-/**
-* Test whether one visible definition is the standard adjacent-Agent messaging tool.
-* @param definition - the scope-resolved `send_message` candidate.
-* @returns whether the definition carries the internal standard-tool identity.
-*/
-function isAdjacentAgentSendMessageTool(definition) {
-	return definition !== void 0 && definition[adjacentAgentSendMessageTool] === true;
-}
-/**
-* Process-stable symbol-keyed Queue delivery shared by the bundled runtime
-* entry and this unbundled internal subpath.
-* @internal
-*/
-const queueSubagentPrompt = Symbol.for("dsh.subagent.queuePrompt");
-//#endregion
-//#region lib/types/continuation.js
+//#region lib/types/continuation-messages.js
 /**
-* Internal continuable-subagent manager: stable child ids, descriptor
-* persistence, activation admission, the live ownership graph, cold resume,
-* child-first disposal, and settlement delivery to the parent, behind
-* `ctx.subagents`.
+* Model-visible messages owned by continuable-subagent orchestration.
 *
-* A continuable child has one durable Session and at most one process-local
-* {@link Activation} — one residency epoch for a reconstructed child Agent. An
-* Activation is not a request, result, cancellation, or Task boundary: it may
-* execute many FIFO turns and stays resident while descendants it created are
-* still running. The Agent inbox is the only turn queue, so this manager owns
-* residency while the Agent loop owns all turn ordering and execution. No
-* continuable path creates a Task or an intermediate result-bearing wrapper.
-*
-* Because residency is this manager's alone to end, telling the parent that a
-* child settled is its job too. An external `subagent/end` listener cannot do
-* it correctly: that payload names no parent, the child handle is already
-* disposed by then, and the release that wakes the parent's own settlement
-* watcher has already run. See {@link SubagentContinuationManager.notifySettlement}.
-*
-* @module @deepseek-ai/dsh-subagent
+* @module @deepseek-ai/dsh-subagent/continuation-messages
 */
-var __addDisposableResource$1 = function(env, value, async) {
-	if (value !== null && value !== void 0) {
-		if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
-		var dispose, inner;
-		if (async) {
-			if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
-			dispose = value[Symbol.asyncDispose];
-		}
-		if (dispose === void 0) {
-			if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
-			dispose = value[Symbol.dispose];
-			if (async) inner = dispose;
-		}
-		if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
-		if (inner) dispose = function() {
-			try {
-				inner.call(this);
-			} catch (e) {
-				return Promise.reject(e);
-			}
-		};
-		env.stack.push({
-			value,
-			dispose,
-			async
-		});
-	} else if (async) env.stack.push({ async: true });
-	return value;
-};
-var __disposeResources$1 = (function(SuppressedError) {
-	return function(env) {
-		function fail(e) {
-			env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
-			env.hasError = true;
-		}
-		var r, s = 0;
-		function next() {
-			while (r = env.stack.pop()) try {
-				if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
-				if (r.dispose) {
-					var result = r.dispose.call(r.value);
-					if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) {
-						fail(e);
-						return next();
-					});
-				} else s |= 1;
-			} catch (e) {
-				fail(e);
-			}
-			if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
-			if (env.hasError) throw env.error;
-		}
-		return next();
-	};
-})(typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed, message) {
-	var e = new Error(message);
-	return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
-});
-/**
-* Read one Activation's current disposal transaction. This indirection exists
-* because TypeScript would otherwise narrow repeated reads of the mutable field
-* inside a long-lived closure to constants instead of re-reading runtime state.
-* @param activation - the Activation to inspect.
-* @returns the in-flight or settled disposal, or `undefined` while resident.
-*/
-function disposalOf(activation) {
-	return activation.disposal;
-}
 /** Build durable attribution for one adjacent-Agent message. */
 function agentMessageSource(sender) {
 	return {
@@ -892,19 +602,29 @@ function agentMessageSource(sender) {
 		senderSessionId: sender.id
 	};
 }
-/** Build the model-visible and durable representation of one adjacent-Agent message. */
-function agentMessage(sender, content) {
+/**
+* Build the model-visible and durable representation of one adjacent-Agent message.
+* @param sender - exact live Agent that authored the message.
+* @param content - model-visible message blocks supplied by the sender.
+* @returns the durable user-message representation delivered to the recipient.
+*/
+function createAgentMessage(sender, content) {
 	return createUserMessage({
 		content: [{
 			type: "text",
-			text: `Agent ${sender.id} sent a message:`
+			text: `Agent ${sender.id} sent a message: `
 		}, ...content],
 		source: agentMessageSource(sender)
 	});
 }
-/** Append adjacent-Agent return guidance to a continuable child's initial task. */
-function continuableInitialPrompt(parentId, prompt) {
-	const encodedParentId = JSON.stringify(parentId);
+/**
+* Append adjacent-Agent return guidance to a continuable child's initial task.
+* @param parentId - durable parent session id named in the guidance.
+* @param prompt - initial model-visible task blocks.
+* @returns task blocks followed by the continuable return guidance.
+*/
+function withContinuableReturnGuidance(parentId, prompt) {
+	const encodedParentId = JSON.stringify(parentId);
 	return [...prompt, {
 		type: "text",
 		text: `Your parent agent id is ${encodedParentId}. Before you finish, send your result to that agent with send_message({ agent_id: ${encodedParentId}, message: "<self-contained result>" }). The parent shares your workspace but does not automatically receive your transcript, tool output, or reasoning. Send earlier messages as well when a finding changes what the parent should do next; sending a message does not end your turn.`
@@ -931,6 +651,101 @@ function settlementSummary(childId, stopReason) {
 		default: return `${subject} ended abnormally (${String(stopReason)}) before it finished.`;
 	}
 }
+/**
+* Build the runtime-owned settlement notice delivered to a child's parent.
+* @param childId - durable child session id named in the notice.
+* @param terminal - recorded terminal state for the settled Activation.
+* @returns the durable user-message representation delivered to the parent.
+*/
+function createSettlementMessage(childId, terminal) {
+	const summary = settlementSummary(childId, terminal.stopReason);
+	return createUserMessage({
+		content: [{
+			type: "text",
+			text: summary
+		}, ...terminal.output === void 0 ? [{
+			type: "text",
+			text: "It left no closing message."
+		}] : [{
+			type: "text",
+			text: "Its closing message:"
+		}, ...terminal.output]],
+		source: {
+			kind: "subagent-settled",
+			form: "notice",
+			summary: boundContextSummary(summary),
+			senderSessionId: childId
+		}
+	});
+}
+//#endregion
+//#region lib/types/inbox.js
+/**
+* Activation-local admission around one continuable subagent's Agent inbox.
+*
+* @module @deepseek-ai/dsh-subagent/inbox
+*/
+/** Delegate Queue and Steer to one live Agent until its Activation starts closing. */
+var SubagentInbox = class {
+	agent;
+	closingPromise;
+	/**
+	* Wrap one live continuable Agent.
+	* @param agent - the Agent whose inbox receives accepted deliveries.
+	*/
+	constructor(agent) {
+		this.agent = agent;
+	}
+	/**
+	* Read the Activation's close transaction.
+	* @returns the memoized transaction, or `undefined` while delivery remains open.
+	*/
+	get closing() {
+		return this.closingPromise;
+	}
+	/**
+	* Read whether the underlying Agent still has accepted work to claim.
+	* @returns whether either Agent inbox destination is non-empty.
+	*/
+	get hasPending() {
+		return this.agent.inbox.hasPending;
+	}
+	/**
+	* Submit through the Agent only while its Activation remains resident.
+	* @param message - the accepted input to submit.
+	* @param delivery - whether to queue a distinct turn or steer the nearest step.
+	*/
+	deliver(message, delivery) {
+		if (this.closingPromise !== void 0) throw new SubagentError(`subagent "${this.agent.id}" activation is being disposed; the message was not accepted`, "ACTIVATION_CLOSING");
+		if (delivery === "steer") this.agent.steer(message);
+		else this.agent.followup(message);
+	}
+	/**
+	* Close delivery synchronously and share one asynchronous release.
+	* @param release - the one release operation to start after closing admission.
+	* @returns the memoized release transaction.
+	*/
+	close(release) {
+		const existing = this.closingPromise;
+		if (existing !== void 0) return existing;
+		const completion = Promise.withResolvers();
+		this.closingPromise = completion.promise;
+		release().then(completion.resolve, completion.reject);
+		return completion.promise;
+	}
+};
+//#endregion
+//#region lib/types/continuation-activation.js
+/**
+* Process-local Activation ownership for continuable subagents: admission,
+* parent-child residency, serialized delivery, settlement, and disposal.
+*
+* The continuation manager owns durable request orchestration and delegates
+* every mutable residency decision to this registry, so delivery and teardown
+* share one child lock and one Activation map.
+*
+* @module @deepseek-ai/dsh-subagent/continuation-activation
+*/
 /** Serialize each durable child's delivery, release, and disposal. */
 var ChildLock = class {
 	tails = /* @__PURE__ */ new Map();
@@ -950,19 +765,15 @@ var ChildLock = class {
 		return result;
 	}
 };
-/**
-* The continuable-subagent orchestration service behind `ctx.subagents`. Tool
-* schema and host adapters are consumers of this one contract; foreground
-* one-shot delegation keeps calling `ctx.subagents.start()` and never enters
-* this lifecycle.
-*/
-var SubagentContinuationManager = class {
+/** Own the complete process-local lifetime of continuable child Activations. */
+var ContinuableActivationRegistry = class {
 	ctx;
-	host;
+	observeActivation;
 	/** Child session id → its live Activation. Process-local, never durable. */
-	activations = /* @__PURE__ */ new Map();
+	resident = /* @__PURE__ */ new Map();
 	/** Materializations admitted before drain, tracked through publication or rollback. */
 	materializations = /* @__PURE__ */ new Set();
+	/** Per-child serializer shared by delivery, release, and disposal. */
 	locks = new ChildLock();
 	/** Structural Cordis owner of every Activation handle. */
 	ownerCtx;
@@ -974,9 +785,14 @@ var SubagentContinuationManager = class {
 	*/
 	closingScopes = /* @__PURE__ */ new Map();
 	draining = false;
-	constructor(ctx, host) {
+	/**
+	* Build one registry inside the service's Agent-injected context.
+	* @param ctx - context providing Agents, Sessions, and teardown ownership.
+	* @param observeActivation - build the lifecycle observer for one residency epoch.
+	*/
+	constructor(ctx, observeActivation) {
 		this.ctx = ctx;
-		this.host = host;
+		this.observeActivation = observeActivation;
 		const scope = ctx.plugin(function activationOwner() {});
 		this.ownerCtx = scope.ctx;
 		ctx.on("agent/disposed", ({ agent }) => {
@@ -988,187 +804,50 @@ var SubagentContinuationManager = class {
 		}.bind(this), "subagents.continuations()");
 	}
 	/**
-	* Start one continuable background child: reserve its durable identity,
-	* resolve the provider's detached creation spec, create the child Agent
-	* through the private activation-owner scope, establish any continuable-parent
-	* ownership, and submit the initial prompt. Resolves when inbox acceptance
-	* yields the message id — without waiting for the turn to start or for the
-	* message to reach the Session log.
-	*
-	* Every failure before that acceptance rejects without either id, disposing
-	* any created handle and rolling back the Activation and parent ownership.
-	* The caller signal owns lookup, materialization, and admission only until
-	* acceptance; afterwards the manager owns the Activation independently.
-	* @param spec - provider, delegation request, and caller cancellation.
-	* @returns the durable child id and the accepted initial prompt's message id.
+	* Return the live Activation for a durable child id, if resident.
+	* @param childId - durable child session id to look up.
+	* @returns the process-local Activation, or `undefined` when it is not resident.
 	*/
-	async startContinuable(spec) {
-		const request = spec.request;
-		const parent = request.parent;
-		this.assertAdmitting(parent);
-		const persistence = this.requirePersistence();
-		assertSubagentMaxDepth(request.maxDepth);
-		const childId = spec.childId ?? brandString(randomUUID());
-		this.assertChildIdAvailable(childId);
-		const childDepth = resolveChildDepth(parent, request.maxDepth);
-		const agentOptions = resolveChildAgentOptions(parent, request.agentOptions, childDepth);
-		const agentProvider = agentOptions.provider;
-		const agentModel = agentOptions.model;
-		const agentReasoningEffort = agentOptions.reasoningEffort;
-		const descriptor = snapshotSubagentDescriptor({
-			mode: "continuable",
-			provider: spec.provider,
-			label: spec.label,
-			...agentProvider !== void 0 ? { agentProvider } : {},
-			...agentModel !== void 0 ? { agentModel } : {},
-			...agentReasoningEffort !== void 0 ? { agentReasoningEffort } : {},
-			...request.persona !== void 0 ? { persona: request.persona } : {},
-			...request.toolFilter !== void 0 ? { toolFilter: request.toolFilter } : {}
-		});
-		const delegatedPolicies = captureDelegatedPolicyOverrides(parent);
-		const prepared = await this.host.prepareContinuable(spec.provider, {
-			sessionId: childId,
-			parent,
-			signal: spec.signal
-		});
-		spec.signal.throwIfAborted();
-		this.assertAdmitting(parent);
-		const inheritedEventCount = SessionLogOffset(prepared.seed?.length ?? 0);
-		const seed = seedDescriptorTurn(childId, prepared.seed, descriptor);
-		return {
-			childId,
-			messageId: await this.locks.run(childId, async () => {
-				spec.signal.throwIfAborted();
-				this.assertAdmitting(parent);
-				this.assertChildIdAvailable(childId);
-				if (spec.childId !== void 0) {
-					const persisted = await persistence.listSnapshots(spec.signal);
-					spec.signal.throwIfAborted();
-					this.assertAdmitting(parent);
-					this.assertChildIdAvailable(childId);
-					if (persisted.some((snapshot) => snapshot.header.id === childId)) throw new SubagentError(`subagent "${childId}" already exists`, "DUPLICATE_CHILD");
-				}
-				const activation = await this.materialize({
-					childId,
-					provider: spec.provider,
-					parent,
-					create: {
-						seed,
-						meta: childSessionMeta(parent, childDepth, prepared.seed !== void 0),
-						inheritedEventCount,
-						delegatedPolicies
-					},
-					agentOptions,
-					composition: {
-						persona: request.persona,
-						toolFilter: request.toolFilter
-					},
-					signal: spec.signal
-				});
-				return this.submitMaterialized(activation, isAdjacentAgentSendMessageTool(this.ctx.get("tools")?.get("send_message", activation.handle.agent)) ? continuableInitialPrompt(parent.id, request.prompt) : request.prompt, {
-					source: { kind: "user" },
-					signal: spec.signal,
-					delivery: "queue"
-				}, parent);
-			})
-		};
-	}
-	/** Reject one child identity already owned by a live Agent or Session. */
-	assertChildIdAvailable(childId) {
-		if (this.ctx.agents.get(childId) !== void 0 || this.ctx.get("sessions")?.get(childId) !== void 0) throw new SubagentError(`subagent "${childId}" already exists`, "DUPLICATE_CHILD");
+	get(childId) {
+		return this.resident.get(childId);
 	}
 	/**
-	* Deliver one model-authored message to a direct continuable child or to the
-	* sender's direct parent. Both directions use Steer: a running target admits
-	* the message at its nearest step boundary, while an idle target starts a
-	* turn. A missing direct child cold-resumes through the ordinary continuation
-	* lifecycle. The caller signal owns the operation only until inbox acceptance.
-	* @param sender - exact live Agent authorizing and originating the message.
-	* @param targetId - durable direct-parent or direct-child session id.
-	* @param content - model-authored content to deliver.
-	* @param options - caller cancellation before acceptance.
-	* @returns the accepted message's inbox id.
-	* @throws when adjacency, availability, or admission rejects delivery.
+	* Reject one child identity already owned by a live Agent or Session.
+	* @param childId - proposed durable child session id.
 	*/
-	async sendMessage(sender, targetId, content, options) {
-		if (this.ctx.agents.get(sender.id) !== sender) throw new SubagentError("message delivery requires the exact live sender agent", "UNAUTHORIZED");
-		this.assertAdmitting(sender);
-		const senderActivation = this.activations.get(sender.id);
-		if (senderActivation !== void 0 && senderActivation.handle.agent === sender && senderActivation.parentSession === targetId) {
-			options.signal.throwIfAborted();
-			return this.sendToParent(senderActivation, sender, content);
-		}
-		if (sender.session.header.parentSession === targetId) throw new SubagentError(`agent "${sender.id}" is not a resident continuable child and cannot send to parent "${targetId}"`, "UNAUTHORIZED");
-		return this.deliverToChild(sender, targetId, content, {
-			signal: options.signal,
-			delivery: "steer"
-		});
+	assertChildIdAvailable(childId) {
+		if (this.ctx.agents.get(childId) !== void 0 || this.ctx.get("sessions")?.get(childId) !== void 0) throw new SubagentError(`subagent "${childId}" already exists`, "DUPLICATE_CHILD");
 	}
 	/**
-	* Queue one human-authored prompt as a distinct direct-child turn.
-	* @param parent - exact live direct parent authorizing delivery.
-	* @param childId - durable direct-child session id.
-	* @param content - human-authored content to deliver.
-	* @param source - durable host-protocol provenance.
-	* @param signal - caller cancellation before inbox acceptance.
-	* @returns the accepted message's inbox id.
+	* Pre-register `childId` in a continuation-managed parent's owned set so the
+	* parent cannot settle while a caller is still establishing or resuming that
+	* child. Returns a releaser for the failure path; it removes only a hold
+	* this call added, and leaves ownership in place once a live Activation for
+	* the child exists.
+	* @param parent - the live direct parent the operation is admitted under.
+	* @param childId - the durable child the operation addresses.
+	* @returns the failure-path releaser; a no-op when nothing was added.
 	*/
-	async queuePrompt(parent, childId, content, source, signal) {
-		return this.deliverToChild(parent, childId, content, {
-			source,
-			signal,
-			delivery: "queue"
-		});
-	}
-	/** Route one parent-originated delivery through residency and cold resume. */
-	async deliverToChild(parent, childId, content, options) {
-		this.assertAdmitting(parent);
-		while (true) {
-			const live = await this.locks.run(childId, async () => {
-				const activation = this.activations.get(childId);
-				if (activation === void 0) return this.coldResume(parent, childId, content, options);
-				const disposal = activation.disposal;
-				/* v8 ignore next 3 -- the send-versus-dispose cutoff: reaching this arm needs a
-				* delivery to observe the transaction inside the same critical section that opened it,
-				* which no test can schedule deterministically. The behavior is covered end-to-end by
-				* "cold-resumes a delivery that lost the race with final disposal". */
-				if (disposal !== void 0) return disposal.then(() => void 0, () => void 0);
-				if (contentHasImage(content)) {
-					await this.assertImageCapable(activation.handle.agent, options.signal);
-					if (activation.disposal !== void 0) {
-						await Promise.allSettled([activation.disposal]);
-						return;
-					}
-				}
-				return this.submitAdmitted(activation, content, options, parent);
-			});
-			/* v8 ignore start -- only the lost-cutoff arm above returns undefined, so only that
-			* race reaches the retry below, which then cold-resumes a new Activation. */
-			if (live !== void 0) return live;
-			this.assertAdmitting(parent);
-			options.signal.throwIfAborted();
-		}
+	holdOwnership(parent, childId) {
+		const parentActivation = this.resident.get(parent.id);
+		if (parentActivation === void 0 || parentActivation.handle.agent !== parent) return () => {};
+		if (parentActivation.inbox.closing !== void 0) throw new SubagentError(`subagent parent "${parent.id}" is being disposed; the child was not established`, "ACTIVATION_CLOSING");
+		if (parentActivation.ownedChildren.has(childId)) return () => {};
+		parentActivation.ownedChildren.add(childId);
+		return () => {
+			const live = this.resident.get(childId);
+			/* v8 ignore next 4 -- reaching this arm needs another delivery to establish the child
+			* between this operation's failure and its releaser running, which no test can schedule
+			* deterministically: the ownership edge then belongs to that live Activation, so the
+			* conservative keep leaves it for finishDisposal's releaseOwnership. */
+			if (live !== void 0 && live.inbox.closing === void 0) return;
+			if (parentActivation.ownedChildren.delete(childId)) this.wake(parentActivation);
+		};
 	}
 	/**
-	* Interrupt one live continuable child's current turn. Admission is
-	* synchronous and the effect is asynchronous: this authorizes the caller,
-	* requests `Agent.cancel(cause, { keepInbox: true })` on the target, and
-	* returns without waiting for the target to observe the signal or reach
-	* quiescence. The Activation, its handle, accepted unclaimed inbox work, and
-	* already-published descendants are untouched; work already claimed into the
-	* interrupted turn is not requeued. Once the interrupted driver is idle, a
-	* waking send resumes the parked queue.
-	*
-	* An absent target is an accepted no-op, which uniformly covers natural
-	* completion races, repeated requests, one-shot ids, and unknown ids without
-	* consulting the durable catalog. A target whose disposal transaction is
-	* already open is likewise an accepted no-op after authorization.
+	* Interrupt one live continuable child's current turn under the supplied authority.
 	* @param targetSessionId - the durable child session id to interrupt.
 	* @param authority - the human parent address or exact live ancestor Agent.
-	* @throws {SubagentError} `UNAUTHORIZED` when the presented authority does
-	*   not own the live target: a stale or self-targeting ancestor caller, a
-	*   parent address that is not the live target's durable direct parent, or
-	*   an ancestor outside the target's recorded live lineage.
 	*/
 	interrupt(targetSessionId, authority) {
 		if (authority.kind === "ancestor") {
@@ -1176,81 +855,56 @@ var SubagentContinuationManager = class {
 			if (this.ctx.agents.get(caller.id) !== caller) throw new SubagentError(`interrupting "${targetSessionId}" requires the exact live ancestor agent`, "UNAUTHORIZED");
 			if (caller.id === targetSessionId) throw new SubagentError(`agent "${caller.id}" cannot interrupt itself`, "UNAUTHORIZED");
 		}
-		const activation = this.activations.get(targetSessionId);
+		const activation = this.resident.get(targetSessionId);
 		if (activation === void 0) return;
 		if (authority.kind === "user") {
 			if (activation.handle.agent.session.header.parentSession !== authority.parentSessionId) throw new SubagentError(`subagent "${targetSessionId}" belongs to another parent session`, "UNAUTHORIZED");
 		} else if (!activation.ancestry.has(authority.agent)) throw new SubagentError(`subagent "${targetSessionId}" is not a live descendant of agent "${authority.agent.id}"`, "UNAUTHORIZED");
-		if (activation.disposal !== void 0) return;
+		if (activation.inbox.closing !== void 0) return;
 		activation.handle.agent.cancel(authority.kind === "user" ? { kind: "user" } : { kind: "parent" }, { keepInbox: true });
 	}
-	/** Deliver one resident continuable child's message to its live direct parent. */
-	sendToParent(activation, sender, content) {
-		/* v8 ignore next 6 -- only synchronous re-entrant teardown can open this
-		* transaction between exact-agent authorization and this no-await span. */
-		if (activation.disposal !== void 0) throw new SubagentError(`subagent "${sender.id}" activation is being disposed; the message was not delivered`, "ACTIVATION_CLOSING");
-		const parent = this.ctx.agents.get(activation.parentSession);
-		if (parent === void 0) throw new SubagentError("direct parent is not live; the message was not delivered", "PARENT_UNAVAILABLE");
-		const message = agentMessage(sender, content);
-		this.sendWaking(parent, message, () => {
-			this.sendAgentMessage(parent, message);
-		});
-		return message.id;
-	}
 	/**
-	* Perform one waking send to a parent, accounted against that parent's own
-	* Activation when it has one. Registering the id before the send is what
-	* keeps a continuation-managed parent from being judged quiescent in the
-	* window between a waking send and the microtask that admits it.
-	* @param parent - the exact live parent receiving the waking message.
-	* @param message - the message whose id is accounted.
-	* @param send - the synchronous waking send to perform.
+	* Send through a receiving parent's Activation inbox when it has one.
+	* @param parent - exact live Agent receiving the message.
+	* @param message - durable user message to deliver.
+	* @param delivery - receiving inbox destination.
 	*/
-	sendWaking(parent, message, send) {
-		const parentActivation = this.activations.get(parent.id);
-		if (parentActivation !== void 0 && parentActivation.handle.agent === parent) this.admitWaking(parentActivation, message.id, send);
-		else send();
-	}
-	/** Send one Agent message while translating only the target's own rejection. */
-	sendAgentMessage(parent, message) {
-		try {
-			parent.steer(message);
-		} catch (error) {
-			throw new SubagentError("direct parent is not live; the message was not delivered", "PARENT_UNAVAILABLE", { cause: error });
+	sendWaking(parent, message, delivery) {
+		const parentActivation = this.resident.get(parent.id);
+		if (parentActivation !== void 0 && parentActivation.handle.agent === parent) {
+			try {
+				parentActivation.inbox.deliver(message, delivery);
+			} finally {
+				this.wake(parentActivation);
+			}
+			return;
 		}
+		if (delivery === "steer") parent.steer(message);
+		else parent.followup(message);
 	}
 	/**
 	* Close admission, await every already-admitted materialization through
-	* publication or rollback, then dispose the stable live Activation forest
-	* child-first. Sibling branches drain independently: one failure is recorded
-	* but never prevents the remaining handles from being attempted, and the
-	* aggregate rejects only after every branch settles.
-	* @returns once materialization is quiescent and every live Activation released its handle.
-	* @throws an aggregate error when any branch failed to release.
+	* publication or rollback, then dispose the stable live Activation graph
+	* child-first.
 	*/
 	async drain() {
 		this.draining = true;
 		await Promise.all([...this.materializations].map((materialization) => materialization.settled));
 		const owned = /* @__PURE__ */ new Set();
-		for (const activation of this.activations.values()) for (const child of activation.ownedChildren) owned.add(child);
-		const roots = [...this.activations.values()].filter((activation) => !owned.has(activation.childId));
+		for (const activation of this.resident.values()) for (const child of activation.ownedChildren) owned.add(child);
+		const roots = [...this.resident.values()].filter((activation) => !owned.has(activation.childId));
 		await this.disposeRoots(roots, "activation(s)");
 	}
 	/**
 	* Stop only the continuable descendants of exact live host-owned parents.
-	* Admission stays closed for those parent trees until each exact parent
-	* leaves the Agent registry; unrelated trees and manager-wide admission stay
-	* live.
 	* @param parents - exact live roots whose continuable descendants must stop.
-	* @returns once every retained descendant Activation released its handle.
-	* @throws an aggregate error after all scoped branches settle when any failed.
 	*/
 	async drainDescendants(parents) {
 		const roots = new Set(parents.filter((parent) => this.ctx.agents.get(parent.id) === parent));
 		if (roots.size === 0) return;
 		for (const root of roots) this.closingMembers(root).add(root);
 		const targets = [];
-		for (const activation of this.activations.values()) {
+		for (const activation of this.resident.values()) {
 			const lineage = this.liveLineage(activation.handle.agent);
 			const owners = [...roots].filter((root) => activation.handle.agent !== root && activation.ancestry.has(root));
 			if (owners.length === 0) continue;
@@ -1277,20 +931,15 @@ var SubagentContinuationManager = class {
 		await this.disposeRoots(targetRoots, "scoped activation(s)");
 	}
 	/**
-	* Release selected resident direct children of one exact live parent without
-	* closing admission for the parent's other continuable children. Owned
-	* descendants are released recursively through the same lifecycle.
+	* Release selected resident direct children of one exact live parent.
 	* @param parent - exact live direct parent authorizing the selected release.
 	* @param childIds - durable direct-child ids to release when resident.
-	* @returns once every selected Activation released its handle.
-	* @throws {SubagentError} `UNAUTHORIZED` when a resident target is not the
-	*   parent's direct continuable child or the parent identity is stale.
 	*/
 	async drainChildren(parent, childIds) {
 		if (this.ctx.agents.get(parent.id) !== parent) throw new SubagentError("selected child teardown requires the exact live parent agent", "UNAUTHORIZED");
 		const targets = [];
 		for (const childId of new Set(childIds)) {
-			const activation = this.activations.get(childId);
+			const activation = this.resident.get(childId);
 			if (activation === void 0) continue;
 			if (activation.parentSession !== parent.id || !activation.ancestry.has(parent)) throw new SubagentError(`subagent "${childId}" is not a direct child of agent "${parent.id}"`, "UNAUTHORIZED");
 			targets.push(activation);
@@ -1298,6 +947,75 @@ var SubagentContinuationManager = class {
 		for (const activation of targets) this.dispose(activation).catch(() => void 0);
 		await this.disposeRoots(targets, "selected activation(s)");
 	}
+	/**
+	* Reject new admission once the registry or this exact parent tree began draining.
+	* @param agent - exact live Agent whose lineage determines admission.
+	*/
+	assertAdmitting(agent) {
+		const closing = this.closingTeardownFor(agent);
+		if (closing === void 0) return;
+		throw new SubagentError(closing === "manager" ? "continuable subagents are draining; the operation was not admitted" : `continuable subagents below parent "${closing.id}" are draining; the operation was not admitted`, "DRAINING");
+	}
+	/**
+	* Authorize one operation against the durable direct-parent lineage.
+	* @param parent - exact live Agent claiming direct-parent authority.
+	* @param childId - durable child session id addressed by the operation.
+	* @param parentSession - durable direct-parent id recorded by the child.
+	*/
+	authorizeLineage(parent, childId, parentSession) {
+		if (this.ctx.agents.get(parent.id) !== parent) throw new SubagentError(`subagent "${childId}" delivery requires the exact live parent agent`, "UNAUTHORIZED");
+		if (parentSession !== parent.id) throw new SubagentError(`subagent "${childId}" belongs to another parent session`, "UNAUTHORIZED");
+	}
+	/**
+	* Create or resume one child Agent and publish its Activation.
+	* @param inputs - reconstruction and admission inputs for the residency epoch.
+	* @returns the published process-local Activation.
+	*/
+	materialize(inputs) {
+		this.assertAdmitting(inputs.parent);
+		const settled = Promise.withResolvers();
+		const lineage = this.liveLineage(inputs.parent);
+		const materialization = {
+			lineage,
+			settled: settled.promise
+		};
+		this.materializations.add(materialization);
+		return this.materializeTracked(inputs, lineage).finally(() => {
+			this.materializations.delete(materialization);
+			settled.resolve();
+		});
+	}
+	/**
+	* Cross the final admission cutoff and submit without yielding.
+	* @param activation - the exact resident child receiving the message.
+	* @param message - the already-built durable user message.
+	* @param delivery - the Agent inbox destination.
+	* @param parent - exact live direct parent authorizing admission.
+	* @param signal - caller cancellation before inbox acceptance.
+	* @returns the accepted durable message id.
+	*/
+	submitAdmitted(activation, message, delivery, parent, signal) {
+		signal.throwIfAborted();
+		this.assertAdmitting(parent);
+		this.authorizeLineage(parent, activation.childId, activation.handle.agent.session.header.parentSession);
+		this.acquireOwnership(parent, activation.childId);
+		try {
+			activation.inbox.deliver(message, delivery);
+		} finally {
+			this.wake(activation);
+		}
+		activation.announced = true;
+		return message.id;
+	}
+	/**
+	* Stop and release one Activation through its memoized close transaction.
+	* @param activation - exact residency epoch to close.
+	* @param finalStateFlushed - whether natural settlement already flushed final state.
+	* @returns the shared close transaction.
+	*/
+	dispose(activation, finalStateFlushed = false) {
+		return activation.inbox.close(() => this.finishDisposal(activation, finalStateFlushed));
+	}
 	/** Dispose independent roots and report every branch failure after all settle. */
 	async disposeRoots(roots, failureSubject) {
 		const reasons = (await Promise.all(roots.map(async (activation) => {
@@ -1318,11 +1036,7 @@ var SubagentContinuationManager = class {
 		this.closingScopes.set(root, members);
 		return members;
 	}
-	/**
-	* Return the exact currently resolvable ancestry from `agent` upward. The
-	* first element is always the supplied identity, even when it is already
-	* stale; each ancestor after it must be the registry's current exact entry.
-	*/
+	/** Return the exact currently resolvable ancestry from `agent` upward. */
 	liveLineage(agent) {
 		const lineage = [agent];
 		const seen = new Set([agent.id]);
@@ -1336,172 +1050,25 @@ var SubagentContinuationManager = class {
 		}
 		return lineage;
 	}
-	/**
-	* The teardown that closed continuable admission for this agent's lineage.
-	* `'manager'` is the whole manager draining; an Agent is the exact scoped root
-	* whose forest is closing.
-	* @param agent - the agent whose lineage is tested.
-	* @returns the closing teardown, or `undefined` while admission is open.
-	*/
+	/** Return the teardown that closed continuable admission for this agent's lineage. */
 	closingTeardownFor(agent) {
 		if (this.draining) return "manager";
 		const lineage = this.liveLineage(agent);
 		for (const [root, members] of this.closingScopes) if (members.has(agent) || lineage.includes(root)) return root;
 	}
-	/** Reject new admission once the manager or this exact parent tree began draining. */
-	assertAdmitting(agent) {
-		const closing = this.closingTeardownFor(agent);
-		if (closing === void 0) return;
-		throw new SubagentError(closing === "manager" ? "continuable subagents are draining; the operation was not admitted" : `continuable subagents below parent "${closing.id}" are draining; the operation was not admitted`, "DRAINING");
-	}
-	/**
-	* Derive residency from Agent quiescence and the owned-child set. `running`
-	* covers an active admission, an open turn, or accepted waking inbox work.
-	*
-	* `Agent.status` alone is insufficient: it stays `idle` between an accepted
-	* waking send and the microtask that admits it, so a synchronous inbox
-	* observer would see `settled` while a turn is already queued. `accepted`
-	* holds the ids this manager admitted but has not yet seen drained.
-	*/
-	stateOf(activation) {
-		if (activation.handle.agent.status === "running" || activation.accepted.size > 0) return "running";
-		if (activation.ownedChildren.size > 0) return "waiting";
-		return "settled";
-	}
-	/**
-	* Cold-resume a persisted child: retain and authorize its prepared Session, fold the
-	* generic descriptor, create the Activation through `ctx.agents.resume()`,
-	* and submit the waiting turn. This never dispatches through a subagent
-	* provider — the persisted Session already holds the initial prefix and the
-	* descriptor is the whole reconstruction input.
-	*/
-	async coldResume(parent, childId, content, options) {
-		const env_1 = {
-			stack: [],
-			error: void 0,
-			hasError: false
-		};
-		try {
-			const query = this.requireSessionQuery();
-			let observation;
-			try {
-				observation = await query.observeSession(childId, { signal: options.signal });
-			} catch (error) {
-				options.signal.throwIfAborted();
-				throw new SubagentError(`subagent "${childId}" is unavailable`, "NOT_RESUMABLE", { cause: error });
+	/** Perform one tracked materialization through publication or rollback. */
+	async materializeTracked(inputs, parentLineage) {
+		const { childId, provider, parent, create } = inputs;
+		inputs.signal.throwIfAborted();
+		const setup = (childCtx) => {
+			const child = childCtx.agent;
+			if (create !== void 0) {
+				child.session.append("subagent/descriptor", create.descriptor);
+				appendDelegatedPolicyOverrides(child.session, create.delegatedPolicies);
 			}
-			const source = __addDisposableResource$1(env_1, observation, false);
-			this.assertAdmitting(parent);
-			this.authorizeLineage(parent, childId, source.header.parentSession);
-			const descriptor = foldSubagentDescriptor(source.events.slice(source.inheritedEventCount));
-			if (descriptor === void 0 || descriptor.mode !== "continuable") throw new SubagentError(`subagent "${childId}" has no supported continuation state and cannot be resumed; choose a different target`, "NOT_RESUMABLE");
-			let activation;
-			try {
-				activation = await this.materialize({
-					childId,
-					provider: descriptor.provider,
-					parent,
-					agentOptions: {
-						...descriptor.agentProvider !== void 0 ? { provider: descriptor.agentProvider } : {},
-						...descriptor.agentModel !== void 0 ? { model: descriptor.agentModel } : {},
-						...descriptor.agentReasoningEffort !== void 0 ? { reasoningEffort: ReasoningEffortId(descriptor.agentReasoningEffort) } : {}
-					},
-					composition: {
-						persona: descriptor.persona,
-						toolFilter: descriptor.toolFilter
-					},
-					signal: options.signal
-				});
-			} catch (error) {
-				options.signal.throwIfAborted();
-				if (error instanceof SubagentError) throw error;
-				throw new SubagentError(`subagent "${childId}" is unavailable`, "NOT_RESUMABLE", { cause: error });
-			}
-			return await this.submitMaterialized(activation, content, options, parent);
-		} catch (e_1) {
-			env_1.error = e_1;
-			env_1.hasError = true;
-		} finally {
-			__disposeResources$1(env_1);
-		}
-	}
-	/**
-	* Submit to a freshly materialized Activation or roll it back completely.
-	* @param activation - the just-published Activation to admit or release.
-	* @param content - the initial or resumed message content.
-	* @param options - durable source, scheduling, and pre-acceptance cancellation.
-	* @param parent - the live direct parent authorizing admission.
-	* @returns the accepted inbox message id.
-	*/
-	async submitMaterialized(activation, content, options, parent) {
-		try {
-			if (contentHasImage(content)) {
-				await this.assertImageCapable(activation.handle.agent, options.signal);
-				if (activation.disposal !== void 0) throw new SubagentError(`subagent "${activation.childId}" is closing`, "ACTIVATION_CLOSING");
-			}
-			return this.submitAdmitted(activation, content, options, parent);
-		} catch (error) {
-			/* v8 ignore next -- rollback disposal failures must not mask the
-			* pre-acceptance signal, drain, or lifecycle failure. */
-			await this.dispose(activation).catch(() => void 0);
-			throw error;
-		}
-	}
-	/**
-	* Refuse image content addressed to a child whose model accepts text only.
-	* Callers guard with `contentHasImage`, so text-only delivery never awaits.
-	* The check runs inside the per-child delivery lock, before the message
-	* exists, so a rejection leaves no partial user message. When the child's
-	* route is not fixed by its options (a request-waterfall listener owns it)
-	* or no LLM registry is composed, delivery proceeds and the LLM layer's
-	* text-only projection replaces each image with its stable placeholder.
-	* @param agent - the live or freshly materialized child agent.
-	* @param signal - caller cancellation bounding the model-info read.
-	* @throws {SubagentError} `MODEL_DOES_NOT_SUPPORT_IMAGES` when the child's resolved model declines image input.
-	*/
-	async assertImageCapable(agent, signal) {
-		const { provider, model } = agent.options;
-		if (provider === void 0 || model === void 0) return;
-		const llm = this.ctx.get("llm");
-		/* v8 ignore next -- a deployment without the LLM registry serves no model
-		* to refuse against; delivery then defers to the text-only projection. */
-		if (llm === void 0) return;
-		const info = await llm.resolveModelInfo(provider, model, signal);
-		if (info.inputModalities !== void 0 && !info.inputModalities.includes("image")) throw new SubagentError(`Model "${model}" does not support image input.`, "MODEL_DOES_NOT_SUPPORT_IMAGES");
-	}
-	/**
-	* Create or resume the child Agent through the private activation-owner
-	* scope, install the handle in a fresh Activation, and register ownership on
-	* a continuation-managed parent. Rejection leaves no Activation, no handle,
-	* and no ownership membership.
-	*/
-	materialize(inputs) {
-		this.assertAdmitting(inputs.parent);
-		const settled = Promise.withResolvers();
-		const lineage = this.liveLineage(inputs.parent);
-		const materialization = {
-			lineage,
-			settled: settled.promise
-		};
-		this.materializations.add(materialization);
-		return this.materializeTracked(inputs, lineage).finally(() => {
-			this.materializations.delete(materialization);
-			settled.resolve();
-		});
-	}
-	/**
-	* Perform one tracked materialization. The caller keeps the drain barrier
-	* registered until this either returns a resident Activation or finishes
-	* rollback.
-	*/
-	async materializeTracked(inputs, parentLineage) {
-		const { childId, provider, parent, create } = inputs;
-		inputs.signal.throwIfAborted();
-		const setup = (childCtx) => {
-			if (create !== void 0) appendDelegatedPolicyOverrides(childCtx.agent.session, create.delegatedPolicies);
 			applyChildComposition(childCtx, parent, inputs.composition);
 		};
-		const observer = this.host.observeActivation(provider, childId, parent);
+		const observer = this.observeActivation(provider, childId, parent);
 		const handle = create === void 0 ? await this.ownerCtx.agents.resume({
 			resumeSessionId: childId,
 			agentOptions: inputs.agentOptions,
@@ -1510,7 +1077,7 @@ var SubagentContinuationManager = class {
 		}) : await this.ownerCtx.agents.create({
 			sessionId: childId,
 			meta: create.meta,
-			seed: create.seed,
+			...create.seed === void 0 ? {} : { seed: create.seed },
 			inheritedEventCount: create.inheritedEventCount,
 			agentOptions: inputs.agentOptions,
 			signal: inputs.signal,
@@ -1521,27 +1088,23 @@ var SubagentContinuationManager = class {
 			parentSession: parent.id,
 			provider,
 			handle,
+			inbox: new SubagentInbox(handle.agent),
 			ancestry: new WeakSet([handle.agent, ...parentLineage]),
 			ownedChildren: /* @__PURE__ */ new Set(),
 			observer,
-			disposal: void 0,
-			accepted: /* @__PURE__ */ new Set(),
 			announced: false,
 			poke: Promise.withResolvers()
 		};
-		this.activations.set(childId, activation);
+		this.resident.set(childId, activation);
 		try {
 			inputs.signal.throwIfAborted();
 			this.assertAdmitting(parent);
 			this.acquireOwnership(parent, childId);
-			handle.agent.ctx.on("agent/inbox/claimed", ({ message }) => {
-				/* v8 ignore next -- a claim of an id this manager never admitted needs
-				* another sender on the same child, which no current path allows. */
-				if (activation.accepted.delete(message.id)) this.wake(activation);
-			});
-			handle.agent.ctx.on("agent/inbox/discarded", ({ message }) => {
-				if (activation.accepted.delete(message.id)) this.wake(activation);
-			});
+			const wakeOnInboxRemoval = () => {
+				this.wake(activation);
+			};
+			handle.agent.ctx.on("agent/inbox/claimed", wakeOnInboxRemoval);
+			handle.agent.ctx.on("agent/inbox/discarded", wakeOnInboxRemoval);
 			observer.start(handle.agent);
 		} catch (error) {
 			/* v8 ignore next -- rollback failure must not mask the admission failure
@@ -1552,126 +1115,72 @@ var SubagentContinuationManager = class {
 		this.watchSettlement(activation);
 		return activation;
 	}
-	/**
-	* Release an Activation whose start edge was not published. The memoized
-	* transaction remains in the live map until handle disposal settles, so a
-	* concurrent drain or delivery observes the same closing boundary.
-	*/
+	/** Release an Activation whose start edge was not published. */
 	rollbackUnpublished(activation) {
-		return activation.disposal ??= (async () => {
+		return activation.inbox.close(async () => {
 			try {
 				await activation.handle.dispose();
 			} finally {
-				this.activations.delete(activation.childId);
+				this.resident.delete(activation.childId);
 				this.releaseOwnership(activation.childId);
 			}
-		})();
+		});
 	}
-	/**
-	* Register the child in a continuation-managed parent's owned set before the
-	* child can run, so that parent cannot settle while the child is live. A
-	* top-level or other non-continuation Agent has no Activation and stays
-	* outside the waiting graph.
-	*/
+	/** Register the child in a continuation-managed parent's owned set. */
 	acquireOwnership(parent, childId) {
-		const parentActivation = this.activations.get(parent.id);
+		const parentActivation = this.resident.get(parent.id);
 		if (parentActivation === void 0) return;
-		if (parentActivation.disposal !== void 0) throw new SubagentError(`subagent parent "${parent.id}" is being disposed; the child was not established`, "ACTIVATION_CLOSING");
+		if (parentActivation.inbox.closing !== void 0) throw new SubagentError(`subagent parent "${parent.id}" is being disposed; the child was not established`, "ACTIVATION_CLOSING");
 		parentActivation.ownedChildren.add(childId);
 	}
 	/** Remove one child from its live owner's set and let that owner re-check settlement. */
 	releaseOwnership(childId) {
-		for (const candidate of this.activations.values()) if (candidate.ownedChildren.delete(childId)) this.wake(candidate);
+		for (const candidate of this.resident.values()) if (candidate.ownedChildren.delete(childId)) this.wake(candidate);
 	}
-	/** Let a settlement watcher re-observe quiescence after ownership or inbox changes. */
+	/** Let a settlement watcher re-check residency after relevant state changes. */
 	wake(activation) {
 		activation.poke.resolve();
 		activation.poke = Promise.withResolvers();
 	}
-	/**
-	* Submit one message as the child's next FIFO turn and return its accepted
-	* inbox id. Acceptance is the operation's success boundary; the manager owns
-	* the Activation independently afterwards.
-	*/
-	submit(activation, content, options, parent) {
-		this.acquireOwnership(parent, activation.childId);
-		const message = options.delivery === "steer" ? agentMessage(parent, content) : createUserMessage({
-			content,
-			source: options.source
-		});
-		const accepted = this.admitWaking(activation, message.id, () => {
-			if (options.delivery === "steer") activation.handle.agent.steer(message);
-			else activation.handle.agent.followup(message);
-		});
-		activation.announced = true;
-		return accepted;
-	}
-	/**
-	* Account one waking send across a resident Activation's settlement window.
-	* @param activation - Activation receiving waking inbox work.
-	* @param messageId - stable identity of the message about to be sent.
-	* @param send - synchronous send that publishes one enqueue occurrence.
-	* @returns the accepted message id.
-	*/
-	admitWaking(activation, messageId, send) {
-		activation.accepted.add(messageId);
-		try {
-			send();
-		} catch (error) {
-			activation.accepted.delete(messageId);
-			throw error;
-		}
-		this.wake(activation);
-		return messageId;
-	}
-	/**
-	* Cross the final admission cutoff and submit without yielding. Signal abort,
-	* manager drain, or Activation disposal that wins before this synchronous
-	* span rejects without inbox acceptance.
-	*/
-	submitAdmitted(activation, content, options, parent) {
-		options.signal.throwIfAborted();
-		this.assertAdmitting(parent);
-		/* v8 ignore next 6 -- only a synchronous re-entrant disposer can change
-		* this field between the caller's live check and this no-await boundary. */
-		if (disposalOf(activation) !== void 0) throw new SubagentError(`subagent "${activation.childId}" activation is being disposed; the message was not accepted`, "ACTIVATION_CLOSING");
-		this.authorizeLineage(parent, activation.childId, activation.handle.agent.session.header.parentSession);
-		return this.submit(activation, content, options, parent);
-	}
-	/**
-	* Authorize one operation against the durable direct-parent lineage. Other
-	* agents, ancestors, teams, workflows, and hosts remain rejected until an
-	* explicit authority protocol has a production consumer.
-	*/
-	authorizeLineage(parent, childId, parentSession) {
-		if (this.ctx.agents.get(parent.id) !== parent) throw new SubagentError(`subagent "${childId}" delivery requires the exact live parent agent`, "UNAUTHORIZED");
-		if (parentSession !== parent.id) throw new SubagentError(`subagent "${childId}" belongs to another parent session`, "UNAUTHORIZED");
-	}
-	/**
-	* Follow one Activation to settlement: wait for Agent quiescence, then for
-	* every owned child to complete disposal, and dispose the handle once both
-	* hold. A `next-turn` delivered while `waiting` wakes the same Agent and
-	* returns it to `running`, so this re-observes rather than settling early.
-	*/
+	/** Follow one Activation to natural settlement. */
 	watchSettlement(activation) {
 		(async () => {
-			while (disposalOf(activation) === void 0) {
-				const poked = activation.poke.promise;
-				await Promise.race([activation.handle.agent.whenIdle(), poked]);
-				if (disposalOf(activation) !== void 0) return;
-				const settling = await this.locks.run(activation.childId, () => {
-					if (disposalOf(activation) !== void 0 || this.stateOf(activation) !== "settled") return Promise.resolve({ settling: false });
-					return Promise.resolve({
-						settling: true,
-						done: this.dispose(activation)
-					});
+			while (true) {
+				const idleObservation = activation.poke;
+				await activation.handle.agent.whenIdle();
+				if (activation.inbox.closing !== void 0) return;
+				const readiness = await this.locks.run(activation.childId, () => Promise.resolve(this.settlementState(activation, idleObservation)));
+				if (readiness === "closed") return;
+				if (readiness === "retry") continue;
+				if (readiness === "wait") {
+					await idleObservation.promise;
+					continue;
+				}
+				const finalSeq = activation.handle.agent.session.seq;
+				await this.flushFinalState(activation);
+				const attempt = await this.locks.run(activation.childId, () => {
+					const state = this.settlementState(activation, idleObservation);
+					if (state !== "ready") return Promise.resolve(state);
+					if (activation.handle.agent.session.seq !== finalSeq) return Promise.resolve("retry");
+					let done;
+					try {
+						activation.handle.agent.runMaintenance(() => {
+							done = this.dispose(activation, true);
+							return Promise.resolve();
+						});
+					} catch {
+						return Promise.resolve("retry");
+					}
+					return Promise.resolve({ done });
 				});
-				if (!settling.settling) {
-					if (activation.handle.agent.status !== "running") await poked;
+				if (attempt === "closed") return;
+				if (attempt === "retry") continue;
+				if (attempt === "wait") {
+					await idleObservation.promise;
 					continue;
 				}
 				try {
-					await settling.done;
+					await attempt.done;
 				} catch (error) {
 					this.ctx.logger.warn(`subagent "${activation.childId}" activation teardown failed: ${errorChain(error)}`);
 				}
@@ -1679,53 +1188,44 @@ var SubagentContinuationManager = class {
 			}
 		})();
 	}
-	/**
-	* Stop one Activation immediately, then release it child-first. The memoized
-	* transaction is installed before cancellation or recursive callbacks, so
-	* admission and reentrant teardown converge on the same owner.
-	*
-	* The final session flush is best effort and never prevents handle disposal
-	* or ownership release, because retaining a child would permanently pin its
-	* ancestors in `waiting`.
-	* @param activation - the residency epoch to stop and release.
-	* @returns the one disposal transaction owned by this Activation.
-	*/
-	dispose(activation) {
-		const existing = activation.disposal;
-		if (existing !== void 0) return existing;
-		const completion = Promise.withResolvers();
-		activation.disposal = completion.promise;
-		this.finishDisposal(activation).then(completion.resolve, completion.reject);
-		return completion.promise;
+	/** Classify one Inbox and owned-child observation without reading Agent execution state. */
+	settlementState(activation, observation) {
+		if (activation.inbox.closing !== void 0) return "closed";
+		if (activation.poke !== observation) return "retry";
+		if (activation.inbox.hasPending || activation.ownedChildren.size > 0) return "wait";
+		return "ready";
 	}
-	/**
-	* Propagate stop synchronously, then finish the child-first release.
-	* @param activation - the Activation whose disposal transaction is installed.
-	* @returns once the handle and ownership edge are released.
-	*/
-	async finishDisposal(activation) {
+	/** Propagate stop synchronously, then finish the child-first release. */
+	async finishDisposal(activation, finalStateFlushed) {
 		this.wake(activation);
 		const { childId } = activation;
-		activation.handle.agent.cancel({ kind: "parent" });
-		const idle = activation.handle.agent.whenIdle();
-		const childDisposals = [...activation.ownedChildren].map((child) => this.activations.get(child)).filter((child) => child !== void 0).map((child) => this.dispose(child));
 		const failures = [];
-		try {
-			const reasons = (await Promise.all(childDisposals.map(async (disposal) => {
-				try {
-					await disposal;
-					return;
-				} catch (error) {
-					return error;
-				}
-			}))).filter((reason) => reason !== void 0);
-			if (reasons.length > 0) failures.push(new SubagentError(`subagent "${childId}" child teardown failed: ${reasons.map((reason) => errorChain(reason)).join("; ")}`, "ACTIVATION_TEARDOWN_FAILED"));
-			await idle;
-			await this.flushFinalState(activation);
+		if (finalStateFlushed) try {
 			activation.observer.capture(activation.handle.agent);
 		} catch (error) {
 			failures.push(new SubagentError(`subagent "${childId}" activation teardown failed: ${errorChain(error)}`, "ACTIVATION_TEARDOWN_FAILED", { cause: error }));
 		}
+		else {
+			activation.handle.agent.cancel({ kind: "parent" });
+			const idle = activation.handle.agent.whenIdle();
+			const childDisposals = [...activation.ownedChildren].map((child) => this.resident.get(child)).filter((child) => child !== void 0).map((child) => this.dispose(child));
+			try {
+				const reasons = (await Promise.all(childDisposals.map(async (disposal) => {
+					try {
+						await disposal;
+						return;
+					} catch (error) {
+						return error;
+					}
+				}))).filter((reason) => reason !== void 0);
+				if (reasons.length > 0) failures.push(new SubagentError(`subagent "${childId}" child teardown failed: ${reasons.map((reason) => errorChain(reason)).join("; ")}`, "ACTIVATION_TEARDOWN_FAILED"));
+				await idle;
+				await this.flushFinalState(activation);
+				activation.observer.capture(activation.handle.agent);
+			} catch (error) {
+				failures.push(new SubagentError(`subagent "${childId}" activation teardown failed: ${errorChain(error)}`, "ACTIVATION_TEARDOWN_FAILED", { cause: error }));
+			}
+		}
 		try {
 			await activation.handle.dispose();
 		} catch (error) {
@@ -1734,72 +1234,29 @@ var SubagentContinuationManager = class {
 		let failure;
 		if (failures.length === 1) failure = failures[0];
 		else if (failures.length > 1) failure = new SubagentError(`subagent "${childId}" activation teardown failed at ${failures.length} boundaries: ` + failures.map((item) => errorChain(item)).join("; "), "ACTIVATION_TEARDOWN_FAILED", { cause: new AggregateError(failures) });
-		this.activations.delete(childId);
+		this.resident.delete(childId);
 		this.notifySettlement(activation, activation.observer.terminal(failure));
 		this.releaseOwnership(childId);
 		activation.observer.settle(failure);
 		if (failure !== void 0) throw failure;
 	}
-	/**
-	* Tell the durable direct parent that this child produced everything it is
-	* going to. Unconditional for every child the caller received an id for: it
-	* does not consider whether the child reported, because the cases that most
-	* need it — a token ceiling, a model failure, cancellation, teardown — are
-	* exactly the ones where the child never got to choose. A materialization
-	* rolled back before its first acceptance stays silent, since the caller was
-	* told that child was not established. A parent that is no longer live is not
-	* an error; the child's own Session remains the durable record either way.
-	* A parent whose own lineage is already closing receives the notice without a
-	* wake, because teardown is not a reason to start a turn.
-	*
-	* Never blocks disposal. A delivery failure is logged and dropped, because
-	* retaining a child to retry a notice would pin its whole ancestry in
-	* `waiting` forever.
-	* @param activation - the settling Activation, still owned by its parent.
-	* @param terminal - how this epoch ended, as the terminal edge will report it.
-	*/
+	/** Tell the durable direct parent how this Activation ended. */
 	notifySettlement(activation, terminal) {
 		if (!activation.announced) return;
 		try {
 			const parent = this.ctx.agents.get(activation.parentSession);
 			if (parent === void 0) return;
-			const summary = settlementSummary(activation.childId, terminal.stopReason);
-			const message = createUserMessage({
-				content: [{
-					type: "text",
-					text: summary
-				}, ...terminal.output === void 0 ? [{
-					type: "text",
-					text: "It left no closing message."
-				}] : [{
-					type: "text",
-					text: "Its closing message:"
-				}, ...terminal.output]],
-				source: {
-					kind: "subagent-settled",
-					form: "notice",
-					summary: boundContextSummary(summary),
-					senderSessionId: activation.childId
-				}
-			});
+			const message = createSettlementMessage(activation.childId, terminal);
 			if (this.closingTeardownFor(parent) !== void 0) {
 				parent.inject(message);
 				return;
 			}
-			this.sendWaking(parent, message, () => {
-				if (parent.status === "idle") parent.followup(message);
-				else parent.steer(message);
-			});
+			this.sendWaking(parent, message, parent.status === "idle" ? "queue" : "steer");
 		} catch (error) {
 			this.ctx.logger.warn(`subagent "${activation.childId}" settlement notice was not delivered to its parent: ` + errorChain(error));
 		}
 	}
-	/**
-	* Request a best-effort final session flush after the child is quiescent.
-	* Listener failure is logged because flush participation cannot identify a
-	* particular persistence backend, and teardown must still release ownership.
-	* @param activation - the Activation whose final events should be flushed.
-	*/
+	/** Request a best-effort final session flush before closing natural-settlement admission. */
 	async flushFinalState(activation) {
 		const child = activation.handle.agent;
 		try {
@@ -1808,6 +1265,591 @@ var SubagentContinuationManager = class {
 			this.ctx.logger.warn(`subagent "${activation.childId}" best-effort final session flush failed; the persisted state may be unavailable or stale on resume: ${errorChain(error)}`);
 		}
 	}
+};
+//#endregion
+//#region lib/types/descriptor.js
+/**
+* The durable subagent-child descriptor: the versioned, model-hidden
+* `subagent/descriptor` session event that identifies every session-backed
+* subagent and records whether it is one-shot or continuable. Continuable
+* descriptors additionally preserve the declared composition required for
+* cold resume. Providers append it turn-enclosed in the child's initial turn.
+*
+* The descriptor deliberately snapshots explicit fields rather than the
+* merge-extensible `AgentOptions` object: an unrelated extension value cannot
+* make continuation fail merely because it is not JSON, and later composition
+* inputs require a deliberate {@link SUBAGENT_DESCRIPTOR_VERSION} change. It
+* omits `subagentDepth` — cold resume trusts the persisted header's
+* `delegationDepth` as the monotone floor — and `outputSchema`, which belongs
+* to one activation's result contract rather than durable child composition.
+* Per-activation knobs such as `maxTokens` are omitted for the same reason as
+* `outputSchema`: they budget one activation. Cold resume requires the exact
+* live parent for authorization but reconstructs child options only from the
+* durable descriptor, so it neither restores the prior budget nor inherits
+* the parent's current one; the resumed route's defaults apply instead.
+*
+* @module @deepseek-ai/dsh-subagent/descriptor
+*/
+/**
+* The current descriptor format version, stamped into every appended
+* `subagent/descriptor` event and required verbatim by {@link foldSubagentDescriptor}.
+* Supporting another composition input is a deliberate version change, never
+* an implicit extra field.
+*/
+const SUBAGENT_DESCRIPTOR_VERSION = 3;
+const DESCRIPTOR_BASE_KEYS = [
+	"version",
+	"mode",
+	"provider",
+	"label"
+];
+const ONE_SHOT_DESCRIPTOR_KEYS = new Set(DESCRIPTOR_BASE_KEYS);
+const CONTINUABLE_DESCRIPTOR_KEYS = new Set([
+	...DESCRIPTOR_BASE_KEYS,
+	"agentProvider",
+	"agentModel",
+	"agentReasoningEffort",
+	"persona",
+	"toolFilter"
+]);
+const TOOL_FILTER_KEYS = new Set(["allow", "deny"]);
+/** Whether a persisted JSON value is an object record. */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Reject fields outside one versioned record's declared schema. */
+function assertKnownKeys(value, keys, path) {
+	const unknown = Object.keys(value).find((key) => !keys.has(key));
+	if (unknown !== void 0) throw new Error(`persisted subagent descriptor ${path} has unknown field "${unknown}"`);
+}
+/** Read one optional string field from a persisted descriptor record. */
+function optionalString(value, key) {
+	if (!Object.hasOwn(value, key)) return void 0;
+	const field = value[key];
+	if (typeof field !== "string") throw new Error(`persisted subagent descriptor ${key} must be a string`);
+	return field;
+}
+/** Read one optional string-array field from a persisted tool restriction. */
+function optionalStringArray(value, key) {
+	if (!Object.hasOwn(value, key)) return void 0;
+	const field = value[key];
+	if (!Array.isArray(field)) throw new Error(`persisted subagent descriptor toolFilter.${key} must be an array of strings`);
+	const items = field;
+	if (items.some((item) => typeof item !== "string")) throw new Error(`persisted subagent descriptor toolFilter.${key} must be an array of strings`);
+	return items;
+}
+/** Validate and reconstruct a persisted tool restriction. */
+function parseToolFilter(value) {
+	if (!isRecord(value)) throw new Error("persisted subagent descriptor toolFilter must be an object");
+	assertKnownKeys(value, TOOL_FILTER_KEYS, "toolFilter");
+	const allow = optionalStringArray(value, "allow");
+	const deny = optionalStringArray(value, "deny");
+	if (allow === void 0 && deny === void 0) throw new Error("persisted subagent descriptor toolFilter must declare allow and/or deny");
+	return {
+		...allow !== void 0 ? { allow } : {},
+		...deny !== void 0 ? { deny } : {}
+	};
+}
+/** Validate one persisted descriptor payload for the current runtime. */
+function parseSubagentDescriptor(value) {
+	if (!isRecord(value)) throw new Error("persisted subagent descriptor payload must be an object");
+	const version = value["version"];
+	if (typeof version !== "number") throw new Error("persisted subagent descriptor version must be a number");
+	if (version !== 3) return void 0;
+	const mode = value["mode"];
+	if (mode !== "one-shot" && mode !== "continuable") throw new Error("persisted subagent descriptor mode must be \"one-shot\" or \"continuable\"");
+	assertKnownKeys(value, mode === "one-shot" ? ONE_SHOT_DESCRIPTOR_KEYS : CONTINUABLE_DESCRIPTOR_KEYS, "payload");
+	const provider = value["provider"];
+	if (typeof provider !== "string") throw new Error("persisted subagent descriptor provider must be a string");
+	if (mode === "one-shot") {
+		const label = optionalString(value, "label");
+		return {
+			version: 3,
+			mode,
+			provider,
+			...label !== void 0 ? { label } : {}
+		};
+	}
+	const label = value["label"];
+	if (typeof label !== "string") throw new Error("persisted subagent descriptor label must be a string");
+	const agentProvider = optionalString(value, "agentProvider");
+	const agentModel = optionalString(value, "agentModel");
+	const agentReasoningEffort = optionalString(value, "agentReasoningEffort");
+	const persona = optionalString(value, "persona");
+	const toolFilter = Object.hasOwn(value, "toolFilter") ? parseToolFilter(value["toolFilter"]) : void 0;
+	return {
+		version: 3,
+		mode,
+		provider,
+		label,
+		...agentProvider !== void 0 ? { agentProvider } : {},
+		...agentModel !== void 0 ? { agentModel } : {},
+		...agentReasoningEffort !== void 0 ? { agentReasoningEffort } : {},
+		...persona !== void 0 ? { persona } : {},
+		...toolFilter !== void 0 ? { toolFilter } : {}
+	};
+}
+function snapshotSubagentDescriptor(input) {
+	const snapshot = snapshotJsonValue(input.mode === "one-shot" ? {
+		version: 3,
+		mode: input.mode,
+		provider: input.provider,
+		...input.label !== void 0 ? { label: input.label } : {}
+	} : {
+		version: 3,
+		mode: input.mode,
+		provider: input.provider,
+		label: input.label,
+		...input.agentProvider !== void 0 ? { agentProvider: input.agentProvider } : {},
+		...input.agentModel !== void 0 ? { agentModel: input.agentModel } : {},
+		...input.agentReasoningEffort !== void 0 ? { agentReasoningEffort: input.agentReasoningEffort } : {},
+		...input.persona !== void 0 ? { persona: input.persona } : {},
+		...input.toolFilter !== void 0 ? { toolFilter: input.toolFilter } : {}
+	});
+	if (snapshot === void 0) throw new Error("subagent descriptor is not losslessly JSON-serializable");
+	return snapshot;
+}
+/**
+* Fold a persisted child log to its supported descriptor. The first
+* `subagent/descriptor` event is authoritative — the establishing provider
+* appends exactly one, so a later same-type event cannot rewrite the declared
+* composition.
+* @param events - the loaded child session events.
+* @returns the descriptor, or `undefined` when the log has none or its
+*   version is not {@link SUBAGENT_DESCRIPTOR_VERSION} (the child cannot be
+*   classified by this runtime).
+* @throws when a current-version persisted payload does not match its complete
+*   declared schema.
+*/
+function foldSubagentDescriptor(events) {
+	const event = events.find((candidate) => candidate.type === "subagent/descriptor");
+	if (event === void 0) return void 0;
+	return parseSubagentDescriptor(event.data);
+}
+//#endregion
+//#region lib/types/internal.js
+/**
+* Continuation integration markers and host adapters outside the public
+* Service Definition and model-facing Agent messaging contract.
+* @module @deepseek-ai/dsh-subagent/internal
+*/
+/** Process-stable identity carried only by the standard adjacent-Agent messaging tool. */
+const adjacentAgentSendMessageTool = Symbol.for("dsh.subagent.adjacentAgentSendMessageTool");
+/**
+* Test whether one visible definition is the standard adjacent-Agent messaging tool.
+* @param definition - the scope-resolved `send_message` candidate.
+* @returns whether the definition carries the internal standard-tool identity.
+*/
+function isAdjacentAgentSendMessageTool(definition) {
+	return definition !== void 0 && definition[adjacentAgentSendMessageTool] === true;
+}
+/**
+* Process-stable symbol-keyed host delivery shared by the bundled runtime
+* entry and this unbundled internal subpath.
+* @internal
+*/
+const deliverSubagentPrompt = Symbol.for("dsh.subagent.deliverPrompt");
+//#endregion
+//#region lib/types/continuation.js
+/**
+* Continuable-subagent orchestration behind `ctx.subagents`: stable child ids,
+* descriptor persistence, provider preparation, cold resume, authorization,
+* and message routing. {@link ContinuableActivationRegistry} owns the mutable
+* process-local Activation graph and its settlement and disposal lifecycle.
+*
+* A continuable child has one durable Session and at most one process-local
+* Activation. The Agent inbox is the only turn queue, so this manager owns
+* durable orchestration while the Agent loop owns all turn ordering and
+* execution. No continuable path creates a Task or an intermediate
+* result-bearing wrapper.
+*
+* @module @deepseek-ai/dsh-subagent
+*/
+var __addDisposableResource$1 = function(env, value, async) {
+	if (value !== null && value !== void 0) {
+		if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+		var dispose, inner;
+		if (async) {
+			if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+			dispose = value[Symbol.asyncDispose];
+		}
+		if (dispose === void 0) {
+			if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+			dispose = value[Symbol.dispose];
+			if (async) inner = dispose;
+		}
+		if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+		if (inner) dispose = function() {
+			try {
+				inner.call(this);
+			} catch (e) {
+				return Promise.reject(e);
+			}
+		};
+		env.stack.push({
+			value,
+			dispose,
+			async
+		});
+	} else if (async) env.stack.push({ async: true });
+	return value;
+};
+var __disposeResources$1 = (function(SuppressedError) {
+	return function(env) {
+		function fail(e) {
+			env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+			env.hasError = true;
+		}
+		var r, s = 0;
+		function next() {
+			while (r = env.stack.pop()) try {
+				if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+				if (r.dispose) {
+					var result = r.dispose.call(r.value);
+					if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) {
+						fail(e);
+						return next();
+					});
+				} else s |= 1;
+			} catch (e) {
+				fail(e);
+			}
+			if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+			if (env.hasError) throw env.error;
+		}
+		return next();
+	};
+})(typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed, message) {
+	var e = new Error(message);
+	return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+/**
+* The continuable-subagent orchestration service behind `ctx.subagents`. Tool
+* schema and host adapters are consumers of this one contract; foreground
+* one-shot delegation keeps calling `ctx.subagents.start()` and never enters
+* this lifecycle.
+*/
+var SubagentContinuationManager = class {
+	ctx;
+	host;
+	activations;
+	constructor(ctx, host) {
+		this.ctx = ctx;
+		this.host = host;
+		this.activations = new ContinuableActivationRegistry(ctx, (provider, childId, parent) => host.observeActivation(provider, childId, parent));
+	}
+	/**
+	* Start one continuable background child and resolve at initial inbox acceptance.
+	* Every earlier failure disposes any created handle and rolls back Activation
+	* and parent ownership without returning either id.
+	* @param spec - provider, delegation request, and caller cancellation.
+	* @returns the durable child id and accepted initial prompt message id.
+	*/
+	async startContinuable(spec) {
+		const request = spec.request;
+		const parent = request.parent;
+		this.activations.assertAdmitting(parent);
+		const persistence = this.requirePersistence();
+		assertSubagentMaxDepth(request.maxDepth);
+		const childId = spec.childId ?? brandString(randomUUID());
+		this.activations.assertChildIdAvailable(childId);
+		const childDepth = resolveChildDepth(parent, request.maxDepth);
+		const agentOptions = resolveChildAgentOptions(parent, request.agentOptions, childDepth);
+		const agentProvider = agentOptions.provider;
+		const agentModel = agentOptions.model;
+		const agentReasoningEffort = agentOptions.reasoningEffort;
+		const descriptor = snapshotSubagentDescriptor({
+			mode: "continuable",
+			provider: spec.provider,
+			label: spec.label,
+			...agentProvider !== void 0 ? { agentProvider } : {},
+			...agentModel !== void 0 ? { agentModel } : {},
+			...agentReasoningEffort !== void 0 ? { agentReasoningEffort } : {},
+			...request.persona !== void 0 ? { persona: request.persona } : {},
+			...request.toolFilter !== void 0 ? { toolFilter: request.toolFilter } : {}
+		});
+		const delegatedPolicies = captureDelegatedPolicyOverrides(parent);
+		const releaseHold = this.activations.holdOwnership(parent, childId);
+		try {
+			const prepared = await this.host.prepareContinuable(spec.provider, {
+				sessionId: childId,
+				parent,
+				signal: spec.signal
+			});
+			spec.signal.throwIfAborted();
+			this.activations.assertAdmitting(parent);
+			const inheritedEventCount = SessionLogOffset(prepared.seed?.length ?? 0);
+			const seed = prepared.seed;
+			return {
+				childId,
+				messageId: await this.activations.locks.run(childId, async () => {
+					spec.signal.throwIfAborted();
+					this.activations.assertAdmitting(parent);
+					this.activations.assertChildIdAvailable(childId);
+					if (spec.childId !== void 0) {
+						const persisted = await persistence.stat(childId, { signal: spec.signal });
+						spec.signal.throwIfAborted();
+						this.activations.assertAdmitting(parent);
+						this.activations.assertChildIdAvailable(childId);
+						if (persisted !== void 0) throw new SubagentError(`subagent "${childId}" already exists`, "DUPLICATE_CHILD");
+					}
+					const activation = await this.activations.materialize({
+						childId,
+						provider: spec.provider,
+						parent,
+						create: {
+							seed,
+							meta: childSessionMeta(parent, childDepth, prepared.seed !== void 0),
+							inheritedEventCount,
+							delegatedPolicies,
+							descriptor
+						},
+						agentOptions,
+						composition: {
+							persona: request.persona,
+							toolFilter: request.toolFilter
+						},
+						signal: spec.signal
+					});
+					return this.submitMaterialized(activation, isAdjacentAgentSendMessageTool(this.ctx.get("tools")?.get("send_message", activation.handle.agent)) ? withContinuableReturnGuidance(parent.id, request.prompt) : request.prompt, {
+						source: { kind: "user" },
+						signal: spec.signal,
+						delivery: "queue"
+					}, parent);
+				})
+			};
+		} catch (error) {
+			releaseHold();
+			throw error;
+		}
+	}
+	/**
+	* Deliver one model-authored message to a direct continuable child or to the
+	* sender's direct parent. A missing direct child cold-resumes through the
+	* ordinary continuation lifecycle.
+	* @param sender - exact live Agent authorizing and originating the message.
+	* @param targetId - durable direct-parent or direct-child session id.
+	* @param content - model-authored content to deliver.
+	* @param options - caller cancellation before acceptance.
+	* @returns the accepted message's inbox id.
+	*/
+	async sendMessage(sender, targetId, content, options) {
+		if (this.ctx.agents.get(sender.id) !== sender) throw new SubagentError("message delivery requires the exact live sender agent", "UNAUTHORIZED");
+		this.activations.assertAdmitting(sender);
+		const senderActivation = this.activations.get(sender.id);
+		if (senderActivation !== void 0 && senderActivation.handle.agent === sender && senderActivation.parentSession === targetId) {
+			options.signal.throwIfAborted();
+			return this.sendToParent(senderActivation, sender, content);
+		}
+		if (sender.session.header.parentSession === targetId) throw new SubagentError(`agent "${sender.id}" is not a resident continuable child and cannot send to parent "${targetId}"`, "UNAUTHORIZED");
+		return this.deliverToChild(sender, targetId, content, {
+			signal: options.signal,
+			delivery: "steer"
+		});
+	}
+	/**
+	* Queue one human-authored prompt as a distinct direct-child turn.
+	* @param parent - exact live direct parent authorizing delivery.
+	* @param childId - durable direct-child session id.
+	* @param content - model-visible prompt blocks.
+	* @param source - durable attribution for the human prompt.
+	* @param signal - caller cancellation before inbox acceptance.
+	* @returns the accepted durable message id.
+	*/
+	async queuePrompt(parent, childId, content, source, signal) {
+		return this.deliverToChild(parent, childId, content, {
+			source,
+			signal,
+			delivery: "queue"
+		});
+	}
+	/**
+	* Steer one host-authored prompt to a direct continuable child.
+	* @param parent - exact live direct parent authorizing delivery.
+	* @param childId - durable direct-child session id.
+	* @param content - model-visible prompt blocks.
+	* @param source - durable attribution for the host prompt.
+	* @param signal - caller cancellation before inbox acceptance.
+	* @returns the accepted durable message id.
+	*/
+	async steerPrompt(parent, childId, content, source, signal) {
+		return this.deliverToChild(parent, childId, content, {
+			source,
+			signal,
+			delivery: "steer"
+		});
+	}
+	/** Route one parent-originated delivery through residency and cold resume. */
+	async deliverToChild(parent, childId, content, options) {
+		this.activations.assertAdmitting(parent);
+		const releaseHold = this.activations.holdOwnership(parent, childId);
+		try {
+			return await this.deliverFollowup(parent, childId, content, options);
+		} catch (error) {
+			releaseHold();
+			throw error;
+		}
+	}
+	/** The delivery loop behind {@link deliverToChild}, run under the parent hold. */
+	async deliverFollowup(parent, childId, content, options) {
+		while (true) {
+			const live = await this.activations.locks.run(childId, async () => {
+				const activation = this.activations.get(childId);
+				if (activation === void 0) return this.coldResume(parent, childId, content, options);
+				const disposal = activation.inbox.closing;
+				/* v8 ignore next 3 -- the send-versus-dispose cutoff needs a delivery to
+				* observe the transaction inside the same critical section that opened it. */
+				if (disposal !== void 0) return disposal.then(() => void 0, () => void 0);
+				if (contentHasImage(content)) {
+					await this.assertImageCapable(activation.handle.agent, options.signal);
+					if (activation.inbox.closing !== void 0) {
+						await Promise.allSettled([activation.inbox.closing]);
+						return;
+					}
+				}
+				return this.submitAdmitted(activation, content, options, parent);
+			});
+			/* v8 ignore start -- only a delivery that lost the disposal cutoff retries. */
+			if (live !== void 0) return live;
+			this.activations.assertAdmitting(parent);
+			options.signal.throwIfAborted();
+		}
+	}
+	/**
+	* Interrupt one live continuable child's current turn. Admission is
+	* synchronous and the cancellation effect is asynchronous. An absent or
+	* already-closing target is an accepted no-op after authority checks.
+	* @param targetSessionId - the durable child session id to interrupt.
+	* @param authority - the human parent address or exact live ancestor Agent.
+	*/
+	interrupt(targetSessionId, authority) {
+		this.activations.interrupt(targetSessionId, authority);
+	}
+	/** Deliver one resident continuable child's message to its live direct parent. */
+	sendToParent(activation, sender, content) {
+		/* v8 ignore next 6 -- only synchronous re-entrant teardown can open this
+		* transaction between exact-agent authorization and this no-await span. */
+		if (activation.inbox.closing !== void 0) throw new SubagentError(`subagent "${sender.id}" activation is being disposed; the message was not delivered`, "ACTIVATION_CLOSING");
+		const parent = this.ctx.agents.get(activation.parentSession);
+		if (parent === void 0) throw new SubagentError("direct parent is not live; the message was not delivered", "PARENT_UNAVAILABLE");
+		const message = createAgentMessage(sender, content);
+		this.sendAgentMessage(parent, message);
+		return message.id;
+	}
+	/** Send one Agent message while translating only the target's own rejection. */
+	sendAgentMessage(parent, message) {
+		try {
+			this.activations.sendWaking(parent, message, "steer");
+		} catch (error) {
+			throw new SubagentError("direct parent is not live; the message was not delivered", "PARENT_UNAVAILABLE", { cause: error });
+		}
+	}
+	/** Close manager-wide admission and release every live Activation. */
+	async drain() {
+		await this.activations.drain();
+	}
+	/**
+	* Stop only the continuable descendants of exact live host-owned parents.
+	* @param parents - exact live roots whose continuable descendants must stop.
+	*/
+	async drainDescendants(parents) {
+		await this.activations.drainDescendants(parents);
+	}
+	/**
+	* Release selected resident direct children of one exact live parent.
+	* @param parent - exact live direct parent authorizing the selected release.
+	* @param childIds - durable direct-child ids to release when resident.
+	*/
+	async drainChildren(parent, childIds) {
+		await this.activations.drainChildren(parent, childIds);
+	}
+	/**
+	* Cold-resume a persisted child and submit the waiting turn. The descriptor
+	* supplies every reconstruction input; no subagent provider is dispatched.
+	*/
+	async coldResume(parent, childId, content, options) {
+		const env_1 = {
+			stack: [],
+			error: void 0,
+			hasError: false
+		};
+		try {
+			const query = this.requireSessionQuery();
+			let observation;
+			try {
+				observation = await query.observeSession(childId, { signal: options.signal });
+			} catch (error) {
+				options.signal.throwIfAborted();
+				throw new SubagentError(`subagent "${childId}" is unavailable`, "NOT_RESUMABLE", { cause: error });
+			}
+			const source = __addDisposableResource$1(env_1, observation, false);
+			this.activations.assertAdmitting(parent);
+			this.activations.authorizeLineage(parent, childId, source.header.parentSession);
+			const descriptor = foldSubagentDescriptor(source.events.slice(source.inheritedEventCount));
+			if (descriptor === void 0 || descriptor.mode !== "continuable") throw new SubagentError(`subagent "${childId}" has no supported continuation state and cannot be resumed; choose a different target`, "NOT_RESUMABLE");
+			let activation;
+			try {
+				activation = await this.activations.materialize({
+					childId,
+					provider: descriptor.provider,
+					parent,
+					agentOptions: {
+						...descriptor.agentProvider !== void 0 ? { provider: descriptor.agentProvider } : {},
+						...descriptor.agentModel !== void 0 ? { model: descriptor.agentModel } : {},
+						...descriptor.agentReasoningEffort !== void 0 ? { reasoningEffort: ReasoningEffortId(descriptor.agentReasoningEffort) } : {}
+					},
+					composition: {
+						persona: descriptor.persona,
+						toolFilter: descriptor.toolFilter
+					},
+					signal: options.signal
+				});
+			} catch (error) {
+				options.signal.throwIfAborted();
+				if (error instanceof SubagentError) throw error;
+				throw new SubagentError(`subagent "${childId}" is unavailable`, "NOT_RESUMABLE", { cause: error });
+			}
+			return await this.submitMaterialized(activation, content, options, parent);
+		} catch (e_1) {
+			env_1.error = e_1;
+			env_1.hasError = true;
+		} finally {
+			__disposeResources$1(env_1);
+		}
+	}
+	/** Submit to a freshly materialized Activation or roll it back completely. */
+	async submitMaterialized(activation, content, options, parent) {
+		try {
+			if (contentHasImage(content)) {
+				await this.assertImageCapable(activation.handle.agent, options.signal);
+				if (activation.inbox.closing !== void 0) throw new SubagentError(`subagent "${activation.childId}" is closing`, "ACTIVATION_CLOSING");
+			}
+			return this.submitAdmitted(activation, content, options, parent);
+		} catch (error) {
+			/* v8 ignore next -- rollback disposal failures must not mask the
+			* pre-acceptance signal, drain, or lifecycle failure. */
+			await this.activations.dispose(activation).catch(() => void 0);
+			throw error;
+		}
+	}
+	/** Build and submit one message across the final synchronous admission cutoff. */
+	submitAdmitted(activation, content, options, parent) {
+		const message = options.source === void 0 ? createAgentMessage(parent, content) : createUserMessage({
+			content,
+			source: options.source
+		});
+		return this.activations.submitAdmitted(activation, message, options.delivery, parent, options.signal);
+	}
+	/** Refuse image content for a child whose fixed model accepts text only. */
+	async assertImageCapable(agent, signal) {
+		const { provider, model } = agent.options;
+		if (provider === void 0 || model === void 0) return;
+		const llm = this.ctx.get("llm");
+		/* v8 ignore next -- without an LLM registry, delivery defers to projection. */
+		if (llm === void 0) return;
+		const info = await llm.resolveModelInfo(provider, model, signal);
+		if (info.inputModalities !== void 0 && !info.inputModalities.includes("image")) throw new SubagentError(`Model "${model}" does not support image input.`, "MODEL_DOES_NOT_SUPPORT_IMAGES");
+	}
 	/** Resolve the persistence service continuable children require, or fail loud. */
 	requirePersistence() {
 		const persistence = this.ctx.get("sessionPersistence");
@@ -2319,7 +2361,7 @@ const subagentIdentityProjectionDefinition = {
 * working-directory resolution (config override, else the delegating parent
 * session's workspace), the never-reject result settlement, and the standard
 * run-handle publication. Backends compose these with their own wire drivers;
-* the process machinery itself (spawn, env scrub, tree-scoped teardown)
+* the process machinery itself (spawn, env scrub, managed-range teardown)
 * belongs to the `dsh-subprocess` seam.
 *
 * @module @deepseek-ai/dsh-subagent/out-of-process
@@ -2751,7 +2793,7 @@ let SubagentRuntime = (() => {
 			return this.requireContinuations().sendMessage(sender, targetId, content, options);
 		}
 		/**
-		* Queue one host-protocol message as a distinct direct-child turn.
+		* Deliver one host-protocol message to a direct continuable child.
 		* Symbol-keyed so host adapters can preserve their own provenance without
 		* widening the public Service Definition or impersonating an Agent sender.
 		* @param parent - exact live direct parent authorizing delivery.
@@ -2759,10 +2801,11 @@ let SubagentRuntime = (() => {
 		* @param content - host-authored content to deliver.
 		* @param source - durable host-protocol provenance.
 		* @param signal - caller cancellation before inbox acceptance.
+		* @param delivery - Queue as a distinct turn or Steer at the nearest step.
 		* @returns the accepted message's inbox id.
 		*/
-		[queueSubagentPrompt](parent, childId, content, source, signal) {
-			return this.requireContinuations().queuePrompt(parent, childId, content, source, signal);
+		[deliverSubagentPrompt](parent, childId, content, source, signal, delivery) {
+			return delivery === "steer" ? this.requireContinuations().steerPrompt(parent, childId, content, source, signal) : this.requireContinuations().queuePrompt(parent, childId, content, source, signal);
 		}
 		/**
 		* Interrupt one live continuable child's current turn under a human parent
@@ -2875,11 +2918,12 @@ let SubagentRuntime = (() => {
 		* Deliver one browser-authored message to a continuable child through the
 		* exact live direct parent, retaining the caller-minted request identity and
 		* validated browser zone on the accepted message. Success identifies the
-		* message the child's FIFO inbox accepted; later execution is independent of
-		* this call.
+		* message the child's inbox accepted; later execution is independent of this
+		* call. Queue delivery targets a later turn; steer delivery targets the
+		* nearest step and retains the Agent loop's best-effort fallback semantics.
 		* Image parts are admitted and persisted through the attachment store
 		* before delivery, and the child's model must accept image input.
-		* @param request - durable address, minted identity, content, and optional browser zone.
+		* @param request - durable address, delivery, minted identity, content, and optional browser zone.
 		* @param signal - carrier cancellation, owning the call until inbox acceptance.
 		* @returns the accepted message's inbox identity.
 		* @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-invalid`,
@@ -2888,7 +2932,7 @@ let SubagentRuntime = (() => {
 		*   `subagent/delivery-unavailable`, `gateway/cancelled`, or `gateway/internal`.
 		*/
 		async prompt(request, signal) {
-			const { parentSessionId, childSessionId, clientTimeZone } = request;
+			const { parentSessionId, childSessionId, clientTimeZone, delivery } = request;
 			validateControlRequest("subagent.prompt", request);
 			const canonicalTimeZone = clientTimeZone === void 0 ? void 0 : canonicalClientTimeZone(clientTimeZone);
 			if (clientTimeZone !== void 0 && canonicalTimeZone === void 0) throw new RemoteError("subagent/invalid-time-zone", "clientTimeZone must be UTC or a valid IANA Area/Location name", { value: clientTimeZone });
@@ -2908,9 +2952,9 @@ let SubagentRuntime = (() => {
 				else {
 					const attachments = this.ctx.get("attachments");
 					if (attachments === void 0) throw new Error("subagent image prompt requires an attachment store");
-					content = await admitPromptContent(attachments, request.content);
+					content = await attachments.admitPromptContent(request.content);
 				}
-				return { messageId: await this[queueSubagentPrompt](parent, childSessionId, content, source, signal) };
+				return { messageId: await this[deliverSubagentPrompt](parent, childSessionId, content, source, signal, delivery) };
 			} catch (error) {
 				return rejectPrompt(error, childSessionId, signal);
 			}
@@ -3063,4 +3107,4 @@ let SubagentRuntime = (() => {
 	};
 })();
 //#endregion
-export { AssistantOutputFold, NO_START_CAPABILITIES, SUBAGENT_DESCRIPTOR_VERSION, SubagentDepthError, SubagentError, SubagentRunId, SubagentRuntime, SubagentRuntime as default, appendDelegatedPolicyOverrides, applyChildComposition, assertPositiveFinite, assertSubagentMaxDepth, assertUsableCwd, captureDelegatedPolicyOverrides, childSessionMeta, delegationDepthOf, finalAssistantOutput, foldSubagentDescriptor, parentAgentOptionsForDelegation, resolveChildAgentOptions, resolveChildCwd, resolveChildDepth, seedDescriptorTurn, settleRun, settleRunResult, snapshotSubagentDescriptor, subprocessRunHandle, validateConfiguredCwd };
+export { AssistantOutputFold, NO_START_CAPABILITIES, SUBAGENT_DESCRIPTOR_VERSION, SubagentDepthError, SubagentError, SubagentRunId, SubagentRuntime, SubagentRuntime as default, appendDelegatedPolicyOverrides, applyChildComposition, assertPositiveFinite, assertSubagentMaxDepth, assertUsableCwd, captureDelegatedPolicyOverrides, childSessionMeta, delegationDepthOf, finalAssistantOutput, foldSubagentDescriptor, parentAgentOptionsForDelegation, resolveChildAgentOptions, resolveChildCwd, resolveChildDepth, settleRun, settleRunResult, snapshotSubagentDescriptor, subprocessRunHandle, validateConfiguredCwd };