@deepseek-ai/dsh-subagent 0.2.1-alpha.1 → 0.2.1-alpha.3

package/lib/index.js

@@ -1,19 +1,19 @@
 import z from "@deepseek-ai/schemastery";
 import { scopeTarget } from "@deepseek-ai/dsh-scope";
-import { assertObjectJsonSchema } from "@deepseek-ai/dsh-tools";
+import { ToolArgsError, assertObjectJsonSchema, validateJsonSchemaValue } from "@deepseek-ai/dsh-tools";
 import { canonicalClientTimeZone } from "@deepseek-ai/dsh-util-time";
-import { Remote, RemoteError, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
+import { Remote, RemoteError, TypertRemoteService, principalOf } from "@deepseek-ai/dsh-typert-protocol";
 import { AttachmentError } from "@deepseek-ai/dsh-attachment";
 import { z as z$1 } from "zod";
 import { HarnessError, ReasoningEffortId, boundContextSummary, contentHasImage, createUserMessage, errorChain, joinAssistantStreamText } from "@deepseek-ai/dsh-llm";
 import { randomUUID } from "node:crypto";
 import { foldConsumedWork } from "@deepseek-ai/dsh-agent";
-import { SessionLogOffset, SessionSeq } from "@deepseek-ai/dsh-session";
+import { isAbsolute, resolve } from "node:path";
 import { brandString } from "@deepseek-ai/dsh-brand";
-import { snapshotJsonValue } from "@deepseek-ai/dsh-util-values";
+import { SessionLogOffset, SessionSeq } from "@deepseek-ai/dsh-session";
+import { assertNever, snapshotJsonValue } from "@deepseek-ai/dsh-util-values";
 import { appendChunkedList, chunkedListSchema, iterateChunkedList } from "@deepseek-ai/dsh-chunked-list";
 import { accessSync, constants, statSync } from "node:fs";
-import { isAbsolute, resolve } from "node:path";
 //#region lib/types/error.js
 /**
 * Typed failures shared by subagent service and provider operations.
@@ -121,79 +121,13 @@ function assertSubagentMaxDepth(maxDepth) {
 	if (maxDepth !== void 0 && (typeof maxDepth !== "number" || !Number.isSafeInteger(maxDepth) || maxDepth < 0 || Object.is(maxDepth, -0))) throw new TypeError("subagent maxDepth must be a non-negative safe integer");
 }
 //#endregion
-//#region lib/types/assistant-output.js
-/**
-* Canonical selection of a child's final assistant output. Backend run results
-* and `subagent/end.lastAssistantMessage` apply the same rule: select the last
-* non-empty assistant message. An empty-content message records usage only
-* when the loop appends it after a max-tokens step with no executable blocks,
-* so it does not replace earlier output. If no non-empty message exists,
-* select the accumulated assistant text. Selection is independent of the
-* run's stop reason.
-*
-* @module @deepseek-ai/dsh-subagent/assistant-output
-*/
-/**
-* Incremental fold of the selection rule, for backends that observe a child's
-* output as it streams: session-event backends {@link push} each event, and
-* transports without session events (ACP content chunks) {@link pushText} raw
-* text into the same streamed fallback.
-*/
-var AssistantOutputFold = class {
-	message;
-	partial = [];
-	/**
-	* Fold one session event: a non-empty assistant message becomes the
-	* candidate final answer, while its embedded stream and any log-only attempt
-	* extend the streamed fallback; every other event contributes nothing.
-	* @param event - the next observed session event.
-	*/
-	push(event) {
-		if (event.type === "assistant/message") {
-			const content = event.data.message.content;
-			if (content.length > 0) this.message = content;
-		}
-		if (event.type === "assistant/message" || event.type === "assistant/attempt") this.pushText(joinAssistantStreamText(event.data.stream));
-	}
-	/**
-	* Extend the streamed fallback with text observed outside session events.
-	* @param text - the next streamed text piece (an empty piece is a no-op).
-	*/
-	pushText(text) {
-		if (text.length > 0) this.partial.push(text);
-	}
-	/**
-	* Select the final output folded so far.
-	* @returns the last non-empty assistant message, else the accumulated
-	*   streamed text, or `undefined` when the child produced neither.
-	*/
-	collect() {
-		if (this.message !== void 0) return this.message;
-		const text = this.partial.join("");
-		return text.length > 0 ? [{
-			type: "text",
-			text
-		}] : void 0;
-	}
-};
-/**
-* Apply the selection rule to one complete child-owned event suffix.
-* @param events - the child-owned events (after any seed or epoch boundary).
-* @returns the selected output, or `undefined` when the child produced none.
-*/
-function finalAssistantOutput(events) {
-	const fold = new AssistantOutputFold();
-	for (const event of events) fold.push(event);
-	return fold.collect();
-}
-//#endregion
 //#region lib/types/types.js
 /**
 * The seam's consumer-facing contracts: request, result, and capability types
 * for {@link SubagentProvider}, plus the `subagent/start` and `subagent/end`
 * payloads that plugins and hosts observe. Internal control interfaces belong
 * with their implementation — the lifecycle observer in `./lifecycle.ts`, the
-* continuation host in `./continuation.ts` — so this module stays the published
+* manager host in `./manager.ts` — so this module stays the published
 * surface rather than a bag of everything type-shaped.
 *
 * @module @deepseek-ai/dsh-subagent/types
@@ -209,17 +143,10 @@ function SubagentRunId(id) {
 //#endregion
 //#region lib/types/lifecycle.js
 /**
-* Lifecycle-edge publication for both subagent shapes: the contained emitter,
-* the one-shot run observer, and the continuable Activation observer.
+* Lifecycle-edge publication for managed subagent activations.
 *
-* The public payload contracts ({@link SubagentRunInfo},
-* {@link SubagentRunEndInfo}) live in `./types.ts` with the rest of the seam's
-* consumer-facing types; this module owns only the implementation and the
-* package-private {@link ActivationObserver} the continuation manager consumes.
-* Keeping the internal control interface out of the published surface is
-* deliberate: the observer's `start`/`capture`/`settle` ordering is a contract
-* between this module and one in-package caller, not something a plugin may
-* depend on.
+* Public event payloads live in `./types.ts`; the package-private observer
+* retains only the identity shared by each start/end pair.
 *
 * @module @deepseek-ai/dsh-subagent/lifecycle
 */
@@ -250,40 +177,7 @@ function createLifecycleEmitter(ctx, carrier) {
 	};
 }
 /**
-* Emit the start/end lifecycle pair for one accepted one-shot run.
-* @param emit - the contained lifecycle emitter.
-* @param provider - the provider that established the run.
-* @param parent - the delegating parent keying scoped dispatch.
-* @param run - the published run whose settlement closes the pair.
-* @returns the same run, unchanged.
-*/
-function observeRun(emit, provider, parent, run) {
-	const identity = {
-		runId: SubagentRunId(randomUUID()),
-		provider,
-		id: run.id,
-		local: run.localAgent !== void 0
-	};
-	run.result.then((result) => {
-		emit("subagent/end", {
-			...identity,
-			stopReason: result.stopReason,
-			...result.output.length === 0 ? {} : { lastAssistantMessage: result.output }
-		}, parent);
-	}, () => {
-		emit("subagent/end", {
-			...identity,
-			stopReason: "error"
-		}, parent);
-	});
-	emit("subagent/start", identity, parent);
-	return run;
-}
-/**
-* Build the observer for one continuable Activation's residency epoch. Observers
-* see the same vocabulary as a one-shot run, so a child's start and settlement
-* remain observable without exposing whether the manager materialized, woke, or
-* cold-resumed it. Creation failure before residency emits no lifecycle edge.
+* Build the observer for one local or external activation's residency epoch. Creation failure before residency emits no lifecycle edge.
 * @param emit - the contained lifecycle emitter.
 * @param provider - the provider name recorded in the durable descriptor.
 * @param childId - the durable child session id.
@@ -295,31 +189,18 @@ function createActivationObserver(emit, provider, childId, parent) {
 		runId: SubagentRunId(randomUUID()),
 		provider,
 		id: childId,
-		local: true
+		local: false
 	};
-	let boundary = SessionLogOffset(0);
-	let captured = { stopReason: "completed" };
-	const terminal = (failure) => failure === void 0 ? captured : { stopReason: "error" };
 	return {
 		start: (child) => {
-			boundary = child.session.seq;
+			identity.local = child !== void 0;
 			emit("subagent/start", identity, parent);
 		},
-		capture: (child) => {
-			const own = child.session.snapshotEvents(boundary);
-			const output = finalAssistantOutput(own);
-			captured = {
-				stopReason: epochStopReason(own),
-				...output === void 0 ? {} : { output }
-			};
-		},
-		terminal,
-		settle: (failure) => {
-			const { stopReason, output } = terminal(failure);
+		settle: ({ stopReason, output }) => {
 			emit("subagent/end", {
 				...identity,
 				stopReason,
-				...output === void 0 ? {} : { lastAssistantMessage: output }
+				...output.length === 0 ? {} : { lastAssistantMessage: output }
 			}, parent);
 		}
 	};
@@ -370,9 +251,7 @@ function renderThrown(value) {
 /**
 * Shared in-process child composition: the delegation-depth budget, the
 * durable session metadata, the resolved child `AgentOptions`, the delegated
-* policy seed, and the scoped setup a child agent needs. Both the one-shot
-* provider driver and the continuation manager compose children this way, so
-* depth accounting, lineage stamping, and delegation policy have one home.
+* policy seed, and the scoped setup used by local activations.
 *
 * @module @deepseek-ai/dsh-subagent/child-agent
 */
@@ -456,20 +335,17 @@ function resolveChildAgentOptions(parent, requested, childDepth) {
 * survive persistence, the seed boundary that separates inherited parent
 * history from child work, and the composition the child runs under.
 *
-* The preset is read from the parent's LIVE scope chain rather than from its
-* header, because a parent that switched preset while blank runs on the newer
-* composition and its header still names the older one. Recording it is what
-* makes a child's history reconstructable: without it a cold read of the child
-* resolves the deployment default and rebuilds turns under a tool set the
-* child never had.
+* Omitted selection uses the parent's live composition, including any switch
+* made while the parent was blank.
 * @param parent - the delegating parent agent.
 * @param childDepth - the resolved delegation depth to persist.
 * @param isSeeded - whether this child inherits a parent-log prefix, including an explicitly empty one.
+* @param selectedPreset - independent selection, or omission to inherit the parent.
 * @returns the `meta` for `ctx.agents.create()`.
 */
-function childSessionMeta(parent, childDepth, isSeeded) {
+function childSessionMeta(parent, childDepth, isSeeded, selectedPreset) {
 	const parentHeader = parent.session.header;
-	const agentPreset = parent.ctx.get("agentPresets")?.composedPreset(parent.ctx);
+	const agentPreset = selectedPreset ?? parent.ctx.get("agentPresets")?.composedPreset(parent.ctx);
 	return {
 		...parentHeader.cwd !== void 0 ? { cwd: parentHeader.cwd } : {},
 		...agentPreset === void 0 ? {} : { agentPreset },
@@ -486,29 +362,26 @@ function childSessionMeta(parent, childDepth, isSeeded) {
 */
 const SUBAGENT_DELEGATION_CONTEXT = "You are a delegated subagent: your permission scope was fixed when you were started and cannot be widened from inside this session — operations that require approval are rejected automatically. When the task needs access beyond that scope, do not retry the denied operation; state the limitation in your reply so the delegating agent can handle it.";
 /**
-* Compose one child inside its creation window: join its parent's preset,
-* register the fixed delegation-scope statement, then apply the child's own
-* shadowing persona section and tool restriction, all owned by the child's
-* scope and therefore invisible to its parent and siblings. Creation and cold
-* resume both pass through here.
-*
-* The join comes first and the child's own registrations second, which is the
-* order the layering already implies — the nearest scope wins a name, and a
-* per-child restriction intersects with everything its chain admits — but
-* stating it here keeps the two steps from being read as independent.
-*
-* The join and the per-child registrations live in ONE call because a child
-* composed without the join is exactly the defect this function exists to
-* prevent: with every model-facing row on the agent plane, a child that joins
-* no preset sees an empty tool registry and none of its parent's prompt
-* sections. Taking the parent as a parameter is what makes that omission
-* unrepresentable at the call sites.
+* Compose a child before publication and restore historical descriptor overrides.
+* Explicit selection mounts the named preset; omission synchronously joins the
+* parent's current generation. Registrations belong to the child's scope.
 * @param childCtx - the child agent's scoped creation context.
-* @param parent - the delegating parent whose composition the child joins.
-* @param composition - the per-child persona and tool filter to install.
+* @param parent - the delegating parent used when no preset is selected.
+* @param composition - independent preset and any overrides read from a historical descriptor.
+* @returns A promise when mounting an independent preset; otherwise completes synchronously.
 */
 function applyChildComposition(childCtx, parent, composition) {
+	if (composition.agentPreset !== void 0) {
+		const presets = childCtx.get("agentPresets");
+		if (presets === void 0) throw new SubagentError("selecting a child agent preset requires the agent-presets service", "PRESET_UNAVAILABLE");
+		return presets.mount(childCtx, composition.agentPreset).then(() => {
+			applyChildOverrides(childCtx, composition);
+		});
+	}
 	childCtx.get("agentPresets")?.composeFrom(childCtx, parent.ctx);
+	applyChildOverrides(childCtx, composition);
+}
+function applyChildOverrides(childCtx, composition) {
 	childCtx.systemPrompt.context({
 		name: "subagent:delegation",
 		order: childCtx.systemPrompt.getContextOrder("SUBAGENT_DELEGATION"),
@@ -608,12 +481,13 @@ function withContinuableReturnGuidance(parentId, prompt) {
 * the parent's own task vocabulary.
 * @param childId - the durable child the parent knows by id.
 * @param stopReason - how the child's last ordinary turn ended.
+* @param continuable - whether the child accepts a later message.
 * @returns the model-facing opening line of the settlement notice.
 */
-function settlementSummary(childId, stopReason) {
+function settlementSummary(childId, stopReason, continuable) {
 	const subject = `Background subagent ${childId}`;
 	switch (stopReason) {
-		case "completed": return `${subject} finished and will do no further work unless you send it more.`;
+		case "completed": return continuable ? `${subject} finished and will do no further work unless you send it more.` : `${subject} finished. It cannot receive follow-up messages.`;
 		case "aborted": return `${subject} was stopped before it finished.`;
 		case "max-tokens": return `${subject} ran out of room before it finished.`;
 		case "refusal": return `${subject} declined the task.`;
@@ -628,22 +502,34 @@ function settlementSummary(childId, stopReason) {
 * Build the runtime-owned settlement notice from the child's nonempty closing text.
 * @param childId - durable child session id named in the notice.
 * @param terminal - recorded terminal state for the settled Activation.
+* @param continuable - whether the child can accept another task.
 * @returns the durable user-message representation delivered to the parent.
 */
-function createSettlementMessage(childId, terminal) {
-	const summary = settlementSummary(childId, terminal.stopReason);
-	const closingText = (terminal.output ?? []).flatMap((block) => block.type === "text" && block.text.length > 0 ? [block] : []);
+function createSettlementMessage(childId, terminal, continuable = true) {
+	const summary = settlementSummary(childId, terminal.stopReason, continuable);
+	const closingText = terminal.output.flatMap((block) => block.type === "text" && block.text.length > 0 ? [block] : []);
 	return createUserMessage({
-		content: [{
-			type: "text",
-			text: summary
-		}, ...closingText.length === 0 ? [{
-			type: "text",
-			text: "It left no closing message."
-		}] : [{
-			type: "text",
-			text: "Its closing message:"
-		}, ...closingText]],
+		content: [
+			{
+				type: "text",
+				text: summary
+			},
+			...closingText.length === 0 ? [{
+				type: "text",
+				text: "It left no closing message."
+			}] : [{
+				type: "text",
+				text: "Its closing message:"
+			}, ...closingText],
+			...terminal.structured !== void 0 ? [{
+				type: "text",
+				text: `Structured result: ${JSON.stringify(terminal.structured)}`
+			}] : [],
+			...terminal.diagnostic !== void 0 ? [{
+				type: "text",
+				text: terminal.diagnostic
+			}] : []
+		],
 		source: {
 			kind: "subagent-settled",
 			form: "notice",
@@ -653,731 +539,107 @@ function createSettlementMessage(childId, terminal) {
 	});
 }
 //#endregion
-//#region lib/types/inbox.js
+//#region lib/types/descriptor.js
 /**
-* Activation-local admission around one continuable subagent's Agent inbox.
+* The durable subagent-child descriptor: the versioned, model-hidden
+* `subagent/descriptor` session event that identifies every session-backed
+* subagent, including historical one-shot records. The manager appends each
+* continuable child's descriptor inside its initial turn, preserving the
+* declared composition required for cold resume.
+*
+* The descriptor deliberately snapshots explicit fields rather than the
+* merge-extensible `AgentOptions` object: an unrelated extension value cannot
+* make continuation fail merely because it is not JSON, and later composition
+* inputs require a deliberate {@link SUBAGENT_DESCRIPTOR_VERSION} change. It
+* omits `subagentDepth` — cold resume trusts the persisted header's
+* `delegationDepth` as the monotone floor — and `outputSchema`, which belongs
+* to one activation's result contract rather than durable child composition.
+* Per-activation knobs such as `maxTokens` are omitted for the same reason as
+* `outputSchema`: they budget one activation. Cold resume requires the exact
+* live parent for authorization but reconstructs child options only from the
+* durable descriptor, so it neither restores the prior budget nor inherits
+* the parent's current one; the resumed route's defaults apply instead.
 *
-* @module @deepseek-ai/dsh-subagent/inbox
+* @module @deepseek-ai/dsh-subagent/descriptor
 */
-/** Delegate Queue and Steer to one live Agent until its Activation starts closing. */
-var SubagentInbox = class {
-	agent;
-	closingPromise;
-	/**
-	* Wrap one live continuable Agent.
-	* @param agent - the Agent whose inbox receives accepted deliveries.
-	*/
-	constructor(agent) {
-		this.agent = agent;
-	}
-	/**
-	* Read the Activation's close transaction.
-	* @returns the memoized transaction, or `undefined` while delivery remains open.
-	*/
-	get closing() {
-		return this.closingPromise;
-	}
-	/**
-	* Read whether the underlying Agent still has accepted work to claim.
-	* @returns whether either Agent inbox destination is non-empty.
-	*/
-	get hasPending() {
-		return this.agent.inbox.nextTurn.length > 0 || this.agent.inbox.nextStep.length > 0;
-	}
-	/**
-	* Submit through the Agent only while its Activation remains resident.
-	* @param message - the accepted input to submit.
-	* @param delivery - whether to queue a distinct turn or steer the nearest step.
-	*/
-	deliver(message, delivery) {
-		if (this.closingPromise !== void 0) throw new SubagentError(`subagent "${this.agent.id}" activation is being disposed; the message was not accepted`, "ACTIVATION_CLOSING");
-		if (delivery === "steer") this.agent.steer(message);
-		else this.agent.followup(message);
-	}
-	/**
-	* Close delivery synchronously and share one asynchronous release.
-	* @param release - the one release operation to start after closing admission.
-	* @returns the memoized release transaction.
-	*/
-	close(release) {
-		const existing = this.closingPromise;
-		if (existing !== void 0) return existing;
-		const completion = Promise.withResolvers();
-		this.closingPromise = completion.promise;
-		release().then(completion.resolve, completion.reject);
-		return completion.promise;
-	}
-};
-//#endregion
-//#region lib/types/continuation-activation.js
 /**
-* Process-local Activation ownership for continuable subagents: admission,
-* parent-child residency, serialized delivery, settlement, and disposal.
-*
-* The continuation manager owns durable request orchestration and delegates
-* every mutable residency decision to this registry, so delivery and teardown
-* share one child lock and one Activation map.
-*
-* @module @deepseek-ai/dsh-subagent/continuation-activation
+* The current descriptor format version, stamped into every appended
+* `subagent/descriptor` event and required verbatim by {@link foldSubagentDescriptor}.
+* Supporting another composition input is a deliberate version change, never
+* an implicit extra field.
 */
-/** Process-local slots shared through uninterrupted continuable parent links. */
-var ActivationPool = class {
-	slots = /* @__PURE__ */ new Set();
-	/** Reserve before reconstruction; the returned release also tolerates unpublished rollback. */
-	reserve(capacity) {
-		if (this.slots.size >= capacity) throw new SubagentError(`subagent limit reached (active child limit: ${capacity}); wait for an existing child to finish or complete this work with the current agents`, "ACTIVATION_LIMIT_REACHED");
-		const slot = Symbol();
-		this.slots.add(slot);
-		return () => {
-			this.slots.delete(slot);
-		};
-	}
-};
-/** Serialize each durable child's delivery, release, and disposal. */
-var ChildLock = class {
-	tails = /* @__PURE__ */ new Map();
-	/**
-	* Run `operation` after every previously queued operation for `childId`.
-	* @param childId - the durable child whose operations are linearized.
-	* @param operation - the critical section to run in order.
-	* @returns the operation's own settlement.
-	*/
-	run(childId, operation) {
-		const result = (this.tails.get(childId) ?? Promise.resolve()).then(operation, operation);
-		const tail = result.then(() => void 0, () => void 0);
-		this.tails.set(childId, tail);
-		tail.then(() => {
-			if (this.tails.get(childId) === tail) this.tails.delete(childId);
-		});
-		return result;
-	}
-};
-/** Own the complete process-local lifetime of continuable child Activations. */
-var ContinuableActivationRegistry = class {
-	ctx;
-	observeActivation;
-	maxActiveSubagents;
-	/** Child session id → its live Activation. Process-local, never durable. */
-	resident = /* @__PURE__ */ new Map();
-	/** Root identities retain their pool across child settlement without retaining dead roots. */
-	rootPools = /* @__PURE__ */ new WeakMap();
-	/** Materializations admitted before drain, tracked through publication or rollback. */
-	materializations = /* @__PURE__ */ new Set();
-	/** Per-child serializer shared by delivery, release, and disposal. */
-	locks = new ChildLock();
-	/** Structural Cordis owner of every Activation handle. */
-	ownerCtx;
-	/**
-	* Exact roots whose host teardown has begun, with the live lineage members
-	* observed under each root. Entries remain until that exact root leaves the
-	* Agent registry, closing admission throughout its host's teardown without
-	* poisoning a later same-id replacement.
-	*/
-	closingScopes = /* @__PURE__ */ new Map();
-	draining = false;
-	/**
-	* Build one registry inside the service's Agent-injected context.
-	* @param ctx - context providing Agents, Sessions, and teardown ownership.
-	* @param observeActivation - build the lifecycle observer for one residency epoch.
-	*/
-	constructor(ctx, observeActivation, maxActiveSubagents) {
-		this.ctx = ctx;
-		this.observeActivation = observeActivation;
-		this.maxActiveSubagents = maxActiveSubagents;
-		const scope = ctx.plugin(function activationOwner() {});
-		this.ownerCtx = scope.ctx;
-		ctx.on("agent/disposed", ({ agent }) => {
-			this.closingScopes.delete(agent);
-		});
-		ctx.effect(function* () {
-			yield scope.dispose;
-			yield () => this.drain();
-		}.bind(this), "subagents.continuations()");
-	}
-	/**
-	* Return the live Activation for a durable child id, if resident.
-	* @param childId - durable child session id to look up.
-	* @returns the process-local Activation, or `undefined` when it is not resident.
-	*/
-	get(childId) {
-		return this.resident.get(childId);
-	}
-	/**
-	* Reject one child identity already owned by a live Agent or Session.
-	* @param childId - proposed durable child session id.
-	*/
-	assertChildIdAvailable(childId) {
-		if (this.ctx.agents.get(childId) !== void 0 || this.ctx.get("sessions")?.get(childId) !== void 0) throw new SubagentError(`subagent "${childId}" already exists`, "DUPLICATE_CHILD");
-	}
-	/**
-	* Pre-register `childId` in a continuation-managed parent's owned set so the
-	* parent cannot settle while a caller is still establishing or resuming that
-	* child. Returns a releaser for the failure path; it removes only a hold
-	* this call added, and leaves ownership in place once a live Activation for
-	* the child exists.
-	* @param parent - the live direct parent the operation is admitted under.
-	* @param childId - the durable child the operation addresses.
-	* @returns the failure-path releaser; a no-op when nothing was added.
-	*/
-	holdOwnership(parent, childId) {
-		const parentActivation = this.resident.get(parent.id);
-		if (parentActivation === void 0 || parentActivation.handle.agent !== parent) return () => {};
-		if (parentActivation.inbox.closing !== void 0) throw new SubagentError(`subagent parent "${parent.id}" is being disposed; the child was not established`, "ACTIVATION_CLOSING");
-		if (parentActivation.ownedChildren.has(childId)) return () => {};
-		parentActivation.ownedChildren.add(childId);
-		return () => {
-			const live = this.resident.get(childId);
-			/* v8 ignore next 4 -- reaching this arm needs another delivery to establish the child
-			* between this operation's failure and its releaser running, which no test can schedule
-			* deterministically: the ownership edge then belongs to that live Activation, so the
-			* conservative keep leaves it for finishDisposal's releaseOwnership. */
-			if (live !== void 0 && live.inbox.closing === void 0) return;
-			if (parentActivation.ownedChildren.delete(childId)) this.wake(parentActivation);
-		};
-	}
-	/**
-	* Interrupt one live continuable child's current turn under the supplied authority.
-	* @param targetSessionId - the durable child session id to interrupt.
-	* @param authority - the human parent address or exact live ancestor Agent.
-	*/
-	interrupt(targetSessionId, authority) {
-		if (authority.kind === "ancestor") {
-			const caller = authority.agent;
-			if (this.ctx.agents.get(caller.id) !== caller) throw new SubagentError(`interrupting "${targetSessionId}" requires the exact live ancestor agent`, "UNAUTHORIZED");
-			if (caller.id === targetSessionId) throw new SubagentError(`agent "${caller.id}" cannot interrupt itself`, "UNAUTHORIZED");
-		}
-		const activation = this.resident.get(targetSessionId);
-		if (activation === void 0) return;
-		if (authority.kind === "user") {
-			if (activation.handle.agent.session.header.parentSession !== authority.parentSessionId) throw new SubagentError(`subagent "${targetSessionId}" belongs to another parent session`, "UNAUTHORIZED");
-		} else if (!activation.ancestry.has(authority.agent)) throw new SubagentError(`subagent "${targetSessionId}" is not a live descendant of agent "${authority.agent.id}"`, "UNAUTHORIZED");
-		if (activation.inbox.closing !== void 0) return;
-		activation.handle.agent.cancel(authority.kind === "user" ? { kind: "user" } : { kind: "parent" }, { keepInbox: true });
-	}
-	/**
-	* Send through a receiving parent's Activation inbox when it has one.
-	* @param parent - exact live Agent receiving the message.
-	* @param message - durable user message to deliver.
-	* @param delivery - receiving inbox destination.
-	*/
-	sendWaking(parent, message, delivery) {
-		const parentActivation = this.resident.get(parent.id);
-		if (parentActivation !== void 0 && parentActivation.handle.agent === parent) {
-			try {
-				parentActivation.inbox.deliver(message, delivery);
-			} finally {
-				this.wake(parentActivation);
-			}
-			return;
-		}
-		if (delivery === "steer") parent.steer(message);
-		else parent.followup(message);
-	}
-	/**
-	* Close admission, await every already-admitted materialization through
-	* publication or rollback, then dispose the stable live Activation graph
-	* child-first.
-	*/
-	async drain() {
-		this.draining = true;
-		await Promise.all([...this.materializations].map((materialization) => materialization.settled));
-		const owned = /* @__PURE__ */ new Set();
-		for (const activation of this.resident.values()) for (const child of activation.ownedChildren) owned.add(child);
-		const roots = [...this.resident.values()].filter((activation) => !owned.has(activation.childId));
-		await this.disposeRoots(roots, "activation(s)");
-	}
-	/**
-	* Stop only the continuable descendants of exact live host-owned parents.
-	* @param parents - exact live roots whose continuable descendants must stop.
-	*/
-	async drainDescendants(parents) {
-		const roots = new Set(parents.filter((parent) => this.ctx.agents.get(parent.id) === parent));
-		if (roots.size === 0) return;
-		for (const root of roots) this.closingMembers(root).add(root);
-		const targets = [];
-		for (const activation of this.resident.values()) {
-			const lineage = this.liveLineage(activation.handle.agent);
-			const owners = [...roots].filter((root) => activation.handle.agent !== root && activation.ancestry.has(root));
-			if (owners.length === 0) continue;
-			targets.push(activation);
-			for (const owner of owners) {
-				const members = this.closingMembers(owner);
-				members.add(activation.handle.agent);
-				for (const agent of lineage) members.add(agent);
-			}
-		}
-		const materializations = [...this.materializations].filter((materialization) => {
-			const owners = [...roots].filter((root) => materialization.lineage.includes(root));
-			for (const owner of owners) {
-				const members = this.closingMembers(owner);
-				for (const agent of materialization.lineage) members.add(agent);
-			}
-			return owners.length > 0;
-		});
-		const ownedTargets = /* @__PURE__ */ new Set();
-		for (const activation of targets) for (const child of activation.ownedChildren) ownedTargets.add(child);
-		const targetRoots = targets.filter((activation) => !ownedTargets.has(activation.childId));
-		for (const activation of targets) this.dispose(activation).catch(() => void 0);
-		await Promise.all(materializations.map((materialization) => materialization.settled));
-		await this.disposeRoots(targetRoots, "scoped activation(s)");
-	}
-	/**
-	* Release selected resident direct children of one exact live parent.
-	* @param parent - exact live direct parent authorizing the selected release.
-	* @param childIds - durable direct-child ids to release when resident.
-	*/
-	async drainChildren(parent, childIds) {
-		if (this.ctx.agents.get(parent.id) !== parent) throw new SubagentError("selected child teardown requires the exact live parent agent", "UNAUTHORIZED");
-		const targets = [];
-		for (const childId of new Set(childIds)) {
-			const activation = this.resident.get(childId);
-			if (activation === void 0) continue;
-			if (activation.parentSession !== parent.id || !activation.ancestry.has(parent)) throw new SubagentError(`subagent "${childId}" is not a direct child of agent "${parent.id}"`, "UNAUTHORIZED");
-			targets.push(activation);
-		}
-		for (const activation of targets) this.dispose(activation).catch(() => void 0);
-		await this.disposeRoots(targets, "selected activation(s)");
-	}
-	/**
-	* Reject new admission once the registry or this exact parent tree began draining.
-	* @param agent - exact live Agent whose lineage determines admission.
-	*/
-	assertAdmitting(agent) {
-		const closing = this.closingTeardownFor(agent);
-		if (closing === void 0) return;
-		throw new SubagentError(closing === "manager" ? "continuable subagents are draining; the operation was not admitted" : `continuable subagents below parent "${closing.id}" are draining; the operation was not admitted`, "DRAINING");
-	}
-	/**
-	* Authorize one operation against the durable direct-parent lineage.
-	* @param parent - exact live Agent claiming direct-parent authority.
-	* @param childId - durable child session id addressed by the operation.
-	* @param parentSession - durable direct-parent id recorded by the child.
-	*/
-	authorizeLineage(parent, childId, parentSession) {
-		if (this.ctx.agents.get(parent.id) !== parent) throw new SubagentError(`subagent "${childId}" delivery requires the exact live parent agent`, "UNAUTHORIZED");
-		if (parentSession !== parent.id) throw new SubagentError(`subagent "${childId}" belongs to another parent session`, "UNAUTHORIZED");
-	}
-	/**
-	* Create or resume one child Agent and publish its Activation.
-	* @param inputs - reconstruction and admission inputs for the residency epoch.
-	* @returns the published process-local Activation.
-	*/
-	materialize(inputs) {
-		this.assertAdmitting(inputs.parent);
-		inputs.signal.throwIfAborted();
-		const lineage = this.liveLineage(inputs.parent);
-		const pool = this.resident.get(inputs.parent.id)?.pool ?? this.rootPool(inputs.parent);
-		const releaseSlot = pool.reserve(this.maxActiveSubagents());
-		const settled = Promise.withResolvers();
-		const materialization = {
-			lineage,
-			settled: settled.promise
-		};
-		this.materializations.add(materialization);
-		return this.materializeTracked(inputs, lineage, pool, releaseSlot).catch((error) => {
-			releaseSlot();
-			throw error;
-		}).finally(() => {
-			this.materializations.delete(materialization);
-			settled.resolve();
-		});
-	}
-	/**
-	* Cross the final admission cutoff and submit without yielding.
-	* @param activation - the exact resident child receiving the message.
-	* @param message - the already-built durable user message.
-	* @param delivery - the Agent inbox destination.
-	* @param parent - exact live direct parent authorizing admission.
-	* @param signal - caller cancellation before inbox acceptance.
-	* @returns the accepted durable message id.
-	*/
-	submitAdmitted(activation, message, delivery, parent, signal) {
-		signal.throwIfAborted();
-		this.assertAdmitting(parent);
-		this.authorizeLineage(parent, activation.childId, activation.handle.agent.session.header.parentSession);
-		this.acquireOwnership(parent, activation.childId);
-		try {
-			activation.inbox.deliver(message, delivery);
-		} finally {
-			this.wake(activation);
-		}
-		return message.id;
-	}
-	/**
-	* Stop and release one Activation through its memoized close transaction.
-	* @param activation - exact residency epoch to close.
-	* @param finalStateFlushed - whether natural settlement already flushed final state.
-	* @returns the shared close transaction.
-	*/
-	dispose(activation, finalStateFlushed = false) {
-		return activation.inbox.close(() => this.finishDisposal(activation, finalStateFlushed));
-	}
-	/** Dispose independent roots and report every branch failure after all settle. */
-	async disposeRoots(roots, failureSubject) {
-		const reasons = (await Promise.all(roots.map(async (activation) => {
-			try {
-				await this.dispose(activation);
-				return;
-			} catch (error) {
-				return error;
-			}
-		}))).filter((failure) => failure !== void 0);
-		if (reasons.length > 0) throw new SubagentError(`continuable subagent teardown failed for ${reasons.length} ${failureSubject}: ` + reasons.map((reason) => errorChain(reason)).join("; "), "ACTIVATION_TEARDOWN_FAILED");
-	}
-	/** Return the retained member set for one exact scoped-teardown root. */
-	closingMembers(root) {
-		const existing = this.closingScopes.get(root);
-		if (existing !== void 0) return existing;
-		const members = /* @__PURE__ */ new Set();
-		this.closingScopes.set(root, members);
-		return members;
-	}
-	/** Return the exact currently resolvable ancestry from `agent` upward. */
-	liveLineage(agent) {
-		const lineage = [agent];
-		const seen = new Set([agent.id]);
-		let parentSession = agent.session.header.parentSession;
-		while (parentSession !== void 0) {
-			const parent = this.ctx.agents.get(parentSession);
-			if (parent === void 0 || seen.has(parent.id)) break;
-			lineage.push(parent);
-			seen.add(parent.id);
-			parentSession = parent.session.header.parentSession;
-		}
-		return lineage;
-	}
-	/** Return the teardown that closed continuable admission for this agent's lineage. */
-	closingTeardownFor(agent) {
-		if (this.draining) return "manager";
-		const lineage = this.liveLineage(agent);
-		for (const [root, members] of this.closingScopes) if (members.has(agent) || lineage.includes(root)) return root;
-	}
-	/** Resolve a root's pool once; descendants inherit their resident parent's pool directly. */
-	rootPool(parent) {
-		let pool = this.rootPools.get(parent);
-		if (pool === void 0) {
-			pool = new ActivationPool();
-			this.rootPools.set(parent, pool);
-		}
-		return pool;
-	}
-	/** Perform one tracked materialization through publication or rollback. */
-	async materializeTracked(inputs, parentLineage, pool, releaseSlot) {
-		const { childId, provider, parent, create } = inputs;
-		inputs.signal.throwIfAborted();
-		const setup = (childCtx, child) => {
-			if (create !== void 0) {
-				child.session.append("subagent/descriptor", create.descriptor);
-				appendDelegatedPolicyOverrides(child.session, create.delegatedPolicies);
-			}
-			applyChildComposition(childCtx, parent, inputs.composition);
-		};
-		const observer = this.observeActivation(provider, childId, parent);
-		const handle = create === void 0 ? await this.ownerCtx.agents.resume({
-			resumeSessionId: childId,
-			parentAgent: parent,
-			agentOptions: inputs.agentOptions,
-			signal: inputs.signal,
-			setup
-		}) : await this.ownerCtx.agents.create({
-			sessionId: childId,
-			parentAgent: parent,
-			meta: create.meta,
-			...create.seed === void 0 ? {} : { seed: create.seed },
-			inheritedEventCount: create.inheritedEventCount,
-			agentOptions: inputs.agentOptions,
-			signal: inputs.signal,
-			setup
-		});
-		const activation = {
-			pool,
-			releaseSlot,
-			childId,
-			parentSession: parent.id,
-			provider,
-			handle,
-			inbox: new SubagentInbox(handle.agent),
-			ancestry: new WeakSet([handle.agent, ...parentLineage]),
-			ownedChildren: /* @__PURE__ */ new Set(),
-			observer,
-			announced: false,
-			poke: Promise.withResolvers()
-		};
-		this.resident.set(childId, activation);
-		try {
-			inputs.signal.throwIfAborted();
-			this.assertAdmitting(parent);
-			this.acquireOwnership(parent, childId);
-			const wakeOnInboxRemoval = () => {
-				this.wake(activation);
-			};
-			handle.agent.ctx.on("agent/inbox/claimed", wakeOnInboxRemoval);
-			handle.agent.ctx.on("agent/inbox/discarded", wakeOnInboxRemoval);
-			observer.start(handle.agent);
-		} catch (error) {
-			/* v8 ignore next -- rollback failure must not mask the admission failure
-			* that prevented this operation from returning an accepted message id. */
-			await this.rollbackUnpublished(activation).catch(() => void 0);
-			throw error;
-		}
-		this.watchSettlement(activation);
-		return activation;
-	}
-	/** Release an Activation whose start edge was not published. */
-	rollbackUnpublished(activation) {
-		return activation.inbox.close(async () => {
-			try {
-				await activation.handle.dispose();
-			} finally {
-				this.resident.delete(activation.childId);
-				activation.releaseSlot();
-				this.releaseOwnership(activation.childId);
-			}
-		});
-	}
-	/** Register the child in a continuation-managed parent's owned set. */
-	acquireOwnership(parent, childId) {
-		const parentActivation = this.resident.get(parent.id);
-		if (parentActivation === void 0) return;
-		if (parentActivation.inbox.closing !== void 0) throw new SubagentError(`subagent parent "${parent.id}" is being disposed; the child was not established`, "ACTIVATION_CLOSING");
-		parentActivation.ownedChildren.add(childId);
-	}
-	/** Remove one child from its live owner's set and let that owner re-check settlement. */
-	releaseOwnership(childId) {
-		for (const candidate of this.resident.values()) if (candidate.ownedChildren.delete(childId)) this.wake(candidate);
-	}
-	/** Let a settlement watcher re-check residency after relevant state changes. */
-	wake(activation) {
-		activation.poke.resolve();
-		activation.poke = Promise.withResolvers();
-	}
-	/** Follow one Activation to natural settlement. */
-	watchSettlement(activation) {
-		(async () => {
-			while (true) {
-				const idleObservation = activation.poke;
-				await activation.handle.agent.whenIdle();
-				if (activation.inbox.closing !== void 0) return;
-				const readiness = await this.locks.run(activation.childId, () => Promise.resolve(this.settlementState(activation, idleObservation)));
-				if (readiness === "closed") return;
-				if (readiness === "retry") continue;
-				if (readiness === "wait") {
-					await idleObservation.promise;
-					continue;
-				}
-				const finalSeq = activation.handle.agent.session.seq;
-				await this.flushFinalState(activation);
-				const attempt = await this.locks.run(activation.childId, () => {
-					const state = this.settlementState(activation, idleObservation);
-					if (state !== "ready") return Promise.resolve(state);
-					if (activation.handle.agent.session.seq !== finalSeq) return Promise.resolve("retry");
-					let done;
-					try {
-						activation.handle.agent.runMaintenance(() => {
-							done = this.dispose(activation, true);
-							return Promise.resolve();
-						});
-					} catch {
-						return Promise.resolve("retry");
-					}
-					return Promise.resolve({ done });
-				});
-				if (attempt === "closed") return;
-				if (attempt === "retry") continue;
-				if (attempt === "wait") {
-					await idleObservation.promise;
-					continue;
-				}
-				try {
-					await attempt.done;
-				} catch (error) {
-					this.ctx.logger.warn(`subagent "${activation.childId}" activation teardown failed: ${errorChain(error)}`);
-				}
-				return;
-			}
-		})();
-	}
-	/** Classify one Inbox and owned-child observation without reading Agent execution state. */
-	settlementState(activation, observation) {
-		if (activation.inbox.closing !== void 0) return "closed";
-		if (activation.poke !== observation) return "retry";
-		if (activation.inbox.hasPending || activation.ownedChildren.size > 0) return "wait";
-		return "ready";
-	}
-	/** Propagate stop synchronously, then finish the child-first release. */
-	async finishDisposal(activation, finalStateFlushed) {
-		this.wake(activation);
-		const { childId } = activation;
-		const failures = [];
-		if (finalStateFlushed) try {
-			activation.observer.capture(activation.handle.agent);
-		} catch (error) {
-			failures.push(new SubagentError(`subagent "${childId}" activation teardown failed: ${errorChain(error)}`, "ACTIVATION_TEARDOWN_FAILED", { cause: error }));
-		}
-		else {
-			activation.handle.agent.cancel({ kind: "parent" });
-			const idle = activation.handle.agent.whenIdle();
-			const childDisposals = [...activation.ownedChildren].map((child) => this.resident.get(child)).filter((child) => child !== void 0).map((child) => this.dispose(child));
-			try {
-				const reasons = (await Promise.all(childDisposals.map(async (disposal) => {
-					try {
-						await disposal;
-						return;
-					} catch (error) {
-						return error;
-					}
-				}))).filter((reason) => reason !== void 0);
-				if (reasons.length > 0) failures.push(new SubagentError(`subagent "${childId}" child teardown failed: ${reasons.map((reason) => errorChain(reason)).join("; ")}`, "ACTIVATION_TEARDOWN_FAILED"));
-				await idle;
-				await this.flushFinalState(activation);
-				activation.observer.capture(activation.handle.agent);
-			} catch (error) {
-				failures.push(new SubagentError(`subagent "${childId}" activation teardown failed: ${errorChain(error)}`, "ACTIVATION_TEARDOWN_FAILED", { cause: error }));
-			}
-		}
-		try {
-			await activation.handle.dispose();
-		} catch (error) {
-			failures.push(new SubagentError(`subagent "${childId}" activation handle disposal failed: ${errorChain(error)}`, "ACTIVATION_TEARDOWN_FAILED", { cause: error }));
-		}
-		let failure;
-		if (failures.length === 1) failure = failures[0];
-		else if (failures.length > 1) failure = new SubagentError(`subagent "${childId}" activation teardown failed at ${failures.length} boundaries: ` + failures.map((item) => errorChain(item)).join("; "), "ACTIVATION_TEARDOWN_FAILED", { cause: new AggregateError(failures) });
-		this.resident.delete(childId);
-		activation.releaseSlot();
-		this.notifySettlement(activation, activation.observer.terminal(failure));
-		this.releaseOwnership(childId);
-		activation.observer.settle(failure);
-		if (failure !== void 0) throw failure;
-	}
-	/** Tell the durable direct parent how this Activation ended. */
-	notifySettlement(activation, terminal) {
-		if (!activation.announced) return;
-		try {
-			const parent = this.ctx.agents.get(activation.parentSession);
-			if (parent === void 0) return;
-			const message = createSettlementMessage(activation.childId, terminal);
-			if (this.closingTeardownFor(parent) !== void 0) {
-				parent.inject(message);
-				return;
-			}
-			this.sendWaking(parent, message, parent.status === "idle" ? "queue" : "steer");
-		} catch (error) {
-			this.ctx.logger.warn(`subagent "${activation.childId}" settlement notice was not delivered to its parent: ` + errorChain(error));
-		}
-	}
-	/** Request a best-effort final session flush before closing natural-settlement admission. */
-	async flushFinalState(activation) {
-		const child = activation.handle.agent;
-		try {
-			await child.ctx.sessions.flush(child.session);
-		} catch (error) {
-			this.ctx.logger.warn(`subagent "${activation.childId}" best-effort final session flush failed; the persisted state may be unavailable or stale on resume: ${errorChain(error)}`);
-		}
-	}
-};
-//#endregion
-//#region lib/types/descriptor.js
-/**
-* The durable subagent-child descriptor: the versioned, model-hidden
-* `subagent/descriptor` session event that identifies every session-backed
-* subagent and records whether it is one-shot or continuable. Continuable
-* descriptors additionally preserve the declared composition required for
-* cold resume. Providers append it turn-enclosed in the child's initial turn.
-*
-* The descriptor deliberately snapshots explicit fields rather than the
-* merge-extensible `AgentOptions` object: an unrelated extension value cannot
-* make continuation fail merely because it is not JSON, and later composition
-* inputs require a deliberate {@link SUBAGENT_DESCRIPTOR_VERSION} change. It
-* omits `subagentDepth` — cold resume trusts the persisted header's
-* `delegationDepth` as the monotone floor — and `outputSchema`, which belongs
-* to one activation's result contract rather than durable child composition.
-* Per-activation knobs such as `maxTokens` are omitted for the same reason as
-* `outputSchema`: they budget one activation. Cold resume requires the exact
-* live parent for authorization but reconstructs child options only from the
-* durable descriptor, so it neither restores the prior budget nor inherits
-* the parent's current one; the resumed route's defaults apply instead.
-*
-* @module @deepseek-ai/dsh-subagent/descriptor
-*/
-/**
-* The current descriptor format version, stamped into every appended
-* `subagent/descriptor` event and required verbatim by {@link foldSubagentDescriptor}.
-* Supporting another composition input is a deliberate version change, never
-* an implicit extra field.
-*/
-const SUBAGENT_DESCRIPTOR_VERSION = 3;
-const DESCRIPTOR_BASE_KEYS = [
-	"version",
-	"mode",
-	"provider",
-	"label"
-];
-const ONE_SHOT_DESCRIPTOR_KEYS = new Set(DESCRIPTOR_BASE_KEYS);
-const CONTINUABLE_DESCRIPTOR_KEYS = new Set([
-	...DESCRIPTOR_BASE_KEYS,
-	"agentProvider",
-	"agentModel",
-	"agentReasoningEffort",
-	"persona",
-	"toolFilter"
-]);
-const TOOL_FILTER_KEYS = new Set(["allow", "deny"]);
-/** Whether a persisted JSON value is an object record. */
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/** Reject fields outside one versioned record's declared schema. */
-function assertKnownKeys(value, keys, path) {
-	const unknown = Object.keys(value).find((key) => !keys.has(key));
-	if (unknown !== void 0) throw new Error(`persisted subagent descriptor ${path} has unknown field "${unknown}"`);
-}
-/** Read one optional string field from a persisted descriptor record. */
-function optionalString(value, key) {
-	if (!Object.hasOwn(value, key)) return void 0;
-	const field = value[key];
-	if (typeof field !== "string") throw new Error(`persisted subagent descriptor ${key} must be a string`);
-	return field;
-}
-/** Read one optional string-array field from a persisted tool restriction. */
-function optionalStringArray(value, key) {
-	if (!Object.hasOwn(value, key)) return void 0;
-	const field = value[key];
-	if (!Array.isArray(field)) throw new Error(`persisted subagent descriptor toolFilter.${key} must be an array of strings`);
-	const items = field;
-	if (items.some((item) => typeof item !== "string")) throw new Error(`persisted subagent descriptor toolFilter.${key} must be an array of strings`);
-	return items;
-}
-/** Validate and reconstruct a persisted tool restriction. */
-function parseToolFilter(value) {
-	if (!isRecord(value)) throw new Error("persisted subagent descriptor toolFilter must be an object");
-	assertKnownKeys(value, TOOL_FILTER_KEYS, "toolFilter");
-	const allow = optionalStringArray(value, "allow");
-	const deny = optionalStringArray(value, "deny");
-	if (allow === void 0 && deny === void 0) throw new Error("persisted subagent descriptor toolFilter must declare allow and/or deny");
-	return {
-		...allow !== void 0 ? { allow } : {},
-		...deny !== void 0 ? { deny } : {}
-	};
-}
-/** Validate one persisted descriptor payload for the current runtime. */
-function parseSubagentDescriptor(value) {
-	if (!isRecord(value)) throw new Error("persisted subagent descriptor payload must be an object");
-	const version = value["version"];
-	if (typeof version !== "number") throw new Error("persisted subagent descriptor version must be a number");
-	if (version !== 3) return void 0;
-	const mode = value["mode"];
-	if (mode !== "one-shot" && mode !== "continuable") throw new Error("persisted subagent descriptor mode must be \"one-shot\" or \"continuable\"");
-	assertKnownKeys(value, mode === "one-shot" ? ONE_SHOT_DESCRIPTOR_KEYS : CONTINUABLE_DESCRIPTOR_KEYS, "payload");
-	const provider = value["provider"];
-	if (typeof provider !== "string") throw new Error("persisted subagent descriptor provider must be a string");
-	if (mode === "one-shot") {
-		const label = optionalString(value, "label");
-		return {
-			version: 3,
-			mode,
-			provider,
-			...label !== void 0 ? { label } : {}
+const SUBAGENT_DESCRIPTOR_VERSION = 3;
+const DESCRIPTOR_BASE_KEYS = [
+	"version",
+	"mode",
+	"provider",
+	"label"
+];
+const ONE_SHOT_DESCRIPTOR_KEYS = new Set(DESCRIPTOR_BASE_KEYS);
+const CONTINUABLE_DESCRIPTOR_KEYS = new Set([
+	...DESCRIPTOR_BASE_KEYS,
+	"agentProvider",
+	"agentModel",
+	"agentReasoningEffort",
+	"persona",
+	"toolFilter"
+]);
+const TOOL_FILTER_KEYS = new Set(["allow", "deny"]);
+/** Whether a persisted JSON value is an object record. */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Reject fields outside one versioned record's declared schema. */
+function assertKnownKeys(value, keys, path) {
+	const unknown = Object.keys(value).find((key) => !keys.has(key));
+	if (unknown !== void 0) throw new Error(`persisted subagent descriptor ${path} has unknown field "${unknown}"`);
+}
+/** Read one optional string field from a persisted descriptor record. */
+function optionalString(value, key) {
+	if (!Object.hasOwn(value, key)) return void 0;
+	const field = value[key];
+	if (typeof field !== "string") throw new Error(`persisted subagent descriptor ${key} must be a string`);
+	return field;
+}
+/** Read one optional string-array field from a persisted tool restriction. */
+function optionalStringArray(value, key) {
+	if (!Object.hasOwn(value, key)) return void 0;
+	const field = value[key];
+	if (!Array.isArray(field)) throw new Error(`persisted subagent descriptor toolFilter.${key} must be an array of strings`);
+	const items = field;
+	if (items.some((item) => typeof item !== "string")) throw new Error(`persisted subagent descriptor toolFilter.${key} must be an array of strings`);
+	return items;
+}
+/** Validate and reconstruct a persisted tool restriction. */
+function parseToolFilter(value) {
+	if (!isRecord(value)) throw new Error("persisted subagent descriptor toolFilter must be an object");
+	assertKnownKeys(value, TOOL_FILTER_KEYS, "toolFilter");
+	const allow = optionalStringArray(value, "allow");
+	const deny = optionalStringArray(value, "deny");
+	if (allow === void 0 && deny === void 0) throw new Error("persisted subagent descriptor toolFilter must declare allow and/or deny");
+	return {
+		...allow !== void 0 ? { allow } : {},
+		...deny !== void 0 ? { deny } : {}
+	};
+}
+/** Validate one persisted descriptor payload for the current runtime. */
+function parseSubagentDescriptor(value) {
+	if (!isRecord(value)) throw new Error("persisted subagent descriptor payload must be an object");
+	const version = value["version"];
+	if (typeof version !== "number") throw new Error("persisted subagent descriptor version must be a number");
+	if (version !== 3) return void 0;
+	const mode = value["mode"];
+	if (mode !== "one-shot" && mode !== "continuable") throw new Error("persisted subagent descriptor mode must be \"one-shot\" or \"continuable\"");
+	assertKnownKeys(value, mode === "one-shot" ? ONE_SHOT_DESCRIPTOR_KEYS : CONTINUABLE_DESCRIPTOR_KEYS, "payload");
+	const provider = value["provider"];
+	if (typeof provider !== "string") throw new Error("persisted subagent descriptor provider must be a string");
+	if (mode === "one-shot") {
+		const label = optionalString(value, "label");
+		return {
+			version: 3,
+			mode,
+			provider,
+			...label !== void 0 ? { label } : {}
 		};
 	}
 	const label = value["label"];
@@ -1399,13 +661,14 @@ function parseSubagentDescriptor(value) {
 		...toolFilter !== void 0 ? { toolFilter } : {}
 	};
 }
+/**
+* Validate and detach a continuable descriptor input.
+* @param input - the caller-collected continuable composition fields.
+* @returns the versioned, detached continuable descriptor payload.
+* @throws when a field is not losslessly JSON-serializable.
+*/
 function snapshotSubagentDescriptor(input) {
-	const snapshot = snapshotJsonValue(input.mode === "one-shot" ? {
-		version: 3,
-		mode: input.mode,
-		provider: input.provider,
-		...input.label !== void 0 ? { label: input.label } : {}
-	} : {
+	const snapshot = snapshotJsonValue({
 		version: 3,
 		mode: input.mode,
 		provider: input.provider,
@@ -1451,12 +714,17 @@ const continuableCatalogSchema = z$1.object({
 	mode: z$1.literal("continuable"),
 	label: z$1.string()
 }).strict();
+const externalCatalogSchema = oneShotCatalogSchema.extend({
+	version: z$1.literal(2),
+	mode: z$1.literal("external")
+});
 const unknownCatalogSchema = oneShotCatalogSchema.extend({
 	version: z$1.literal(1),
 	mode: z$1.literal("unknown")
 });
 const eventDataSchema = z$1.union([
 	oneShotCatalogSchema,
+	externalCatalogSchema,
 	continuableCatalogSchema,
 	unknownCatalogSchema
 ]);
@@ -1469,6 +737,14 @@ const viewSchema = z$1.array(z$1.union([
 		id: sessionIdSchema,
 		createdAt: oneShotCatalogSchema.shape.childCreatedAt
 	}),
+	externalCatalogSchema.omit({
+		version: true,
+		childId: true,
+		childCreatedAt: true
+	}).extend({
+		id: sessionIdSchema,
+		createdAt: externalCatalogSchema.shape.childCreatedAt
+	}),
 	continuableCatalogSchema.omit({
 		version: true,
 		childId: true,
@@ -1491,102 +767,383 @@ const stateSchema = z$1.object({
 	head: chunkedListSchema(eventDataSchema).optional()
 }).strict();
 /**
-* Materialize complete and unknown-mode child identities from parent catalog events.
-* @param state - parent catalog fold state.
-* @returns current direct-child rows in parent catalog event order.
+* Materialize complete and unknown-mode child identities from parent catalog events.
+* @param state - parent catalog fold state.
+* @returns current direct-child rows in parent catalog event order.
+*/
+function subagentCatalogEntries(state) {
+	const entries = [];
+	for (const data of iterateChunkedList(state.head)) {
+		const { version: _version, childId, childCreatedAt, ...descriptor } = data;
+		entries.push({
+			id: childId,
+			createdAt: childCreatedAt,
+			...descriptor
+		});
+	}
+	return entries;
+}
+/** Parent-owned direct-child catalog projection; invalid own facts reject restoration. */
+const subagentCatalogProjectionDefinition = {
+	key: "subagentCatalog",
+	stateSchema,
+	init: (_header, inheritedEventCount) => ({ inheritedEventCount }),
+	apply: (state, event) => {
+		if (event.type !== "subagent/catalog" || event.seq < state.inheritedEventCount) return state;
+		return {
+			...state,
+			head: appendChunkedList(state.head, eventDataSchema.parse(event.data))
+		};
+	},
+	stateVersion: 6,
+	wire: {
+		viewSchema,
+		view: subagentCatalogEntries
+	}
+};
+/**
+* Append a complete direct-child discovery fact to its parent Session.
+* @param parent - durable direct parent receiving the discovery fact.
+* @param child - established child's immutable Session metadata.
+* @param descriptor - mode-discriminated creation label frozen with the child.
+*/
+function establishCatalogChild(parent, child, descriptor) {
+	parent.append("subagent/catalog", {
+		version: 0,
+		childId: child.id,
+		childCreatedAt: child.createdAt,
+		mode: descriptor.mode,
+		label: descriptor.label
+	});
+}
+/** Catalog payload version emitted by external execution creation. */
+const EXTERNAL_SUBAGENT_CATALOG_VERSION = 2;
+/**
+* Record an external execution without a local child Session.
+* @param parent - durable direct parent receiving the discovery fact.
+* @param childId - identity returned by the external provider.
+* @param label - display label assigned by the caller.
+*/
+function establishExternalCatalogChild(parent, childId, label) {
+	parent.append("subagent/catalog", {
+		version: EXTERNAL_SUBAGENT_CATALOG_VERSION,
+		childId,
+		childCreatedAt: Date.now(),
+		mode: "external",
+		label
+	});
+}
+//#endregion
+//#region lib/types/internal.js
+/**
+* Continuation integration markers and host adapters outside the public
+* Service Definition and model-facing Agent messaging contract.
+* @module @deepseek-ai/dsh-subagent/internal
+*/
+/** Process-stable identity carried only by the standard adjacent-Agent messaging tool. */
+const adjacentAgentSendMessageTool = Symbol.for("dsh.subagent.adjacentAgentSendMessageTool");
+/**
+* Test whether one visible definition is the standard adjacent-Agent messaging tool.
+* @param definition - the scope-resolved `send_message` candidate.
+* @returns whether the definition carries the internal standard-tool identity.
+*/
+function isAdjacentAgentSendMessageTool(definition) {
+	return definition !== void 0 && definition[adjacentAgentSendMessageTool] === true;
+}
+/**
+* Process-stable symbol-keyed host delivery shared by the bundled runtime
+* entry and this unbundled internal subpath.
+* @internal
+*/
+const deliverSubagentPrompt = Symbol.for("dsh.subagent.deliverPrompt");
+//#endregion
+//#region lib/types/structured.js
+/**
+* Child-scoped structured-output tool, prompt instruction, terminal guard, and authoritative
+* result capture for in-process subagents. Each child registers its real schema on its own
+* scope, so concurrent runs do not interact and disposal leaves no global residue. The prompt
+* contribution is ordinary reconstructed request state.
+*
+* Capture commits only after the authoritative `tools/result` succeeds; PTC mode capture also
+* waits for the enclosing `run_code` result. The terminal result marker and monotonic tool
+* guard prevent later calls from reopening a completed structured run.
+* @module @deepseek-ai/dsh-subagent/structured
+*/
+/** The model-facing tool name a structured child must call to finish. */
+const STRUCTURED_OUTPUT_TOOL = "structured_output";
+/**
+* The instruction registered as the child's trailing scoped prompt section:
+* the demand travels with the
+* tool, as ordinary prompt state of exactly one agent.
+*/
+const STRUCTURED_OUTPUT_INSTRUCTION = `When you have your final answer, you MUST report it by calling the \`${STRUCTURED_OUTPUT_TOOL}\` tool with arguments matching its parameter schema exactly. Do not finish with a plain text answer: only the tool call counts as your result.`;
+/**
+* Attach the scoped capture tool, instruction, and enforcement to a child during
+* its creation window. Child disposal removes every registration.
+* @param childCtx - the child agent's scope context (`setup`'s argument).
+* @param schema - the trusted, already-asserted schema subset to enforce (see
+*   `assertObjectJsonSchema` in dsh-tools).
+* @param canComplete - whether accepted input and owned child work have finished.
+* @returns the attachment handle (read `captured()` after the child settles).
+*/
+function attachStructuredRuntime(childCtx, schema, canComplete) {
+	/**
+	* Validated values staged by the capture tool body, awaiting THEIR OWN
+	* authoritative `tools/result` notification. The execution object's identity
+	* uniquely identifies a trip through the pipeline: adapter call ids may
+	* repeat across steps, but another execution can never reach this Map
+	* entry. This is distinct from the opaque `ToolExecutionToken` used to
+	* correlate nested transports. The final notification always deletes its own
+	* stage, whether the result succeeded or failed.
+	*/
+	const staged = /* @__PURE__ */ new Map();
+	/** Successful nested capture waiting for its enclosing transport to commit. */
+	let pending;
+	let captured;
+	const schemaEntry = {
+		name: STRUCTURED_OUTPUT_TOOL,
+		description: "Report your final structured result. Call this exactly once, when your answer is complete; the arguments must match this tool's parameter schema exactly.",
+		parameters: { ...schema }
+	};
+	childCtx.tools.register({
+		...schemaEntry,
+		output: {
+			schema: {
+				type: "object",
+				properties: { recorded: {
+					type: "boolean",
+					const: true
+				} },
+				required: ["recorded"],
+				additionalProperties: false
+			},
+			render: () => [{
+				type: "text",
+				text: "Structured output recorded."
+			}]
+		},
+		execute(args, exec) {
+			const violations = validateJsonSchemaValue(schema, args);
+			if (violations.length > 0) throw new ToolArgsError(violations);
+			if (!canComplete()) throw new Error("Wait for all delegated child tasks to finish and process pending messages before submitting structured output.");
+			staged.set(exec, { value: args });
+			exec.concludeTurn();
+			return Promise.resolve({ recorded: true });
+		}
+	});
+	childCtx.systemPrompt.section({
+		name: `tool:${STRUCTURED_OUTPUT_TOOL}`,
+		order: childCtx.systemPrompt.getSectionOrder("STRUCTURED_OUTPUT"),
+		text: STRUCTURED_OUTPUT_INSTRUCTION
+	});
+	childCtx.tools.guard((exec) => captured === void 0 && pending === void 0 ? void 0 : `structured output already recorded: the run is complete, so \`${exec.name}\` is not executed`);
+	childCtx.on("tools/result", function(exec, result) {
+		if (exec.name === "structured_output") {
+			const entry = staged.get(exec);
+			if (entry === void 0) return;
+			staged.delete(exec);
+			if (result.isError) return;
+			if (exec.parent === void 0) {
+				/* v8 ignore else -- sequential agent-loop dispatch lets the guard block every later supported call */
+				if (captured === void 0) captured = { value: entry.value };
+			} else if (captured === void 0 && pending === void 0) pending = {
+				parent: exec.parent,
+				value: entry.value
+			};
+			return;
+		}
+		if (pending?.parent !== exec.token) return;
+		const entry = pending;
+		pending = void 0;
+		if (result.isError) return;
+		/* v8 ignore else -- PTC mode serializes outer executions, so the guard blocks every later supported call */
+		if (captured === void 0) captured = { value: entry.value };
+	});
+	return {
+		captured: () => captured,
+		acceptsInput: () => staged.size === 0 && pending === void 0 && captured === void 0
+	};
+}
+//#endregion
+//#region lib/types/assistant-output.js
+/**
+* Canonical selection of a child's final assistant output. Backend run results
+* and `subagent/end.lastAssistantMessage` apply the same rule: select the last
+* non-empty assistant message. An empty-content message records usage only
+* when the loop appends it after a max-tokens step with no executable blocks,
+* so it does not replace earlier output. If no non-empty message exists,
+* select the accumulated assistant text. Selection is independent of the
+* run's stop reason.
+*
+* @module @deepseek-ai/dsh-subagent/assistant-output
+*/
+/**
+* Incremental fold of the selection rule, for backends that observe a child's
+* output as it streams: session-event backends {@link push} each event, and
+* transports without session events (ACP content chunks) {@link pushText} raw
+* text into the same streamed fallback.
+*/
+var AssistantOutputFold = class {
+	message;
+	partial = [];
+	/**
+	* Fold one session event: a non-empty assistant message becomes the
+	* candidate final answer, while its embedded stream and any log-only attempt
+	* extend the streamed fallback; every other event contributes nothing.
+	* @param event - the next observed session event.
+	*/
+	push(event) {
+		if (event.type === "assistant/message") {
+			const content = event.data.message.content;
+			if (content.length > 0) this.message = content;
+		}
+		if (event.type === "assistant/message" || event.type === "assistant/attempt") this.pushText(joinAssistantStreamText(event.data.stream));
+	}
+	/**
+	* Extend the streamed fallback with text observed outside session events.
+	* @param text - the next streamed text piece (an empty piece is a no-op).
+	*/
+	pushText(text) {
+		if (text.length > 0) this.partial.push(text);
+	}
+	/**
+	* Select the final output folded so far.
+	* @returns the last non-empty assistant message, else the accumulated
+	*   streamed text, or `undefined` when the child produced neither.
+	*/
+	collect() {
+		if (this.message !== void 0) return this.message;
+		const text = this.partial.join("");
+		return text.length > 0 ? [{
+			type: "text",
+			text
+		}] : void 0;
+	}
+};
+/**
+* Apply the selection rule to one complete child-owned event suffix.
+* @param events - the child-owned events (after any seed or epoch boundary).
+* @returns the selected output, or `undefined` when the child produced none.
 */
-function subagentCatalogEntries(state) {
-	const entries = [];
-	for (const data of iterateChunkedList(state.head)) entries.push(data.mode !== "continuable" ? {
-		id: data.childId,
-		createdAt: data.childCreatedAt,
-		mode: data.mode,
-		...data.label === void 0 ? {} : { label: data.label }
-	} : {
-		id: data.childId,
-		createdAt: data.childCreatedAt,
-		mode: data.mode,
-		label: data.label
-	});
-	return entries;
+function finalAssistantOutput(events) {
+	const fold = new AssistantOutputFold();
+	for (const event of events) fold.push(event);
+	return fold.collect();
 }
-/** Parent-owned direct-child catalog projection; invalid own facts reject restoration. */
-const subagentCatalogProjectionDefinition = {
-	key: "subagentCatalog",
-	stateSchema,
-	init: (_header, inheritedEventCount) => ({ inheritedEventCount }),
-	apply: (state, event) => {
-		if (event.type !== "subagent/catalog" || event.seq < state.inheritedEventCount) return state;
-		return {
-			...state,
-			head: appendChunkedList(state.head, eventDataSchema.parse(event.data))
+//#endregion
+//#region lib/types/activation.js
+/** Execution-period records, capacity slots, child serialization, and local output capture.
+* @module @deepseek-ai/dsh-subagent/activation
+*/
+/** Process-local slots shared through uninterrupted continuable parent links. */
+var ActivationPool = class {
+	slots = /* @__PURE__ */ new Set();
+	/**
+	* Reserve before reconstruction; release also tolerates unpublished rollback.
+	* @param capacity - the maximum simultaneous activations in this pool.
+	* @returns an idempotent slot release.
+	*/
+	reserve(capacity) {
+		if (this.slots.size >= capacity) throw new SubagentError(`subagent limit reached (active child limit: ${capacity}); wait for an existing child to finish or complete this work with the current agents`, "ACTIVATION_LIMIT_REACHED");
+		const slot = Symbol();
+		this.slots.add(slot);
+		return () => {
+			this.slots.delete(slot);
 		};
-	},
-	stateVersion: 3,
-	wire: {
-		viewSchema,
-		view: subagentCatalogEntries
 	}
 };
 /**
-* Append a complete direct-child discovery fact to its parent Session.
-* @param parent - durable direct parent receiving the discovery fact.
-* @param child - established child's immutable Session metadata.
-* @param descriptor - mode-discriminated creation label frozen with the child.
+* Read the live Agent retained by local execution.
+* @param activation - the managed local or external execution.
+* @returns the local Agent, absent for an external run.
 */
-function establishCatalogChild(parent, child, descriptor) {
-	parent.append("subagent/catalog", descriptor.mode === "one-shot" ? {
-		version: 0,
-		childId: child.id,
-		childCreatedAt: child.createdAt,
-		mode: descriptor.mode,
-		...descriptor.label === void 0 ? {} : { label: descriptor.label }
-	} : {
-		version: 0,
-		childId: child.id,
-		childCreatedAt: child.createdAt,
-		mode: descriptor.mode,
-		label: descriptor.label
-	});
+function activationAgent(activation) {
+	return activation.kind === "local" ? activation.handle.agent : void 0;
 }
-//#endregion
-//#region lib/types/internal.js
 /**
-* Continuation integration markers and host adapters outside the public
-* Service Definition and model-facing Agent messaging contract.
-* @module @deepseek-ai/dsh-subagent/internal
+* Require local residency before accepting further input.
+* @param activation - execution targeted by message delivery.
+* @returns the local activation.
+* @throws when the external backend cannot accept another message.
 */
-/** Process-stable identity carried only by the standard adjacent-Agent messaging tool. */
-const adjacentAgentSendMessageTool = Symbol.for("dsh.subagent.adjacentAgentSendMessageTool");
+function requireLocalActivation(activation) {
+	switch (activation.kind) {
+		case "local": return activation;
+		case "external": throw new SubagentError(`subagent "${activation.childId}" does not accept follow-up input`, "NOT_CONTINUABLE");
+		/* v8 ignore next 2 -- Both execution kinds are handled above. */
+		default: return assertNever(activation);
+	}
+}
 /**
-* Test whether one visible definition is the standard adjacent-Agent messaging tool.
-* @param definition - the scope-resolved `send_message` candidate.
-* @returns whether the definition carries the internal standard-tool identity.
+* Retain local failures whose turn ending could not be committed.
+* @param activation - exact local Agent and epoch receiving the scoped observers.
+* @param wake - notify its settlement watcher when failure changes readiness.
 */
-function isAdjacentAgentSendMessageTool(definition) {
-	return definition !== void 0 && definition[adjacentAgentSendMessageTool] === true;
+function observeLocalFailure(activation, wake) {
+	const child = activation.handle.agent;
+	child.ctx.on("agent/error", ({ agent }) => {
+		if (agent !== child) return;
+		activation.failureAt = child.session.seq;
+		wake();
+	});
+	child.ctx.on("session/event", (session, event) => {
+		if (session === child.session && event.type === "turn/end" && activation.failureAt !== void 0 && event.seq >= activation.failureAt) activation.failureAt = void 0;
+	});
 }
 /**
-* Process-stable symbol-keyed host delivery shared by the bundled runtime
-* entry and this unbundled internal subpath.
-* @internal
-*/
-const deliverSubagentPrompt = Symbol.for("dsh.subagent.deliverPrompt");
+* Capture local output and retain failures without a later committed turn ending.
+* @param activation - the settled local execution and any structured result.
+* @returns final output, stop reason, and committed structured value.
+*/
+function captureLocalResult(activation) {
+	const events = activation.handle.agent.session.snapshotEvents(activation.outputStart);
+	const output = finalAssistantOutput(events) ?? [];
+	const stopReason = activation.failureAt === void 0 ? epochStopReason(events) : "error";
+	const structured = activation.structured;
+	if (structured !== void 0) {
+		const captured = structured.captured();
+		if (captured !== void 0) return {
+			output,
+			stopReason,
+			structured: captured.value
+		};
+		if (stopReason === "completed") return {
+			output,
+			stopReason: "error"
+		};
+	}
+	return {
+		output,
+		stopReason
+	};
+}
+/** Serialize each durable child's delivery, release, and disposal. */
+var ChildLock = class {
+	tails = /* @__PURE__ */ new Map();
+	/**
+	* Run `operation` after every previously queued operation for `childId`.
+	* @param childId - the durable child whose operations are linearized.
+	* @param operation - the critical section to run in order.
+	* @returns the operation's own settlement.
+	*/
+	run(childId, operation) {
+		const result = (this.tails.get(childId) ?? Promise.resolve()).then(operation, operation);
+		const tail = result.then(() => void 0, () => void 0);
+		this.tails.set(childId, tail);
+		tail.then(() => {
+			if (this.tails.get(childId) === tail) this.tails.delete(childId);
+		});
+		return result;
+	}
+};
 //#endregion
-//#region lib/types/continuation.js
+//#region lib/types/manager.js
 /**
-* Continuable-subagent orchestration behind `ctx.subagents`: stable child ids,
-* descriptor persistence, provider preparation, cold resume, authorization,
-* and message routing. {@link ContinuableActivationRegistry} owns the mutable
-* process-local Activation graph and its settlement and disposal lifecycle.
-*
-* A continuable child has one durable Session and at most one process-local
-* Activation. The Agent inbox is the only turn queue, so this manager owns
-* durable orchestration while the Agent loop owns all turn ordering and
-* execution. No continuable path creates a Task or an intermediate
-* result-bearing wrapper.
+* Owns subagent startup, message admission, cold resume, and execution lifetimes.
+* One child lock orders input acceptance and closure; one activation map owns
+* capacity, parent relationships, and resource release across all providers.
 *
-* @module @deepseek-ai/dsh-subagent
+* @module @deepseek-ai/dsh-subagent/manager
 */
 var __addDisposableResource$2 = function(env, value, async) {
 	if (value !== null && value !== void 0) {
@@ -1646,20 +1203,183 @@ var __disposeResources$2 = (function(SuppressedError) {
 	var e = new Error(message);
 	return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 });
-/**
-* The continuable-subagent orchestration service behind `ctx.subagents`. Tool
-* schema and host adapters are consumers of this one contract; foreground
-* one-shot delegation keeps calling `ctx.subagents.start()` and never enters
-* this lifecycle.
-*/
-var SubagentContinuationManager = class {
+/** Render only the safe outer message from execution or teardown failures. */
+function failureMessage(error) {
+	return error instanceof Error ? error.message : "unknown teardown failure";
+}
+/** Own subagent requests and the resources of every live activation. */
+var SubagentManager = class {
 	ctx;
 	host;
-	activations;
+	maxActiveSubagents;
+	/** Child session id → its live Activation. Process-local, never durable. */
+	resident = /* @__PURE__ */ new Map();
+	/** Root identities retain their pool across child settlement without retaining dead roots. */
+	rootPools = /* @__PURE__ */ new WeakMap();
+	/** Materializations admitted before drain, tracked through publication or rollback. */
+	materializations = /* @__PURE__ */ new Set();
+	/** Per-child serializer shared by delivery, release, and disposal. */
+	locks = new ChildLock();
+	/** Structural Cordis owner of every Activation handle. */
+	ownerCtx;
+	/**
+	* Exact roots whose host teardown has begun, with the live lineage members
+	* observed under each root. Entries remain until that exact root leaves the
+	* Agent registry, closing admission throughout its host's teardown without
+	* poisoning a later same-id replacement.
+	*/
+	closingScopes = /* @__PURE__ */ new Map();
+	draining = false;
+	/**
+	* Build one manager inside the service's Agent-injected context.
+	* @param ctx - context providing Agents, Sessions, and teardown ownership.
+	* @param host - provider dispatch and lifecycle observation owned by the service.
+	* @param maxActiveSubagents - the current configured child capacity.
+	*/
 	constructor(ctx, host, maxActiveSubagents) {
 		this.ctx = ctx;
 		this.host = host;
-		this.activations = new ContinuableActivationRegistry(ctx, (provider, childId, parent) => host.observeActivation(provider, childId, parent), maxActiveSubagents);
+		this.maxActiveSubagents = maxActiveSubagents;
+		const scope = ctx.plugin(function activationOwner() {});
+		this.ownerCtx = scope.ctx;
+		ctx.on("agent/disposed", ({ agent }) => {
+			this.closingScopes.delete(agent);
+		});
+		ctx.effect(function* () {
+			yield scope.dispose;
+			yield () => this.drain();
+		}.bind(this), "subagents.manager()");
+	}
+	/**
+	* Interrupt one live continuable child's current turn under the supplied authority.
+	* @param targetSessionId - the durable child session id to interrupt.
+	* @param authority - the human parent address or exact live ancestor Agent.
+	*/
+	interrupt(targetSessionId, authority) {
+		if (authority.kind === "ancestor") {
+			const caller = authority.agent;
+			if (this.ctx.agents.get(caller.id) !== caller) throw new SubagentError(`interrupting "${targetSessionId}" requires the exact live ancestor agent`, "UNAUTHORIZED");
+			if (caller.id === targetSessionId) throw new SubagentError(`agent "${caller.id}" cannot interrupt itself`, "UNAUTHORIZED");
+		}
+		const activation = this.resident.get(targetSessionId);
+		if (activation === void 0) return;
+		if (authority.kind === "user") {
+			if (activation.parent.id !== authority.parentSessionId) throw new SubagentError(`subagent "${targetSessionId}" belongs to another parent session`, "UNAUTHORIZED");
+		} else if (!activation.ancestry.has(authority.agent)) throw new SubagentError(`subagent "${targetSessionId}" is not a live descendant of agent "${authority.agent.id}"`, "UNAUTHORIZED");
+		if (activation.closing !== void 0) return;
+		const kind = authority.kind === "user" ? "user" : "parent";
+		if (activation.kind === "local") activation.handle.agent.cancel({ kind }, { keepInbox: true });
+		else {
+			activation.controller.abort({ kind });
+			this.dispose(activation).catch(() => void 0);
+		}
+	}
+	/**
+	* Close admission, await every already-admitted materialization through
+	* publication or rollback, then dispose the stable live Activation graph
+	* child-first.
+	*/
+	async drain() {
+		this.draining = true;
+		for (const pending of this.materializations) pending.controller.abort();
+		await Promise.all([...this.materializations].map((materialization) => materialization.settled));
+		const owned = /* @__PURE__ */ new Set();
+		for (const activation of this.resident.values()) for (const child of activation.ownedChildren) owned.add(child);
+		const roots = [...this.resident.values()].filter((activation) => !owned.has(activation.childId));
+		await this.disposeRoots(roots, "activation(s)");
+	}
+	/**
+	* Join progressing child work, leaving idle parked inboxes resident.
+	* @param parent - exact live parent whose descendants are observed.
+	* @returns whether work was joined and the host must recheck parent completion.
+	*/
+	async waitForChildren(parent) {
+		let observed = false;
+		while (true) {
+			const pending = [...this.materializations].filter((item) => item.lineage.includes(parent));
+			const children = [...this.resident.values()].filter((item) => activationAgent(item) !== parent && item.ancestry.has(parent));
+			observed ||= children.some((item) => item.kind === "local" && item.handle.agent.status !== "idle");
+			await Promise.all(children.flatMap((item) => item.kind === "local" ? [item.handle.agent.whenIdle()] : []));
+			const waits = pending.map((item) => item.settled);
+			for (const item of children) {
+				if (item.kind === "external" || item.closing !== void 0) {
+					waits.push(item.result.promise.catch(() => void 0));
+					continue;
+				}
+				if (item.handle.agent.status !== "idle") {
+					waits.push(item.handle.agent.whenIdle());
+					continue;
+				}
+				if (item.ownedChildren.size > 0) {
+					if ([...item.ownedChildren].some((id) => !this.resident.has(id))) waits.push(item.poke.promise);
+					continue;
+				}
+				const inbox = item.handle.agent.inbox;
+				if (item.failureAt === void 0 && (inbox.nextTurn.length > 0 || inbox.nextStep.length > 0)) continue;
+				waits.push(Promise.race([item.result.promise.catch(() => void 0), item.poke.promise]));
+			}
+			if (waits.length > 0) {
+				observed = true;
+				await Promise.all(waits);
+				continue;
+			}
+			if ([...this.materializations].some((item) => item.lineage.includes(parent) && !pending.includes(item)) || [...this.resident.values()].some((item) => activationAgent(item) !== parent && item.ancestry.has(parent) && !children.includes(item))) continue;
+			return observed;
+		}
+	}
+	/**
+	* Stop the managed descendants of exact live host-owned parents.
+	* @param parents - exact live roots whose managed descendants must stop.
+	*/
+	async drainDescendants(parents) {
+		const roots = new Set(parents.filter((parent) => this.ctx.agents.get(parent.id) === parent));
+		if (roots.size === 0) return;
+		for (const root of roots) this.closingMembers(root).add(root);
+		const targets = [];
+		for (const activation of this.resident.values()) {
+			const child = activationAgent(activation);
+			const lineage = this.liveLineage(child ?? activation.parent);
+			const owners = [...roots].filter((root) => child !== root && activation.ancestry.has(root));
+			if (owners.length === 0) continue;
+			targets.push(activation);
+			for (const owner of owners) {
+				const members = this.closingMembers(owner);
+				if (child !== void 0) members.add(child);
+				for (const agent of lineage) members.add(agent);
+			}
+		}
+		const materializations = [...this.materializations].filter((materialization) => {
+			const owners = [...roots].filter((root) => materialization.lineage.includes(root));
+			for (const owner of owners) {
+				const members = this.closingMembers(owner);
+				for (const agent of materialization.lineage) members.add(agent);
+			}
+			if (owners.length > 0) materialization.controller.abort();
+			return owners.length > 0;
+		});
+		const ownedTargets = /* @__PURE__ */ new Set();
+		for (const activation of targets) for (const child of activation.ownedChildren) ownedTargets.add(child);
+		const targetRoots = targets.filter((activation) => !ownedTargets.has(activation.childId));
+		for (const activation of targets) this.dispose(activation).catch(() => void 0);
+		await Promise.all(materializations.map((materialization) => materialization.settled));
+		await this.disposeRoots(targetRoots, "scoped activation(s)");
+	}
+	/**
+	* Release selected resident direct children of one exact live parent.
+	* @param parent - exact live direct parent authorizing the selected release.
+	* @param childIds - durable direct-child ids to release when resident.
+	*/
+	async drainChildren(parent, childIds) {
+		if (this.ctx.agents.get(parent.id) !== parent) throw new SubagentError("selected child teardown requires the exact live parent agent", "UNAUTHORIZED");
+		const targets = [];
+		for (const childId of new Set(childIds)) {
+			const activation = this.resident.get(childId);
+			if (activation === void 0) continue;
+			if (activation.parent.id !== parent.id || !activation.ancestry.has(parent)) throw new SubagentError(`subagent "${childId}" is not a direct child of agent "${parent.id}"`, "UNAUTHORIZED");
+			targets.push(activation);
+		}
+		for (const activation of targets) this.dispose(activation).catch(() => void 0);
+		await this.disposeRoots(targets, "selected activation(s)");
 	}
 	/**
 	* Start one continuable background child and resolve at initial inbox acceptance.
@@ -1668,14 +1388,14 @@ var SubagentContinuationManager = class {
 	* @param spec - provider, delegation request, and caller cancellation.
 	* @returns the durable child id and accepted initial prompt message id.
 	*/
-	async startContinuable(spec) {
+	async startLocal(spec) {
 		const request = spec.request;
 		const parent = request.parent;
-		this.activations.assertAdmitting(parent);
-		const persistence = this.requirePersistence();
+		this.assertAdmitting(parent);
+		const persistence = spec.delivery === "caller" ? this.ctx.get("sessionPersistence") : this.requirePersistence();
 		assertSubagentMaxDepth(request.maxDepth);
 		const childId = spec.childId ?? brandString(randomUUID());
-		this.activations.assertChildIdAvailable(childId);
+		this.assertChildIdAvailable(childId);
 		const childDepth = resolveChildDepth(parent, request.maxDepth);
 		const agentOptions = resolveChildAgentOptions(parent, request.agentOptions, childDepth);
 		const agentProvider = agentOptions.provider;
@@ -1687,128 +1407,679 @@ var SubagentContinuationManager = class {
 			label: spec.label,
 			...agentProvider !== void 0 ? { agentProvider } : {},
 			...agentModel !== void 0 ? { agentModel } : {},
-			...agentReasoningEffort !== void 0 ? { agentReasoningEffort } : {},
-			...request.persona !== void 0 ? { persona: request.persona } : {},
-			...request.toolFilter !== void 0 ? { toolFilter: request.toolFilter } : {}
+			...agentReasoningEffort !== void 0 ? { agentReasoningEffort } : {}
 		});
 		const delegatedPolicies = captureDelegatedPolicyOverrides(parent);
-		const releaseHold = this.activations.holdOwnership(parent, childId);
+		const releaseHold = this.holdOwnership(parent, childId);
 		try {
+			const cwd = await this.resolveDirectory(request, spec.signal);
 			const prepared = await this.host.prepareContinuable(spec.provider, {
 				sessionId: childId,
+				cwd,
 				parent,
 				signal: spec.signal
 			});
 			spec.signal.throwIfAborted();
-			this.activations.assertAdmitting(parent);
+			this.assertAdmitting(parent);
 			const inheritedEventCount = SessionLogOffset(prepared.seed?.length ?? 0);
 			const seed = prepared.seed;
+			let established;
+			const messageId = await this.locks.run(childId, async () => {
+				spec.signal.throwIfAborted();
+				this.assertAdmitting(parent);
+				this.assertChildIdAvailable(childId);
+				if (spec.childId !== void 0) {
+					const persisted = await persistence?.stat(childId, { signal: spec.signal });
+					spec.signal.throwIfAborted();
+					this.assertAdmitting(parent);
+					this.assertChildIdAvailable(childId);
+					if (persisted !== void 0) throw new SubagentError(`subagent "${childId}" already exists`, "DUPLICATE_CHILD");
+				}
+				const activation = await this.materialize({
+					kind: "local",
+					childId,
+					provider: spec.provider,
+					parent,
+					create: {
+						cwd,
+						seed,
+						meta: childSessionMeta(parent, childDepth, prepared.seed !== void 0, request.agentPreset),
+						inheritedEventCount,
+						delegatedPolicies,
+						descriptor
+					},
+					agentOptions,
+					composition: { agentPreset: request.agentPreset },
+					signal: spec.signal,
+					delivery: spec.delivery,
+					outputSchema: spec.request.outputSchema
+				});
+				established = activation;
+				const child = requireLocalActivation(activation).handle.agent;
+				const childHeader = child.session.header;
+				return await this.submitMaterialized(activation, spec.delivery !== "caller" && isAdjacentAgentSendMessageTool(this.ctx.get("tools")?.get("send_message", child)) ? withContinuableReturnGuidance(parent.id, request.prompt) : request.prompt, {
+					source: { kind: "user" },
+					signal: spec.signal,
+					delivery: "queue"
+				}, parent, () => {
+					establishCatalogChild(parent.session, childHeader, descriptor);
+				});
+			});
 			return {
+				...this.receipt(established),
 				childId,
-				messageId: await this.activations.locks.run(childId, async () => {
-					spec.signal.throwIfAborted();
-					this.activations.assertAdmitting(parent);
-					this.activations.assertChildIdAvailable(childId);
-					if (spec.childId !== void 0) {
-						const persisted = await persistence.stat(childId, { signal: spec.signal });
-						spec.signal.throwIfAborted();
-						this.activations.assertAdmitting(parent);
-						this.activations.assertChildIdAvailable(childId);
-						if (persisted !== void 0) throw new SubagentError(`subagent "${childId}" already exists`, "DUPLICATE_CHILD");
-					}
-					const activation = await this.activations.materialize({
-						childId,
-						provider: spec.provider,
-						parent,
-						create: {
-							seed,
-							meta: childSessionMeta(parent, childDepth, prepared.seed !== void 0),
-							inheritedEventCount,
-							delegatedPolicies,
-							descriptor
-						},
-						agentOptions,
-						composition: {
-							persona: request.persona,
-							toolFilter: request.toolFilter
-						},
-						signal: spec.signal
-					});
-					const childHeader = activation.handle.agent.session.header;
-					return await this.submitMaterialized(activation, isAdjacentAgentSendMessageTool(this.ctx.get("tools")?.get("send_message", activation.handle.agent)) ? withContinuableReturnGuidance(parent.id, request.prompt) : request.prompt, {
-						source: { kind: "user" },
-						signal: spec.signal,
-						delivery: "queue"
-					}, parent, () => {
-						establishCatalogChild(parent.session, childHeader, descriptor);
-					});
+				messageId
+			};
+		} catch (error) {
+			releaseHold();
+			throw error;
+		}
+	}
+	/**
+	* Start an external backend under activation ownership.
+	* @param spec - task, provider, cancellation, and delivery policy.
+	* @returns the accepted activation and its result/disposal capabilities.
+	*/
+	async startExternal(spec) {
+		const parent = spec.request.parent;
+		this.assertAdmitting(parent);
+		const pendingId = brandString(randomUUID());
+		const releaseHold = this.holdOwnership(parent, pendingId);
+		let activation;
+		try {
+			const cwd = await this.resolveDirectory(spec.request, spec.signal);
+			activation = await this.materialize({
+				kind: "external",
+				childId: pendingId,
+				provider: spec.provider,
+				parent,
+				signal: spec.signal,
+				delivery: spec.delivery,
+				start: (signal) => this.host.startExternal(spec.provider, {
+					...spec.request,
+					cwd,
+					label: spec.label,
+					signal
 				})
+			});
+			this.assertAdmitting(parent);
+			this.assertLiveParent(parent, activation.childId);
+			spec.signal.throwIfAborted();
+			if (spec.delivery === "parent") establishExternalCatalogChild(parent.session, activation.childId, spec.label);
+			this.announce(activation);
+			return this.receipt(activation);
+		} catch (error) {
+			if (activation !== void 0) try {
+				await this.dispose(activation);
+			} catch (cleanupError) {
+				this.ctx.logger.warn(`subagent "${activation.childId}" admission rollback failed: ${failureMessage(cleanupError)}`);
+			}
+			throw error;
+		} finally {
+			releaseHold();
+		}
+	}
+	/** Capture the explicit or inherited directory while the parent still owns startup. */
+	async resolveDirectory(request, signal) {
+		const cwd = request.cwd !== void 0 && isAbsolute(request.cwd) ? request.cwd : resolve(await this.ctx.workingDirectory.ensure(request.parent, signal), request.cwd ?? ".");
+		signal.throwIfAborted();
+		return cwd;
+	}
+	/**
+	* Deliver one model-authored message to a direct continuable child or to the
+	* sender's direct parent. A missing direct child cold-resumes through the
+	* ordinary continuation lifecycle.
+	* @param sender - exact live Agent authorizing and originating the message.
+	* @param targetId - durable direct-parent or direct-child session id.
+	* @param content - model-authored content to deliver.
+	* @param options - caller cancellation before acceptance.
+	* @returns the accepted message's inbox id.
+	*/
+	async sendMessage(sender, targetId, content, options) {
+		if (this.ctx.agents.get(sender.id) !== sender) throw new SubagentError("message delivery requires the exact live sender agent", "UNAUTHORIZED");
+		this.assertAdmitting(sender);
+		const senderActivation = this.resident.get(sender.id);
+		if (senderActivation !== void 0 && senderActivation.kind === "local" && senderActivation.handle.agent === sender && senderActivation.parent.id === targetId) {
+			options.signal.throwIfAborted();
+			return this.sendToParent(senderActivation, sender, content);
+		}
+		if (sender.session.header.parentSession === targetId) throw new SubagentError(`agent "${sender.id}" is not a resident continuable child and cannot send to parent "${targetId}"`, "UNAUTHORIZED");
+		return this.deliverToChild(sender, targetId, content, {
+			signal: options.signal,
+			delivery: "steer"
+		});
+	}
+	/**
+	* Queue one human-authored prompt as a distinct direct-child turn.
+	* @param parent - exact live direct parent authorizing delivery.
+	* @param childId - durable direct-child session id.
+	* @param content - model-visible prompt blocks.
+	* @param source - durable attribution for the human prompt.
+	* @param signal - caller cancellation before inbox acceptance.
+	* @returns the accepted durable message id.
+	*/
+	async queuePrompt(parent, childId, content, source, signal) {
+		return this.deliverToChild(parent, childId, content, {
+			source,
+			signal,
+			delivery: "queue"
+		});
+	}
+	/**
+	* Steer one host-authored prompt to a direct continuable child.
+	* @param parent - exact live direct parent authorizing delivery.
+	* @param childId - durable direct-child session id.
+	* @param content - model-visible prompt blocks.
+	* @param source - durable attribution for the host prompt.
+	* @param signal - caller cancellation before inbox acceptance.
+	* @returns the accepted durable message id.
+	*/
+	async steerPrompt(parent, childId, content, source, signal) {
+		return this.deliverToChild(parent, childId, content, {
+			source,
+			signal,
+			delivery: "steer"
+		});
+	}
+	/** Admit local input synchronously before any teardown can begin. */
+	deliver(activation, message, delivery) {
+		if (activation.closing !== void 0) throw new SubagentError("subagent activation is being disposed; the message was not accepted", "ACTIVATION_CLOSING");
+		const local = requireLocalActivation(activation);
+		if (local.structured?.acceptsInput() === false) throw new SubagentError("subagent is submitting or has submitted its structured result; the message was not accepted", "INPUT_CLOSED");
+		if (delivery === "steer") local.handle.agent.steer(message);
+		else local.handle.agent.followup(message);
+	}
+	/**
+	* Reject one child identity already owned by a live Agent or Session.
+	* @param childId - proposed durable child session id.
+	*/
+	assertChildIdAvailable(childId) {
+		if (this.resident.has(childId) || this.ctx.agents.get(childId) !== void 0 || this.ctx.get("sessions")?.get(childId) !== void 0) throw new SubagentError(`subagent "${childId}" already exists`, "DUPLICATE_CHILD");
+	}
+	/**
+	* Pre-register `childId` in a continuation-managed parent's owned set so the
+	* parent cannot settle while a caller is still establishing or resuming that
+	* child. Returns a releaser for the failure path; it removes only a hold
+	* this call added, and leaves ownership in place once a live Activation for
+	* the child exists.
+	* @param parent - the live direct parent the operation is admitted under.
+	* @param childId - the durable child the operation addresses.
+	* @returns the failure-path releaser; a no-op when nothing was added.
+	*/
+	holdOwnership(parent, childId) {
+		const parentActivation = this.resident.get(parent.id);
+		if (parentActivation === void 0 || activationAgent(parentActivation) !== parent) return () => {};
+		if (parentActivation.closing !== void 0) throw new SubagentError(`subagent parent "${parent.id}" is being disposed; the child was not established`, "ACTIVATION_CLOSING");
+		if (parentActivation.ownedChildren.has(childId)) return () => {};
+		parentActivation.ownedChildren.add(childId);
+		return () => {
+			const live = this.resident.get(childId);
+			/* v8 ignore next 4 -- reaching this arm needs another delivery to establish the child
+			* between this operation's failure and its releaser running, which no test can schedule
+			* deterministically: the ownership edge then belongs to that live Activation, so the
+			* conservative keep leaves it for finishDisposal's releaseOwnership. */
+			if (live !== void 0 && live.closing === void 0) return;
+			if (parentActivation.ownedChildren.delete(childId)) this.wake(parentActivation);
+		};
+	}
+	/**
+	* Apply activation admission to a resident parent before delivering input.
+	* @param parent - exact live Agent receiving the message.
+	* @param message - durable user message to deliver.
+	* @param delivery - receiving inbox destination.
+	*/
+	sendWaking(parent, message, delivery) {
+		const parentActivation = this.resident.get(parent.id);
+		if (parentActivation !== void 0 && activationAgent(parentActivation) === parent) {
+			try {
+				this.deliver(parentActivation, message, delivery);
+			} finally {
+				this.wake(parentActivation);
+			}
+			return;
+		}
+		if (delivery === "steer") parent.steer(message);
+		else parent.followup(message);
+	}
+	/**
+	* Reject new admission once the manager or this exact parent tree began draining.
+	* @param agent - exact live Agent whose lineage determines admission.
+	*/
+	assertAdmitting(agent) {
+		const closing = this.closingTeardownFor(agent);
+		if (closing === void 0) return;
+		throw new SubagentError(closing === "manager" ? "subagents are draining; the operation was not admitted" : `subagents below parent "${closing.id}" are draining; the operation was not admitted`, "DRAINING");
+	}
+	/**
+	* Authorize one operation against the durable direct-parent lineage.
+	* @param parent - exact live Agent claiming direct-parent authority.
+	* @param childId - durable child session id addressed by the operation.
+	* @param parentSession - durable direct-parent id recorded by the child.
+	*/
+	authorizeLineage(parent, childId, parentSession) {
+		this.assertLiveParent(parent, childId);
+		if (parentSession !== parent.id) throw new SubagentError(`subagent "${childId}" belongs to another parent session`, "UNAUTHORIZED");
+	}
+	/** Reject parent authority after the live registry entry changes. */
+	assertLiveParent(parent, childId) {
+		if (this.ctx.agents.get(parent.id) !== parent) throw new SubagentError(`subagent "${childId}" delivery requires the exact live parent agent`, "UNAUTHORIZED");
+	}
+	/**
+	* Create or resume one child Agent and publish its Activation.
+	* @param inputs - reconstruction and admission inputs for the residency epoch.
+	* @returns the published process-local Activation.
+	*/
+	materialize(inputs) {
+		this.assertAdmitting(inputs.parent);
+		inputs.signal.throwIfAborted();
+		const lineage = this.liveLineage(inputs.parent);
+		const pool = this.resident.get(inputs.parent.id)?.pool ?? this.rootPool(inputs.parent);
+		const releaseSlot = pool.reserve(this.maxActiveSubagents());
+		const settled = Promise.withResolvers();
+		const controller = new AbortController();
+		const materialization = {
+			lineage,
+			settled: settled.promise,
+			controller
+		};
+		this.materializations.add(materialization);
+		return this.materializeTracked({
+			...inputs,
+			signal: AbortSignal.any([inputs.signal, controller.signal])
+		}, lineage, pool, releaseSlot).catch((error) => {
+			releaseSlot();
+			if (error instanceof Error && error.name === "AbortError") this.assertAdmitting(inputs.parent);
+			throw error;
+		}).finally(() => {
+			this.materializations.delete(materialization);
+			settled.resolve();
+		});
+	}
+	/**
+	* Stop and release one Activation through its memoized close transaction.
+	* @param activation - exact residency epoch to close.
+	* @returns the shared close transaction.
+	*/
+	dispose(activation) {
+		return this.close(activation, () => this.finishDisposal(activation, true));
+	}
+	/** Close admission synchronously and share one release, including startup rollback. */
+	close(activation, release) {
+		if (activation.closing !== void 0) return activation.closing;
+		const completion = Promise.withResolvers();
+		activation.closing = completion.promise;
+		release().then(completion.resolve, completion.reject);
+		return completion.promise;
+	}
+	/** Dispose independent roots and report every branch failure after all settle. */
+	async disposeRoots(roots, failureSubject) {
+		const reasons = (await Promise.all(roots.map(async (activation) => {
+			try {
+				await this.dispose(activation);
+				return;
+			} catch (error) {
+				return error;
+			}
+		}))).filter((failure) => failure !== void 0);
+		if (reasons.length > 0) throw new SubagentError(`subagent teardown failed for ${reasons.length} ${failureSubject}: ` + reasons.map((reason) => failureMessage(reason)).join("; "), "ACTIVATION_TEARDOWN_FAILED");
+	}
+	/** Return the retained member set for one exact scoped-teardown root. */
+	closingMembers(root) {
+		const existing = this.closingScopes.get(root);
+		if (existing !== void 0) return existing;
+		const members = /* @__PURE__ */ new Set();
+		this.closingScopes.set(root, members);
+		return members;
+	}
+	/** Return the exact currently resolvable ancestry from `agent` upward. */
+	liveLineage(agent) {
+		const lineage = [agent];
+		const seen = new Set([agent.id]);
+		let parentSession = agent.session.header.parentSession;
+		while (parentSession !== void 0) {
+			const parent = this.ctx.agents.get(parentSession);
+			if (parent === void 0 || seen.has(parent.id)) break;
+			lineage.push(parent);
+			seen.add(parent.id);
+			parentSession = parent.session.header.parentSession;
+		}
+		return lineage;
+	}
+	/** Return the teardown that closed continuable admission for this agent's lineage. */
+	closingTeardownFor(agent) {
+		if (this.draining) return "manager";
+		const lineage = this.liveLineage(agent);
+		for (const [root, members] of this.closingScopes) if (members.has(agent) || lineage.includes(root)) return root;
+	}
+	/** Resolve a root's pool once; descendants inherit their resident parent's pool directly. */
+	rootPool(parent) {
+		let pool = this.rootPools.get(parent);
+		if (pool === void 0) {
+			pool = new ActivationPool();
+			this.rootPools.set(parent, pool);
+		}
+		return pool;
+	}
+	/** Perform one tracked materialization through publication or rollback. */
+	async materializeTracked(inputs, parentLineage, pool, releaseSlot) {
+		const { provider, parent } = inputs;
+		let childId = inputs.childId;
+		inputs.signal.throwIfAborted();
+		let resource;
+		if (inputs.kind === "external") {
+			const controller = new AbortController();
+			const cancelStartup = () => {
+				controller.abort(inputs.signal.reason);
+			};
+			inputs.signal.addEventListener("abort", cancelStartup, { once: true });
+			try {
+				const run = await inputs.start(controller.signal);
+				resource = {
+					kind: "external",
+					run,
+					controller
+				};
+				run.result.catch(() => void 0);
+				childId = run.id;
+				try {
+					this.assertChildIdAvailable(childId);
+				} catch (error) {
+					await run.dispose();
+					throw error;
+				}
+			} finally {
+				inputs.signal.removeEventListener("abort", cancelStartup);
+			}
+		} else {
+			const { create } = inputs;
+			let structured;
+			const setup = async (childCtx, child) => {
+				if (inputs.composition.agentPreset !== void 0) await applyChildComposition(childCtx, parent, inputs.composition);
+				if (create !== void 0) {
+					if (inputs.composition.agentPreset !== void 0) child.session.append("agent-preset/selected", { agentPreset: inputs.composition.agentPreset });
+					child.session.append("subagent/descriptor", create.descriptor);
+					appendDelegatedPolicyOverrides(child.session, create.delegatedPolicies);
+					const workingDirectory = childCtx.get("workingDirectory");
+					if (workingDirectory === void 0) throw new Error("local subagents require the working-directory service");
+					await workingDirectory.set(child, create.cwd, inputs.signal);
+				}
+				if (inputs.composition.agentPreset === void 0) await applyChildComposition(childCtx, parent, inputs.composition);
+				if (inputs.outputSchema !== void 0) structured = attachStructuredRuntime(childCtx, inputs.outputSchema, () => this.resident.get(childId)?.ownedChildren.size === 0 && child.inbox.nextStep.length === 0 && child.inbox.nextTurn.length === 0);
+			};
+			const handle = create === void 0 ? await this.ownerCtx.agents.resume({
+				resumeSessionId: childId,
+				parentAgent: parent,
+				agentOptions: inputs.agentOptions,
+				signal: inputs.signal,
+				setup
+			}) : await this.ownerCtx.agents.create({
+				sessionId: childId,
+				parentAgent: parent,
+				meta: create.meta,
+				...create.seed === void 0 ? {} : { seed: create.seed },
+				inheritedEventCount: create.inheritedEventCount,
+				agentOptions: inputs.agentOptions,
+				signal: inputs.signal,
+				setup
+			});
+			resource = {
+				kind: "local",
+				handle,
+				outputStart: handle.agent.session.seq,
+				structured,
+				failureAt: void 0,
+				poke: Promise.withResolvers()
+			};
+		}
+		const observer = this.host.observeActivation(provider, childId, parent);
+		const activation = {
+			pool,
+			releaseSlot,
+			childId,
+			...resource,
+			parent,
+			delivery: inputs.delivery ?? "parent",
+			result: Promise.withResolvers(),
+			closing: void 0,
+			ancestry: new WeakSet(resource.kind === "external" ? parentLineage : [resource.handle.agent, ...parentLineage]),
+			ownedChildren: /* @__PURE__ */ new Set(),
+			observer,
+			announced: false
+		};
+		activation.result.promise.catch(() => void 0);
+		this.resident.set(childId, activation);
+		try {
+			this.assertAdmitting(parent);
+			inputs.signal.throwIfAborted();
+			if (this.ctx.agents.get(parent.id) !== parent) throw new SubagentError("subagent parent is no longer live", "UNAUTHORIZED");
+			this.acquireOwnership(parent, childId);
+			const wakeSettlement = () => {
+				this.wake(activation);
 			};
+			if (activation.kind === "local") {
+				observeLocalFailure(activation, wakeSettlement);
+				activation.handle.agent.ctx.on("agent/inbox/inserted", wakeSettlement);
+				activation.handle.agent.ctx.on("agent/inbox/claimed", wakeSettlement);
+				activation.handle.agent.ctx.on("agent/inbox/discarded", wakeSettlement);
+			}
+			observer.start(activationAgent(activation));
 		} catch (error) {
-			releaseHold();
+			/* v8 ignore next -- rollback failure must not mask the admission failure
+			* that prevented this operation from returning an accepted message id. */
+			await this.rollbackUnpublished(activation, error).catch(() => void 0);
 			throw error;
 		}
+		return activation;
 	}
 	/**
-	* Deliver one model-authored message to a direct continuable child or to the
-	* sender's direct parent. A missing direct child cold-resumes through the
-	* ordinary continuation lifecycle.
-	* @param sender - exact live Agent authorizing and originating the message.
-	* @param targetId - durable direct-parent or direct-child session id.
-	* @param content - model-authored content to deliver.
-	* @param options - caller cancellation before acceptance.
-	* @returns the accepted message's inbox id.
+	* Begin settlement observation after initial acceptance is recorded.
+	* @param activation - accepted activation to observe.
 	*/
-	async sendMessage(sender, targetId, content, options) {
-		if (this.ctx.agents.get(sender.id) !== sender) throw new SubagentError("message delivery requires the exact live sender agent", "UNAUTHORIZED");
-		this.activations.assertAdmitting(sender);
-		const senderActivation = this.activations.get(sender.id);
-		if (senderActivation !== void 0 && senderActivation.handle.agent === sender && senderActivation.parentSession === targetId) {
-			options.signal.throwIfAborted();
-			return this.sendToParent(senderActivation, sender, content);
+	announce(activation) {
+		if (activation.announced) return;
+		activation.announced = true;
+		if (activation.kind === "local") this.watchLocalSettlement(activation);
+		else {
+			const finish = () => this.close(activation, () => this.finishDisposal(activation, false));
+			activation.run.result.then(finish, finish).catch((error) => {
+				this.reportTeardownFailure(activation, error);
+			});
 		}
-		if (sender.session.header.parentSession === targetId) throw new SubagentError(`agent "${sender.id}" is not a resident continuable child and cannot send to parent "${targetId}"`, "UNAUTHORIZED");
-		return this.deliverToChild(sender, targetId, content, {
-			signal: options.signal,
-			delivery: "steer"
-		});
 	}
-	/**
-	* Queue one human-authored prompt as a distinct direct-child turn.
-	* @param parent - exact live direct parent authorizing delivery.
-	* @param childId - durable direct-child session id.
-	* @param content - model-visible prompt blocks.
-	* @param source - durable attribution for the human prompt.
-	* @param signal - caller cancellation before inbox acceptance.
-	* @returns the accepted durable message id.
-	*/
-	async queuePrompt(parent, childId, content, source, signal) {
-		return this.deliverToChild(parent, childId, content, {
-			source,
-			signal,
-			delivery: "queue"
+	/** Release an Activation whose start edge was not published. */
+	rollbackUnpublished(activation, error) {
+		return this.close(activation, async () => {
+			try {
+				await (activation.kind === "local" ? activation.handle.dispose() : activation.run.dispose());
+			} finally {
+				this.resident.delete(activation.childId);
+				activation.releaseSlot();
+				this.releaseOwnership(activation.childId);
+				activation.result.reject(error);
+			}
 		});
 	}
-	/**
-	* Steer one host-authored prompt to a direct continuable child.
-	* @param parent - exact live direct parent authorizing delivery.
-	* @param childId - durable direct-child session id.
-	* @param content - model-visible prompt blocks.
-	* @param source - durable attribution for the host prompt.
-	* @param signal - caller cancellation before inbox acceptance.
-	* @returns the accepted durable message id.
-	*/
-	async steerPrompt(parent, childId, content, source, signal) {
-		return this.deliverToChild(parent, childId, content, {
-			source,
-			signal,
-			delivery: "steer"
-		});
+	/** Register the child in a continuation-managed parent's owned set. */
+	acquireOwnership(parent, childId) {
+		const parentActivation = this.resident.get(parent.id);
+		if (parentActivation === void 0) return;
+		if (parentActivation.closing !== void 0) throw new SubagentError(`subagent parent "${parent.id}" is being disposed; the child was not established`, "ACTIVATION_CLOSING");
+		parentActivation.ownedChildren.add(childId);
+		this.wake(parentActivation);
+	}
+	/** Remove one child from its live owner's set and let that owner re-check settlement. */
+	releaseOwnership(childId) {
+		for (const candidate of this.resident.values()) if (candidate.ownedChildren.delete(childId)) this.wake(candidate);
+	}
+	/** Let a settlement watcher re-check residency after relevant state changes. */
+	wake(activation) {
+		if (activation.kind === "external") return;
+		activation.poke.resolve();
+		activation.poke = Promise.withResolvers();
+	}
+	/** Follow one Activation to natural settlement. */
+	watchLocalSettlement(activation) {
+		(async () => {
+			while (true) {
+				const idleObservation = activation.poke;
+				await activation.handle.agent.whenIdle();
+				if (activation.closing !== void 0) return;
+				const readiness = await this.locks.run(activation.childId, () => Promise.resolve(this.settlementState(activation, idleObservation)));
+				if (readiness === "closed") return;
+				if (readiness === "retry") continue;
+				if (readiness === "wait") {
+					await idleObservation.promise;
+					continue;
+				}
+				const finalSeq = activation.handle.agent.session.seq;
+				await this.flushFinalState(activation);
+				const attempt = await this.locks.run(activation.childId, () => {
+					const state = this.settlementState(activation, idleObservation);
+					if (state !== "ready") return Promise.resolve(state);
+					if (activation.handle.agent.session.seq !== finalSeq) return Promise.resolve("retry");
+					let done;
+					try {
+						activation.handle.agent.runMaintenance(() => {
+							done = this.close(activation, () => this.finishDisposal(activation, false));
+							return Promise.resolve();
+						});
+					} catch (_error) {
+						return Promise.resolve("retry");
+					}
+					return Promise.resolve({ done });
+				});
+				if (typeof attempt === "string") {
+					if (attempt === "closed") return;
+					continue;
+				}
+				try {
+					await attempt.done;
+				} catch (error) {
+					this.reportTeardownFailure(activation, error);
+				}
+				return;
+			}
+		})();
+	}
+	/** Report disposal failure once after the natural settlement observer finishes. */
+	reportTeardownFailure(activation, error) {
+		this.ctx.logger.warn(`subagent "${activation.childId}" activation teardown failed: ${failureMessage(error)}`);
+	}
+	/** Check pending input and owned children before closing admission. */
+	settlementState(activation, observation) {
+		if (activation.closing !== void 0) return "closed";
+		if (activation.poke !== observation) return "retry";
+		const inbox = activation.handle.agent.inbox;
+		if (activation.ownedChildren.size > 0) return "wait";
+		if (activation.failureAt === void 0 && (inbox.nextTurn.length > 0 || inbox.nextStep.length > 0)) return "wait";
+		return "ready";
+	}
+	/** Propagate stop synchronously and await descendant startup rollback before release. */
+	async finishDisposal(activation, stop) {
+		this.wake(activation);
+		const { childId } = activation;
+		const failures = [];
+		let result = {
+			output: [],
+			stopReason: "error"
+		};
+		let resultFailure;
+		let externalDisposal;
+		const child = activationAgent(activation);
+		const detail = (error) => child === void 0 ? failureMessage(error) : errorChain(error);
+		try {
+			if (activation.kind === "external") {
+				if (stop) {
+					activation.controller.abort({ kind: "parent" });
+					externalDisposal = Promise.resolve().then(() => activation.run.dispose());
+					externalDisposal.catch(() => void 0);
+				}
+				result = await activation.run.result;
+			} else {
+				if (stop) {
+					activation.handle.agent.cancel({ kind: "parent" });
+					const idle = activation.handle.agent.whenIdle();
+					const children = [...activation.ownedChildren].map((child) => this.resident.get(child)).filter((child) => child !== void 0);
+					const pending = [...this.materializations].filter((item) => item.lineage.includes(activation.handle.agent));
+					const childDisposals = children.map((child) => this.dispose(child));
+					for (const item of pending) item.controller.abort();
+					childDisposals.push(...pending.map((item) => item.settled));
+					const reasons = (await Promise.all(childDisposals.map(async (disposal) => {
+						try {
+							await disposal;
+							return;
+						} catch (error) {
+							return error;
+						}
+					}))).filter((reason) => reason !== void 0);
+					if (reasons.length > 0) failures.push(new SubagentError(`subagent "${childId}" child teardown failed: ${reasons.map((reason) => failureMessage(reason)).join("; ")}`, "ACTIVATION_TEARDOWN_FAILED"));
+					await idle;
+					await this.flushFinalState(activation);
+				}
+				result = captureLocalResult(activation);
+			}
+		} catch (error) {
+			resultFailure = { error };
+			failures.push(new SubagentError(`subagent "${childId}" activation teardown failed: ${detail(error)}`, "ACTIVATION_TEARDOWN_FAILED", { cause: error }));
+		}
+		try {
+			if (activation.kind === "local") await activation.handle.dispose();
+			else await (externalDisposal ?? activation.run.dispose());
+		} catch (error) {
+			failures.push(new SubagentError(`subagent "${childId}" activation handle disposal failed: ${detail(error)}`, "ACTIVATION_TEARDOWN_FAILED", { cause: error }));
+		}
+		let failure;
+		if (failures.length === 1) failure = failures[0];
+		else if (failures.length > 1) failure = new SubagentError(`subagent "${childId}" activation teardown failed at ${failures.length} boundaries: ` + failures.map((item) => detail(item)).join("; "), "ACTIVATION_TEARDOWN_FAILED", { cause: new AggregateError(failures) });
+		this.resident.delete(childId);
+		activation.releaseSlot();
+		const terminal = failure === void 0 ? result : {
+			output: [],
+			stopReason: "error"
+		};
+		this.notifySettlement(activation, result);
+		this.releaseOwnership(childId);
+		activation.observer.settle(terminal);
+		if (resultFailure === void 0) activation.result.resolve(result);
+		else activation.result.reject(resultFailure.error);
+		if (failure !== void 0) throw failure;
+	}
+	/** Deliver the captured execution result to the durable direct parent after cleanup. */
+	notifySettlement(activation, terminal) {
+		if (!activation.announced || activation.delivery === "caller") return;
+		try {
+			const parent = this.ctx.agents.get(activation.parent.id);
+			if (parent !== activation.parent) return;
+			const message = createSettlementMessage(activation.childId, terminal, activationAgent(activation) !== void 0);
+			if (this.closingTeardownFor(parent) !== void 0) {
+				parent.inject(message);
+				return;
+			}
+			this.sendWaking(parent, message, parent.status === "idle" ? "queue" : "steer");
+		} catch (error) {
+			this.ctx.logger.warn(`subagent "${activation.childId}" settlement notice was not delivered to its parent: ` + errorChain(error));
+		}
+	}
+	/** Request a best-effort final session flush before closing natural-settlement admission. */
+	async flushFinalState(activation) {
+		try {
+			await activation.handle.agent.ctx.sessions.flush(activation.handle.agent.session);
+		} catch (error) {
+			this.ctx.logger.warn(`subagent "${activation.childId}" best-effort final session flush failed; the persisted state may be unavailable or stale on resume: ${errorChain(error)}`);
+		}
+	}
+	/** Return capabilities bound to an exact activation instead of a future same-id instance. */
+	receipt(activation) {
+		return {
+			childId: activation.childId,
+			result: activation.result.promise,
+			dispose: () => this.dispose(activation)
+		};
 	}
 	/** Route one parent-originated delivery through residency and cold resume. */
 	async deliverToChild(parent, childId, content, options) {
-		this.activations.assertAdmitting(parent);
-		const releaseHold = this.activations.holdOwnership(parent, childId);
+		this.assertAdmitting(parent);
+		const releaseHold = this.holdOwnership(parent, childId);
 		try {
 			return await this.deliverFollowup(parent, childId, content, options);
 		} catch (error) {
@@ -1819,47 +2090,38 @@ var SubagentContinuationManager = class {
 	/** The delivery loop behind {@link deliverToChild}, run under the parent hold. */
 	async deliverFollowup(parent, childId, content, options) {
 		while (true) {
-			const live = await this.activations.locks.run(childId, async () => {
-				const activation = this.activations.get(childId);
+			const live = await this.locks.run(childId, async () => {
+				const activation = this.resident.get(childId);
 				if (activation === void 0) return this.coldResume(parent, childId, content, options);
-				const disposal = activation.inbox.closing;
+				requireLocalActivation(activation);
+				const disposal = activation.closing;
 				/* v8 ignore next 3 -- the send-versus-dispose cutoff needs a delivery to
 				* observe the transaction inside the same critical section that opened it. */
 				if (disposal !== void 0) return disposal.then(() => void 0, () => void 0);
 				if (contentHasImage(content)) {
-					await this.assertImageCapable(activation.handle.agent, options.signal);
-					if (activation.inbox.closing !== void 0) {
-						await Promise.allSettled([activation.inbox.closing]);
+					await this.assertImageCapable(requireLocalActivation(activation).handle.agent, options.signal);
+					if (activation.closing !== void 0) {
+						await Promise.allSettled([activation.closing]);
 						return;
 					}
 				}
 				const messageId = this.submitAdmitted(activation, content, options, parent);
-				activation.announced = true;
+				this.announce(activation);
 				return messageId;
 			});
 			/* v8 ignore start -- only a delivery that lost the disposal cutoff retries. */
 			if (live !== void 0) return live;
-			this.activations.assertAdmitting(parent);
+			this.assertAdmitting(parent);
 			options.signal.throwIfAborted();
 		}
 	}
-	/**
-	* Interrupt one live continuable child's current turn. Admission is
-	* synchronous and the cancellation effect is asynchronous. An absent or
-	* already-closing target is an accepted no-op after authority checks.
-	* @param targetSessionId - the durable child session id to interrupt.
-	* @param authority - the human parent address or exact live ancestor Agent.
-	*/
-	interrupt(targetSessionId, authority) {
-		this.activations.interrupt(targetSessionId, authority);
-	}
 	/** Deliver one resident continuable child's message to its live direct parent. */
 	sendToParent(activation, sender, content) {
 		/* v8 ignore next 6 -- only synchronous re-entrant teardown can open this
 		* transaction between exact-agent authorization and this no-await span. */
-		if (activation.inbox.closing !== void 0) throw new SubagentError(`subagent "${sender.id}" activation is being disposed; the message was not delivered`, "ACTIVATION_CLOSING");
-		const parent = this.ctx.agents.get(activation.parentSession);
-		if (parent === void 0) throw new SubagentError("direct parent is not live; the message was not delivered", "PARENT_UNAVAILABLE");
+		if (activation.closing !== void 0) throw new SubagentError(`subagent "${sender.id}" activation is being disposed; the message was not delivered`, "ACTIVATION_CLOSING");
+		const parent = this.ctx.agents.get(activation.parent.id);
+		if (parent !== activation.parent) throw new SubagentError("direct parent is not live; the message was not delivered", "PARENT_UNAVAILABLE");
 		const message = createAgentMessage(sender, content);
 		this.sendAgentMessage(parent, message);
 		return message.id;
@@ -1867,30 +2129,11 @@ var SubagentContinuationManager = class {
 	/** Send one Agent message while translating only the target's own rejection. */
 	sendAgentMessage(parent, message) {
 		try {
-			this.activations.sendWaking(parent, message, "steer");
+			this.sendWaking(parent, message, "steer");
 		} catch (error) {
 			throw new SubagentError("direct parent is not live; the message was not delivered", "PARENT_UNAVAILABLE", { cause: error });
 		}
 	}
-	/** Close manager-wide admission and release every live Activation. */
-	async drain() {
-		await this.activations.drain();
-	}
-	/**
-	* Stop only the continuable descendants of exact live host-owned parents.
-	* @param parents - exact live roots whose continuable descendants must stop.
-	*/
-	async drainDescendants(parents) {
-		await this.activations.drainDescendants(parents);
-	}
-	/**
-	* Release selected resident direct children of one exact live parent.
-	* @param parent - exact live direct parent authorizing the selected release.
-	* @param childIds - durable direct-child ids to release when resident.
-	*/
-	async drainChildren(parent, childIds) {
-		await this.activations.drainChildren(parent, childIds);
-	}
 	/**
 	* Cold-resume a persisted child and submit the waiting turn. The descriptor
 	* supplies every reconstruction input; no subagent provider is dispatched.
@@ -1911,13 +2154,18 @@ var SubagentContinuationManager = class {
 				throw new SubagentError(`subagent "${childId}" is unavailable`, "NOT_RESUMABLE", { cause: error });
 			}
 			const source = __addDisposableResource$2(env_1, observation, false);
-			this.activations.assertAdmitting(parent);
-			this.activations.authorizeLineage(parent, childId, source.header.parentSession);
-			const descriptor = foldSubagentDescriptor(source.events.slice(source.inheritedEventCount));
+			this.assertAdmitting(parent);
+			this.authorizeLineage(parent, childId, source.header.parentSession);
+			const ownEvents = source.events.slice(source.inheritedEventCount);
+			const descriptor = foldSubagentDescriptor(ownEvents);
 			if (descriptor === void 0 || descriptor.mode !== "continuable") throw new SubagentError(`subagent "${childId}" has no supported continuation state and cannot be resumed; choose a different target`, "NOT_RESUMABLE");
 			let activation;
 			try {
-				activation = await this.activations.materialize({
+				const independentlySelected = hasIndependentPresetSelection(ownEvents);
+				const agentPreset = independentlySelected ? source.projections?.values.agentPreset : void 0;
+				if (independentlySelected && typeof agentPreset !== "string") throw new SubagentError(`subagent "${childId}" has no agent preset projection for restoration`, "NOT_RESUMABLE");
+				activation = await this.materialize({
+					kind: "local",
 					childId,
 					provider: descriptor.provider,
 					parent,
@@ -1927,6 +2175,7 @@ var SubagentContinuationManager = class {
 						...descriptor.agentReasoningEffort !== void 0 ? { reasoningEffort: ReasoningEffortId(descriptor.agentReasoningEffort) } : {}
 					},
 					composition: {
+						agentPreset: agentPreset ?? void 0,
 						persona: descriptor.persona,
 						toolFilter: descriptor.toolFilter
 					},
@@ -1949,16 +2198,16 @@ var SubagentContinuationManager = class {
 	async submitMaterialized(activation, content, options, parent, commit) {
 		try {
 			if (contentHasImage(content)) {
-				await this.assertImageCapable(activation.handle.agent, options.signal);
-				if (activation.inbox.closing !== void 0) throw new SubagentError(`subagent "${activation.childId}" is closing`, "ACTIVATION_CLOSING");
+				await this.assertImageCapable(requireLocalActivation(activation).handle.agent, options.signal);
+				if (activation.closing !== void 0) throw new SubagentError(`subagent "${activation.childId}" is closing`, "ACTIVATION_CLOSING");
 			}
 			const messageId = this.submitAdmitted(activation, content, options, parent);
 			commit?.();
-			activation.announced = true;
+			this.announce(activation);
 			return messageId;
 		} catch (error) {
 			try {
-				await this.activations.dispose(activation);
+				await this.dispose(activation);
 			} catch (cleanupError) {
 				this.ctx.logger.warn(`subagent continuation: disposal after admission or catalog append failure also failed: ${String(cleanupError)}`);
 			}
@@ -1971,7 +2220,16 @@ var SubagentContinuationManager = class {
 			content,
 			source: options.source
 		});
-		return this.activations.submitAdmitted(activation, message, options.delivery, parent, options.signal);
+		options.signal.throwIfAborted();
+		this.assertAdmitting(parent);
+		this.authorizeLineage(parent, activation.childId, activation.parent.id);
+		this.acquireOwnership(parent, activation.childId);
+		try {
+			this.deliver(activation, message, options.delivery);
+		} finally {
+			this.wake(activation);
+		}
+		return message.id;
 	}
 	/** Refuse image content for a child whose fixed model accepts text only. */
 	async assertImageCapable(agent, signal) {
@@ -1996,6 +2254,15 @@ var SubagentContinuationManager = class {
 		return query;
 	}
 };
+/** Creation-time selection precedes the own descriptor; historical forks can select after it. */
+function hasIndependentPresetSelection(events) {
+	for (const event of events) {
+		if (event.type === "subagent/descriptor") return false;
+		if (event.type === "agent-preset/selected") return true;
+	}
+	/* v8 ignore next -- coldResume rejects logs without a supported own descriptor before this lookup. */
+	return false;
+}
 //#endregion
 //#region lib/types/list-children.js
 /**
@@ -2124,7 +2391,7 @@ async function listDescendants(ctx, rootSessionId, signal) {
 		visited.add(entry.id);
 		let children;
 		try {
-			children = await readChildren(entry.id);
+			children = entry.mode === "external" ? [] : await readChildren(entry.id);
 		} catch (error) {
 			if (error instanceof SubagentError) throw error;
 			const code = error instanceof Error && "code" in error ? error.code : void 0;
@@ -2482,8 +2749,7 @@ const subagentIdentityProjectionDefinition = {
 * Provider-side vocabulary for OUT-OF-PROCESS subagent backends — the pieces
 * that enforce this seam's own contracts around a child in another process:
 * the no-capabilities advertisement, timing-bound validation, child
-* working-directory resolution (config override, else the delegating parent
-* session's workspace), the never-reject result settlement, and the standard
+* working-directory validation, the never-reject result settlement, and the standard
 * run-handle publication. Backends compose these with their own wire drivers;
 * the process machinery itself (spawn, env scrub, managed-range teardown)
 * belongs to the `dsh-subprocess` seam.
@@ -2517,15 +2783,14 @@ function normalizeSubagentDiagnostic(result) {
 /**
 * The capability advertisement of an out-of-process backend: NONE. A child in
 * another process cannot honor parent-enforced start features
-* (`agentOptions`/`outputSchema`/`maxDepth`/`toolFilter`/`persona`), so the service rejects a
+* (`agentOptions`/`agentPreset`/`outputSchema`/`maxDepth`), so the service rejects a
 * request needing any of them before `start` runs — never accepted-then-ignored.
 */
 const NO_START_CAPABILITIES = Object.freeze({
 	agentOptions: false,
+	agentPreset: false,
 	outputSchema: false,
-	depthLimit: false,
-	toolFilter: false,
-	persona: false
+	depthLimit: false
 });
 /**
 * Assert a configured timing bound is a positive finite number (it bounds a
@@ -2566,39 +2831,6 @@ function assertUsableCwd(prefix, label, cwd) {
 	if (!isEnterableDirectory(cwd)) throw new Error(`${prefix}: ${label} is not an accessible directory: ${cwd}`);
 	return cwd;
 }
-/**
-* Validate a configured `cwd` override ONCE, at plugin load: reject the empty
-* string (`path.resolve('')` is the process cwd — it would silently
-* reintroduce the launch-directory fallback this resolution removes),
-* interpret a relative path against the harness launch directory, and require
-* an enterable directory.
-* @param prefix - the consuming plugin's diagnostic prefix.
-* @param cwd - the configured override, or `undefined` when the config omits it.
-* @returns the validated absolute override, or `undefined` when omitted.
-*/
-function validateConfiguredCwd(prefix, cwd) {
-	if (cwd === void 0) return void 0;
-	if (cwd === "") throw new Error(`${prefix}: config cwd must not be empty — omit the key to inherit the parent session cwd`);
-	return assertUsableCwd(prefix, "config cwd", resolve(cwd));
-}
-/**
-* Resolve the child's working directory at start: the deployment override
-* when configured (already validated at load), else the parent session's
-* workspace cwd (validated here, its earliest resolvable point). Fails loud
-* when neither exists — falling back to the harness process cwd would
-* silently bind the child to the server's launch directory instead of the
-* delegating session's workspace (one server process serves many sessions,
-* each with its own cwd).
-* @param prefix - the consuming plugin's diagnostic prefix.
-* @param configured - the load-validated override, or `undefined`.
-* @param parentCwd - the delegating parent session's workspace cwd, if any.
-* @returns the absolute child working directory.
-*/
-function resolveChildCwd(prefix, configured, parentCwd) {
-	if (configured !== void 0) return configured;
-	if (parentCwd === void 0) throw new Error(`${prefix}: no working directory for the child — configure \`cwd\` or delegate from a parent session that has one`);
-	return assertUsableCwd(prefix, "parent session cwd", parentCwd);
-}
 /** Normalize an unknown thrown value to an Error (the catch binding is `unknown`). */
 function toError(value) {
 	/* v8 ignore next */
@@ -2646,13 +2878,12 @@ async function settleRunResult(parts) {
 * local cancellation — there is no assumption the child cooperates — and then
 * awaits the backend's teardown to actual exit.
 * @param parts - the run identity, result, cancellation wiring, and teardown.
-* @returns the seam run handle (`localAgent` is `undefined` for remote runs).
+* @returns the external run handle.
 */
 function subprocessRunHandle(parts) {
 	let disposal;
 	return {
 		id: parts.id,
-		localAgent: void 0,
 		result: parts.result,
 		dispose() {
 			if (disposal !== void 0) return disposal;
@@ -2664,80 +2895,6 @@ function subprocessRunHandle(parts) {
 	};
 }
 //#endregion
-//#region lib/types/run-settlement.js
-/**
-* Settlement of one ONE-SHOT subagent run into a background-Task outcome. Only
-* the one-shot background path uses Jobs; continuable children have no Task,
-* no per-message result, and no Task cancellation.
-*
-* @module @deepseek-ai/dsh-subagent/run-settlement
-*/
-/** Flatten a child's final output blocks to the task's final text. */
-function finalText(blocks) {
-	return blocks.filter((block) => block.type === "text").map((block) => block.text).join("");
-}
-/** Render a failed stop reason with optional provider-authored detail. */
-function failureDetail(result) {
-	const stopReason = result.stopReason;
-	return result.diagnostic === void 0 ? stopReason : `${stopReason}; diagnostic: ${result.diagnostic}`;
-}
-/**
-* Map a child result to the task outcome: completed carries final text, local
-* cancellation (`aborted` without a diagnostic) is killed, and provider-
-* diagnosed remote aborts plus every other reason are failed without partial
-* output.
-* @param result - child terminal result.
-* @returns outcome for the `ctx.jobs` registration.
-*/
-function runOutcome(result) {
-	switch (result.stopReason) {
-		case "completed": return {
-			status: "completed",
-			result: finalText(result.output)
-		};
-		case "aborted": return result.diagnostic === void 0 ? { status: "killed" } : {
-			status: "failed",
-			detail: failureDetail(result)
-		};
-		case "error":
-		case "max-tokens":
-		case "refusal": return {
-			status: "failed",
-			detail: failureDetail(result)
-		};
-		default: return {
-			status: "failed",
-			detail: failureDetail(result)
-		};
-	}
-}
-/**
-* Await the child result, dispose the run, then return its task outcome. Result
-* and disposal failures become `failed`; when both fail, both details survive.
-* @param run - live run to settle and release.
-* @returns outcome after child resources are released.
-*/
-async function settleRun(run) {
-	let outcome;
-	try {
-		outcome = runOutcome(await run.result);
-	} catch (error) {
-		outcome = {
-			status: "failed",
-			detail: String(error)
-		};
-	}
-	try {
-		await run.dispose();
-	} catch (error) {
-		return {
-			status: "failed",
-			detail: `${outcome.detail === void 0 ? "" : `${outcome.detail}; `}dispose failed: ${String(error)}`
-		};
-	}
-	return outcome;
-}
-//#endregion
 //#region lib/types/index.js
 var __runInitializers = function(thisArg, initializers, value) {
 	var useValue = arguments.length > 2;
@@ -2777,7 +2934,7 @@ var __esDecorate = function(ctor, descriptorIn, decorators, contextIn, initializ
 	if (target) Object.defineProperty(target, contextIn.name, descriptor);
 	done = true;
 };
-/** Named provider registry with one-shot runs, durable discovery, and continuable-child operations. */
+/** Named provider registry with managed activations, durable discovery, and local child messaging. */
 let SubagentRuntime = (() => {
 	let _classSuper = TypertRemoteService;
 	let _instanceExtraInitializers = [];
@@ -2822,8 +2979,9 @@ let SubagentRuntime = (() => {
 			maxDepth: z.number().step(1).min(0).max(Number.MAX_SAFE_INTEGER).default(1).volatile(),
 			maxActiveSubagents: z.number().step(1).min(1).max(Number.MAX_SAFE_INTEGER).default(8).volatile()
 		});
+		static inject = ["workingDirectory"];
 		providers = /* @__PURE__ */ new Map();
-		continuations;
+		manager;
 		/**
 		* The contained lifecycle-edge publisher. Built here because scoped dispatch
 		* keys its carrier by this exact service instance, whose own context filter
@@ -2835,21 +2993,23 @@ let SubagentRuntime = (() => {
 			this.config = config;
 			this.emitLifecycle = createLifecycleEmitter(this.ctx, (parent) => scopeTarget(this, parent));
 			ctx.inject(["agents"], (childCtx) => {
-				const manager = new SubagentContinuationManager(childCtx, {
+				const manager = new SubagentManager(childCtx, {
+					startExternal: (name, request) => {
+						return this.expectProvider(name).start(request);
+					},
 					prepareContinuable: (name, request) => this.prepareContinuable(name, request),
 					observeActivation: (provider, childId, parent) => this.observeActivation(provider, childId, parent)
 				}, () => this.config.maxActiveSubagents.get());
-				this.continuations = manager;
+				this.manager = manager;
 				childCtx.effect(() => () => {
 					/* v8 ignore else -- one injected binding owns the slot until its fiber disposes. */
-					if (this.continuations === manager) this.continuations = void 0;
-				}, "subagents.continuationBinding()");
+					if (this.manager === manager) this.manager = void 0;
+				}, "subagents.managerBinding()");
 			});
 			ctx.inject(["sessionProjections"], (projectionCtx) => {
-				const projections = projectionCtx.sessionProjections;
-				projections.register(subagentCatalogProjectionDefinition);
-				projections.register(subagentTimingProjectionDefinition);
-				projections.register(subagentIdentityProjectionDefinition);
+				projectionCtx.sessionProjections.register(subagentCatalogProjectionDefinition);
+				projectionCtx.sessionProjections.register(subagentTimingProjectionDefinition);
+				projectionCtx.sessionProjections.register(subagentIdentityProjectionDefinition);
 			});
 			ctx.inject(["agents"], (agentsCtx) => {
 				installSubagentArchiveAdmission(agentsCtx);
@@ -2868,16 +3028,32 @@ let SubagentRuntime = (() => {
 			return depth;
 		}
 		/**
-		* Establish one durable continuable child and deliver its initial prompt.
-		* Resolves when the child's inbox accepts that prompt, without waiting for the
-		* turn to start or for the message to reach the Session log; any earlier
-		* failure rejects with no ids and rolls back the child entirely.
-		* @param spec - provider, delegation request, and caller cancellation.
-		* @returns the durable child id and the accepted prompt's message id.
-		* @throws when continuation services are unavailable or materialization fails.
+		* Establish a managed child with backend-specific execution capabilities.
+		* @param spec - task, backend, and result recipient.
+		* @returns identities, execution result, and exact-activation disposal. A reserved
+		* childId requires a local backend and guarantees an accepted messageId.
+		*/
+		async startActivation(spec) {
+			const provider = this.expectProvider(spec.provider);
+			if (spec.childId !== void 0 && provider.prepareContinuable === void 0) throw new SubagentError("reserved child ids require a local backend", "UNSUPPORTED_CAPABILITY");
+			assertSubagentMaxDepth(spec.request.maxDepth);
+			this.assertCapabilities(provider, {
+				...spec.request,
+				signal: spec.signal
+			});
+			const manager = this.requireManager();
+			if (this.ctx.get("agents")?.get(spec.request.parent.id) !== spec.request.parent) throw new SubagentError("subagent creation requires the exact live parent agent", "UNAUTHORIZED");
+			if (spec.request.outputSchema !== void 0) assertObjectJsonSchema(spec.request.outputSchema);
+			return provider.prepareContinuable === void 0 ? manager.startExternal(spec) : manager.startLocal(spec);
+		}
+		/**
+		* Join progressing descendants without cancelling them. Idle descendants whose
+		* inboxes require a later wake stay resident and do not delay host completion.
+		* @param parent - the exact parent whose descendant work is observed.
+		* @returns whether work was joined; hosts recheck parent idle after true.
 		*/
-		async startContinuable(spec) {
-			return this.requireContinuations().startContinuable(spec);
+		async waitForChildren(parent) {
+			return this.manager?.waitForChildren(parent) ?? false;
 		}
 		/**
 		* Steer one model-authored message to the sender's direct parent or direct
@@ -2894,7 +3070,7 @@ let SubagentRuntime = (() => {
 		*   or the message was not admitted.
 		*/
 		async sendMessage(sender, targetId, content, options) {
-			return this.requireContinuations().sendMessage(sender, targetId, content, options);
+			return this.requireManager().sendMessage(sender, targetId, content, options);
 		}
 		/**
 		* Deliver one host-protocol message to a direct continuable child.
@@ -2909,16 +3085,16 @@ let SubagentRuntime = (() => {
 		* @returns the accepted message's inbox id.
 		*/
 		[deliverSubagentPrompt](parent, childId, content, source, signal, delivery) {
-			return delivery === "steer" ? this.requireContinuations().steerPrompt(parent, childId, content, source, signal) : this.requireContinuations().queuePrompt(parent, childId, content, source, signal);
+			return delivery === "steer" ? this.requireManager().steerPrompt(parent, childId, content, source, signal) : this.requireManager().queuePrompt(parent, childId, content, source, signal);
 		}
 		/**
-		* Interrupt one live continuable child's current turn under a human parent
+		* Interrupt one live child's current execution under a human parent
 		* address or an exact live ancestor Agent. Fire-and-return: the cancel
 		* signal is issued before this returns, but the target may keep running
 		* until it observes the signal. Unclaimed pending inbox work, the Activation,
 		* and published descendants are preserved; claimed work is not requeued.
-		* Once the interrupted driver is idle, a waking send resumes the parked FIFO
-		* queue. An absent target — including a one-shot or unknown id —
+		* Once the interrupted Agent is idle, a waking send resumes the parked FIFO
+		* queue. External backends stop their single execution. An absent target
 		* is an accepted no-op, as is a manager-less composition, which cannot own a
 		* live Activation.
 		* @param targetSessionId - the durable child session id to interrupt.
@@ -2927,35 +3103,35 @@ let SubagentRuntime = (() => {
 		*   live target.
 		*/
 		interrupt(targetSessionId, authority) {
-			this.continuations?.interrupt(targetSessionId, authority);
+			this.manager?.interrupt(targetSessionId, authority);
 		}
 		/**
-		* Close continuable admission below exact live parent Agents, stop only their
+		* Close subagent admission below exact live parent Agents, stop only their
 		* visible descendant Activations synchronously, then await admitted scoped
 		* materializations and release those forests child-first. The scoped cutoff
 		* lasts until each exact parent leaves the registry; unrelated parent trees
 		* remain live.
 		* @param parents - exact host-owned parent Agents entering teardown.
-		* @returns once every retained descendant Activation released its `AgentHandle`.
+		* @returns once every retained descendant activation released its execution handle.
 		* @throws an aggregate error after all branches settle when any failed.
 		*/
-		async drainContinuableDescendants(parents) {
-			const manager = this.continuations;
+		async drainDescendants(parents) {
+			const manager = this.manager;
 			if (manager === void 0) return;
 			await manager.drainDescendants(parents);
 		}
 		/**
-		* Release selected resident continuable direct children of one exact live
+		* Release selected resident direct children of one exact live
 		* parent. Other children of the same parent remain admitted and resident.
 		* Absent targets and a manager-less composition are accepted no-ops.
 		* @param parent - exact live direct parent authorizing the selected release.
 		* @param childIds - durable direct-child ids to release when resident.
-		* @returns once every selected Activation released its `AgentHandle`.
+		* @returns once every selected activation released its execution handle.
 		* @throws {SubagentError} `UNAUTHORIZED` when a resident target belongs to a
 		*   different parent or the supplied parent identity is stale.
 		*/
-		async drainContinuableChildren(parent, childIds) {
-			const manager = this.continuations;
+		async drainChildren(parent, childIds) {
+			const manager = this.manager;
 			if (manager === void 0) return;
 			await manager.drainChildren(parent, childIds);
 		}
@@ -2974,7 +3150,8 @@ let SubagentRuntime = (() => {
 		/**
 		* Recursively list reachable parent catalogs in stable pre-order, preserving
 		* each catalog's event order. Each row carries its catalog parent and depth;
-		* one-shot and unknown-mode children remain traversal nodes. Unknown modes
+		* external children are leaves; one-shot and unknown-mode children remain
+		* traversal nodes. Unknown modes
 		* produce unsupported diagnostics. Unreadable child catalogs produce corrupt
 		* or unavailable diagnostics and stop only that branch. Root read failures,
 		* missing services or projections, and cancellation reject the whole listing.
@@ -3014,10 +3191,12 @@ let SubagentRuntime = (() => {
 			if (clientTimeZone !== void 0 && canonicalTimeZone === void 0) throw new RemoteError("subagent/invalid-time-zone", "clientTimeZone must be UTC or a valid IANA Area/Location name", { value: clientTimeZone });
 			const parent = this.ctx.get("agents")?.get(parentSessionId);
 			if (parent === void 0) throw new RemoteError("subagent/parent-unavailable", `parent session "${parentSessionId}" is not live`, { parentSessionId });
+			const principal = principalOf(this.ctx.invocation);
 			const source = {
 				kind: "user",
 				rpcId: request.requestId,
-				...canonicalTimeZone === void 0 ? {} : { clientTimeZone: canonicalTimeZone }
+				...canonicalTimeZone === void 0 ? {} : { clientTimeZone: canonicalTimeZone },
+				...principal === void 0 ? {} : { principal }
 			};
 			try {
 				let content;
@@ -3069,12 +3248,14 @@ let SubagentRuntime = (() => {
 		/**
 		* Register a provider under its name. Registration is effect-scoped and HMR
 		* safe; removing a provider blocks new starts but does not revoke runs that
-		* were already returned to their holders.
+		* were already returned to their holders. Providers without either execution
+		* method are rejected with UNSUPPORTED_CAPABILITY before registration.
 		* @param provider - the trusted provider implementation.
 		* @returns the exact Cordis effect disposer.
 		*/
 		registerProvider(provider) {
 			const name = provider.name;
+			if (provider.start === void 0 && provider.prepareContinuable === void 0) throw new SubagentError(`subagent provider "${name}" must implement start or prepareContinuable`, "UNSUPPORTED_CAPABILITY");
 			return this.ctx.effect(function* () {
 				if (this.providers.has(name)) throw new SubagentError(`a subagent provider named "${name}" is already registered`, "DUPLICATE_PROVIDER");
 				this.providers.set(name, provider);
@@ -3101,55 +3282,12 @@ let SubagentRuntime = (() => {
 			return [...this.providers.keys()];
 		}
 		/**
-		* Establish a published child on the named provider. Capability and semantic
-		* checks run before delegation. Provider ownership lasts until its promise
-		* fulfills; a rejection therefore has no run for the caller to dispose and
-		* emits no run lifecycle events. Post-publication turn and infrastructure
-		* failures settle through the returned run.
-		* A catalog append failure disposes the run and handles its result rejection;
-		* the caller receives the catalog error even if disposal also fails.
-		* @param name - the provider to use.
-		* @param request - child label, prompt, parent, signal, and optional capabilities.
-		* @returns the published holder-owned run.
-		*/
-		async start(name, request) {
-			const provider = this.expectProvider(name);
-			this.assertCapabilities(provider, request);
-			assertSubagentMaxDepth(request.maxDepth);
-			if (request.outputSchema !== void 0) assertObjectJsonSchema(request.outputSchema);
-			const descriptor = snapshotSubagentDescriptor({
-				mode: "one-shot",
-				provider: name,
-				...request.label !== void 0 ? { label: request.label } : {}
-			});
-			const resolved = {
-				...request,
-				descriptor
-			};
-			const run = await provider.start(resolved);
-			const child = run.localAgent?.session;
-			if (child !== void 0) try {
-				establishCatalogChild(request.parent.session, child.header, descriptor);
-			} catch (error) {
-				run.result.catch(() => void 0);
-				try {
-					await run.dispose();
-				} catch (cleanupError) {
-					this.ctx.logger.warn(`subagent: disposal after catalog append failure also failed: ${String(cleanupError)}`);
-				}
-				throw error;
-			}
-			return observeRun(this.emitLifecycle, name, request.parent, run);
-		}
-		/**
 		* Resolve one provider's detached continuable-creation contribution. Method
 		* presence on the provider IS the capability, so a provider without it is
 		* rejected before the manager reserves any child resources.
 		*/
 		async prepareContinuable(name, request) {
-			const provider = this.expectProvider(name);
-			if (provider.prepareContinuable === void 0) throw new SubagentError(`subagent provider "${provider.name}" does not support continuable children (no prepareContinuable capability)`, "UNSUPPORTED_CAPABILITY");
-			return provider.prepareContinuable(request);
+			return this.expectProvider(name).prepareContinuable(request);
 		}
 		/** Look up a provider for dispatch or fail loud. */
 		expectProvider(name) {
@@ -3157,10 +3295,10 @@ let SubagentRuntime = (() => {
 			if (provider === void 0) throw new SubagentError(`no subagent provider registered for "${name}"`, "NO_PROVIDER");
 			return provider;
 		}
-		/** Resolve the optional continuable-subagent manager or fail loud. */
-		requireContinuations() {
-			if (this.continuations === void 0) throw new SubagentError("continuable subagents require the agents service", "CONTINUATION_UNAVAILABLE");
-			return this.continuations;
+		/** Resolve the subagent manager or fail loud. */
+		requireManager() {
+			if (this.manager === void 0) throw new SubagentError("continuable subagents require the agents service", "CONTINUATION_UNAVAILABLE");
+			return this.manager;
 		}
 		/**
 		* Build the lifecycle observer for one continuable Activation's residency
@@ -3171,6 +3309,7 @@ let SubagentRuntime = (() => {
 		}
 		/** Reject the first requested capability that the provider lacks. */
 		assertCapabilities(provider, request) {
+			if (request.agentPreset !== void 0 && (!provider.capabilities.agentPreset || provider.inheritsParentContext)) throw new SubagentError(`subagent provider "${provider.name}" does not support independent agent preset selection`, "UNSUPPORTED_CAPABILITY");
 			const needs = [
 				{
 					when: request.agentOptions !== void 0,
@@ -3183,14 +3322,6 @@ let SubagentRuntime = (() => {
 				{
 					when: request.maxDepth !== void 0,
 					cap: "depthLimit"
-				},
-				{
-					when: request.toolFilter !== void 0,
-					cap: "toolFilter"
-				},
-				{
-					when: request.persona !== void 0,
-					cap: "persona"
 				}
 			];
 			for (const { when, cap } of needs) if (when && !provider.capabilities[cap]) throw new SubagentError(`subagent provider "${provider.name}" does not support the "${cap}" capability`, "UNSUPPORTED_CAPABILITY");
@@ -3198,4 +3329,4 @@ let SubagentRuntime = (() => {
 	};
 })();
 //#endregion
-export { AssistantOutputFold, NO_START_CAPABILITIES, SUBAGENT_DESCRIPTOR_VERSION, SubagentDepthError, SubagentError, SubagentRunId, SubagentRuntime, SubagentRuntime as default, appendDelegatedPolicyOverrides, applyChildComposition, assertPositiveFinite, assertSubagentMaxDepth, assertUsableCwd, captureDelegatedPolicyOverrides, childSessionMeta, delegationDepthOf, finalAssistantOutput, foldSubagentDescriptor, parentAgentOptionsForDelegation, resolveChildAgentOptions, resolveChildCwd, resolveChildDepth, settleRun, settleRunResult, snapshotSubagentDescriptor, subprocessRunHandle, validateConfiguredCwd };
+export { AssistantOutputFold, NO_START_CAPABILITIES, STRUCTURED_OUTPUT_TOOL, SUBAGENT_DESCRIPTOR_VERSION, SubagentDepthError, SubagentError, SubagentRunId, SubagentRuntime, SubagentRuntime as default, appendDelegatedPolicyOverrides, applyChildComposition, assertPositiveFinite, assertSubagentMaxDepth, assertUsableCwd, captureDelegatedPolicyOverrides, childSessionMeta, delegationDepthOf, finalAssistantOutput, foldSubagentDescriptor, parentAgentOptionsForDelegation, resolveChildAgentOptions, resolveChildDepth, settleRunResult, snapshotSubagentDescriptor, subprocessRunHandle };