@duckmind/dm-linux-x64 0.65.5 → 0.65.7

package/extensions/dm-subagents/src/runs/foreground/subagent-executor.js

@@ -21,10 +21,13 @@ import { handleManagementAction } from "../../agents/agent-management.js";
 import { handleRefinementAction } from "../../agents/agent-refinements.js";
 import { buildDoctorReport } from "../../extension/doctor.js";
 import { readSubagentGuide } from "../../extension/subagent-guide.js";
-import { normalizePublicSubagentExecution } from "../../extension/public-execution.js";
+import { normalizePublicSubagentExecution, validateWorkflowCapacityOverrides } from "../../extension/public-execution.js";
 import { runSync } from "./execution.js";
 import { handleWatchdogToolAction, WATCHDOG_TOOL_ACTIONS } from "../../watchdog/tool-actions.js";
-import { buildModelCandidates, inheritsParentModel, normalizeParentModel, resolveEffectiveSubagentModel } from "../shared/model-fallback.js";
+import { applyWatchdogLaunchRules } from "../../watchdog/rules.js";
+import { childWatchdogProgressForModel } from "../../watchdog/child-status.js";
+import { normalizeParentModel, resolveEffectiveSubagentModel, resolveModelOrigin } from "../shared/model-resolution.js";
+import { projectChainOutputSchemas, resolveEffectiveOutputSchema } from "../shared/child-launch-plan.js";
 import { formatRetainedChildren, listRetainedChildren } from "../background/retained-children.js";
 import { resolveModelScopesForAgent } from "../shared/model-scope.js";
 import { recordRun } from "../shared/run-history.js";
@@ -40,27 +43,30 @@ import { updateActiveRunIndex } from "../background/active-run-index.js";
 import { steeringReceipt } from "../background/steering.js";
 import { acquireActiveAsyncCapacity, ActiveAsyncCapacityError, getActiveAsyncCapacitySnapshot, resolveAbandonedSlotReleaseAfterMs, resolveMaxActiveAsyncRunsPerSession, transferActiveAsyncCapacity } from "../background/active-async-capacity.js";
 import { isScheduledRunAction } from "../background/scheduled-runs.js";
+import { encodeIndexSegment } from "../background/index-segment.js";
 import { enqueueChainAppendRequest, readPendingChainAppendRequests, runnerStepOutputNames } from "../background/chain-append.js";
 import { ChainOutputValidationError, validateChainOutputBindingsWithContext } from "../shared/chain-outputs.js";
-import { normalizeGateAcceptance, validateExecutionAcceptance } from "../shared/acceptance.js";
-import { canPreferFork, createForkContextResolver, forkedChildRequiresThinkingOff, resolveSubagentLaunchContext } from "../../shared/fork-context.js";
+import { acceptanceHasTypedVerify, normalizeGateAcceptance, resolveAcceptanceReportMode, TYPED_VERIFY_OUTPUT_SCHEMA_CONFLICT, validateAcceptanceInput, validateExecutionAcceptance, validateExecutionAcceptancePolicy } from "../shared/acceptance.js";
+import { canPreferFork, createForkContextResolver, resolveSubagentLaunchContext } from "../../shared/fork-context.js";
 import { createPrunedForkSessionWriter } from "../../shared/pruned-fork.js";
 import { resolveCurrentSessionId } from "../../shared/session-identity.js";
 import { currentCompletionOwnerId } from "../../shared/completion-owner.js";
+import { SUBAGENT_ASYNC_COMPLETE_EVENT } from "../../shared/types.js";
 import { applyIntercomBridgeToAgent, INTERCOM_BRIDGE_MARKER, resolveIntercomBridge, resolveIntercomSessionTarget, resolveSubagentIntercomTarget } from "../../intercom/intercom-bridge.js";
 import { formatControlIntercomMessage, formatControlNoticeMessage, resolveControlConfig, shouldNotifyControlEvent } from "../shared/subagent-control.js";
 import { formatSpawnBudget, getSpawnBudgetSnapshot, grantSpawnBudget, preflightSpawnBudget, preflightSpawnBudgetGrant, reserveSpawnBudget } from "../shared/spawn-budget.js";
-import { claimRunFanoutBatch, claimRunFanoutBatchWithCommit, createRunFanoutBudget, decodeRunFanoutBudgetDescriptor, formatRunFanoutBudget, getRunFanoutBudgetSnapshot, readRunFanoutBudgetDescriptor, RunFanoutLimitError, RUN_FANOUT_BUDGET_ENV, writeRunFanoutBudgetDescriptor } from "../shared/run-fanout-budget.js";
+import { claimRunFanoutBatch, claimRunFanoutBatchWithCommit, createRunFanoutBudget, formatRunFanoutBudget, getRunFanoutBudgetSnapshot, readRunFanoutBudgetDescriptor, RunFanoutLimitError, writeRunFanoutBudgetDescriptor } from "../shared/run-fanout-budget.js";
+import { retainLiveForegroundNestedRoute } from "../../integrations/dm-web-session-liveness.js";
 import { validateToolBudgetConfig } from "../shared/tool-budget.js";
 import { usageBudgetExceededMessage, usageBudgetState, validateUsageBudgetConfig } from "../shared/usage-budget.js";
 import { intersectSubagentCapabilityCeilings, resolveCurrentSubagentCapabilityCeiling } from "../shared/capability-ceiling.js";
-import { isAgentContractV1 } from "../shared/agent-contract.js";
+import { isAgentContract } from "../shared/agent-contract.js";
 import { normalizeExtensionBindings } from "../shared/extension-bindings.js";
+import { resolveRequiredChildExtensions } from "../../shared/required-child-extensions.js";
 import { finalizeSingleOutput, injectSingleOutputInstruction, normalizeSingleOutputOverride, outputPathMappingFromTask, resolveSingleOutputPath, validateFileOnlyOutputMode } from "../shared/single-output.js";
 import { assertJsonSchemaObject, cleanupStructuredOutputRuntime, createStructuredOutputRuntime } from "../shared/structured-output.js";
-import { compactForegroundDetails, getSingleResultOutput, readStatus, resolveChildCwd, sumResultsCost, sumResultsUsage } from "../../shared/utils.js";
-import { createTaskMutationArbiter } from "../shared/llm-intent-arbiter.js";
-import { discardPreservedWorktrees, formatParallelHandoffError, formatParallelHandoffReference, formatStoredParallelHandoffCleanup, parallelHandoffPath, readParallelHandoffManifest, recordParallelHandoffMerge, recordParallelHandoffSupersession, writeParallelHandoffGroup, writePendingParallelHandoff } from "../shared/parallel-handoff.js";
+import { compactForegroundDetails, getSingleResultOutput, PROMPT_REDACTED, readStatus, resolveChildCwd, sumResultsCost, sumResultsUsage } from "../../shared/utils.js";
+import { discardPreservedWorktrees, formatParallelHandoffError, formatParallelHandoffReference, formatStoredParallelHandoffCleanup, parallelHandoffPath, readParallelHandoffManifest, recordParallelHandoffMerge, recordParallelHandoffSupersession, writeParallelHandoffGroup, writeWorktreeSetupHandoff } from "../shared/parallel-handoff.js";
 import { summarizeContextModes } from "../shared/context-mode.js";
 import {
   attachNestedChildrenToResultChildren,
@@ -71,50 +77,60 @@ import {
   stripDetailsOutputsForIntercomReceipt
 } from "../../intercom/result-intercom.js";
 import { applySteeringRecoveryAgentConfig, asyncReviveRequiresRecoveryDescriptor, buildRevivedAsyncTask, readAsyncRecoveryDescriptor, resolveAsyncResumeTarget, resolveAsyncRunLocation } from "../background/async-resume.js";
-import { deliverInterruptRequest, readRevivalBriefs, requestAsyncSteer } from "../background/control-channel.js";
-import { updateSteeringTarget, waitForSteeringAction } from "../background/steering.js";
+import { closeSteerInbox, consumeSteerRequests, deliverInterruptRequest, readRevivalBriefs, requestAsyncSteer, watchAsyncControlInbox } from "../background/control-channel.js";
+import { createSteeringStatus, recordSteeringRequest, steeringStatus, updateSteeringTarget, waitForSteeringAction } from "../background/steering.js";
 import { canQueueRetainedAsyncFollowUp, steerAsyncRun } from "./async-steering-action.js";
 import {
-  removeWorkflowForegroundSteeringRoute,
   resolveWorkflowForegroundSteeringTarget,
   steerWorkflowForegroundTarget,
-  workflowForegroundSteeringDir,
-  workflowForegroundSteeringLaunchOptions
+  steerWorkflowRun
 } from "./workflow-foreground-steering.js";
 import { stopAsyncRun } from "./async-stop-action.js";
 import { dismissRecoveredWorkflow } from "./async-dismiss-action.js";
 import { promotePausedWorkflowIfSettled, reconcileDetachedWorkflowChildCompletion } from "./workflow-detach-reconcile.js";
 import { reconcileAsyncRun } from "../background/stale-run-reconciler.js";
 import { resolveAsyncRootResultPath, waitForImportedAsyncRoot } from "../background/chain-root-attachment.js";
-import { resultFilePath, writeAsyncResultFile } from "../background/result-files.js";
-import { attachRootChildrenToSteps, createNestedRoute, findNestedControlResult, resolveInheritedNestedRouteFromEnv, resolveNestedAsyncDir, resolveNestedParentAddressFromEnv, snapshotNestedEventFiles, updateForegroundNestedProjection, writeNestedControlRequest, writeNestedEvent } from "../shared/nested-events.js";
+import { fallbackResultPayloadPathForSessionRun, removeResultIndex, resultFilePath, writeAsyncResultFile } from "../background/result-files.js";
+import { attachRootChildrenToSteps, createNestedRoute, findNestedControlResult, inheritedNestedParentAddressOf, inheritedNestedRouteOf, nestedRunScope, resolveNestedAsyncDir, retainNestedLookupRoute, snapshotNestedEventFiles, updateForegroundNestedProjection, writeNestedControlRequest, writeNestedEvent } from "../shared/nested-events.js";
 import { resolveSubagentRunId } from "../background/run-id-resolver.js";
 import { formatNestedRunStatusLines } from "../shared/nested-render.js";
-import { isStoppableAsyncStatusStep, resolveAsyncStatusChild } from "../shared/child-identity.js";
+import { isStoppableAsyncStatusStep, resolveAsyncStatusChild, stopStoppableAsyncStatusChildren } from "../shared/child-identity.js";
 import { inspectSubagentStatus } from "../background/run-status.js";
 import { getExternalJobProvider } from "../../api/external-job-provider.js";
 import { externalJobFollowUpRequestDigest, externalJobFollowUpRequestId, externalJobFollowUpRunId, externalJobPromptDigest, externalJobStableJson } from "../shared/external-job-runner.js";
 import { externalCliReceiptMetadata, normalizeExternalCliRunnerStatus } from "../shared/external-cli-contract.js";
+import { formatHerdrMachineRunnerUnsupported, resolveHerdrMachinePlacement } from "../shared/herdr-machine.js";
 import { applyForceTopLevelAsyncOverride } from "../background/top-level-async.js";
 import { handleMissionAction, MISSION_ACTIONS } from "../../missions/actions.js";
 import { attachMissionToLaunchResult, prepareMissionLaunch, writeMissionAsyncBinding } from "../../missions/lifecycle.js";
 import { MissionNotFoundError, updateMission } from "../../missions/store.js";
 import { createMissionWorkflowState } from "../../missions/workflow-state.js";
 import { resolveAuthorityDecision } from "../../policy/authority.js";
-import { handleHerdrInspectorAction, HERDR_INSPECTOR_ACTIONS } from "../../inspectors/herdr/actions.js";
+import { handleInspectorAction, INSPECTOR_ACTIONS } from "../../inspectors/actions.js";
+import { createBuiltinInspectorPlugins } from "../../inspectors/plugins.js";
 import { handleHerdrProjectPaneAction, HERDR_PROJECT_PANE_ACTIONS } from "../../inspectors/herdr/project-panes.js";
 import { previewSimpleWorkflowRun, runWorkflowScript, validateWorkflowScript, WorkflowScriptError } from "../../workflows/scripted-workflow.js";
+import { formatIncrementalChildCompletion, incrementalChildCompletionTriggersTurn } from "../background/notify.js";
 import { executeWorkflowHostCommand, resolveWorkflowHostOutputClaimPath } from "../../workflows/host-command.js";
-import { buildWorkflowReceipt, resolveWorkflowReceiptResumeEntry, writeWorkflowReceipt } from "../../workflows/workflow-receipt.js";
+import { buildWorkflowReceipt, readWorkflowReceipt, workflowReceiptPath, resolveWorkflowReceiptResumeEntry, writeWorkflowReceipt } from "../../workflows/workflow-receipt.js";
 import { upsertHostStep, validHostStepNodes } from "../shared/host-step-status.js";
 import { assertWorkflowLaneKey, normalizeWorkflowLaneMetadata } from "../shared/lane-metadata.js";
-import { parseWorkflowChildSummary, workflowChildSummary } from "../../workflows/workflow-child-summary.js";
+import { parseWorkflowChildSummary, workflowChildProgress, workflowChildSummary } from "../../workflows/workflow-child-summary.js";
 import { resolveWorkflowChatProgress } from "../../workflows/chat-progress.js";
 import { annotateWorkflowPreflightTrace, formatWorkflowPreflight, formatWorkflowPreflightWarnings, normalizeWorkflowPreflight, workflowPreflightWarnings } from "../../workflows/workflow-preflight.js";
-import { claimWorkflowChildPermit, validateWorkflowChildPermitRoot } from "../../shared/workflow-child-permit.js";
+import {
+  authorizeWorkflowResourceHost,
+  claimWorkflowChildPermit,
+  consumeWorkflowResourcePermit,
+  validateWorkflowChildPermitRoot
+} from "../../shared/workflow-child-permit.js";
+import { deepFreezeWorkflowArgs, normalizeWorkflowArgs, resolveWorkflowResource } from "../../workflows/workflow-resources.js";
+import { stableJsonDigest } from "../../shared/launch-contract.js";
 import {
   cleanupWorktrees,
   createWorktrees,
+  preflightWorktreeSource,
+  withWorktreeTransaction,
   diffWorktrees,
   formatWorktreeDiffSummary
 } from "../shared/worktree.js";
@@ -124,9 +140,12 @@ import {
   DEFAULT_ARTIFACT_CONFIG,
   DEFAULT_FORK_PREAMBLE,
   SUBAGENT_ACTIONS,
+  SUBAGENT_ASYNC_STARTED_EVENT,
+  SUBAGENT_CHILD_STATUS_EVENT,
   SUBAGENT_CONTROL_EVENT,
   SUBAGENT_CONTROL_INTERCOM_EVENT,
   SUBAGENT_FOREGROUND_COMPLETE_EVENT,
+  SUBAGENT_LIFECYCLE_ARTIFACT_VERSION,
   checkSubagentDepth,
   resolveChildMaxSubagentDepth,
   resolveCurrentMaxSubagentDepth,
@@ -196,6 +215,15 @@ function rememberParentModel(state, sessionId, model) {
     state.lastParentModel = parentModel;
   return parentModel ?? state.lastParentModel;
 }
+function inheritedNestedRoute(deps) {
+  return inheritedNestedRouteOf(deps.childRuntime);
+}
+function inheritedNestedParentAddress(deps) {
+  return inheritedNestedParentAddressOf(deps.childRuntime);
+}
+function inheritedRunFanoutBudget(deps) {
+  return deps.childRuntime?.runFanoutBudget;
+}
 function resolveRequestedCwd(runtimeCwd, requestedCwd) {
   return requestedCwd ? path.resolve(runtimeCwd, requestedCwd) : runtimeCwd;
 }
@@ -214,12 +242,19 @@ function loadWorkflowScriptPath(params, runtimeCwd) {
   const { workflowScriptPath: _workflowScriptPath, ...rest } = params;
   return { params: { ...rest, workflowScript } };
 }
-function removeForegroundControlIfIdle(state, runId) {
+export function removeForegroundControlIfIdle(state, runId, trackRetainedNestedRoute) {
   const control = state.foregroundControls.get(runId);
   if (control && (!foregroundSchedulingSettled(control) || (control.activeChildren?.size ?? 0) > 0))
     return false;
-  if (control)
-    removeWorkflowForegroundSteeringRoute(control);
+  if (control?.nestedRoute && trackRetainedNestedRoute) {
+    try {
+      if (retainLiveForegroundNestedRoute(state, control.nestedRoute))
+        trackRetainedNestedRoute(runId);
+    } catch (error) {
+      console.error(`Failed to retain live nested descendants for foreground run '${runId}':`, error);
+    }
+  }
+  retainNestedLookupRoute(state, control?.nestedRoute, control?.sessionId);
   state.foregroundControls.delete(runId);
   if (state.lastForegroundControlId === runId)
     state.lastForegroundControlId = null;
@@ -285,8 +320,8 @@ function formatForegroundActivity(control) {
 function nestedResolutionScopeForExecutor(deps) {
   if (deps.allowMutatingManagementActions !== false)
     return;
-  const route = resolveInheritedNestedRouteFromEnv();
-  const address = route ? resolveNestedParentAddressFromEnv() : undefined;
+  const route = inheritedNestedRoute(deps);
+  const address = route ? inheritedNestedParentAddress(deps) : undefined;
   return {
     routes: route ? [route] : [],
     ...address ? { descendantOf: { parentRunId: address.parentRunId, ...address.parentStepIndex !== undefined ? { parentStepIndex: address.parentStepIndex } : {} } } : {}
@@ -428,6 +463,7 @@ function rememberForegroundRun(state, input) {
     updatedAt,
     children: input.results.map((result, index) => {
       const resumeContract = omitUndefinedProperties({
+        modelResponseAliases: input.modelResponseAliases,
         outputSchema: input.params.outputSchema,
         agentContract: input.params.agentContract,
         acceptance: input.params.acceptance,
@@ -468,6 +504,7 @@ function rememberForegroundRun(state, input) {
         ...Object.keys(resumeContract).length ? { resumeContract } : {},
         ...result.launchContractDigest ? { launchContractDigest: result.launchContractDigest } : {},
         ...input.extensionBindings ? { extensionBindings: input.extensionBindings } : {},
+        ...input.requiredExtensions?.length ? { requiredExtensions: input.requiredExtensions } : {},
         ...result.launchResolvedExtensions ? { launchResolvedExtensions: result.launchResolvedExtensions } : {},
         ...result.runtimeAcknowledgedExtensions ? { runtimeAcknowledgedExtensions: result.runtimeAcknowledgedExtensions } : {},
         ...result.capabilityCeiling ? { capabilityCeiling: result.capabilityCeiling } : {},
@@ -627,6 +664,7 @@ function resolveForegroundResumeTarget(params, state, options = {}) {
     ...child.launchContractDigest ? { launchContractDigest: child.launchContractDigest } : {},
     ...child.resumeContract ? { resumeContract: child.resumeContract } : {},
     ...child.extensionBindings ? { extensionBindings: normalizeExtensionBindings(child.extensionBindings).value } : {},
+    ...child.requiredExtensions ? { requiredExtensions: child.requiredExtensions } : {},
     ...child.capabilityCeiling ? { capabilityCeiling: child.capabilityCeiling } : {}
   };
 }
@@ -868,10 +906,15 @@ function appendStepToAsyncChain(input) {
     };
   }
   const chain = [input.params.step];
-  const acceptanceErrors = validateExecutionAcceptance({ ...input.params, chain });
-  if (acceptanceErrors.length > 0) {
+  const validationParams = { ...input.params, chain };
+  const acceptancePolicyErrors = validateExecutionAcceptancePolicy(validationParams);
+  const outputSchemaError = validateLaunchOutputSchemaOverrides(validationParams);
+  const earlyErrors = [...acceptancePolicyErrors];
+  if (outputSchemaError)
+    earlyErrors.push(outputSchemaError);
+  if (earlyErrors.length > 0) {
     return {
-      content: [{ type: "text", text: `Cannot append step: ${acceptanceErrors.join(" ")}` }],
+      content: [{ type: "text", text: `Cannot append step: ${earlyErrors.join(" ")}` }],
       isError: true,
       details: { mode: "management", results: [] }
     };
@@ -950,6 +993,14 @@ function appendStepToAsyncChain(input) {
   const scope = resolveExecutionAgentScope(input.params.agentScope);
   const discoveredForAppend = input.deps.discoverAgents(input.requestCwd, scope, input.parentModel?.provider);
   const agents = discoveredForAppend.agents;
+  const acceptanceErrors = validateExecutionAcceptance(projectEffectiveAcceptanceSchemas(validationParams, agents));
+  if (acceptanceErrors.length > 0) {
+    return {
+      content: [{ type: "text", text: `Cannot append step: ${acceptanceErrors.join(" ")}` }],
+      isError: true,
+      details: { mode: "management", results: [] }
+    };
+  }
   const contextPolicy = resolveExplicitContextPolicy(input.params);
   const chainSkillInput = normalizeSkillInput(input.params.skill);
   const chainSkills = chainSkillInput === false ? [] : chainSkillInput ?? [];
@@ -962,8 +1013,10 @@ function appendStepToAsyncChain(input) {
     currentModelProvider: parentModel?.provider,
     currentModel: parentModel,
     modelScope: discoveredForAppend.modelScope,
+    modelResponseAliases: input.deps.config.modelResponseAliases,
     interactive: input.ctx.hasUI,
-    permissions: input.deps.config.permissions
+    permissions: input.deps.config.permissions,
+    childRuntime: input.deps.childRuntime
   });
   const built = buildAsyncRunnerSteps(resolved.id, compactOptional({
     chain: wrapChainTasksForFork(chain, contextPolicy),
@@ -976,10 +1029,13 @@ function appendStepToAsyncChain(input) {
     cwd: status.cwd ?? input.requestCwd,
     chainSkills,
     dynamicFanoutMaxItems: input.deps.config.chain?.dynamicFanout?.maxItems,
-    maxSubagentDepth: resolveCurrentMaxSubagentDepth(input.deps.config.maxSubagentDepth),
+    maxSubagentDepth: resolveCurrentMaxSubagentDepth(input.deps.config.maxSubagentDepth, input.deps.childRuntime),
     waitToolEnabled: input.deps.waitToolEnabled,
     waitToolDefaultTimeoutMs: input.deps.waitToolDefaultTimeoutMs,
     contextForAgent: contextPolicy.contextForAgent,
+    worktreeBaseDir: input.deps.config.worktreeBaseDir,
+    worktreeProvider: input.deps.config.worktreeProvider,
+    worktreeBranchPrefix: input.deps.config.worktreeBranchPrefix,
     asyncDir: resolved.location.asyncDir,
     validateOutputBindings: false,
     capabilityCeiling: intersectSubagentCapabilityCeilings(status.capabilityCeiling, resolveCurrentSubagentCapabilityCeiling(asyncCtx.currentSessionId))
@@ -1118,6 +1174,49 @@ function resolveNestedResumeTarget(match, trustedSessionRoots) {
     ...recoveryDescriptor ? { recoveryDescriptor } : {}
   });
 }
+function resolveNestedExternalJobResumeTarget(match, params, deps) {
+  const run = match.match.run;
+  if (run.state === "stopped")
+    return;
+  const asyncDir = resolveNestedAsyncDir(match.match.rootRunId, run);
+  if (!asyncDir)
+    return;
+  const status = readNestedRunStatus(asyncDir, run);
+  const steps = status?.steps ?? [];
+  const step = steps[params.index ?? 0];
+  if (!step) {
+    if (params.index === undefined || !steps.some((candidate) => candidate.runner?.type === "external-job"))
+      return;
+  } else if (!step.runner) {
+    if (nestedRunSessionFile(run))
+      return;
+    const agent = deps.discoverAgents(status?.cwd ?? deps.state.baseCwd, resolveExecutionAgentScope(params.agentScope)).agents.find((candidate) => candidate.name === step.agent);
+    if (agent?.runner?.type === "external-job")
+      throw new Error(externalJobWithoutMetadataMessage(run.id));
+    return;
+  } else if (step.runner.type !== "external-job") {
+    return;
+  }
+  const target = resolveAsyncResumeTarget(compactOptional({ dir: asyncDir, index: params.index }), nestedRunScope(match.match.rootRunId), { requireSessionFile: false });
+  if (target.kind === "live")
+    throw new Error(externalJobStillRunningMessage(target.runId));
+  return { source: "async", ...target };
+}
+function readNestedRunStatus(asyncDir, run) {
+  try {
+    return readStatus(asyncDir);
+  } catch (error) {
+    if (nestedRunSessionFile(run))
+      return null;
+    throw error;
+  }
+}
+function externalJobStillRunningMessage(runId) {
+  return `External-job run '${runId}' is still running. Wait for completion, then use subagent({ action: "resume", id: "${runId}", message: "..." }).`;
+}
+function externalJobWithoutMetadataMessage(runId) {
+  return `External-job run '${runId}' has no persisted provider metadata. Cannot follow up without the parent provider job id.`;
+}
 async function waitForNestedControlResult(target, requestId, ignoredFiles, timeoutMs = 1000) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
@@ -1268,14 +1367,14 @@ function externalRunnerControlError(asyncDir, action) {
 }
 async function resumeExternalJobFollowUp(input) {
   if (input.target.kind === "live" || input.target.state === "running" || input.target.state === "queued") {
-    return { content: [{ type: "text", text: `External-job run '${input.target.runId}' is still running. Wait for completion, then use subagent({ action: "resume", id: "${input.target.runId}", message: "..." }).` }], isError: true, details: { mode: "management", results: [] } };
+    return { content: [{ type: "text", text: externalJobStillRunningMessage(input.target.runId) }], isError: true, details: { mode: "management", results: [] } };
   }
   const runner = input.target.runner;
   const externalJob = input.target.externalJob;
   if (runner?.type !== "external-job")
     return { content: [{ type: "text", text: "Internal error: external-job follow-up was requested for a non-external-job runner." }], isError: true, details: { mode: "management", results: [] } };
   if (!externalJob)
-    return { content: [{ type: "text", text: `External-job run '${input.target.runId}' has no persisted provider metadata. Cannot follow up without the parent provider job id.` }], isError: true, details: { mode: "management", results: [] } };
+    return { content: [{ type: "text", text: externalJobWithoutMetadataMessage(input.target.runId) }], isError: true, details: { mode: "management", results: [] } };
   if (externalJob.provider !== runner.provider)
     return { content: [{ type: "text", text: `External-job run '${input.target.runId}' has mismatched provider metadata. Refusing to follow up.` }], isError: true, details: { mode: "management", results: [] } };
   if (!externalJobOptionsEqual(externalJob.options, runner.options))
@@ -1291,18 +1390,20 @@ async function resumeExternalJobFollowUp(input) {
   const requestDigest = externalJobFollowUpRequestDigest({ provider: runner.provider, parentProviderJobId: externalJob.providerJobId, promptDigest, options: runner.options });
   const requestId = externalJobFollowUpRequestId(requestDigest);
   const runId = externalJobFollowUpRunId(requestDigest);
-  const asyncDir = path.join(DIRS.async, runId);
+  const nestedRoute = inheritedNestedRoute(input.deps);
+  const runRoots = nestedRoute ? nestedRunScope(nestedRoute.rootRunId) : { asyncDirRoot: DIRS.async, resultsDir: DIRS.results };
+  const asyncDir = path.join(runRoots.asyncDirRoot, runId);
   const currentSessionId = input.deps.state.currentSessionId;
   if (!currentSessionId)
     return { content: [{ type: "text", text: "External-job follow-up requires an active parent session." }], isError: true, details: { mode: "management", results: [] } };
-  if (fs.existsSync(asyncDir) || fs.existsSync(resultFilePath(DIRS.results, runId))) {
+  if (fs.existsSync(asyncDir) || fs.existsSync(resultFilePath(runRoots.resultsDir, runId))) {
     return externalJobFollowUpStarted({ sourceRunId: input.target.runId, runId, asyncDir, duplicate: true, interactive: input.ctx.hasUI });
   }
-  const depthState = checkSubagentDepth(input.deps.config.maxSubagentDepth);
+  const depthState = checkSubagentDepth(input.deps.config.maxSubagentDepth, input.deps.childRuntime);
   if (depthState.blocked) {
     return { content: [{ type: "text", text: `Nested subagent resume blocked (depth=${depthState.depth}, max=${depthState.maxDepth}). Complete the follow-up directly instead.` }], isError: true, details: { mode: "management", results: [] } };
   }
-  const topLevelResume = depthState.depth === 0 && !resolveInheritedNestedRouteFromEnv() && !input.deps.state.workflowControllers?.has(input.target.runId);
+  const topLevelResume = depthState.depth === 0 && !inheritedNestedRoute(input.deps) && !input.deps.state.workflowControllers?.has(input.target.runId);
   let activeAsyncCapacity;
   try {
     activeAsyncCapacity = topLevelResume ? acquireActiveAsyncCapacity({
@@ -1324,7 +1425,7 @@ async function resumeExternalJobFollowUp(input) {
     ...input.baseAgentConfig,
     runner: { type: "external-job", provider: runner.provider, options: runner.options }
   };
-  const result = executeAsyncSingle(runId, compactOptional({
+  const result = await executeAsyncSingle(runId, compactOptional({
     agent: input.target.agent,
     task: input.followUp,
     goal: input.followUp,
@@ -1338,20 +1439,24 @@ async function resumeExternalJobFollowUp(input) {
       currentModelProvider: parentModel?.provider,
       currentModel: parentModel,
       modelScope: input.modelScope,
+      modelResponseAliases: input.deps.config.modelResponseAliases,
       interactive: input.ctx.hasUI,
-      permissions: input.deps.config.permissions
+      permissions: input.deps.config.permissions,
+      childRuntime: input.deps.childRuntime
     }),
     cwd: input.effectiveCwd,
     artifactsDir,
     artifactConfig,
     shareEnabled: false,
     ...input.parentSessionFile ? { sessionRoot: input.deps.getSubagentSessionRoot(input.parentSessionFile) } : {},
-    maxSubagentDepth: resolveCurrentMaxSubagentDepth(input.deps.config.maxSubagentDepth),
+    maxSubagentDepth: resolveCurrentMaxSubagentDepth(input.deps.config.maxSubagentDepth, input.deps.childRuntime),
     waitToolEnabled: input.deps.waitToolEnabled,
     waitToolDefaultTimeoutMs: input.deps.waitToolDefaultTimeoutMs,
     worktreeSetupHook: input.deps.config.worktreeSetupHook,
     worktreeSetupHookTimeoutMs: input.deps.config.worktreeSetupHookTimeoutMs,
     worktreeBaseDir: input.deps.config.worktreeBaseDir,
+    worktreeProvider: input.deps.config.worktreeProvider,
+    worktreeBranchPrefix: input.deps.config.worktreeBranchPrefix,
     controlConfig: resolveControlConfig(input.deps.config.control, undefined),
     controlIntercomTarget: input.intercomBridge.active ? input.intercomBridge.orchestratorTarget : undefined,
     childIntercomTarget: input.intercomBridge.active ? (agent, index) => resolveSubagentIntercomTarget(runId, agent, index) : undefined,
@@ -1369,6 +1474,33 @@ async function resumeExternalJobFollowUp(input) {
   }
   return externalJobFollowUpStarted({ sourceRunId: input.target.runId, runId: result.details.asyncId ?? runId, asyncDir: result.details.asyncDir ?? asyncDir, interactive: input.ctx.hasUI });
 }
+function resolveRequestedResumeTarget(params, deps, parentSessionFile) {
+  const requestedId = params.id ?? params.runId;
+  let resolved;
+  try {
+    resolved = requestedId ? resolveSubagentRunId(requestedId, omitUndefinedProperties({ state: deps.state, nested: nestedResolutionScopeForExecutor(deps) })) : undefined;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "";
+    const asyncMatches = message.match(/async:/g)?.length ?? 0;
+    if (!isResumeAmbiguity(error) || !message.includes("foreground:") || asyncMatches !== 1)
+      throw error;
+  }
+  if (resolved?.kind === "nested") {
+    if (params.chain?.length)
+      throw new Error("Attaching a running subagent as a chain root is currently available for top-level async runs only.");
+    if (resolved.match.run.state === "running" || resolved.match.run.state === "queued")
+      return { kind: "live-nested", target: resolved };
+    const externalJobTarget = resolveNestedExternalJobResumeTarget(resolved, params, deps);
+    if (externalJobTarget)
+      return externalJobTarget;
+    const trustedSessionRoots = [
+      ...deps.config.defaultSessionDir ? [path.resolve(deps.expandTilde(deps.config.defaultSessionDir))] : [],
+      ...parentSessionFile ? [deps.getSubagentSessionRoot(parentSessionFile)] : []
+    ];
+    return resolveNestedResumeTarget(resolved, trustedSessionRoots);
+  }
+  return resolveResumeTarget(params, deps.state, { asyncRequireSessionFile: false });
+}
 async function resumeAsyncRun(input) {
   const followUp = (input.params.message ?? input.params.task ?? "").trim();
   const attachChain = (input.params.chain?.length ?? 0) > 0 ? input.params.chain : undefined;
@@ -1386,47 +1518,22 @@ async function resumeAsyncRun(input) {
       details: { mode: "management", results: [] }
     };
   }
-  const acceptanceErrors = validateExecutionAcceptance(input.params);
-  if (acceptanceErrors.length > 0) {
-    return {
-      content: [{ type: "text", text: `Cannot resume: ${acceptanceErrors.join(" ")}` }],
-      isError: true,
-      details: { mode: "management", results: [] }
-    };
+  const acceptancePolicyErrors = validateExecutionAcceptancePolicy(input.params);
+  if (acceptancePolicyErrors.length > 0) {
+    return { content: [{ type: "text", text: `Cannot resume: ${acceptancePolicyErrors.join(" ")}` }], isError: true, details: { mode: "management", results: [] } };
+  }
+  const outputSchemaError = validateLaunchOutputSchemaOverrides(input.params);
+  if (outputSchemaError) {
+    return { content: [{ type: "text", text: `Cannot resume: ${outputSchemaError}` }], isError: true, details: { mode: "management", results: [] } };
   }
   input.deps.state.currentSessionId = resolveCurrentSessionId(input.ctx.sessionManager);
   let target;
   const parentSessionFile = input.ctx.sessionManager.getSessionFile() ?? null;
   try {
-    const requestedId = input.params.id ?? input.params.runId;
-    let resolved;
-    try {
-      resolved = requestedId ? resolveSubagentRunId(requestedId, omitUndefinedProperties({ state: input.deps.state, nested: nestedResolutionScopeForExecutor(input.deps) })) : undefined;
-    } catch (error) {
-      const message = error instanceof Error ? error.message : "";
-      const asyncMatches = message.match(/async:/g)?.length ?? 0;
-      if (!isResumeAmbiguity(error) || !message.includes("foreground:") || asyncMatches !== 1)
-        throw error;
-    }
-    if (resolved?.kind === "nested") {
-      if (attachChain) {
-        return {
-          content: [{ type: "text", text: "Attaching a running subagent as a chain root is currently available for top-level async runs only." }],
-          isError: true,
-          details: { mode: "management", results: [] }
-        };
-      }
-      if (resolved.match.run.state === "running" || resolved.match.run.state === "queued") {
-        return resumeLiveNestedRun({ target: resolved, message: followUp });
-      }
-      const trustedSessionRoots = [
-        ...input.deps.config.defaultSessionDir ? [path.resolve(input.deps.expandTilde(input.deps.config.defaultSessionDir))] : [],
-        ...parentSessionFile ? [input.deps.getSubagentSessionRoot(parentSessionFile)] : []
-      ];
-      target = resolveNestedResumeTarget(resolved, trustedSessionRoots);
-    } else {
-      target = resolveResumeTarget(input.params, input.deps.state, { asyncRequireSessionFile: false });
-    }
+    const resolved = resolveRequestedResumeTarget(input.params, input.deps, parentSessionFile);
+    if (resolved.kind === "live-nested")
+      return resumeLiveNestedRun({ target: resolved.target, message: followUp });
+    target = resolved;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     return { content: [{ type: "text", text: message }], isError: true, details: { mode: "management", results: [] } };
@@ -1445,7 +1552,7 @@ async function resumeAsyncRun(input) {
       details: { mode: "management", results: [] }
     };
   }
-  const { blocked, depth, maxDepth } = checkSubagentDepth(input.deps.config.maxSubagentDepth);
+  const { blocked, depth, maxDepth } = checkSubagentDepth(input.deps.config.maxSubagentDepth, input.deps.childRuntime);
   if (blocked) {
     return {
       content: [{ type: "text", text: `Nested subagent resume blocked (depth=${depth}, max=${maxDepth}). Complete the follow-up directly instead.` }],
@@ -1460,7 +1567,7 @@ async function resumeAsyncRun(input) {
   const discoveredAgents = discovered.agents;
   const unknownAgentDiagnosticContext = diagnosticContextFromDiscovery(discovered, effectiveCwd, scope);
   const modelScope = discovered.modelScope;
-  const sessionName = resolveIntercomSessionTarget(input.deps.dm.getSessionName(), input.ctx.sessionManager.getSessionId());
+  const sessionName = resolveIntercomSessionTarget(input.deps.childRuntime?.intercomSessionName ?? input.deps.dm.getSessionName(), input.ctx.sessionManager.getSessionId());
   const recoveryDescriptor = "recoveryDescriptor" in target ? target.recoveryDescriptor : undefined;
   const recoveryContext = recoveryDescriptor?.context ?? (input.params.context === "profile" ? undefined : input.params.context);
   const intercomBridge = resolveIntercomBridge({
@@ -1498,7 +1605,7 @@ async function resumeAsyncRun(input) {
   if (target.source === "async" && target.runner?.type === "external-job") {
     if (attachChain)
       return { content: [{ type: "text", text: "External-job follow-up does not support chain attachment. Use action='resume' with message instead." }], isError: true, details: { mode: "management", results: [] } };
-    return resumeExternalJobFollowUp({
+    const resumed = await resumeExternalJobFollowUp({
       target,
       followUp,
       baseAgentConfig,
@@ -1512,6 +1619,10 @@ async function resumeAsyncRun(input) {
       parentSessionFile,
       absoluteDeadlineAt: input.absoluteDeadlineAt
     });
+    const resumedRunId = resumed.details.runId ?? resumed.details.asyncId;
+    if (!resumed.isError && resumedRunId)
+      input.onLaunch?.({ agent: target.agent, async: true, runId: resumedRunId });
+    return resumed;
   }
   if (attachChain) {
     if (target.source !== "async") {
@@ -1528,8 +1639,12 @@ async function resumeAsyncRun(input) {
         details: { mode: "chain", results: [] }
       };
     }
+    const acceptanceErrors = validateExecutionAcceptance(projectEffectiveAcceptanceSchemas(input.params, agents));
+    if (acceptanceErrors.length > 0) {
+      return { content: [{ type: "text", text: `Cannot resume: ${acceptanceErrors.join(" ")}` }], isError: true, details: { mode: "chain", results: [] } };
+    }
     const runId = randomUUID();
-    const topLevelResume = depth === 0 && !resolveInheritedNestedRouteFromEnv() && !input.params.workflowParentRunId;
+    const topLevelResume = depth === 0 && !inheritedNestedRoute(input.deps) && !input.params.workflowParentRunId;
     let activeAsyncCapacity;
     try {
       activeAsyncCapacity = topLevelResume ? acquireActiveAsyncCapacity({
@@ -1574,8 +1689,10 @@ async function resumeAsyncRun(input) {
         currentModelProvider: parentModel?.provider,
         currentModel: parentModel,
         modelScope,
+        modelResponseAliases: input.deps.config.modelResponseAliases,
         interactive: input.ctx.hasUI,
-        permissions: input.deps.config.permissions
+        permissions: input.deps.config.permissions,
+        childRuntime: input.deps.childRuntime
       }),
       availableModels,
       cwd: effectiveCwd,
@@ -1588,12 +1705,16 @@ async function resumeAsyncRun(input) {
       agentContract: input.params.agentContract,
       fast: input.params.fast,
       dynamicFanoutMaxItems: input.deps.config.chain?.dynamicFanout?.maxItems,
-      maxSubagentDepth: resolveCurrentMaxSubagentDepth(input.deps.config.maxSubagentDepth),
+      maxSubagentDepth: resolveCurrentMaxSubagentDepth(input.deps.config.maxSubagentDepth, input.deps.childRuntime),
       waitToolEnabled: input.deps.waitToolEnabled,
       waitToolDefaultTimeoutMs: input.deps.waitToolDefaultTimeoutMs,
       worktreeSetupHook: input.deps.config.worktreeSetupHook,
       worktreeSetupHookTimeoutMs: input.deps.config.worktreeSetupHookTimeoutMs,
       worktreeBaseDir: input.deps.config.worktreeBaseDir,
+      baseRef: input.params.baseRef ?? target.recoveryDescriptor?.baseRef,
+      ...recoveryDescriptor?.requiredExtensions ? { requiredExtensions: recoveryDescriptor.requiredExtensions } : {},
+      worktreeProvider: input.deps.config.worktreeProvider,
+      worktreeBranchPrefix: input.deps.config.worktreeBranchPrefix,
       controlConfig: resolveControlConfig(input.deps.config.control, input.params.control),
       controlIntercomTarget: intercomBridge.active ? intercomBridge.orchestratorTarget : undefined,
       childIntercomTarget: intercomBridge.active ? (agent, index) => resolveSubagentIntercomTarget(runId, agent, index) : undefined,
@@ -1608,6 +1729,7 @@ async function resumeAsyncRun(input) {
       return result;
     }
     const attachedId = result.details.asyncId ?? runId;
+    input.onLaunch?.({ agent: target.agent, ...target.sessionFile ? { sessionFile: target.sessionFile } : {}, async: true, runId: attachedId });
     const lines = [
       `Attached async subagent ${target.runId} as the first step of a new chain.`,
       `Chain run: ${attachedId}`,
@@ -1627,11 +1749,26 @@ async function resumeAsyncRun(input) {
   if (!revivalSessionFile) {
     return { content: [{ type: "text", text: `Async run '${target.runId}' child ${target.index} does not have a persisted session file to resume from.` }], isError: true, details: { mode: "management", results: [] } };
   }
+  if (input.params.baseRef !== undefined && "managedWorktree" in target && target.managedWorktree === true) {
+    return { content: [{ type: "text", text: "Cannot resume with baseRef: retained managed-worktree children continue in their existing worktree. Start a new worktree run from that base ref instead." }], isError: true, details: { mode: "management", results: [] } };
+  }
   if (target.source === "async" && asyncReviveRequiresRecoveryDescriptor(target)) {
     return { content: [{ type: "text", text: `Async child '${target.runId}' is missing its required run fan-out recovery identity. Start a new run instead.` }], isError: true, details: { mode: "management", results: [] } };
   }
+  if (target.source === "nested" && !target.recoveryDescriptor) {
+    return { content: [{ type: "text", text: `Nested child '${target.runId}' is missing its required recovery identity. Start a new run instead.` }], isError: true, details: { mode: "management", results: [] } };
+  }
+  const recoveryAgentConfig = recoveryDescriptor ? applySteeringRecoveryAgentConfig(baseAgentConfig, recoveryDescriptor) : baseAgentConfig;
+  const agentConfig = intercomBridge.active ? applyIntercomBridgeToAgent(recoveryAgentConfig, intercomBridge) : recoveryAgentConfig;
+  const foregroundContract = target.source === "foreground" ? target.resumeContract : undefined;
+  const outputSchema = Object.hasOwn(input.params, "outputSchema") ? input.params.outputSchema : Object.hasOwn(foregroundContract ?? {}, "outputSchema") ? foregroundContract?.outputSchema : recoveryDescriptor?.structuredOutputSchema;
+  const acceptance = input.params.acceptance !== undefined ? input.params.acceptance : foregroundContract?.acceptance !== undefined ? foregroundContract.acceptance : recoveryDescriptor?.acceptance;
+  const acceptanceErrors = validateExecutionAcceptance({ ...input.params, acceptance, outputSchema });
+  if (acceptanceErrors.length > 0) {
+    return { content: [{ type: "text", text: `Cannot resume: ${acceptanceErrors.join(" ")}` }], isError: true, details: { mode: "management", results: [] } };
+  }
   const runId = randomUUID();
-  const topLevelResume = depth === 0 && !resolveInheritedNestedRouteFromEnv() && !input.params.workflowParentRunId;
+  const topLevelResume = depth === 0 && !inheritedNestedRoute(input.deps) && !input.params.workflowParentRunId;
   let activeAsyncCapacity;
   try {
     activeAsyncCapacity = !topLevelResume ? undefined : target.source === "async" ? transferActiveAsyncCapacity({
@@ -1652,17 +1789,13 @@ async function resumeAsyncRun(input) {
       return { content: [{ type: "text", text: error.message }], isError: true, details: { mode: "single", results: [], activeAsyncCapacity: error.snapshot } };
     return { content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }], isError: true, details: { mode: "single", results: [] } };
   }
-  const recoveryAgentConfig = recoveryDescriptor ? applySteeringRecoveryAgentConfig(baseAgentConfig, recoveryDescriptor) : baseAgentConfig;
-  const agentConfig = intercomBridge.active ? applyIntercomBridgeToAgent(recoveryAgentConfig, intercomBridge) : recoveryAgentConfig;
-  const foregroundContract = target.source === "foreground" ? target.resumeContract : undefined;
-  const outputSchema = input.params.outputSchema ?? foregroundContract?.outputSchema ?? recoveryDescriptor?.structuredOutputSchema;
   const agentContract = input.params.agentContract ?? foregroundContract?.agentContract ?? recoveryDescriptor?.agentContract;
   const artifactConfig = recoveryDescriptor?.artifactConfig ?? omitUndefinedProperties({ ...DEFAULT_ARTIFACT_CONFIG, enabled: input.params.artifacts !== false, dir: input.deps.config.artifactDir ?? DEFAULT_ARTIFACT_CONFIG.dir });
   const artifactsDir = recoveryDescriptor?.artifactsDir ?? getArtifactsDir(parentSessionFile, effectiveCwd, artifactConfig.dir);
   const availableModels = input.ctx.modelRegistry.getAvailable().map(toModelInfo);
   const parentModel = input.parentModel;
   const revivalAsyncDir = path.join(DIRS.async, runId);
-  const result = executeAsyncSingle(runId, compactOptional({
+  const result = await executeAsyncSingle(runId, compactOptional({
     agent: target.agent,
     task: buildRevivedAsyncTask(target, effectiveFollowUp),
     goal: effectiveFollowUp,
@@ -1676,8 +1809,10 @@ async function resumeAsyncRun(input) {
       currentModelProvider: parentModel?.provider,
       currentModel: parentModel,
       modelScope,
+      modelResponseAliases: recoveryDescriptor ? recoveryDescriptor.modelResponseAliases : foregroundContract?.modelResponseAliases,
       interactive: input.ctx.hasUI,
-      permissions: input.deps.config.permissions
+      permissions: input.deps.config.permissions,
+      childRuntime: input.deps.childRuntime
     }),
     cwd: effectiveCwd,
     maxOutput: input.params.maxOutput ?? recoveryDescriptor?.maxOutput,
@@ -1697,41 +1832,49 @@ async function resumeAsyncRun(input) {
     modelOverride: recoveryDescriptor?.model ?? target.model,
     fast: recoveryDescriptor?.fast,
     modelOverrideFromParent: recoveryDescriptor?.modelOverrideFromParent,
+    modelOrigin: recoveryDescriptor?.modelOrigin ?? (recoveryDescriptor?.modelOverrideFromParent ? "inherited" : undefined),
     thinkingOverride: recoveryDescriptor?.thinking ?? target.thinking,
     thinkingCeiling: recoveryDescriptor?.thinkingCeiling ?? ("thinkingCeiling" in target ? target.thinkingCeiling : undefined),
     extensionBindings: recoveryDescriptor?.extensionBindings ?? ("extensionBindings" in target ? target.extensionBindings : undefined),
+    requiredExtensions: recoveryDescriptor?.requiredExtensions ?? target.requiredExtensions,
     outputBaseDir: resolveSingleRunOutputBaseDir(input.deps, artifactsDir, runId),
-    maxSubagentDepth: recoveryDescriptor?.maxSubagentDepth ?? resolveCurrentMaxSubagentDepth(input.deps.config.maxSubagentDepth),
+    maxSubagentDepth: recoveryDescriptor?.maxSubagentDepth ?? resolveCurrentMaxSubagentDepth(input.deps.config.maxSubagentDepth, input.deps.childRuntime),
     waitToolEnabled: input.deps.waitToolEnabled,
     waitToolDefaultTimeoutMs: input.deps.waitToolDefaultTimeoutMs,
     worktreeSetupHook: input.deps.config.worktreeSetupHook,
     worktreeSetupHookTimeoutMs: input.deps.config.worktreeSetupHookTimeoutMs,
     worktreeBaseDir: input.deps.config.worktreeBaseDir,
-    worktree: input.params.worktree === true,
+    baseRef: input.params.baseRef ?? recoveryDescriptor?.baseRef,
+    worktreeProvider: input.deps.config.worktreeProvider,
+    worktreeBranchPrefix: input.deps.config.worktreeBranchPrefix,
+    worktree: input.params.worktree === true && !(("managedWorktree" in target) && target.managedWorktree === true),
     lane: input.params.lane ?? recoveryDescriptor?.lane,
-    controlConfig: recoveryDescriptor?.controlConfig ?? resolveControlConfig(input.deps.config.control, input.params.control),
+    controlConfig: resolveRevivalControlConfig({ globalConfig: input.deps.config.control, requestedControl: input.params.control, recoveryControlConfig: recoveryDescriptor?.controlConfig }),
     intercomBridge: input.params.intercomBridge ?? recoveryDescriptor?.intercomBridge,
     controlIntercomTarget: intercomBridge.active ? intercomBridge.orchestratorTarget : undefined,
     childIntercomTarget: intercomBridge.active ? (agent, index) => resolveSubagentIntercomTarget(runId, agent, index) : undefined,
     availableModels,
     output: input.params.output !== undefined ? input.params.output : foregroundContract?.output ?? recoveryDescriptor?.outputPath,
     outputMode: input.params.outputMode ?? foregroundContract?.outputMode ?? recoveryDescriptor?.outputMode,
+    outputClaimPath: input.params.workflowOutputClaimPath,
     ...agentContract ? { agentContract } : {},
     ...outputSchema ? { structuredOutputSchema: outputSchema } : {},
     ...recoveryDescriptor?.skills ? { skills: [...recoveryDescriptor.skills] } : {},
-    ...input.params.acceptance !== undefined ? { acceptance: input.params.acceptance } : foregroundContract?.acceptance !== undefined ? { acceptance: foregroundContract.acceptance } : recoveryDescriptor?.acceptance !== undefined ? { acceptance: recoveryDescriptor.acceptance } : {},
+    ...acceptance !== undefined ? { acceptance } : {},
     ...input.params.timeoutMs !== undefined ? { timeoutMs: input.params.timeoutMs } : {},
     ...input.absoluteDeadlineAt !== undefined ? { absoluteDeadlineAt: input.absoluteDeadlineAt } : {},
     ...input.params.toolBudget !== undefined ? { toolBudget: input.params.toolBudget } : {},
-    capabilityCeiling: intersectSubagentCapabilityCeilings("capabilityCeiling" in target ? target.capabilityCeiling : undefined, recoveryDescriptor?.capabilityCeiling, resolveCurrentSubagentCapabilityCeiling(input.deps.state.currentSessionId)),
+    capabilityCeiling: intersectSubagentCapabilityCeilings(recoveryDescriptor?.capabilityCeiling ?? (target.source === "foreground" || target.source === "async" && target.mode === "workflow" ? target.capabilityCeiling : undefined), resolveCurrentSubagentCapabilityCeiling(input.deps.state.currentSessionId)),
     runFanoutBudget: input.params.runFanoutBudget ?? recoveryDescriptor?.runFanoutBudget ?? createRunFanoutBudget(runId, resolveMaxSubagentSpawnsPerRun(input.deps.config.maxSubagentSpawnsPerRun)),
     parentWorkflowRunId: input.params.workflowParentRunId,
     workflowKey: input.params.workflowKey,
     activeAsyncCapacity
   }));
+  const notifyLaunch = () => input.onLaunch?.({ agent: target.agent, sessionFile: revivalSessionFile, async: true, runId });
   if (result.isError) {
     const startedStatus = readStatus(revivalAsyncDir);
     if (input.params.workflowParentRunId !== undefined && startedStatus?.runId === runId && startedStatus.processTerminal?.runnerProcessInstanceId) {
+      notifyLaunch();
       return {
         ...result,
         details: {
@@ -1746,6 +1889,7 @@ async function resumeAsyncRun(input) {
     activeAsyncCapacity?.rollback();
     return result;
   }
+  notifyLaunch();
   for (const brief of queuedBriefs)
     fs.rmSync(brief.path, { force: true });
   if (queuedBriefs.length > 0 && sourceAsyncDir) {
@@ -1773,7 +1917,9 @@ async function resumeAsyncRun(input) {
     } finally {
       input.signal?.removeEventListener("abort", stopOnAbort);
     }
-    fs.rmSync(resultPath, { force: true });
+    if (completed.importedPublication)
+      removeWorkflowAwaitedResult(asyncDir, resultPath, revivedId, completed.importedPublication);
+    emitWorkflowAwaitedChildComplete(input.deps.dm, input.deps.state, revivedId, asyncDir, input.params.workflowParentRunId, completed);
     const usage = importedAsyncRootUsage(completed);
     const childResult = {
       index: 0,
@@ -1789,14 +1935,14 @@ async function resumeAsyncRun(input) {
       ...completed.stopped ? { stopped: true } : {},
       ...completed.sessionFile ? { sessionFile: completed.sessionFile } : {},
       ...completed.model ? { model: completed.model } : {},
-      ...completed.attemptedModels ? { attemptedModels: completed.attemptedModels } : {},
-      ...completed.modelAttempts ? { modelAttempts: completed.modelAttempts } : {},
+      ...completed.requestedModel ? { requestedModel: completed.requestedModel } : {},
       ...completed.contextOverflow ? { contextOverflow: true } : {},
       ...completed.structuredOutput !== undefined ? { structuredOutput: completed.structuredOutput } : {},
       ...completed.structuredOutputPath ? { structuredOutputPath: completed.structuredOutputPath } : {},
       ...completed.structuredOutputSchemaPath ? { structuredOutputSchemaPath: completed.structuredOutputSchemaPath } : {},
       ...completed.acceptance ? { acceptance: completed.acceptance } : {},
       ...completed.artifactPaths ? { artifactPaths: completed.artifactPaths } : {},
+      ...completed.savedOutputPath ? { savedOutputPath: completed.savedOutputPath } : {},
       ...completed.outputSaveError ? { outputSaveError: completed.outputSaveError } : {},
       ...completed.transcriptPath ? { transcriptPath: completed.transcriptPath } : {},
       ...completed.transcriptError ? { transcriptError: completed.transcriptError } : {}
@@ -1974,6 +2120,9 @@ function canonicalizeExecutionParams(params, agents, diagnostics, context) {
     const agent = agents.find((candidate) => candidate.name === result.name);
     if (params.extensionBindings !== undefined && (agent?.runner?.type === "external-cli" || agent?.runner?.type === "external-job"))
       return { error: `extensionBindings is not supported for runner.type='${agent.runner.type}'.` };
+    const machineError = agent ? formatHerdrMachineRunnerUnsupported({ machine: params.machine ?? agent.machine, agentName: agent.name, runnerType: agent.runner?.type, adapter: agent.runner?.type === "external-cli" ? agent.runner.adapter : undefined, worktree: params.worktree }) : undefined;
+    if (machineError)
+      return { error: machineError };
   }
   if (params.extensionBindings !== undefined) {
     try {
@@ -2029,20 +2178,33 @@ function canonicalizeExecutionParams(params, agents, diagnostics, context) {
   }
   return { params };
 }
+function projectEffectiveAcceptanceSchemas(params, agents) {
+  const withEffectiveSchema = (step) => {
+    const agent = agents.find((candidate) => candidate.name === step.agent);
+    return agent ? { ...step, outputSchema: resolveEffectiveOutputSchema(agent, step.outputSchema) } : step;
+  };
+  return {
+    ...params,
+    ...params.tasks ? { tasks: params.tasks.map(withEffectiveSchema) } : {},
+    ...params.chain ? { chain: projectChainOutputSchemas(params.chain, agents) } : {}
+  };
+}
 function validateExecutionInput(params, agents, hasChain, hasTasks, hasSingle, allowClarifyTaskPrompt, context) {
   if (Number(hasChain) + Number(hasTasks) + Number(hasSingle) !== 1) {
+    const agentList = agents.map((a) => a.name).join(", ") || "none";
+    const noMode = !hasChain && !hasTasks && !hasSingle;
     return {
       content: [
         {
           type: "text",
-          text: `Provide exactly one mode. Agents: ${agents.map((a) => a.name).join(", ") || "none"}`
+          text: noMode && typeof params.workflowKey === "string" ? `Workflow child '${params.workflowKey}' has no agent. Pass { key, agent, task }. Agents: ${agentList}` : `Provide exactly one mode. Agents: ${agentList}`
         }
       ],
       isError: true,
       details: { mode: "single", results: [] }
     };
   }
-  const acceptanceErrors = validateExecutionAcceptance(params);
+  const acceptanceErrors = validateExecutionAcceptance(projectEffectiveAcceptanceSchemas(params, agents));
   if (acceptanceErrors.length > 0) {
     return {
       content: [{ type: "text", text: acceptanceErrors.join(" ") }],
@@ -2263,6 +2425,14 @@ function buildRequestedModeError(params, message) {
     details: { mode: getRequestedModeLabel(params), results: [] }
   }, params.context === "profile" ? undefined : params.context);
 }
+function buildWorkflowValidationResult(validation, mode, preflight) {
+  const payload = preflight ? { ...validation, preflight } : validation;
+  return {
+    content: [{ type: "text", text: JSON.stringify(payload) }],
+    ...validation.ok ? {} : { isError: true },
+    details: { mode, results: [] }
+  };
+}
 function applySingleAgentLaunchDefaults(params, agents) {
   if ((params.chain?.length ?? 0) > 0 || (params.tasks?.length ?? 0) > 0 || !params.agent)
     return params;
@@ -2270,14 +2440,37 @@ function applySingleAgentLaunchDefaults(params, agents) {
   if (!agent)
     return params;
   const parentTimeoutMs = params.timeoutMs === undefined && params.maxRuntimeMs === undefined && agent.defaultTimeoutMs === undefined && params.workflowParentDeadlineAt !== undefined ? Math.max(1, params.workflowParentDeadlineAt - Date.now()) : undefined;
+  const outputSchema = params.outputSchema === false ? false : resolveEffectiveOutputSchema(agent, params.outputSchema);
   return {
     ...params,
     ...params.async === undefined && agent.defaultAsync !== undefined ? { async: agent.defaultAsync } : {},
     ...params.timeoutMs === undefined && params.maxRuntimeMs === undefined && agent.defaultTimeoutMs !== undefined ? { timeoutMs: agent.defaultTimeoutMs } : {},
     ...parentTimeoutMs !== undefined ? { timeoutMs: parentTimeoutMs } : {},
-    ...params.acceptance === undefined && agent.defaultAcceptance !== undefined ? { acceptance: agent.defaultAcceptance } : {}
+    ...params.acceptance === undefined && agent.defaultAcceptance !== undefined ? { acceptance: agent.defaultAcceptance } : {},
+    ...outputSchema !== undefined ? { outputSchema } : {}
   };
 }
+function validateLaunchOutputSchemaOverrides(params) {
+  const values = [params.outputSchema, ...(params.tasks ?? []).map((task) => task.outputSchema)];
+  for (const step of params.chain ?? []) {
+    if (isParallelStep(step))
+      values.push(...step.parallel.map((task) => task.outputSchema));
+    else if (isDynamicParallelStep(step))
+      values.push(step.parallel.outputSchema);
+    else
+      values.push(step.outputSchema);
+  }
+  for (const value of values) {
+    if (value === undefined || value === false)
+      continue;
+    try {
+      assertJsonSchemaObject(value, "outputSchema");
+    } catch (error) {
+      return error instanceof Error ? error.message : String(error);
+    }
+  }
+  return;
+}
 export const DEFAULT_FOREGROUND_TIMEOUT_MS = 30 * 60 * 1000;
 
 export { DEFAULT_ASYNC_TIMEOUT_MS };
@@ -2397,17 +2590,22 @@ function withResolvedContext(result, fallback) {
   };
 }
 function withAggregatedToolUsage(result) {
-  if (result.details.results.length === 0)
-    return result;
-  const usage = sumResultsUsage(result.details.results);
-  return usage.input !== 0 || usage.output !== 0 || usage.cacheRead !== 0 || usage.cacheWrite !== 0 || usage.cost !== 0 || usage.turns !== 0 ? { ...result, details: { ...result.details, totalChildUsage: usage } } : result;
-}
-function withForkThinkingNotes(result, downgrades) {
-  if (downgrades.size === 0)
-    return result;
-  const children = [...downgrades.entries()].sort(([a], [b]) => a - b).map(([index, agent]) => `${agent} (child ${index})`).join(", ");
-  const note = `Note: fork context forced thinking off for ${children}. The forked transcript contained signed Anthropic thinking blocks that were sanitized, and Anthropic children cannot resume such a transcript with thinking enabled. Use context: "fresh" when an Anthropic child needs thinking.`;
-  return { ...result, content: [...result.content, { type: "text", text: note }] };
+  const highWarnings = result.details.results.flatMap((child) => child.watchdog?.warnings?.filter((warning) => warning.importance === "high") ?? []);
+  const projected = {
+    ...result,
+    ...highWarnings.length ? { content: [...result.content, { type: "text", text: ["High-importance watchdog findings:", ...highWarnings.map((warning) => `- ${warning.severity}: ${warning.summary}
+  Evidence: ${warning.evidence}
+  Recommended action: ${warning.recommendedAction}`)].join(`
+`) }] } : {},
+    details: {
+      ...result.details,
+      results: result.details.results.map((child) => ({ ...child, ...child.watchdog ? { watchdog: childWatchdogProgressForModel(child.watchdog) } : {} }))
+    }
+  };
+  if (projected.details.results.length === 0)
+    return projected;
+  const usage = sumResultsUsage(projected.details.results);
+  return usage.input !== 0 || usage.output !== 0 || usage.cacheRead !== 0 || usage.cacheWrite !== 0 || usage.cost !== 0 || usage.turns !== 0 ? { ...projected, details: { ...projected.details, totalChildUsage: usage } } : projected;
 }
 function toExecutionErrorResult(params, error, contextSummary) {
   const message = error instanceof Error ? error.message : String(error);
@@ -2422,7 +2620,7 @@ function resolveStaticLaunchSummary(input) {
   const externalRunner = agentConfig?.runner?.type === "external-cli" || agentConfig?.runner?.type === "external-job";
   const modelScopes = resolveModelScopesForAgent(input.modelScope, input.agent, input.parentModel);
   const model = externalRunner ? undefined : resolveEffectiveSubagentModel(input.explicitModel, agentConfig?.model, input.parentModel, input.availableModels, agentConfig?.modelProvider ?? input.currentProvider, modelScopes.length === 0 ? {} : { scope: modelScopes });
-  const thinkingOverride = externalRunner ? undefined : input.thinkingOverrideForTask(input.agent, input.index, model);
+  const thinkingOverride = externalRunner ? undefined : input.thinkingOverrideForTask();
   const thinking = externalRunner ? undefined : resolveEffectiveThinking(model, thinkingOverride ?? agentConfig?.thinking);
   return {
     agent: input.agent,
@@ -2524,8 +2722,9 @@ async function preflightForkSessionsForStaticTasks(params, contextPolicy, prepar
   if (!contextPolicy.usesFork)
     return;
   if (params.agent) {
-    if (shouldForkAgent(contextPolicy, params.agent))
-      await prepareSessionForTask(params.agent, 0, params.model);
+    if (shouldForkAgent(contextPolicy, params.agent)) {
+      await prepareSessionForTask(params.agent, 0, params.model, params.modelOrigin === "inherited", params.modelOrigin);
+    }
     return;
   }
   if (params.tasks) {
@@ -2573,6 +2772,35 @@ function importedAsyncRootUsage(completed) {
     turns: 0
   };
 }
+function removeWorkflowAwaitedResult(asyncDir, resultPath, runId, publication) {
+  try {
+    fs.rmSync(resultPath, { force: true });
+  } catch {}
+  removeResultIndex(asyncDir, publication.sessionId, runId, publication.toolCallId);
+}
+function emitWorkflowAwaitedChildComplete(dm, state, runId, asyncDir, parentWorkflowRunId, completed) {
+  let status;
+  try {
+    status = readStatus(asyncDir);
+  } catch (error) {
+    console.error(`Failed to read awaited workflow child status for ${runId}; emitting completion with fallback metadata:`, error);
+  }
+  dm.events.emit(SUBAGENT_ASYNC_COMPLETE_EVENT, {
+    id: runId,
+    runId,
+    sessionId: status?.sessionId ?? completed.importedPublication?.sessionId ?? state.currentSessionId,
+    completionOwnerId: status?.completionOwnerId ?? state.completionOwnerId ?? currentCompletionOwnerId(),
+    asyncDir,
+    agent: completed.agent,
+    mode: "single",
+    state: completed.stopped ? "stopped" : completed.success ? "complete" : "failed",
+    success: completed.success,
+    timestamp: Date.now(),
+    triggerTurn: false,
+    awaitedByWorkflow: true,
+    parentWorkflowRunId
+  });
+}
 async function waitForWorkflowAsyncSingleResult(params, launchResult, options) {
   if (params.workflowAwaitAsync !== true || !launchResult.details.asyncDir)
     return launchResult;
@@ -2594,7 +2822,9 @@ async function waitForWorkflowAsyncSingleResult(params, launchResult, options) {
   } finally {
     options.signal?.removeEventListener("abort", stopOnAbort);
   }
-  fs.rmSync(resultPath, { force: true });
+  if (completed.importedPublication)
+    removeWorkflowAwaitedResult(asyncDir, resultPath, options.runId, completed.importedPublication);
+  emitWorkflowAwaitedChildComplete(options.dm, options.state, options.runId, asyncDir, params.workflowParentRunId, completed);
   const usage = importedAsyncRootUsage(completed);
   const childResult = omitUndefinedProperties({
     index: 0,
@@ -2610,14 +2840,14 @@ async function waitForWorkflowAsyncSingleResult(params, launchResult, options) {
     ...completed.stopped ? { stopped: true } : {},
     ...completed.sessionFile ? { sessionFile: completed.sessionFile } : {},
     ...completed.model ? { model: completed.model } : {},
-    ...completed.attemptedModels ? { attemptedModels: completed.attemptedModels } : {},
-    ...completed.modelAttempts ? { modelAttempts: completed.modelAttempts } : {},
+    ...completed.requestedModel ? { requestedModel: completed.requestedModel } : {},
     ...completed.contextOverflow ? { contextOverflow: true } : {},
     ...completed.structuredOutput !== undefined ? { structuredOutput: completed.structuredOutput } : {},
     ...completed.structuredOutputPath ? { structuredOutputPath: completed.structuredOutputPath } : {},
     ...completed.structuredOutputSchemaPath ? { structuredOutputSchemaPath: completed.structuredOutputSchemaPath } : {},
     ...completed.acceptance ? { acceptance: completed.acceptance } : {},
     ...completed.artifactPaths ? { artifactPaths: completed.artifactPaths } : {},
+    ...completed.savedOutputPath ? { savedOutputPath: completed.savedOutputPath } : {},
     ...completed.outputSaveError ? { outputSaveError: completed.outputSaveError } : {},
     ...completed.transcriptPath ? { transcriptPath: completed.transcriptPath } : {},
     ...completed.transcriptError ? { transcriptError: completed.transcriptError } : {}
@@ -2673,11 +2903,13 @@ async function runAsyncPath(data, deps) {
     currentModelProvider: parentModel?.provider,
     currentModel: parentModel,
     modelScope: data.modelScope,
+    modelResponseAliases: deps.config.modelResponseAliases,
     interactive: ctx.hasUI,
-    permissions: deps.config.permissions
+    permissions: deps.config.permissions,
+    childRuntime: deps.childRuntime
   });
   const availableModels = ctx.modelRegistry.getAvailable().map(toModelInfo);
-  const currentMaxSubagentDepth = resolveCurrentMaxSubagentDepth(deps.config.maxSubagentDepth);
+  const currentMaxSubagentDepth = resolveCurrentMaxSubagentDepth(deps.config.maxSubagentDepth, deps.childRuntime);
   const currentProvider = parentModel?.provider;
   const controlIntercomTarget = resolveRunLevelIntercomTarget(intercomBridge, contextPolicy);
   const childIntercomTarget = resolveChildIntercomTargetFactory(intercomBridge, contextPolicy, id);
@@ -2701,9 +2933,21 @@ async function runAsyncPath(data, deps) {
       return buildRequestedModeError(params, `Agent '${a.name}' uses runner.type='${a.runner.type}' and does not support fast mode.`);
     }
     const modelScopes = resolveModelScopesForAgent(data.modelScope, a.name, parentModel);
-    const modelOverride = a.runner?.type === "external-cli" || a.runner?.type === "external-job" ? params.model ?? (externalRunnerWithoutExplicitModel ? undefined : a.model) : resolveEffectiveSubagentModel(params.model, a.model, parentModel, availableModels, a.modelProvider ?? currentProvider, modelScopes.length === 0 ? {} : { scope: modelScopes });
-    const modelOverrideFromParent = inheritsParentModel(params.model, a.model, parentModel);
-    const asyncResult = executeAsyncSingle(id, compactOptional({
+    const modelOrigin = resolveModelOrigin({
+      storedOrigin: params.modelOrigin,
+      explicitModel: params.model,
+      agentModel: a.model,
+      parentModel
+    });
+    const modelOverride = a.runner?.type === "external-cli" || a.runner?.type === "external-job" ? params.model ?? (externalRunnerWithoutExplicitModel ? undefined : a.model) : resolveEffectiveSubagentModel(params.model, a.model, parentModel, availableModels, a.modelProvider ?? currentProvider, {
+      ...modelScopes.length === 0 ? {} : { scope: modelScopes },
+      source: modelOrigin === "explicit" ? "explicit" : "inherited"
+    });
+    const modelOverrideFromParent = modelOrigin === "inherited";
+    const launchRuleError = applyWatchdogLaunchRules({ cwd: effectiveCwd, agent: a.name, model: modelOverride ?? (parentModel && `${parentModel.provider}/${parentModel.id}`), warn: (violation) => deps.watchdog?.displayRuleWarning(violation) });
+    if (launchRuleError)
+      return toExecutionErrorResult(params, new Error(launchRuleError), data.contextPolicy.contextSummary);
+    const asyncResult = await executeAsyncSingle(id, compactOptional({
       agent: params.agent,
       task: shouldForkAgent(contextPolicy, params.agent) ? wrapForkTask(params.task ?? "") : params.task ?? "",
       goal: params.task ?? "",
@@ -2713,13 +2957,15 @@ async function runAsyncPath(data, deps) {
       availableModels,
       cwd: effectiveCwd,
       requestedCwd: data.requestedCwd,
+      machine: params.machine,
+      machineCwd: params.machineCwd,
       maxOutput: params.maxOutput,
       artifactsDir: artifactConfig.enabled ? artifactsDir : undefined,
       artifactConfig,
       shareEnabled,
       activeAsyncCapacity: data.activeAsyncCapacity,
       sessionRoot,
-      sessionFile: sessionFileForTask(params.agent, 0, modelOverride, modelOverrideFromParent),
+      sessionFile: sessionFileForTask(params.agent, 0, modelOverride, modelOverrideFromParent, modelOrigin),
       context: contextPolicy.contextForAgent(params.agent),
       skills,
       output: effectiveOutput,
@@ -2730,7 +2976,8 @@ async function runAsyncPath(data, deps) {
       modelOverride,
       fast: params.fast,
       modelOverrideFromParent,
-      thinkingOverride: externalRunnerWithoutExplicitModel ? undefined : thinkingOverrideForTask(params.agent, 0, modelOverride, modelOverrideFromParent),
+      modelOrigin,
+      thinkingOverride: externalRunnerWithoutExplicitModel ? undefined : thinkingOverrideForTask(),
       thinkingCeiling: a.maxThinking,
       maxSubagentDepth,
       waitToolEnabled: deps.waitToolEnabled,
@@ -2739,13 +2986,16 @@ async function runAsyncPath(data, deps) {
       worktreeSetupHook: deps.config.worktreeSetupHook,
       worktreeSetupHookTimeoutMs: deps.config.worktreeSetupHookTimeoutMs,
       worktreeBaseDir: deps.config.worktreeBaseDir,
+      baseRef: params.baseRef,
+      worktreeProvider: deps.config.worktreeProvider,
+      worktreeBranchPrefix: deps.config.worktreeBranchPrefix,
       controlConfig,
       intercomBridge: params.intercomBridge,
       controlIntercomTarget,
       childIntercomTarget: childIntercomTarget ? (agent, index) => childIntercomTarget(agent, index) : undefined,
       nestedRoute,
       agentContract: params.agentContract,
-      structuredOutputSchema: params.outputSchema,
+      structuredOutputSchema: params.outputSchema || undefined,
       extensionBindings: params.extensionBindings,
       acceptance: params.acceptance,
       timeoutMs: data.timeoutMs,
@@ -2753,6 +3003,7 @@ async function runAsyncPath(data, deps) {
       usageBudget: data.usageBudget,
       configToolBudget: data.configToolBudget,
       toolTimeoutMs: data.params?.toolTimeoutMs,
+      checkpointBeforeDeadlineMs: data.params?.checkpointBeforeDeadlineMs ?? deps.config.checkpointBeforeDeadlineMs,
       configToolTimeoutMs: data.configToolTimeoutMs,
       capabilityCeiling: data.capabilityCeiling,
       runFanoutBudget: data.runFanoutBudget,
@@ -2761,20 +3012,25 @@ async function runAsyncPath(data, deps) {
       lane: params.lane,
       workflowAwaitAsync: params.workflowAwaitAsync
     }));
-    return waitForWorkflowAsyncSingleResult(params, asyncResult, { runId: id, task: params.task ?? "", signal: data.signal, state: deps.state, kill: deps.kill });
+    return waitForWorkflowAsyncSingleResult(params, asyncResult, { runId: id, task: params.task ?? "", signal: data.signal, state: deps.state, dm: deps.dm, kill: deps.kill });
   }
   return null;
 }
-function createSingleWorktreeSetup(enabled, cwd, runId, agent, setupHook, setupHookTimeoutMs, baseDir, beforeCreate) {
-  if (!enabled)
-    return {};
+async function createSingleWorktreeSetup(cwd, runId, agent, setupHook, setupHookTimeoutMs, baseDir, baseRef, provider, branchPrefix, label, task, onProgress, signal, deadlineAt) {
   try {
     return {
-      setup: createWorktrees(cwd, runId, 1, omitUndefinedProperties({
+      setup: await createWorktrees(cwd, runId, 1, omitUndefinedProperties({
         agents: [agent],
         setupHook: setupHook ? { hookPath: setupHook, ...setupHookTimeoutMs === undefined ? {} : { timeoutMs: setupHookTimeoutMs } } : undefined,
         baseDir,
-        beforeCreate
+        baseRef,
+        provider,
+        branchPrefix,
+        labels: [label],
+        tasks: [task],
+        onProgress,
+        signal,
+        deadlineAt
       }))
     };
   } catch (error) {
@@ -2796,9 +3052,6 @@ export function sanitizeRunPathSegment(value, maxBytes = 120) {
 function resolveSingleRunOutputBaseDir(deps, artifactsDir, runId) {
   return resolveConfiguredSingleRunOutputBaseDir(deps) ?? path.join(artifactsDir, "outputs", sanitizeRunPathSegment(runId));
 }
-function resolveWorkflowAggregateOutputPath(output, ctxCwd, workflowCwd, outputBaseDir) {
-  return resolveSingleOutputPath(output, ctxCwd, workflowCwd, outputBaseDir);
-}
 function workflowChildDefaultOutput(aggregateOutputPath, artifactsDir, workflowRunId, workflowKey) {
   if (aggregateOutputPath) {
     const parsed = path.parse(aggregateOutputPath);
@@ -2808,6 +3061,9 @@ function workflowChildDefaultOutput(aggregateOutputPath, artifactsDir, workflowR
 }
 function workflowHostCommandRunner(input) {
   return async (key, params, signal) => {
+    const authorizationError = input.authorize?.(key, params);
+    if (authorizationError)
+      throw new Error(authorizationError);
     const defaultOutputPath = path.join(input.artifactsDir, "outputs", sanitizeRunPathSegment(input.workflowRunId), "host", `${sanitizeRunPathSegment(key)}.log`);
     const outputPath = params.output ? path.resolve(input.workflowCwd, params.output) : defaultOutputPath;
     const claimPath = resolveWorkflowHostOutputClaimPath(outputPath);
@@ -2839,8 +3095,22 @@ function appendWorkflowOutputWarning(text, warning) {
 
 ${warning}` : text;
 }
+export function resolveWorkflowChildLocalCwd(input) {
+  if (input.params.machine !== undefined)
+    return input.workflowCwd;
+  if (typeof input.params.agent === "string") {
+    const agentScope = resolveExecutionAgentScope(input.params.agentScope ?? input.workflowAgentScope);
+    const workflowAgents = input.discoverAgents(input.workflowCwd, agentScope).agents;
+    const agent = resolveAgentName(input.params.agent, workflowAgents).agent ?? resolveAgentName(input.params.agent, input.agents).agent;
+    if (agent?.machine !== undefined)
+      return input.workflowCwd;
+  }
+  return typeof input.params.cwd === "string" ? resolveChildCwd(input.workflowCwd, input.params.cwd) : input.workflowCwd;
+}
 function resolveWorkflowChildOutputPath(input) {
-  if (typeof input.params.resume === "string") {
+  const rawOutput = input.params.output;
+  const hasExplicitOutput = typeof rawOutput === "string" || typeof rawOutput === "boolean";
+  if (typeof input.params.resume === "string" && (!hasExplicitOutput || rawOutput === true || rawOutput === "true")) {
     if (!input.state)
       return { path: undefined, inherited: false };
     const index = input.params.index;
@@ -2850,13 +3120,14 @@ function resolveWorkflowChildOutputPath(input) {
     }, input.state);
     return { path: "recoveryDescriptor" in target ? target.recoveryDescriptor?.outputPath : undefined, inherited: false };
   }
-  const rawOutput = input.params.output;
-  const hasExplicitOutput = typeof rawOutput === "string" || typeof rawOutput === "boolean";
-  const childCwd = typeof input.params.cwd === "string" ? resolveChildCwd(input.workflowCwd, input.params.cwd) : input.workflowCwd;
-  const agentScope = resolveExecutionAgentScope(input.params.agentScope ?? input.workflowAgentScope);
-  const discoveredAgents = input.discoverAgents(childCwd, agentScope).agents;
-  const agent = typeof input.params.agent === "string" ? resolveAgentName(input.params.agent, discoveredAgents).agent ?? resolveAgentName(input.params.agent, input.agents).agent : undefined;
-  const agentOutput = typeof agent?.output === "string" ? agent.output : undefined;
+  const childCwd = resolveWorkflowChildLocalCwd(input);
+  let agentOutput;
+  if (rawOutput === true || rawOutput === "true" || !hasExplicitOutput && !input.aggregateOutputPath) {
+    const agentScope = resolveExecutionAgentScope(input.params.agentScope ?? input.workflowAgentScope);
+    const discoveredAgents = input.discoverAgents(childCwd, agentScope).agents;
+    const agent = typeof input.params.agent === "string" ? resolveAgentName(input.params.agent, discoveredAgents).agent ?? resolveAgentName(input.params.agent, input.agents).agent : undefined;
+    agentOutput = typeof agent?.output === "string" ? agent.output : undefined;
+  }
   const output = rawOutput === true || rawOutput === "true" ? agentOutput : hasExplicitOutput ? rawOutput : input.aggregateOutputPath ? workflowChildDefaultOutput(input.aggregateOutputPath, input.artifactsDir, input.workflowRunId, input.key) : agentOutput;
   return {
     path: resolveSingleOutputPath(output, input.ctxCwd, childCwd, input.configuredOutputBaseDir ?? path.join(input.artifactsDir, "outputs", sanitizeRunPathSegment(input.workflowRunId))),
@@ -2911,25 +3182,89 @@ function prepareWorkflowChildLaunchParams(input) {
     childParams = { ...input.childParams, output: input.outputOverride };
   } else if (usesDefaultOutput && input.aggregateOutputPath !== undefined) {
     childParams = { ...input.childParams, output: workflowChildDefaultOutput(input.aggregateOutputPath, input.artifactsDir, input.parentWorkflowRunId, input.workflowKey) };
-  } else if (input.childParams.resume === undefined) {
+  } else if (input.childParams.resume === undefined || input.childParams.output !== undefined) {
     const resolvedOutput = resolveWorkflowChildOutputPath({ ctxCwd: input.ctxCwd, workflowCwd: input.workflowCwd, artifactsDir: input.artifactsDir, workflowRunId: input.parentWorkflowRunId, aggregateOutputPath: input.aggregateOutputPath, configuredOutputBaseDir: input.configuredOutputBaseDir, discoverAgents: input.discoverAgents, agents: input.agents, workflowAgentScope: input.workflowAgentScope, key: input.workflowKey, params: input.childParams });
     if (resolvedOutput.path)
       childParams = { ...input.childParams, output: resolvedOutput.path };
   }
-  const childCwd = typeof childParams.cwd === "string" ? resolveChildCwd(input.workflowCwd, childParams.cwd) : input.workflowCwd;
+  const childCwd = resolveWorkflowChildLocalCwd({ ...input, params: childParams });
   const agentScope = resolveExecutionAgentScope(childParams.agentScope ?? input.workflowAgentScope);
   const discoveredAgents = input.discoverAgents(childCwd, agentScope).agents;
   const agent = typeof childParams.agent === "string" ? resolveAgentName(childParams.agent, discoveredAgents).agent ?? resolveAgentName(childParams.agent, input.agents).agent : undefined;
   const externalAsyncRequired = agent?.runner?.type === "external-cli" || agent?.runner?.type === "external-job";
   return prepareWorkflowLaunchParams(input.workflowDefaults, childParams, input.parentWorkflowRunId, input.workflowKey, { ...input.options, externalAsyncRequired, outputClaimPath: input.outputClaimPath });
 }
-function finalizeSingleWorktreeHandoff(input) {
-  const diffsDir = path.join(input.artifactsDir, "worktree-diffs", input.runId);
-  const diffs = diffWorktrees(input.worktreeSetup, [input.agent], diffsDir);
-  const diffSummary = formatWorktreeDiffSummary(diffs);
-  const manifestPath = parallelHandoffPath(input.artifactsDir, input.runId);
-  const handoff = {
-    manifestPath,
+async function finalizeSingleWorktreeHandoff(input) {
+  let admitted = false;
+  try {
+    return await withWorktreeTransaction(() => {
+      admitted = true;
+      const diffsDir = path.join(input.artifactsDir, "worktree-diffs", input.runId);
+      const diffs = diffWorktrees(input.worktreeSetup, [input.agent], diffsDir);
+      const diffSummary = formatWorktreeDiffSummary(diffs);
+      const manifestPath = parallelHandoffPath(input.artifactsDir, input.runId);
+      const handoff = {
+        manifestPath,
+        runId: input.runId,
+        mode: "single",
+        source: "foreground",
+        cwd: input.cwd,
+        stepIndex: 0,
+        flatStartIndex: 0,
+        setup: input.worktreeSetup,
+        laneBindings: input.workflowKey || input.lane ? [{ index: 0, taskIndex: 0, ...input.workflowKey ? { workflowKey: input.workflowKey } : {}, runId: input.workflowKey ? input.runId : undefined, ...input.lane ? { lane: input.lane } : {} }] : undefined,
+        diffs,
+        results: [{
+          agent: input.result.agent,
+          ...input.workflowKey ? { workflowKey: input.workflowKey } : {},
+          ...input.workflowKey ? { runId: input.runId } : {},
+          ...input.lane ? { lane: input.lane } : {},
+          status: resolveSubagentResultStatus(omitUndefinedProperties({
+            exitCode: input.result.exitCode,
+            interrupted: input.result.interrupted,
+            detached: input.result.detached,
+            state: input.result.stopped ? "stopped" : undefined,
+            processSignal: input.result.processSignal,
+            timedOut: input.result.timedOut,
+            stopped: input.result.stopped,
+            turnBudgetExceeded: input.result.turnBudgetExceeded
+          })),
+          summary: resultSummaryForIntercom(input.result),
+          ...input.result.artifactPaths?.outputPath ? { outputPath: input.result.artifactPaths.outputPath } : {},
+          ...input.result.structuredOutput !== undefined ? { structuredOutput: input.result.structuredOutput } : {},
+          ...input.result.structuredOutputPath ? { structuredOutputPath: input.result.structuredOutputPath } : {},
+          ...input.result.sessionFile ? { sessionPath: input.result.sessionFile } : {}
+        }]
+      };
+      try {
+        writeParallelHandoffGroup(handoff);
+        const cleanup = cleanupWorktrees(input.worktreeSetup, { kind: "preserve", capturedDiffs: diffs, handoffManifestPath: manifestPath });
+        const reference = writeParallelHandoffGroup({ ...handoff, cleanup });
+        return {
+          suffix: [diffSummary, formatParallelHandoffReference(reference)].filter(Boolean).join(`
+
+`),
+          reference
+        };
+      } catch (error) {
+        return { suffix: [diffSummary, formatParallelHandoffError(error)].filter(Boolean).join(`
+
+`) };
+      }
+    });
+  } catch (error) {
+    if (admitted)
+      throw error;
+    const reference = retainSingleWorktreeHandoff(input, error);
+    return { suffix: `${formatParallelHandoffError(error)}
+
+${formatParallelHandoffReference(reference)}`, reference };
+  }
+}
+function retainSingleWorktreeHandoff(input, error) {
+  const reason = `Worktree finalization retained; manual reconciliation required: ${error instanceof Error ? error.message : String(error)}`;
+  return writeParallelHandoffGroup({
+    manifestPath: parallelHandoffPath(input.artifactsDir, input.runId),
     runId: input.runId,
     mode: "single",
     source: "foreground",
@@ -2937,45 +3272,20 @@ function finalizeSingleWorktreeHandoff(input) {
     stepIndex: 0,
     flatStartIndex: 0,
     setup: input.worktreeSetup,
-    laneBindings: input.workflowKey || input.lane ? [{ index: 0, taskIndex: 0, ...input.workflowKey ? { workflowKey: input.workflowKey } : {}, runId: input.workflowKey ? input.runId : undefined, ...input.lane ? { lane: input.lane } : {} }] : undefined,
-    diffs,
-    results: [{
-      agent: input.result.agent,
-      ...input.workflowKey ? { workflowKey: input.workflowKey } : {},
-      ...input.workflowKey ? { runId: input.runId } : {},
-      ...input.lane ? { lane: input.lane } : {},
-      status: resolveSubagentResultStatus(omitUndefinedProperties({
-        exitCode: input.result.exitCode,
-        interrupted: input.result.interrupted,
-        detached: input.result.detached,
-        state: input.result.stopped ? "stopped" : undefined,
-        processSignal: input.result.processSignal,
-        timedOut: input.result.timedOut,
-        stopped: input.result.stopped,
-        turnBudgetExceeded: input.result.turnBudgetExceeded
-      })),
-      summary: resultSummaryForIntercom(input.result),
-      ...input.result.artifactPaths?.outputPath ? { outputPath: input.result.artifactPaths.outputPath } : {},
-      ...input.result.structuredOutput !== undefined ? { structuredOutput: input.result.structuredOutput } : {},
-      ...input.result.structuredOutputPath ? { structuredOutputPath: input.result.structuredOutputPath } : {},
-      ...input.result.sessionFile ? { sessionPath: input.result.sessionFile } : {}
-    }]
-  };
-  try {
-    writeParallelHandoffGroup(handoff);
-    const cleanup = cleanupWorktrees(input.worktreeSetup, { kind: "preserve", capturedDiffs: diffs, handoffManifestPath: manifestPath });
-    const reference = writeParallelHandoffGroup({ ...handoff, cleanup });
-    return {
-      suffix: [diffSummary, formatParallelHandoffReference(reference)].filter(Boolean).join(`
-
-`),
-      reference
-    };
-  } catch (error) {
-    return { suffix: [diffSummary, formatParallelHandoffError(error)].filter(Boolean).join(`
-
-`) };
-  }
+    diffs: [],
+    results: [],
+    cleanup: { state: "partial", pruned: false, errors: [reason], tasks: input.worktreeSetup.worktrees.map((worktree) => ({
+      index: worktree.index,
+      path: worktree.path,
+      branch: worktree.branch,
+      provider: worktree.provider,
+      naming: worktree.naming,
+      worktreeRemoved: false,
+      branchRemoved: false,
+      preserved: true,
+      reason
+    })) }
+  });
 }
 async function runSinglePath(data, deps) {
   const {
@@ -2993,7 +3303,8 @@ async function runSinglePath(data, deps) {
     artifactsDir,
     onUpdate,
     controlConfig,
-    contextPolicy
+    contextPolicy,
+    suppressUnchangedDelegationUpdates
   } = data;
   let lane;
   try {
@@ -3015,6 +3326,15 @@ async function runSinglePath(data, deps) {
       details: { mode: "single", results: [] }
     };
   }
+  let foregroundMachine;
+  const requestedMachine = params.machine ?? agentConfig.machine;
+  if (requestedMachine) {
+    try {
+      foregroundMachine = resolveHerdrMachinePlacement({ machine: requestedMachine, cwd: ctx.cwd, stepCwd: params.machineCwd }).machine;
+    } catch (error) {
+      return toExecutionErrorResult(params, error instanceof Error ? error : new Error(String(error)), data.contextPolicy.contextSummary);
+    }
+  }
   const effectiveToolBudget = resolveEffectiveToolBudget(omitUndefinedProperties({ runBudget: data.toolBudget, agentBudget: agentConfig.toolBudget, configBudget: data.configToolBudget }));
   if (effectiveToolBudget.error)
     return toExecutionErrorResult(params, new Error(effectiveToolBudget.error), data.contextPolicy.contextSummary);
@@ -3023,19 +3343,31 @@ async function runSinglePath(data, deps) {
   const availableModels = ctx.modelRegistry.getAvailable().map(toModelInfo);
   const modelScopes = resolveModelScopesForAgent(data.modelScope, agentConfig.name, parentModel);
   let task = typeof params.task === "string" ? params.task : "";
-  let modelOverride = resolveEffectiveSubagentModel(params.model, agentConfig.model, parentModel, availableModels, agentConfig.modelProvider ?? currentProvider, modelScopes.length === 0 ? {} : { scope: modelScopes });
-  const modelOverrideFromParent = inheritsParentModel(params.model, agentConfig.model, parentModel);
+  const modelOrigin = resolveModelOrigin({
+    storedOrigin: params.modelOrigin,
+    explicitModel: params.model,
+    agentModel: agentConfig.model,
+    parentModel
+  });
+  let modelOverride = resolveEffectiveSubagentModel(params.model, agentConfig.model, parentModel, availableModels, agentConfig.modelProvider ?? currentProvider, {
+    ...modelScopes.length === 0 ? {} : { scope: modelScopes },
+    source: modelOrigin === "explicit" ? "explicit" : "inherited"
+  });
+  const modelOverrideFromParent = modelOrigin === "inherited";
+  const launchRuleError = applyWatchdogLaunchRules({ cwd: effectiveCwd, agent: agentConfig.name, model: modelOverride ?? (parentModel && `${parentModel.provider}/${parentModel.id}`), warn: (violation) => deps.watchdog?.displayRuleWarning(violation) });
+  if (launchRuleError)
+    return toExecutionErrorResult(params, new Error(launchRuleError), data.contextPolicy.contextSummary);
   let skillOverride = normalizeSkillInput(params.skill);
   let readsOverride = params.reads;
   const rawOutput = params.output !== undefined ? params.output : agentConfig.output;
   let effectiveOutput = normalizeSingleOutputOverride(rawOutput, agentConfig.output);
   const effectiveOutputMode = params.outputMode ?? agentConfig.outputMode ?? "inline";
-  const currentMaxSubagentDepth = resolveCurrentMaxSubagentDepth(deps.config.maxSubagentDepth);
+  const currentMaxSubagentDepth = resolveCurrentMaxSubagentDepth(deps.config.maxSubagentDepth, deps.childRuntime);
   const maxSubagentDepth = resolveChildMaxSubagentDepth(currentMaxSubagentDepth, agentConfig.maxSubagentDepth);
-  const sourceCwd = effectiveCwd;
+  const sourceCwd = foregroundMachine?.cwd ?? effectiveCwd;
   let pendingHandoff;
-  const { setup: worktreeSetup, errorResult: worktreeSetupError } = createSingleWorktreeSetup(params.worktree, sourceCwd, runId, params.agent, deps.config.worktreeSetupHook, deps.config.worktreeSetupHookTimeoutMs, deps.config.worktreeBaseDir, (plannedSetup) => {
-    pendingHandoff = writePendingParallelHandoff({
+  const { setup: worktreeSetup, errorResult: worktreeSetupError } = params.worktree ? await createSingleWorktreeSetup(sourceCwd, runId, params.agent, deps.config.worktreeSetupHook, deps.config.worktreeSetupHookTimeoutMs, deps.config.worktreeBaseDir, params.baseRef, deps.config.worktreeProvider, deps.config.worktreeBranchPrefix, params.lane?.key ?? params.workflowKey, task, (progress) => {
+    pendingHandoff = writeWorktreeSetupHandoff({
       manifestPath: parallelHandoffPath(artifactsDir, runId),
       runId,
       mode: "single",
@@ -3043,13 +3375,52 @@ async function runSinglePath(data, deps) {
       cwd: sourceCwd,
       stepIndex: 0,
       flatStartIndex: 0,
-      setup: plannedSetup,
+      progress,
       laneBindings: params.workflowKey || lane ? [{ index: 0, taskIndex: 0, ...params.workflowKey ? { workflowKey: params.workflowKey, runId } : {}, ...lane ? { lane } : {} }] : undefined
     });
-  });
-  if (worktreeSetupError)
+  }, signal, data.deadlineAt) : {};
+  if (worktreeSetupError) {
+    if (pendingHandoff) {
+      worktreeSetupError.details.parallelHandoff = pendingHandoff;
+      worktreeSetupError.content.push({ type: "text", text: formatParallelHandoffReference(pendingHandoff) });
+    }
     return worktreeSetupError;
+  }
   const singleCwd = worktreeSetup?.worktrees[0]?.agentCwd ?? sourceCwd;
+  const cleanupSingleWorktree = async () => {
+    if (!worktreeSetup)
+      return;
+    let admitted = false;
+    try {
+      await withWorktreeTransaction(() => {
+        if (data.deadlineAt !== undefined && Date.now() >= data.deadlineAt)
+          throw new Error("Run deadline expired before unlaunched worktree cleanup");
+        admitted = true;
+        const cleanup = cleanupWorktrees(worktreeSetup);
+        pendingHandoff = writeParallelHandoffGroup({
+          manifestPath: parallelHandoffPath(artifactsDir, runId),
+          runId,
+          mode: "single",
+          source: "foreground",
+          cwd: sourceCwd,
+          stepIndex: 0,
+          flatStartIndex: 0,
+          setup: worktreeSetup,
+          diffs: [],
+          results: [],
+          cleanup
+        });
+      });
+    } catch (error) {
+      if (admitted)
+        throw error;
+      pendingHandoff = retainSingleWorktreeHandoff({ worktreeSetup, artifactsDir, runId, cwd: sourceCwd }, error);
+    }
+  };
+  if (worktreeSetup && (signal?.aborted || data.deadlineAt !== undefined && Date.now() >= data.deadlineAt)) {
+    await cleanupSingleWorktree();
+    return { content: [{ type: "text", text: "Subagent setup canceled before child launch." }], isError: true, details: { mode: "single", results: [], parallelHandoff: pendingHandoff } };
+  }
   const authoredTask = task;
   if (shouldForkAgent(contextPolicy, params.agent)) {
     task = wrapForkTask(task);
@@ -3058,13 +3429,12 @@ async function runSinglePath(data, deps) {
   const outputPath = resolveSingleOutputPath(effectiveOutput, ctx.cwd, singleCwd, resolveSingleRunOutputBaseDir(deps, artifactsDir, runId));
   const validationError = validateFileOnlyOutputMode(effectiveOutputMode, outputPath, `Single run (${params.agent})`);
   if (validationError) {
-    if (worktreeSetup)
-      cleanupWorktrees(worktreeSetup);
-    return { content: [{ type: "text", text: validationError }], isError: true, details: { mode: "single", results: [] } };
+    await cleanupSingleWorktree();
+    return { content: [{ type: "text", text: validationError }], isError: true, details: { mode: "single", results: [], parallelHandoff: pendingHandoff } };
   }
-  const structuredRuntime = params.outputSchema ? createStructuredOutputRuntime(params.outputSchema, artifactConfig.enabled ? path.join(artifactsDir, "structured-output", runId) : undefined, { captureAcceptanceReport: params.acceptance !== false }) : undefined;
+  const structuredRuntime = params.outputSchema ? createStructuredOutputRuntime(params.outputSchema, artifactConfig.enabled ? path.join(artifactsDir, "structured-output", runId) : undefined, { acceptanceReport: resolveAcceptanceReportMode(params.acceptance) }) : undefined;
   const reads = readsOverride !== undefined ? readsOverride : agentConfig.defaultReads ?? false;
-  const readPaths = Array.isArray(reads) ? resolveExistingReadPaths(reads, singleCwd) : [];
+  const readPaths = !foregroundMachine && Array.isArray(reads) ? resolveExistingReadPaths(reads, singleCwd) : [];
   const readsInstruction = readPaths.length > 0 ? `[Read from: ${readPaths.join(", ")}]
 
 ` : "";
@@ -3078,9 +3448,10 @@ async function runSinglePath(data, deps) {
   }
   const interruptController = new AbortController;
   let detachForeground;
+  let childSessionControls;
   const foregroundControl = deps.state.foregroundControls.get(runId);
   if (foregroundControl) {
-    const thinking = resolveEffectiveThinking(modelOverride, thinkingOverrideForTask(params.agent, 0, modelOverride, modelOverrideFromParent));
+    const thinking = resolveEffectiveThinking(modelOverride, thinkingOverrideForTask());
     beginForegroundChild(foregroundControl, omitUndefinedProperties({
       index: 0,
       agent: params.agent,
@@ -3098,15 +3469,33 @@ async function runSinglePath(data, deps) {
         interruptController.abort();
         return true;
       },
-      detach: () => detachForeground?.("user request") === true
+      detach: () => detachForeground?.("user request") === true,
+      steer: async (input) => {
+        if (!childSessionControls)
+          return { state: "failed", reason: CHILD_SESSION_NOT_RUNNING_YET };
+        try {
+          if (input.mode === "follow_up") {
+            await childSessionControls.followUp(input.message);
+            return { state: "queued" };
+          }
+          await childSessionControls.steer(input.message);
+          return { state: "delivered" };
+        } catch (error) {
+          return { state: "failed", reason: error instanceof Error ? error.message : String(error) };
+        }
+      }
     }));
+    if (deps.childRuntime?.fanoutChild)
+      deps.activateSupervisorTransport?.();
   }
+  const modelResponseAliases = deps.config.modelResponseAliases === undefined ? undefined : structuredClone(deps.config.modelResponseAliases);
   const forwardSingleUpdate = onUpdate ? (update) => {
     if (foregroundControl)
       updateForegroundChild(foregroundControl, 0, update.details?.progress?.[0]);
     onUpdate(update);
   } : undefined;
   const deadlineAt = data.deadlineAt ?? (data.timeoutMs !== undefined ? Date.now() + data.timeoutMs : undefined);
+  const requiredExtensions = deps.childRuntime?.requiredExtensions ?? resolveRequiredChildExtensions(data.parentPiSessionId);
   let r;
   let resolveDetachedWorkflowChild;
   const detachedWorkflowChild = params.workflowAwaitDetached === true ? new Promise((resolve) => {
@@ -3114,11 +3503,17 @@ async function runSinglePath(data, deps) {
   }) : undefined;
   try {
     const launched = await runSync(ctx.cwd, agents, params.agent, task, compactOptional({
+      machine: foregroundMachine,
+      parentProviderRegistry: ctx.modelRegistry,
+      remoteReads: foregroundMachine ? readsOverride : undefined,
       permissions: deps.config.permissions,
       runtimeSnapshotHost: deps.dm,
       parentSessionId: ctx.sessionManager.getSessionId() ?? undefined,
-      llmIntentArbiter: createTaskMutationArbiter(ctx),
-      ...workflowForegroundSteeringLaunchOptions(foregroundControl, 0),
+      requiredExtensions,
+      childRuntime: deps.childRuntime,
+      onChildSession: (controls) => {
+        childSessionControls = controls;
+      },
       context: data.contextPolicy.contextForAgent(params.agent),
       unknownAgentDiagnosticContext: data.unknownAgentDiagnosticContext,
       runFanoutBudget: params.runFanoutAdmitted ? data.runFanoutBudget : { ...data.runFanoutBudget, parentPath: `${data.runFanoutBudget.parentPath ? `${data.runFanoutBudget.parentPath}/` : ""}single` },
@@ -3130,7 +3525,7 @@ async function runSinglePath(data, deps) {
       intercomEvents: deps.dm.events,
       runId,
       sessionDir: sessionDirForIndex(0),
-      sessionFile: sessionFileForTask(params.agent, 0, modelOverride, modelOverrideFromParent),
+      sessionFile: sessionFileForTask(params.agent, 0, modelOverride, modelOverrideFromParent, modelOrigin),
       share: shareEnabled,
       artifactsDir: artifactConfig.enabled ? artifactsDir : undefined,
       artifactConfig,
@@ -3142,6 +3537,7 @@ async function runSinglePath(data, deps) {
       waitToolEnabled: deps.waitToolEnabled,
       waitToolDefaultTimeoutMs: deps.waitToolDefaultTimeoutMs,
       onUpdate: forwardSingleUpdate,
+      suppressUnchangedDelegationUpdates,
       controlConfig,
       onControlEvent,
       intercomSessionName: childIntercomTarget,
@@ -3151,10 +3547,12 @@ async function runSinglePath(data, deps) {
       modelOverride,
       fast: params.fast,
       modelOverrideFromParent,
-      thinkingOverride: thinkingOverrideForTask(params.agent, 0, modelOverride, modelOverrideFromParent),
+      modelOrigin,
+      thinkingOverride: thinkingOverrideForTask(),
       thinkingCeiling: agentConfig.maxThinking,
       extensionBindings: params.extensionBindings,
       availableModels,
+      modelResponseAliases,
       preferredModelProvider: currentProvider,
       modelScope: modelScopes,
       skills: effectiveSkills,
@@ -3167,14 +3565,14 @@ async function runSinglePath(data, deps) {
       onDetachReady: (detach) => {
         detachForeground = detach;
       },
-      onDetachedExit: (result) => {
+      onDetachedExit: async (result) => {
         if (resolveDetachedWorkflowChild) {
           resolveDetachedWorkflowChild(result);
           return;
         }
         try {
           if (worktreeSetup) {
-            finalizeSingleWorktreeHandoff({ worktreeSetup, artifactsDir, runId, cwd: sourceCwd, agent: params.agent, result, workflowKey: params.workflowKey, lane });
+            await finalizeSingleWorktreeHandoff({ worktreeSetup, artifactsDir, runId, cwd: sourceCwd, agent: params.agent, result, workflowKey: params.workflowKey, lane });
           }
           try {
             updateRememberedForegroundChild(deps.state, { runId, mode: "single", cwd: singleCwd, sessionId: data.parentSessionId, index: 0, result, events: deps.dm.events, notify: true });
@@ -3199,7 +3597,7 @@ async function runSinglePath(data, deps) {
               if (foregroundControl)
                 finishForegroundChild(foregroundControl, 0);
             } finally {
-              removeForegroundControlIfIdle(deps.state, runId);
+              removeForegroundControlIfIdle(deps.state, runId, deps.trackRetainedNestedRoute);
             }
           }
         }
@@ -3210,13 +3608,13 @@ async function runSinglePath(data, deps) {
       toolTimeoutMs: params.toolTimeoutMs,
       configToolTimeoutMs: data.configToolTimeoutMs,
       toolBudget: effectiveToolBudget.toolBudget,
+      usageBudget: data.usageBudget ?? data.inheritedUsageBudget,
       capabilityCeiling: data.capabilityCeiling,
       allowZeroToolBudget: data.allowZeroToolBudget && effectiveToolBudget.toolBudget === data.toolBudget
     }));
     r = launched.detached && detachedWorkflowChild ? await detachedWorkflowChild : launched;
   } catch (error) {
-    if (worktreeSetup)
-      cleanupWorktrees(worktreeSetup);
+    await cleanupSingleWorktree();
     throw error;
   } finally {
     if (!r?.detached) {
@@ -3231,7 +3629,7 @@ async function runSinglePath(data, deps) {
   }
   let worktreeHandoff;
   if (worktreeSetup) {
-    worktreeHandoff = r.detached ? { suffix: pendingHandoff ? formatParallelHandoffReference(pendingHandoff) : "", reference: pendingHandoff } : finalizeSingleWorktreeHandoff({ worktreeSetup, artifactsDir, runId, cwd: sourceCwd, agent: params.agent, result: r, workflowKey: params.workflowKey, lane });
+    worktreeHandoff = r.detached ? { suffix: pendingHandoff ? formatParallelHandoffReference(pendingHandoff) : "", reference: pendingHandoff } : await finalizeSingleWorktreeHandoff({ worktreeSetup, artifactsDir, runId, cwd: sourceCwd, agent: params.agent, result: r, workflowKey: params.workflowKey, lane });
   }
   if (r.progress)
     allProgress.push(r.progress);
@@ -3269,7 +3667,7 @@ async function runSinglePath(data, deps) {
     usageBudget: usageBudgetState(data.usageBudget, totalCost),
     ...worktreeHandoff?.reference ? { parallelHandoff: worktreeHandoff.reference } : {}
   }));
-  rememberForegroundRun(deps.state, { runId, mode: "single", cwd: singleCwd, sessionId: data.parentSessionId, results: details.results, params, effectiveOutput, effectiveOutputMode, extensionBindings: params.extensionBindings });
+  rememberForegroundRun(deps.state, { modelResponseAliases, runId, mode: "single", cwd: singleCwd, sessionId: data.parentSessionId, results: details.results, params, effectiveOutput, effectiveOutputMode, extensionBindings: params.extensionBindings, requiredExtensions });
   const suppressRoutineResultIntercom = shouldSuppressRoutineResultIntercom({ suppressRoutineResultIntercom: params.suppressRoutineResultIntercom, results: [r] });
   if (!r.detached && !r.interrupted && !suppressRoutineResultIntercom) {
     if (foregroundControl)
@@ -3340,6 +3738,7 @@ function duplicateSubagentCallResult(params) {
   };
 }
 const workflowLaunchObservers = new WeakMap;
+const workflowOwnedUsageBudgets = new WeakMap;
 const missionsMissingFromStore = new Set;
 function recordMissionWorkflowChild(binding, workflowRunId, key, update) {
   if (!binding || missionsMissingFromStore.has(binding.missionId))
@@ -3378,30 +3777,34 @@ export async function runMissionWorkflowChild(binding, workflowRunId, key, phase
     throw error;
   }
 }
-export function bindMissionWorkflowChildAsyncLaunch(params, binding, asyncByDefault, asyncId = randomUUID()) {
+export function bindMissionWorkflowChildAsyncLaunch(params, binding, asyncByDefault, asyncId = randomUUID(), nestedRootRunId) {
   const requestedAsync = params.async ?? asyncByDefault;
   if (!binding || !requestedAsync || params.clarify === true)
     return params;
   const id = asyncId.trim();
   if (!id || path.basename(id) !== id)
     throw new Error("workflow child async id must be a single path segment");
-  writeMissionAsyncBinding(path.join(DIRS.async, id), binding);
+  writeMissionAsyncBinding(path.join(nestedRootRunId ? nestedRunScope(nestedRootRunId).asyncDirRoot : DIRS.async, id), binding);
   return { ...params, workflowChildAsyncId: id };
 }
 function workflowChildResult(key, result, childParams = {}, resumeState, forcedTerminalOutcome) {
+  const running = missionWorkflowChildStatus(result) === "running";
   const receiptOutput = result.content.map((part) => part.type === "text" ? part.text : "").filter(Boolean).join(`
 `);
-  const output = result.details.results.length === 1 && result.details.results[0]?.finalOutput !== undefined ? result.details.results[0].finalOutput : receiptOutput;
+  const output = running ? "" : result.details.results.length === 1 && result.details.results[0]?.finalOutput !== undefined ? result.details.results[0].finalOutput : receiptOutput;
   const childError = result.details.results.map((child) => child.error).find((error) => Boolean(error));
-  const failureError = childError && receiptOutput && receiptOutput !== childError ? `${childError}
+  const failureErrorBase = childError && receiptOutput ? receiptOutput.includes(childError) ? receiptOutput : `${childError}
 
 ${receiptOutput}` : childError || receiptOutput || output || "Child run failed.";
+  const savedOutputEvidence = [...new Set(result.details.results.map((child) => child.savedOutputPath).filter((value) => Boolean(value)))].filter((savedOutputPath) => !failureErrorBase.includes(savedOutputPath)).map((savedOutputPath) => `Saved output: ${savedOutputPath}`);
+  const failureError = [failureErrorBase, ...savedOutputEvidence].join(`
+`);
   const detached = result.details.results.some((child) => child.detached);
   const interrupted = result.details.results.some((child) => child.interrupted);
   const stopped = result.details.results.some((child) => child.stopped);
   const terminalOutcome = forcedTerminalOutcome ?? (result.details.results.some((child) => child.timedOut) ? { state: "partial", reason: "timeout" } : result.details.usageBudget?.exhausted || result.details.results.some((child) => child.turnBudgetExceeded || child.toolBudgetBlocked) ? { state: "partial", reason: "budget_exhausted" } : undefined);
   const acceptanceRecovery = result.details.results.find((child) => child.acceptance?.recovery)?.acceptance?.recovery;
-  const ok = result.isError !== true && !detached && !interrupted && !stopped && acceptanceRecovery === undefined;
+  const ok = result.isError !== true && !running && !detached && !interrupted && !stopped && acceptanceRecovery === undefined;
   const artifactPaths = new Set;
   if (result.details.asyncDir)
     artifactPaths.add(result.details.asyncDir);
@@ -3432,9 +3835,8 @@ ${receiptOutput}` : childError || receiptOutput || output || "Child run failed."
   }
   const requestedContext = childParams.context === "fresh" || childParams.context === "fork" ? childParams.context : undefined;
   const resolvedContext = result.details.context ?? (resolvedContexts.length === 1 ? resolvedContexts[0] : resolvedContexts.length > 1 ? "mixed" : undefined);
-  const resumeSourceRunId = typeof childParams.resume === "string" && childParams.resume.trim() ? childParams.resume.trim() : undefined;
-  const continuationRunIds = [...new Set([resumeSourceRunId, runId].filter((value) => Boolean(value)))];
   const outputReference = result.details.results.find((child) => child.savedOutputPath)?.savedOutputPath ?? result.details.results.find((child) => child.outputReference?.path)?.outputReference?.path;
+  const outputArtifactPath = running ? undefined : result.details.parallelHandoff?.path ?? result.details.results.find((child) => child.artifactPaths?.outputPath)?.artifactPaths?.outputPath;
   const outputPathMapping = typeof childParams.task === "string" ? outputPathMappingFromTask(childParams.task, outputReference) : undefined;
   const externalResult = result.details.results.length === 1 && result.details.results[0]?.runner?.type === "external-cli" ? result.details.results[0] : undefined;
   const externalStatus = result.details.asyncDir ? readStatus(result.details.asyncDir) : undefined;
@@ -3449,12 +3851,14 @@ ${receiptOutput}` : childError || receiptOutput || output || "Child run failed."
   return {
     key,
     ok,
+    ...running ? { state: "running" } : {},
+    ...result.details.asyncDir ? { asyncDir: result.details.asyncDir } : {},
     ...lane ? { lane } : {},
     ...terminalOutcome ? { terminalOutcome } : {},
     ...resolvedAgents.length === 1 ? { agent: resolvedAgents[0] } : {},
     ...runId ? { runId } : {},
     output,
-    ...!ok ? { error: failureError } : {},
+    ...!ok && !running ? { error: failureError } : {},
     ...detached ? { detached: true } : {},
     ...interrupted ? { interrupted: true } : {},
     ...stopped ? { stopped: true } : {},
@@ -3462,11 +3866,12 @@ ${receiptOutput}` : childError || receiptOutput || output || "Child run failed."
     ...requestedContext ? { requestedContext } : {},
     ...resolvedContext ? { resolvedContext } : {},
     ...outputReference ? { outputReference } : {},
+    ...outputArtifactPath ? { outputArtifactPath } : {},
     ...acceptanceRecovery ? { recovery: acceptanceRecovery } : {},
     ...outputPathMapping ? { outputPathMapping } : {},
     ...externalAdapter ? { externalAdapter } : {},
     resumability,
-    continuation: { runIds: continuationRunIds },
+    continuation: { runIds: runId ? [runId] : [] },
     artifactPaths: [...artifactPaths],
     results: result.details.results
   };
@@ -3482,10 +3887,23 @@ function workflowChildAccountingFields(child) {
     ...child.recovery ? { recovery: child.recovery } : {}
   };
 }
+function workflowRunningChildrenSummary(children) {
+  const running = children.filter((child) => child.state === "running");
+  return running.length ? `${running.length} child ${running.length === 1 ? "run remains" : "runs remain"} running or uncollected: ${running.map((child) => `${child.key}=${child.runId}`).join(", ")}. These launch receipts contain no final child results.` : "";
+}
+function workflowResultChildren(children, status, includeFailureFields) {
+  return children.map((child) => {
+    const sessionName = status.steps?.find((step) => step.workflowKey === child.key)?.sessionName;
+    return { workflowKey: child.key, ...child.agent ? { agent: child.agent } : {}, ...child.runId ? { runId: child.runId } : {}, ...sessionName ? { sessionName } : {}, ...workflowChildAccountingFields(child), output: child.output, outputState: child.output.trim() || child.structuredOutput !== undefined ? "present" : "absent", structuredOutput: child.structuredOutput, ...child.state === "running" ? { state: "running" } : { success: child.ok }, ...child.asyncDir ? { asyncDir: child.asyncDir } : {}, ...child.outputReference ? { outputReference: child.outputReference } : {}, ...includeFailureFields && child.terminalOutcome ? { terminalOutcome: child.terminalOutcome } : {}, ...child.outputPathMapping ? { outputPathMapping: child.outputPathMapping } : {}, ...child.stopped ? { stopped: true } : {}, ...child.interrupted ? { interrupted: true } : {}, ...includeFailureFields && child.detached && status.state !== "complete" ? { detached: true } : {}, ...child.outputArtifactPath || child.outputReference ? { artifactPaths: { outputPath: child.outputArtifactPath ?? child.outputReference } } : {} };
+  });
+}
 function workflowOutputPathMappingSummary(children) {
   const mappings = children.flatMap((child) => child.outputPathMapping ? [`'${child.key}': requested ${child.outputPathMapping.requestedPath} -> saved ${child.outputPathMapping.savedPath}`] : []);
   return mappings.length > 0 ? ` Output path mappings: ${mappings.join("; ")}.` : "";
 }
+function workflowDetailsResults(children) {
+  return children.flatMap((child) => (child.results ?? []).map((result) => result.workflowKey ? result : { ...result, workflowKey: child.key }));
+}
 function workflowSteerReceipt(key, result) {
   const steering = result.details.steering;
   const error = result.content.map((part) => part.type === "text" ? part.text : "").filter(Boolean).join(`
@@ -3502,6 +3920,7 @@ function workflowSteerReceipt(key, result) {
     ...state === "failed" && error ? { error } : {}
   };
 }
+const CHILD_SESSION_NOT_RUNNING_YET = "Child session is not running yet.";
 const MAX_WORKFLOW_RESUME_HINT_BYTES = 1024;
 const MAX_WORKFLOW_CHILD_RUN_ID_BYTES = 256;
 const WORKFLOW_RESUME_HINT_PARENT_STATES = new Set(["complete", "failed", "partial"]);
@@ -3553,7 +3972,29 @@ function missingWorkflowReceiptResumeHint(reference, state) {
     return;
   }
 }
-function resolveKeyedWorkflowResume(reference, state) {
+function resolveWorkflowResume(reference, deps, parentSessionFile, index) {
+  const state = deps.state;
+  if (typeof reference === "string") {
+    const target = resolveRequestedResumeTarget({ id: reference.trim(), ...index !== undefined ? { index } : {} }, deps, parentSessionFile);
+    if (target.kind !== "revive")
+      return reference.trim();
+    const runId = target.runId;
+    const status = target.source === "async" && target.asyncDir ? readStatus(target.asyncDir) : undefined;
+    if (status?.runId === runId && status.parentWorkflowRunId && status.workflowKey) {
+      const receiptPath = workflowReceiptPath(DIRS.async, status.parentWorkflowRunId);
+      try {
+        fs.statSync(receiptPath);
+      } catch (error) {
+        if (error.code === "ENOENT")
+          return { runId, runIds: [runId] };
+        throw error;
+      }
+      const entry = readWorkflowReceipt(DIRS.async, status.parentWorkflowRunId).entries[status.workflowKey];
+      if (entry?.latestRunId === runId)
+        return { runId, runIds: entry.continuation.runIds };
+    }
+    return { runId, runIds: [runId] };
+  }
   try {
     const entry = resolveWorkflowReceiptResumeEntry({
       reference,
@@ -3564,10 +4005,7 @@ function resolveKeyedWorkflowResume(reference, state) {
           throw new Error(`Workflow receipt child '${reference.key}' latest run '${runId}' is still running.`);
       }
     });
-    const runId = entry.latestRunId;
-    if (!runId)
-      throw new Error(`Workflow receipt child '${reference.key}' has no retained run id.`);
-    return { runId, runIds: entry.continuation.runIds };
+    return { runId: entry.latestRunId, runIds: entry.continuation.runIds };
   } catch (error) {
     const workflowRunId = reference.workflowRunId.trim();
     if (isMissingWorkflowReceiptDiagnostic(error, workflowRunId)) {
@@ -3578,8 +4016,8 @@ function resolveKeyedWorkflowResume(reference, state) {
     throw error;
   }
 }
-function terminalWorkflowReceipt(workflowRunId, state, children, workflowChildren, terminalOutcome, hostSteps) {
-  return buildWorkflowReceipt({ workflowRunId, state, children, workflowChildren, terminalOutcome, hostSteps });
+function terminalWorkflowReceipt(workflowRunId, state, children, workflowChildren, terminalOutcome, hostSteps, resource, argsDigest) {
+  return buildWorkflowReceipt({ workflowRunId, state, children, workflowChildren, terminalOutcome, hostSteps, resource, ...argsDigest ? { argsDigest } : {} });
 }
 function workflowFailureTerminalOutcome(error, _children, usageBudget) {
   if (usageBudget?.exhausted)
@@ -3592,24 +4030,23 @@ function workflowFailureMessage(error, workflowRunId, children) {
   if (children.length === 0 && text.includes(validationPrefix)) {
     return `Workflow '${workflowRunId}' validation failed before child launch; no children launched.${text.slice(text.indexOf(validationPrefix) + validationPrefix.length)}`;
   }
-  return text;
+  return [text, workflowRunningChildrenSummary(children)].filter(Boolean).join(" ");
 }
 export async function steerWorkflowChildByKey(input) {
   const asyncDirRoot = input.asyncDirRoot ?? DIRS.async;
   const ackTimeoutMs = input.options.ackTimeoutMs ?? 3000;
   const deadline = Date.now() + ackTimeoutMs;
   while (true) {
-    const control = [...input.state.foregroundControls.values()].find((candidate) => candidate.parentWorkflowRunId === input.workflowRunId && candidate.workflowKey === input.key && Boolean(candidate.workflowSteeringDir) && (candidate.activeChildren?.size ?? 0) > 0);
+    const control = [...input.state.foregroundControls.values()].find((candidate) => candidate.parentWorkflowRunId === input.workflowRunId && candidate.workflowKey === input.key && (candidate.activeChildren?.size ?? 0) > 0);
     if (control) {
       const result = await steerWorkflowForegroundTarget({
         target: { control, workflowRunId: input.workflowRunId, sourceRunId: control.runId },
         message: input.message,
         mode: input.options.mode,
-        index: input.options.index,
-        ackTimeoutMs: Math.max(1, deadline - Date.now()),
-        signal: input.signal
+        index: input.options.index
       });
-      return workflowSteerReceipt(input.key, result);
+      if (!result.details.steering?.targets.some((target) => target.reason === CHILD_SESSION_NOT_RUNNING_YET) || Date.now() >= deadline)
+        return workflowSteerReceipt(input.key, result);
     }
     const workflowStatus = readStatus(path.join(asyncDirRoot, input.workflowRunId));
     const step = workflowStatus?.steps?.find((candidate) => candidate.workflowKey === input.key);
@@ -3649,7 +4086,33 @@ export async function steerWorkflowChildByKey(input) {
     await new Promise((resolve) => setTimeout(resolve, Math.min(10, Math.max(1, deadline - Date.now()))));
   }
 }
+export async function preflightWorkflowWorktrees(input) {
+  const sources = new Map;
+  for (const { key, params } of input.calls) {
+    if (params.resume !== undefined)
+      continue;
+    const effective = prepareWorkflowLaunchParams(input.workflowDefaults, params, "preflight", key);
+    if ((effective.worktree ?? input.defaultWorktree) !== true)
+      continue;
+    const cwd = resolveRequestedCwd(input.ctxCwd, effective.cwd);
+    const keys = sources.get(cwd) ?? [];
+    keys.push(key);
+    sources.set(cwd, keys);
+  }
+  for (const [cwd, keys] of sources) {
+    try {
+      await preflightWorktreeSource(cwd, { signal: input.signal, deadlineAt: input.deadlineAt });
+    } catch (error) {
+      throw new Error(`Worktree admission failed for ${keys.map((key) => `'${key}'`).join(", ")} at ${cwd}: ${error instanceof Error ? error.message : String(error)} Select the correct cwd or arrange an operator-approved commit/stash.`, { cause: error });
+    }
+  }
+  input.signal.throwIfAborted();
+}
 export function prepareWorkflowLaunchParams(workflowDefaults, childParams, parentWorkflowRunId, workflowKey, options = {}) {
+  const { globalConcurrencyLimit: _globalConcurrencyLimit, maxSubagentSpawnsPerRun: _maxSubagentSpawnsPerRun, ...workflowDefaultsWithoutCapacity } = workflowDefaults;
+  const { globalConcurrencyLimit: _childGlobalConcurrencyLimit, maxSubagentSpawnsPerRun: _childMaxSubagentSpawnsPerRun, ...childParamsWithoutCapacity } = childParams;
+  workflowDefaults = workflowDefaultsWithoutCapacity;
+  childParams = childParamsWithoutCapacity;
   const capabilityCeiling = intersectSubagentCapabilityCeilings(workflowDefaults.capabilityCeiling, options.capabilityCeiling);
   const lane = normalizeWorkflowLaneMetadata(Object.hasOwn(childParams, "lane") ? childParams.lane : workflowDefaults.lane, `workflow child '${workflowKey}'.lane`);
   assertWorkflowLaneKey(lane, workflowKey, `workflow child '${workflowKey}'.lane`);
@@ -3665,11 +4128,12 @@ export function prepareWorkflowLaunchParams(workflowDefaults, childParams, paren
     const toolBudget = childParams.toolBudget ?? workflowDefaults.toolBudget;
     const intercomBridge = childParams.intercomBridge ?? workflowDefaults.intercomBridge;
     const worktree = childParams.worktree ?? workflowDefaults.worktree;
+    const baseRef = Object.hasOwn(childParams, "baseRef") ? childParams.baseRef : undefined;
     const outputSchema = Object.hasOwn(childParams, "outputSchema") ? childParams.outputSchema : workflowDefaults.outputSchema;
-    if (outputSchema !== undefined)
+    if (outputSchema !== undefined && outputSchema !== false)
       assertJsonSchemaObject(outputSchema, "outputSchema");
     const agentContract = Object.hasOwn(childParams, "agentContract") ? childParams.agentContract : workflowDefaults.agentContract;
-    if (agentContract !== undefined && !isAgentContractV1(agentContract))
+    if (agentContract !== undefined && !isAgentContract(agentContract))
       throw new Error("agentContract must be { version: 1 }.");
     const acceptance = Object.hasOwn(childParams, "acceptance") ? childParams.acceptance : workflowDefaults.acceptance;
     const output = Object.hasOwn(childParams, "output") ? childParams.output : workflowDefaults.output;
@@ -3678,6 +4142,7 @@ export function prepareWorkflowLaunchParams(workflowDefaults, childParams, paren
     const outputMode = Object.hasOwn(childParams, "outputMode") ? childParams.outputMode : workflowDefaults.outputMode;
     if (outputMode !== undefined && outputMode !== "inline" && outputMode !== "file-only")
       throw new Error("outputMode must be 'inline' or 'file-only'.");
+    const control = mergeWorkflowControlOverrides(workflowDefaults.control, childParams.control);
     return {
       action: "resume",
       id: childParams.resume.trim(),
@@ -3685,8 +4150,10 @@ export function prepareWorkflowLaunchParams(workflowDefaults, childParams, paren
       message: typeof childParams.task === "string" ? childParams.task.trim() : "",
       workflowParentRunId: parentWorkflowRunId,
       workflowKey,
+      ...options.outputClaimPath ? { workflowOutputClaimPath: options.outputClaimPath } : {},
       ...lane ? { lane } : {},
       ...worktree !== undefined ? { worktree } : {},
+      ...baseRef !== undefined ? { baseRef } : {},
       ...outputSchema !== undefined ? { outputSchema } : {},
       ...agentContract !== undefined ? { agentContract } : {},
       ...acceptance !== undefined ? { acceptance } : {},
@@ -3696,15 +4163,19 @@ export function prepareWorkflowLaunchParams(workflowDefaults, childParams, paren
       ...options.missionDetached ? { mission: false } : {},
       ...timeoutMs !== undefined ? { timeoutMs } : {},
       ...toolBudget !== undefined ? { toolBudget } : {},
+      ...control !== undefined ? { control } : {},
       ...intercomBridge !== undefined ? { intercomBridge } : {},
       ...capabilityCeiling ? { capabilityCeiling } : {}
     };
   }
+  const control = mergeWorkflowControlOverrides(workflowDefaults.control, childParams.control);
+  const asyncOmitted = childParams.async === undefined && workflowDefaults.async === undefined;
   const launchParams = {
     ...workflowDefaults,
-    async: options.externalAsyncRequired === true && childParams.async === undefined && workflowDefaults.async === undefined ? true : false,
+    ...options.externalAsyncRequired === true && asyncOmitted ? { async: true } : {},
     ...childParams,
-    ...options.externalAsyncRequired === true && childParams.async === undefined && workflowDefaults.async === undefined ? { workflowAwaitAsync: true } : {},
+    ...control !== undefined ? { control } : {},
+    ...asyncOmitted ? { workflowAwaitAsync: true } : {},
     ...options.missionDetached ? { mission: false } : {},
     workflowParentRunId: parentWorkflowRunId,
     workflowKey,
@@ -3723,6 +4194,18 @@ export function prepareWorkflowLaunchParams(workflowDefaults, childParams, paren
     throw new Error(normalizedGate.error);
   return normalizedGate.params;
 }
+function mergeWorkflowControlOverrides(workflowControl, childControl) {
+  if (childControl === undefined)
+    return workflowControl;
+  if (workflowControl === undefined)
+    return childControl;
+  return { ...workflowControl, ...childControl };
+}
+export function resolveRevivalControlConfig(input) {
+  if (input.requestedControl === undefined)
+    return input.recoveryControlConfig ?? resolveControlConfig(input.globalConfig, undefined);
+  return resolveControlConfig(input.recoveryControlConfig ?? input.globalConfig, input.requestedControl);
+}
 function normalizeGateParams(params) {
   if (params.gate !== undefined && params.action === "resume") {
     return { ok: false, error: "gate is not supported with action='resume'; resume uses the retained child contract." };
@@ -3735,6 +4218,16 @@ function normalizeGateParams(params) {
   const { gate: _gate, ...rest } = params;
   return { ok: true, params: { ...rest, ...normalized.acceptance !== undefined ? { acceptance: normalized.acceptance } : {} } };
 }
+function describeTypedVerifyOutputSchemaConflict(effective, requested) {
+  if (!acceptanceHasTypedVerify(effective.acceptance))
+    return;
+  if (effective.outputSchema === undefined || effective.outputSchema === false)
+    return;
+  const agent = effective.agent ?? "?";
+  const schemaSource = requested.outputSchema !== undefined && requested.outputSchema !== false ? "outputSchema" : `agent '${agent}' outputSchema`;
+  const verifySource = requested.gate !== undefined ? "gate.output" : requested.acceptance !== undefined ? "acceptance.verify" : `agent '${agent}' defaultAcceptance`;
+  return `${verifySource}: ${TYPED_VERIFY_OUTPUT_SCHEMA_CONFLICT.replace("with outputSchema", `with ${schemaSource}`)}`;
+}
 function formatWorkflowValue(value) {
   if (value === undefined)
     return "(undefined)";
@@ -3842,9 +4335,7 @@ function applyWorkflowLaneTrace(graph, trace) {
   else
     delete graph.currentNodeId;
 }
-function workflowChatProgressUpdate(runId, chatProgress, workflow, workflowChildren, preflight) {
-  if (chatProgress.mode !== "live-card")
-    return;
+function workflowProgressUpdate(runId, chatProgress, workflow, workflowChildren, preflight) {
   return {
     content: [{ type: "text", text: "Workflow running." }],
     details: { mode: "workflow", runId, results: [], workflow, ...preflight ? { preflight } : {}, ...workflowChildren ? { workflowChildren } : {}, chatProgress }
@@ -3885,14 +4376,19 @@ export function createSubagentExecutor(deps) {
   const delegatedThinkingOverrides = new WeakMap;
   const delegatedZeroToolBudgets = new WeakSet;
   const delegatedExecutions = new WeakSet;
+  const publicExecutions = new WeakSet;
+  const workflowResourcePermits = new WeakMap;
   const workflowPermitContexts = new WeakMap;
   const warnedArtifactPackageDirs = new Set;
   const scheduledOwnerExecutors = new Map;
   const execute = async (_id, params, signal, onUpdate, ctx, preserveActiveSession = false, parentModelOverride) => {
     const workflowLaunchObserver = workflowLaunchObservers.get(params);
+    const inheritedUsageBudget = workflowOwnedUsageBudgets.get(params);
     const delegatedThinkingOverride = delegatedThinkingOverrides.get(params);
     const allowZeroToolBudget = delegatedZeroToolBudgets.has(params);
     const delegatedExecution = delegatedExecutions.has(params);
+    const publicExecution = publicExecutions.has(params);
+    const workflowResourcePermit = workflowResourcePermits.get(params);
     const workflowPermitContext = workflowPermitContexts.get(params);
     const delegatedWorkflowPermit = workflowPermitContext && "root" in workflowPermitContext ? workflowPermitContext.root : undefined;
     const workflowChildPermitLaunch = workflowPermitContext && "child" in workflowPermitContext ? workflowPermitContext.child : undefined;
@@ -3905,6 +4401,9 @@ export function createSubagentExecutor(deps) {
     if (!normalizedGate.ok)
       return buildRequestedModeError(params, normalizedGate.error);
     let requestParams = normalizedGate.params;
+    const capacityOverrideError = validateWorkflowCapacityOverrides(requestParams);
+    if (capacityOverrideError)
+      return buildRequestedModeError(requestParams, capacityOverrideError);
     let workflowPreflight;
     try {
       if (requestParams.preflight !== undefined && requestParams.workflowScript === undefined && requestParams.workflowScriptPath === undefined) {
@@ -3916,7 +4415,9 @@ export function createSubagentExecutor(deps) {
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       if (requestParams.action?.trim() === "validate") {
-        const validation = validateWorkflowScript(requestParams.workflowScript ?? "");
+        const validation = validateWorkflowScript(requestParams.workflowScript ?? "", {
+          maxSubagentSpawnsPerRun: requestParams.maxSubagentSpawnsPerRun ?? resolveMaxSubagentSpawnsPerRun(deps.config.maxSubagentSpawnsPerRun)
+        });
         const invalidValidation = { ...validation, ok: false, errors: [...validation.errors, { message }] };
         return {
           content: [{ type: "text", text: JSON.stringify(invalidValidation) }],
@@ -3927,20 +4428,44 @@ export function createSubagentExecutor(deps) {
       return buildRequestedModeError(requestParams, message);
     }
     if (requestParams.action?.trim() === "validate") {
-      const validation = validateWorkflowScript(requestParams.workflowScript ?? "");
-      const payload = workflowPreflight ? { ...validation, preflight: workflowPreflight } : validation;
-      return {
-        content: [{ type: "text", text: JSON.stringify(payload) }],
-        ...validation.ok ? {} : { isError: true },
-        details: { mode: "management", results: [] }
-      };
+      const validation = validateWorkflowScript(requestParams.workflowScript ?? "", {
+        maxSubagentSpawnsPerRun: requestParams.maxSubagentSpawnsPerRun ?? resolveMaxSubagentSpawnsPerRun(deps.config.maxSubagentSpawnsPerRun)
+      });
+      return buildWorkflowValidationResult(validation, "management", workflowPreflight);
     }
     const normalizedAction = typeof requestParams.action === "string" ? requestParams.action.trim() : requestParams.action;
     if (normalizedAction === "resume" && requestParams.extensionBindings !== undefined)
       return buildRequestedModeError(requestParams, "extensionBindings is not supported with action='resume'; resume uses the original retained child binding.");
+    let workflowResource;
+    if (workflowResourcePermit) {
+      if (typeof requestParams.workflowScript !== "string")
+        return buildRequestedModeError(requestParams, "Resolved workflow resource is missing its workflow script.");
+      const consumed = consumeWorkflowResourcePermit(workflowResourcePermit, requestParams.workflowScript);
+      if (typeof consumed === "string")
+        return buildRequestedModeError(requestParams, consumed);
+      workflowResource = { permit: workflowResourcePermit, ...consumed };
+    }
     if (requestParams.workflowScript !== undefined && normalizedAction === undefined) {
+      const workflowArgsEvidence = requestParams.args === undefined ? undefined : { args: requestParams.args, argsDigest: stableJsonDigest(requestParams.args) };
+      const workflowArgs = workflowArgsEvidence?.args;
+      const workflowArgsDigest = workflowArgsEvidence?.argsDigest;
+      const workflowValidation = validateWorkflowScript(requestParams.workflowScript, {
+        maxSubagentSpawnsPerRun: requestParams.maxSubagentSpawnsPerRun ?? resolveMaxSubagentSpawnsPerRun(deps.config.maxSubagentSpawnsPerRun)
+      });
+      if (!workflowValidation.ok && publicExecution)
+        return buildWorkflowValidationResult(workflowValidation, "workflow", workflowPreflight);
+      const spawnBudgetErrors = workflowValidation.errors.filter((error) => error.kind === "spawn-budget");
+      if (spawnBudgetErrors.length > 0) {
+        return buildRequestedModeError(requestParams, `Workflow '${_id}' validation failed before child launch; no children launched. ${spawnBudgetErrors.map((error) => error.message).join(" ")}`);
+      }
+      for (const warning of workflowValidation.warnings ?? [])
+        console.warn(`[dm-subagents] ${warning.message}`);
+      const acceptanceErrors = validateAcceptanceInput(requestParams.acceptance);
+      if (acceptanceErrors.length > 0)
+        return buildRequestedModeError(requestParams, acceptanceErrors.join(" "));
+      const foregroundWorkflowRunId = encodeIndexSegment(_id);
       if (delegatedWorkflowPermit) {
-        const permitError = validateWorkflowChildPermitRoot(delegatedWorkflowPermit, _id);
+        const permitError = validateWorkflowChildPermitRoot(delegatedWorkflowPermit, foregroundWorkflowRunId);
         if (permitError)
           return buildRequestedModeError(requestParams, permitError);
         if (requestParams.async !== false)
@@ -3988,9 +4513,9 @@ export function createSubagentExecutor(deps) {
       const scriptFirstLine = requestParams.workflowScript.split(/\r?\n/).map((line) => line.trim()).find(Boolean) || "Workflow";
       const boundedScriptPreview = scriptFirstLine.length > 100 ? `${scriptFirstLine.slice(0, 97)}...` : scriptFirstLine;
       const derivedObjective = previewAgent ? `Workflow: ${previewAgent}` : boundedScriptPreview;
-      const workflowDepth = checkSubagentDepth(deps.config.maxSubagentDepth).depth;
+      const workflowDepth = checkSubagentDepth(deps.config.maxSubagentDepth, deps.childRuntime).depth;
       const asyncWorkflow = requestParams.async !== false;
-      const topLevelAsyncWorkflow = asyncWorkflow && workflowDepth === 0 && !resolveInheritedNestedRouteFromEnv() && !requestParams.workflowParentRunId;
+      const topLevelAsyncWorkflow = asyncWorkflow && workflowDepth === 0 && !inheritedNestedRoute(deps) && !requestParams.workflowParentRunId;
       const workflowRunId = asyncWorkflow ? randomUUID() : undefined;
       let workflowCapacity;
       if (workflowRunId && topLevelAsyncWorkflow) {
@@ -4013,7 +4538,7 @@ export function createSubagentExecutor(deps) {
       }
       let workflowFanoutBudget;
       try {
-        workflowFanoutBudget = requestParams.runFanoutBudget ?? decodeRunFanoutBudgetDescriptor(process.env[RUN_FANOUT_BUDGET_ENV]) ?? createRunFanoutBudget(_id, resolveMaxSubagentSpawnsPerRun(deps.config.maxSubagentSpawnsPerRun));
+        workflowFanoutBudget = requestParams.runFanoutBudget ?? inheritedRunFanoutBudget(deps) ?? createRunFanoutBudget(_id, requestParams.maxSubagentSpawnsPerRun ?? resolveMaxSubagentSpawnsPerRun(deps.config.maxSubagentSpawnsPerRun));
       } catch (error) {
         workflowCapacity?.rollback();
         return { content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }], isError: true, details: { mode: "workflow", results: [] } };
@@ -4087,9 +4612,10 @@ export function createSubagentExecutor(deps) {
           ...workflowSessionRoot ? { sessionRoot: workflowSessionRoot } : {},
           ...requestParams.scheduleOrigin ? { scheduleOrigin: requestParams.scheduleOrigin } : {},
           pid: process.pid,
+          ...workflowCapabilityCeiling ? { admissionCapabilityCeiling: workflowCapabilityCeiling } : {},
           steps: [],
           ...workflowPreflight ? { preflight: workflowPreflight } : {},
-          workflow: { trace: [], emits: [], console: [] },
+          workflow: { trace: [], emits: [], console: [], ...workflowArgsEvidence ?? {}, ...workflowResource ? { resource: workflowResource.provenance } : {} },
           workflowChildren: workflowChildSummary({ parentToolCallId: toolCallId, workflowRunId, workflowState: "running", inventoryComplete: false }),
           runFanoutBudget: getRunFanoutBudgetSnapshot(workflowFanoutBudget)
         };
@@ -4109,22 +4635,63 @@ export function createSubagentExecutor(deps) {
           },
           onError: (error, filePath) => console.error(`Failed to update async workflow index '${filePath}':`, error)
         });
-        const queueActiveRunIndex = () => {
-          const state = status.state;
+        const queueActiveRunIndex = (snapshot = status) => {
+          const state = snapshot.state;
           if (indexedState === state && indexPersistence.pendingCount() === 0)
             return;
-          indexPersistence.write(asyncDir, { state, toolCallId: status.toolCallId }, (_filePath, payload) => {
+          indexPersistence.write(asyncDir, { state, toolCallId: snapshot.toolCallId }, (_filePath, payload) => {
             const indexPayload = payload;
             updateActiveRunIndex(asyncDir, indexPayload.state, indexPayload.toolCallId, { retryCapacityErrors: true });
           });
         };
+        let pendingResultPublication;
+        let settleResultPublication;
+        let resultWriteFailureWakeDelivered = false;
+        const reportResultWriteFailure = (error) => {
+          const message = `Failed to write async workflow result ${resultPath}: ${error instanceof Error ? error.message : String(error)}`;
+          console.error(message, error);
+          try {
+            if (currentSessionId && fallbackResultPayloadPathForSessionRun(path.dirname(resultPath), currentSessionId, workflowRunId))
+              return true;
+          } catch (pendingError) {
+            console.error(`Failed to verify pending async workflow result '${workflowRunId}':`, pendingError);
+          }
+          appendWorkflowEvent({ type: "subagent.workflow.result_write_failed", error: message });
+          if (resultWriteFailureWakeDelivered)
+            return false;
+          if (deps.state.currentSessionId !== currentSessionId || deps.state.completionOwnerId !== completionOwnerId)
+            return false;
+          try {
+            deps.dm.sendMessage({
+              customType: "subagent-workflow-result-write-failed",
+              content: message,
+              display: true
+            }, { triggerTurn: true });
+            resultWriteFailureWakeDelivered = true;
+          } catch (sendError) {
+            console.error(`Failed to send workflow result write failure notification for '${workflowRunId}':`, sendError);
+          }
+          deps.refreshResultDelivery?.();
+          return false;
+        };
+        const pendingWorkflowChildAnnouncements = new Map;
+        let announcePersistedWorkflowChildren = () => {};
         const runPersistence = createCapacityResilientJsonWriter({
           keepAlive: true,
-          onSuccess: (filePath) => {
-            if (filePath === statusPath)
-              queueActiveRunIndex();
+          onSuccess: (filePath, payload) => {
+            if (filePath === statusPath) {
+              announcePersistedWorkflowChildren();
+              queueActiveRunIndex(payload);
+            }
+            if (filePath === resultPath)
+              settleResultPublication?.(true);
+          },
+          onError: (error, filePath) => {
+            if (filePath === resultPath)
+              settleResultPublication?.(reportResultWriteFailure(error));
+            else
+              console.error(`Failed to persist async workflow state '${filePath}':`, error);
           },
-          onError: (error, filePath) => console.error(`Failed to persist async workflow state '${filePath}':`, error),
           write: (filePath, payload) => filePath === resultPath ? writeAsyncResultFile(filePath, payload) : writeAtomicJson(filePath, payload)
         });
         let initialPersistenceComplete = false;
@@ -4145,8 +4712,9 @@ export function createSubagentExecutor(deps) {
             queueActiveRunIndex();
           } else if (options.tolerateStatusWriteFailure) {
             try {
-              runPersistence.write(statusPath, status);
-              statusPersistenceDegraded = false;
+              runPersistence.write(statusPath, { ...status });
+              if (runPersistence.pendingCount() === 0)
+                statusPersistenceDegraded = false;
             } catch (error) {
               const message = `Failed to persist async workflow state ${statusPath}: ${error instanceof Error ? error.message : String(error)}`;
               console.error(message, error);
@@ -4160,7 +4728,7 @@ export function createSubagentExecutor(deps) {
               }
             }
           } else {
-            runPersistence.write(statusPath, status);
+            runPersistence.write(statusPath, { ...status });
           }
           if (liveJob) {
             liveJob.status = status.state;
@@ -4188,13 +4756,19 @@ export function createSubagentExecutor(deps) {
         };
         const writeWorkflowResult = (payload) => {
           try {
+            let resultPublished = false;
+            settleResultPublication = (published) => {
+              resultPublished = published;
+            };
+            pendingResultPublication = undefined;
             runPersistence.write(resultPath, payload);
+            if (!resultPublished)
+              pendingResultPublication = new Promise((resolve) => {
+                settleResultPublication = resolve;
+              });
             return true;
           } catch (error) {
-            const message = `Failed to write async workflow result ${resultPath}: ${error instanceof Error ? error.message : String(error)}`;
-            console.error(message, error);
-            appendWorkflowEvent({ type: "subagent.workflow.result_write_failed", error: message });
-            return false;
+            return reportResultWriteFailure(error);
           }
         };
         const projectWorkflowActivity = () => {
@@ -4227,22 +4801,221 @@ export function createSubagentExecutor(deps) {
           indexPersistence.dispose();
           return { content: [{ type: "text", text: `Failed to create async workflow storage: ${error instanceof Error ? error.message : String(error)}` }], isError: true, details: { mode: "workflow", results: [] } };
         }
-        appendWorkflowEvent({ type: "subagent.workflow.started" });
+        appendWorkflowEvent({ type: "subagent.workflow.started", ...workflowArgsDigest ? { argsDigest: workflowArgsDigest } : {} });
+        try {
+          deps.dm.events.emit(SUBAGENT_ASYNC_STARTED_EVENT, {
+            lifecycleArtifactVersion: SUBAGENT_LIFECYCLE_ARTIFACT_VERSION,
+            id: workflowRunId,
+            asyncDir,
+            cwd: workflowCwd,
+            ...workflowSessionRoot ? { sessionRoot: workflowSessionRoot } : {},
+            pid: process.pid,
+            sessionId: currentSessionId ?? undefined,
+            completionOwnerId,
+            mode: "workflow",
+            agent: "workflow",
+            goal: derivedObjective.trim() ? PROMPT_REDACTED : undefined,
+            ...timeout !== undefined ? { timeoutMs: timeout, deadlineAt: startedAt + timeout } : {}
+          });
+        } catch (error) {
+          console.error("Failed to emit async workflow start event:", error);
+        }
+        const emitWorkflowSteerEvent = (type, requestId, index, extra = {}) => {
+          appendWorkflowEvent({ type, requestId, ...index !== undefined ? { index } : {}, ...extra });
+        };
+        const recordWorkflowSteerTargets = (request, targets) => {
+          status.steering ??= createSteeringStatus();
+          recordSteeringRequest(steeringStatus(status), {
+            id: request.id,
+            requestedAt: request.ts,
+            ...request.source ? { source: request.source } : {},
+            message: request.message,
+            targets
+          });
+        };
+        const explicitWorkflowSteerIndexes = (request) => request.targetIndex !== undefined ? [request.targetIndex] : request.targetIndexes;
+        const failWorkflowSteer = (request, indexes, reason) => {
+          const targets = indexes.map((index) => ({ index, state: "failed", reason }));
+          recordWorkflowSteerTargets(request, targets);
+          emitWorkflowSteerEvent("subagent.steer.requested", request.id, undefined, { targets });
+          for (const index of indexes)
+            emitWorkflowSteerEvent("subagent.steer.failed", request.id, index, { reason });
+          persist({ tolerateStatusWriteFailure: true });
+        };
+        const pendingWorkflowSteers = new Set;
+        const deliverWorkflowSteerRequest = (request) => {
+          let indexes = explicitWorkflowSteerIndexes(request);
+          if (status.state !== "running") {
+            failWorkflowSteer(request, indexes ?? [0], `run became ${status.state} before steering request was consumed`);
+            return;
+          }
+          const liveControls = [...deps.state.foregroundControls.values()].filter((candidate) => candidate.parentWorkflowRunId === workflowRunId && (candidate.activeChildren?.size ?? 0) > 0);
+          if (indexes === undefined) {
+            if (liveControls.length !== 1) {
+              failWorkflowSteer(request, [0], liveControls.length > 1 ? `workflow has ${liveControls.length} live children; steer a child run id instead` : "workflow child is not live in this process");
+              return;
+            }
+            const index = status.steps?.findIndex((step) => !!step.workflowKey && step.workflowKey === liveControls[0].workflowKey) ?? -1;
+            if (index < 0) {
+              failWorkflowSteer(request, [0], "live workflow child has no projected step");
+              return;
+            }
+            indexes = [index];
+          }
+          const resolved = indexes.map((index) => {
+            const step = status.steps?.[index];
+            const control = step?.workflowKey ? liveControls.find((candidate) => candidate.workflowKey === step.workflowKey) : undefined;
+            return { index, control, reason: !step ? "child index out of range" : !control ? "workflow child is not live in this process" : undefined };
+          });
+          const targets = resolved.map(({ index, reason }) => ({ index, state: reason ? "failed" : "routed", ...reason ? { reason } : {} }));
+          recordWorkflowSteerTargets(request, targets);
+          emitWorkflowSteerEvent("subagent.steer.requested", request.id, undefined, { targets });
+          persist({ tolerateStatusWriteFailure: true });
+          for (const { index, control, reason } of resolved) {
+            if (!control) {
+              emitWorkflowSteerEvent("subagent.steer.failed", request.id, index, { reason });
+              continue;
+            }
+            emitWorkflowSteerEvent("subagent.steer.routed", request.id, index);
+            const applyWorkflowSteerDelivery = (state, reason) => {
+              if (!pendingWorkflowSteers.has(applyWorkflowSteerDelivery))
+                return;
+              if (state !== "queued")
+                pendingWorkflowSteers.delete(applyWorkflowSteerDelivery);
+              const now = Date.now();
+              const steering = steeringStatus(status);
+              if (state !== "queued")
+                steering.pending = Math.max(0, steering.pending - 1);
+              if (state === "delivered") {
+                steering.delivered++;
+                steering.lastDeliveredAt = now;
+              } else if (state === "failed")
+                steering.failed++;
+              const receipt = steering.recent.find((candidate) => candidate.id === request.id)?.targets.find((target) => target.index === index);
+              if (receipt) {
+                receipt.state = state;
+                if (state === "delivered")
+                  receipt.deliveredAt = now;
+                if (state === "failed")
+                  receipt.failedAt = now;
+                if (reason)
+                  receipt.reason = reason;
+              }
+              if (state === "failed") {
+                const failedStep = status.steps?.[index];
+                if (failedStep)
+                  failedStep.activityState = "needs_attention";
+                status.activityState = "needs_attention";
+              }
+              emitWorkflowSteerEvent(`subagent.steer.${state}`, request.id, index, state === "failed" ? { reason } : { deliveryStatus: state, message: request.message });
+              persist({ tolerateStatusWriteFailure: true });
+            };
+            pendingWorkflowSteers.add(applyWorkflowSteerDelivery);
+            steerWorkflowForegroundTarget({
+              target: { control, workflowRunId, sourceRunId: workflowRunId },
+              message: request.message,
+              ...request.mode ? { mode: request.mode } : {}
+            }).then((result) => {
+              const target = result.details.steering?.targets[0];
+              applyWorkflowSteerDelivery(target?.state === "delivered" ? "delivered" : target?.state === "queued" ? "queued" : "failed", target?.reason ?? (target ? undefined : "steering produced no target receipt"));
+            }, (error) => applyWorkflowSteerDelivery("failed", error instanceof Error ? error.message : String(error)));
+          }
+        };
+        let disposeWorkflowSteerInbox;
+        try {
+          disposeWorkflowSteerInbox = watchAsyncControlInbox(asyncDir, {
+            onSteer: deliverWorkflowSteerRequest,
+            onError: (error, phase, request) => {
+              const reason = error instanceof Error ? error.message : String(error);
+              appendWorkflowEvent({ type: "subagent.workflow.steer_inbox_unavailable", phase, error: reason });
+              if (request)
+                failWorkflowSteer(request, explicitWorkflowSteerIndexes(request) ?? [0], `steer consumer failed: ${reason}`);
+            }
+          });
+        } catch (error) {
+          appendWorkflowEvent({ type: "subagent.workflow.steer_inbox_unavailable", error: error instanceof Error ? error.message : String(error) });
+        }
+        deps.activateSupervisorTransport?.();
         const { workflowScript, async: _workflowAsync, chatProgress: _chatProgress, ...workflowRequest } = requestParams;
+        let workflowSteerInboxClosed = false;
+        const settleWorkflowSteerInbox = (outcome = status.state) => {
+          if (workflowSteerInboxClosed)
+            return;
+          workflowSteerInboxClosed = true;
+          disposeWorkflowSteerInbox?.();
+          for (const settle of pendingWorkflowSteers)
+            settle("failed", `run became ${outcome} before steering delivery settled; delivery unconfirmed`);
+          try {
+            closeSteerInbox(asyncDir, outcome);
+            const undelivered = consumeSteerRequests(asyncDir, undefined, (error) => {
+              appendWorkflowEvent({ type: "subagent.workflow.steer_inbox_unavailable", phase: "drain", error: error instanceof Error ? error.message : String(error) });
+            });
+            for (const request of undelivered)
+              failWorkflowSteer(request, explicitWorkflowSteerIndexes(request) ?? [0], `run became ${outcome} before steering request was consumed`);
+          } catch (error) {
+            appendWorkflowEvent({ type: "subagent.workflow.steer_inbox_unavailable", phase: "close", error: error instanceof Error ? error.message : String(error) });
+          }
+          persist();
+        };
         Promise.resolve().then(async () => {
           const workflowDeadlineAt = timeout === undefined ? undefined : Date.now() + timeout;
           const workflowResults = [];
           const workflowChildRunIds = new Map;
-          const { action: _action, agent: _agent, task: _task, resume: _resume, tasks: _tasks, chain: _chain, concurrency: _concurrency, foregroundOnly: _foregroundOnly, clarify: _clarify, timeoutMs: _timeoutMs, maxRuntimeMs: _maxRuntimeMs, usageBudget: _usageBudget, missionId: _missionId, mission: _mission, preflight: _preflight, ...workflowChildDefaults } = workflowRequest;
+          const { args: _args, action: _action, agent: _agent, task: _task, resume: _resume, tasks: _tasks, chain: _chain, concurrency: _concurrency, foregroundOnly: _foregroundOnly, clarify: _clarify, timeoutMs: _timeoutMs, maxRuntimeMs: _maxRuntimeMs, usageBudget: _usageBudget, missionId: _missionId, mission: _mission, preflight: _preflight, globalConcurrencyLimit: _globalConcurrencyLimit, maxSubagentSpawnsPerRun: _maxSubagentSpawnsPerRun, ...workflowChildDefaults } = workflowRequest;
           const workflowOutput = typeof workflowChildDefaults.output === "string" || typeof workflowChildDefaults.output === "boolean" ? workflowChildDefaults.output : undefined;
           const configuredOutputBaseDir = resolveConfiguredSingleRunOutputBaseDir(deps);
-          const workflowAggregateOutputPath = resolveWorkflowAggregateOutputPath(workflowOutput, parentCwd, workflowCwd, resolveSingleRunOutputBaseDir(deps, workflowArtifactsDir, workflowRunId));
+          const workflowAggregateOutputPath = resolveSingleOutputPath(workflowOutput, parentCwd, workflowCwd, resolveSingleRunOutputBaseDir(deps, workflowArtifactsDir, workflowRunId));
           const claimedOutputPaths = new Map;
           const childOutputOverrides = new Map;
           const childOutputClaimPaths = new Map;
           const producedChildOutputPaths = new Set;
           const workflowSteps = new Map;
-          const runHostCommand = workflowHostCommandRunner({ workflowCwd, artifactsDir: workflowArtifactsDir, workflowRunId, claimedOutputPaths, producedOutputPaths: producedChildOutputPaths });
+          const announcedWorkflowChildren = new Set;
+          const announceWorkflowChild = (key, step) => {
+            if (announcedWorkflowChildren.has(key))
+              return;
+            announcedWorkflowChildren.add(key);
+            const stepIndex = status.steps?.indexOf(step);
+            const childEvent = {
+              type: "subagent.child-status",
+              version: 1,
+              runId: workflowRunId,
+              childId: key,
+              status: "started",
+              ts: Date.now(),
+              source: "async",
+              asyncDir,
+              ...stepIndex !== undefined ? { stepIndex } : {},
+              agent: step.agent,
+              ...step.runId ? { childRunId: step.runId } : {},
+              workflowKey: key,
+              ...step.phase ? { phase: step.phase } : {},
+              ...step.label ? { label: step.label } : {}
+            };
+            appendWorkflowEvent({ ...childEvent });
+            try {
+              deps.dm.events.emit(SUBAGENT_CHILD_STATUS_EVENT, childEvent);
+            } catch (error) {
+              console.error("Failed to emit workflow child status event:", error);
+            }
+          };
+          announcePersistedWorkflowChildren = () => {
+            for (const [key, step] of pendingWorkflowChildAnnouncements) {
+              if (!step.runId)
+                continue;
+              announceWorkflowChild(key, step);
+              pendingWorkflowChildAnnouncements.delete(key);
+            }
+          };
+          const runHostCommand = workflowHostCommandRunner({
+            workflowCwd,
+            artifactsDir: workflowArtifactsDir,
+            workflowRunId,
+            claimedOutputPaths,
+            producedOutputPaths: producedChildOutputPaths,
+            ...workflowResource ? { authorize: (key, params) => authorizeWorkflowResourceHost(workflowResource.permit, key, params.command) } : {}
+          });
+          const workflowHost = workflowResource ? workflowResource.authority.host ? runHostCommand : undefined : publicExecution ? undefined : runHostCommand;
           let projectedTraceLength = 0;
           let projectedTraceTail;
           const updateTrace = (trace) => {
@@ -4352,9 +5125,19 @@ export function createSubagentExecutor(deps) {
           try {
             const workflow = await runWorkflowScript({
               script: workflowScript,
-              globalConcurrencyLimit: deps.config.globalConcurrencyLimit,
+              ...workflowArgs ? { args: workflowArgs } : {},
+              workflowRunId,
+              processCwd: ctx.cwd,
+              globalConcurrencyLimit: requestParams.globalConcurrencyLimit ?? deps.config.globalConcurrencyLimit,
               timeoutMs: timeout,
               signal: controller.signal,
+              continueAfterAbortWhenChildrenSettled: (abortError) => {
+                if (abortError.message !== "Workflow stopped because the extension session was replaced or reloaded.")
+                  return false;
+                const activeAsyncChild = [...deps.state.asyncJobs?.values() ?? []].some((job) => job.parentWorkflowRunId === workflowRunId && (job.status === "queued" || job.status === "running"));
+                const activeForegroundChild = [...deps.state.foregroundControls.values()].some((control) => control.parentWorkflowRunId === workflowRunId && (control.activeChildren?.size ?? 0) > 0);
+                return !activeAsyncChild && !activeForegroundChild;
+              },
               registerStopChild: (stop) => {
                 if (stop)
                   deps.state.workflowChildStops?.set(workflowRunId, stop);
@@ -4363,19 +5146,39 @@ export function createSubagentExecutor(deps) {
               },
               ...workflowState ? { state: workflowState } : {},
               onTrace: updateTrace,
+              onChildSettled: (notification) => {
+                appendWorkflowEvent({
+                  type: "subagent.workflow.child_settled",
+                  childKey: notification.childKey,
+                  ...notification.childRunId ? { childRunId: notification.childRunId } : {},
+                  outcome: notification.outcome,
+                  workflowRunning: notification.workflowRunning
+                });
+                try {
+                  deps.dm.sendMessage({
+                    customType: "subagent-incremental-child-notify",
+                    content: formatIncrementalChildCompletion(notification),
+                    display: notification.outcome !== "completed"
+                  }, { triggerTurn: incrementalChildCompletionTriggersTurn(notification, requestParams.scheduleOrigin) });
+                } catch (sendError) {
+                  console.error(`Failed to send incremental child completion notification for '${notification.childKey}':`, sendError);
+                }
+                deps.refreshResultDelivery?.();
+              },
               onLanePlan: (lanes) => {
                 status.workflowGraph = buildWorkflowLaneGraph(workflowRunId, lanes, status.workflowGraph);
                 applyWorkflowLaneTrace(status.workflowGraph, status.workflow?.trace ?? []);
                 persist({ tolerateStatusWriteFailure: true });
               },
-              host: runHostCommand,
+              ...workflowHost ? { host: workflowHost } : {},
               onHostStep: (hostStep) => {
                 status = upsertHostStep({ status, hostStep, persist: (nextStatus) => {
                   status = nextStatus;
                   persist({ tolerateStatusWriteFailure: true });
                 } });
               },
-              admit: (calls) => {
+              admit: async (calls, admissionSignal) => {
+                await preflightWorkflowWorktrees({ workflowDefaults: workflowChildDefaults, defaultWorktree: deps.config.worktree, calls, ctxCwd: parentCwd, signal: admissionSignal, deadlineAt: workflowDeadlineAt });
                 const outputClaims = workflowChildOutputClaims({ ctxCwd: parentCwd, workflowCwd, artifactsDir: workflowArtifactsDir, workflowRunId, aggregateOutputPath: workflowAggregateOutputPath, configuredOutputBaseDir, discoverAgents: discoverWorkflowAgents, agents: workflowAgents, workflowAgentScope: workflowChildDefaults.agentScope, state: deps.state, claimedOutputPaths, entries: calls });
                 if (outputClaims.error)
                   throw new Error(outputClaims.error);
@@ -4412,8 +5215,10 @@ export function createSubagentExecutor(deps) {
                 });
                 let preparedChildParams;
                 const result = await runMissionWorkflowChild(missionBinding, workflowRunId, key, childPhase, () => {
-                  const childRequest = bindMissionWorkflowChildAsyncLaunch({ ...prepareWorkflowChildLaunchParams({ workflowDefaults: workflowChildDefaults, childParams, parentWorkflowRunId: workflowRunId, workflowKey: key, ctxCwd: parentCwd, workflowCwd, artifactsDir: workflowArtifactsDir, aggregateOutputPath: workflowAggregateOutputPath, configuredOutputBaseDir, discoverAgents: discoverWorkflowAgents, agents: workflowAgents, workflowAgentScope: workflowChildDefaults.agentScope, outputOverride: childOutputOverrides.get(key), outputClaimPath: childOutputClaimPaths.get(key), options: { missionDetached: detachWorkflowChildMissions, awaitDetachedChild: true, runFanoutBudget: workflowFanoutBudget, parentDeadlineAt: workflowDeadlineAt, capabilityCeiling: workflowCapabilityCeiling } }), runFanoutAdmitted: admission.admitted }, missionBinding, deps.asyncByDefault);
+                  const childRequest = bindMissionWorkflowChildAsyncLaunch({ ...prepareWorkflowChildLaunchParams({ workflowDefaults: workflowChildDefaults, childParams, parentWorkflowRunId: workflowRunId, workflowKey: key, ctxCwd: parentCwd, workflowCwd, artifactsDir: workflowArtifactsDir, aggregateOutputPath: workflowAggregateOutputPath, configuredOutputBaseDir, discoverAgents: discoverWorkflowAgents, agents: workflowAgents, workflowAgentScope: workflowChildDefaults.agentScope, outputOverride: childOutputOverrides.get(key), outputClaimPath: childOutputClaimPaths.get(key), options: { missionDetached: detachWorkflowChildMissions, awaitDetachedChild: true, runFanoutBudget: workflowFanoutBudget, parentDeadlineAt: workflowDeadlineAt, capabilityCeiling: workflowCapabilityCeiling } }), runFanoutAdmitted: admission.admitted }, missionBinding, deps.asyncByDefault, undefined, inheritedNestedRoute(deps)?.rootRunId);
                   preparedChildParams = childRequest;
+                  if (workflowUsageBudget.budget)
+                    workflowOwnedUsageBudgets.set(childRequest, workflowUsageBudget.budget);
                   workflowLaunchObservers.set(childRequest, (launch) => {
                     const step = status.steps?.find((candidate) => candidate.workflowKey === key);
                     if (step) {
@@ -4426,6 +5231,8 @@ export function createSubagentExecutor(deps) {
                         step.runId = launch.runId;
                       if (childRequest.lane)
                         step.lane = childRequest.lane;
+                      if (step.runId)
+                        pendingWorkflowChildAnnouncements.set(key, step);
                       persist({ tolerateStatusWriteFailure: true });
                     }
                     recordMissionWorkflowChild(missionBinding, workflowRunId, key, { status: "running", agent: launch.agent, ...launch.sessionFile ? { sessionPath: launch.sessionFile } : {} });
@@ -4469,7 +5276,7 @@ export function createSubagentExecutor(deps) {
                   workflowChildRunIds.set(key, child.runId);
                 const step = status.steps?.find((candidate) => candidate.workflowKey === key);
                 if (step) {
-                  step.async = Boolean(result.details.asyncId || result.details.asyncDir);
+                  step.async = step.async === true || Boolean(result.details.asyncId || result.details.asyncDir);
                   if (child.runId)
                     step.runId = child.runId;
                   if (child.lane)
@@ -4497,37 +5304,43 @@ export function createSubagentExecutor(deps) {
                 return child;
               },
               status: async (keyOrRunId, workflowSignal) => workflowChildResult(keyOrRunId, await execute(randomUUID(), { action: "status", id: keyOrRunId }, workflowSignal, undefined, ctx, preserveActiveSession, workflowParentModel)),
-              resolveResume: (reference) => resolveKeyedWorkflowResume(reference, deps.state),
+              resolveResume: (reference, _signal, index) => resolveWorkflowResume(reference, deps, ctx.sessionManager.getSessionFile() ?? null, index),
               steer: (key, message, options, workflowSignal) => steerWorkflowChildByKey({ state: deps.state, workflowRunId, key, message, options, signal: workflowSignal, resolveRunId: () => workflowChildRunIds.get(key) })
             });
             const finalPreflightWarnings = workflowPreflightWarnings(workflowPreflight, workflow.trace, { settled: true });
             const finalPreflightTrace = annotateWorkflowPreflightTrace(workflow.trace, workflowPreflight);
             const returnPreview = formatWorkflowValue(workflow.value).slice(0, 1000);
             const emitPreview = workflow.emits.length > 0 ? ` Emitted: ${workflow.emits.map(formatWorkflowValue).join(", ").slice(0, 1000)}` : "";
-            const summary = `Workflow completed with ${workflow.children.length} child run(s). Return: ${returnPreview}${emitPreview} Trace: ${workflow.trace.length} event(s).${workflowOutputPathMappingSummary(workflow.children)}${finalPreflightWarnings.length ? ` ${finalPreflightWarnings.join(" ")}` : ""}`;
+            const runningSummary = workflowRunningChildrenSummary(workflow.children);
+            const summary = `${runningSummary ? `Workflow dispatch completed; ${runningSummary}` : `Workflow completed with ${workflow.children.length} child run(s).`} Return: ${returnPreview}${emitPreview} Trace: ${workflow.trace.length} event(s).${workflowOutputPathMappingSummary(workflow.children)}${finalPreflightWarnings.length ? ` ${finalPreflightWarnings.join(" ")}` : ""}`;
             const outputWarning = writeWorkflowAggregateOutput(workflowAggregateOutputPath, summary, producedChildOutputPaths);
             const resultSummary = appendWorkflowOutputWarning(summary, outputWarning);
             const workflowUsage = sumResultsUsage(workflowResults);
+            settleWorkflowSteerInbox("complete");
             const workflowChildren = workflowChildSummary({ parentToolCallId: toolCallId, workflowRunId, workflowState: "completed", inventoryComplete: true, trace: workflow.trace, children: workflow.children, steps: status.steps });
-            status = { ...status, state: "complete", endedAt: Date.now(), workflow: { value: workflow.value, trace: finalPreflightTrace, emits: workflow.emits, console: workflow.console, ...finalPreflightWarnings.length ? { preflightWarnings: finalPreflightWarnings } : {} }, workflowChildren, totalTokens: { input: workflowUsage.input, output: workflowUsage.output, total: workflowUsage.input + workflowUsage.output }, totalCost: sumResultsCost(workflowResults) };
-            const receipt = terminalWorkflowReceipt(workflowRunId, "complete", workflow.children, workflowChildren, undefined, validHostStepNodes(status.workflowGraph));
+            status = { ...status, state: "complete", endedAt: Date.now(), workflow: { value: workflow.value, trace: finalPreflightTrace, emits: workflow.emits, console: workflow.console, ...workflowArgsEvidence ?? {}, ...workflowResource ? { resource: workflowResource.provenance } : {}, ...finalPreflightWarnings.length ? { preflightWarnings: finalPreflightWarnings } : {} }, workflowChildren, totalTokens: { input: workflowUsage.input, output: workflowUsage.output, total: workflowUsage.input + workflowUsage.output }, totalCost: sumResultsCost(workflowResults) };
+            const receipt = terminalWorkflowReceipt(workflowRunId, "complete", workflow.children, workflowChildren, undefined, validHostStepNodes(status.workflowGraph), workflowResource?.provenance, workflowArgsDigest);
+            delete status.workflowReceiptPath;
             let workflowReceipt;
             try {
               workflowReceipt = { path: writeWorkflowReceipt(asyncDir, receipt), receipt };
+              status.workflowReceiptPath = workflowReceipt.path;
             } catch (receiptError) {
               appendWorkflowEvent({ type: "subagent.workflow.receipt_write_failed", error: `Failed to persist async workflow receipt: ${receiptError instanceof Error ? receiptError.message : String(receiptError)}` });
             }
-            if (!writeWorkflowResult({ id: workflowRunId, runId: workflowRunId, toolCallId, agent: "workflow", mode: "workflow", success: true, state: "complete", summary: resultSummary, output: resultSummary, workflowChildren, results: workflow.children.map((child) => ({ workflowKey: child.key, ...child.agent ? { agent: child.agent } : {}, ...child.runId ? { runId: child.runId } : {}, ...status.steps?.find((step) => step.workflowKey === child.key)?.sessionName ? { sessionName: status.steps?.find((step) => step.workflowKey === child.key)?.sessionName } : {}, ...workflowChildAccountingFields(child), output: child.output, outputState: child.output.trim() || child.structuredOutput !== undefined ? "present" : "absent", structuredOutput: child.structuredOutput, success: child.ok, ...child.outputReference ? { outputReference: child.outputReference } : {}, ...child.outputPathMapping ? { outputPathMapping: child.outputPathMapping } : {}, ...child.stopped ? { stopped: true } : {}, ...child.interrupted ? { interrupted: true } : {}, ...child.artifactPaths[0] ? { artifactPaths: { outputPath: child.artifactPaths[0] } } : {} })), workflow: status.workflow, ...workflowReceipt ? { workflowReceipt } : {}, asyncDir, cwd: workflowCwd, sessionId: currentSessionId, completionOwnerId, ...requestParams.scheduleOrigin ? { scheduleOrigin: requestParams.scheduleOrigin } : {}, timestamp: Date.now(), durationMs: Date.now() - startedAt }))
+            if (!writeWorkflowResult({ id: workflowRunId, runId: workflowRunId, toolCallId, agent: "workflow", mode: "workflow", success: true, state: "complete", summary: resultSummary, output: resultSummary, workflowChildren, results: workflowResultChildren(workflow.children, status, false), workflow: status.workflow, ...workflowCapabilityCeiling ? { admissionCapabilityCeiling: workflowCapabilityCeiling } : {}, ...workflowReceipt ? { workflowReceipt } : {}, asyncDir, cwd: workflowCwd, sessionId: currentSessionId, completionOwnerId, ...requestParams.scheduleOrigin ? { scheduleOrigin: requestParams.scheduleOrigin } : {}, timestamp: Date.now(), durationMs: Date.now() - startedAt }))
+              return;
+            if (pendingResultPublication && !await pendingResultPublication)
               return;
             persist();
             deps.refreshResultDelivery?.();
             persistClosed = true;
-            appendWorkflowEvent({ type: "subagent.workflow.completed", state: status.state, ...status.error ? { error: status.error } : {} });
+            appendWorkflowEvent({ type: "subagent.workflow.completed", state: status.state, ...workflowArgsDigest ? { argsDigest: workflowArgsDigest } : {}, ...status.error ? { error: status.error } : {} });
           } catch (error) {
             const partial = error instanceof WorkflowScriptError ? error.partial : { trace: [], emits: [], console: [], children: [] };
             const stopped = controller.signal.aborted;
             const detachedChildKeys = new Set(partial.children.filter((child) => child.detached).map((child) => child.key));
-            const hasRealFailedChild = partial.children.some((child) => !child.ok && !child.detached);
+            const hasRealFailedChild = partial.children.some((child) => !child.ok && child.state !== "running" && !child.detached);
             const pauseForDetached = !stopped && error instanceof WorkflowScriptError && error.errorKind === "detached-child" && detachedChildKeys.size > 0 && !hasRealFailedChild;
             const state = stopped ? "stopped" : pauseForDetached ? "paused" : "failed";
             for (const step of status.steps ?? []) {
@@ -4543,10 +5356,11 @@ export function createSubagentExecutor(deps) {
               }
             }
             const workflowState = state === "paused" ? "paused" : state === "stopped" ? "stopped" : "failed";
+            settleWorkflowSteerInbox(state);
             const workflowChildren = workflowChildSummary({ parentToolCallId: toolCallId, workflowRunId, workflowState, inventoryComplete: true, trace: partial.trace, children: partial.children, steps: status.steps });
             const finalPreflightWarnings = workflowPreflightWarnings(workflowPreflight, partial.trace, { settled: true });
             const finalPreflightTrace = annotateWorkflowPreflightTrace(partial.trace, workflowPreflight);
-            status = compactOptional({ ...status, state, stopped: stopped || undefined, activityState: pauseForDetached ? "needs_attention" : undefined, error: workflowFailureMessage(error, workflowRunId, partial.children), endedAt: Date.now(), workflow: { trace: finalPreflightTrace, emits: partial.emits, console: partial.console, ...finalPreflightWarnings.length ? { preflightWarnings: finalPreflightWarnings } : {} }, workflowChildren });
+            status = compactOptional({ ...status, state, stopped: stopped || undefined, activityState: pauseForDetached || status.activityState === "needs_attention" ? "needs_attention" : undefined, error: workflowFailureMessage(error, workflowRunId, partial.children), endedAt: Date.now(), workflow: { trace: finalPreflightTrace, emits: partial.emits, console: partial.console, ...workflowArgsEvidence ?? {}, ...workflowResource ? { resource: workflowResource.provenance } : {}, ...finalPreflightWarnings.length ? { preflightWarnings: finalPreflightWarnings } : {} }, workflowChildren });
             if (pauseForDetached) {
               const promoted = promotePausedWorkflowIfSettled(status);
               if (promoted)
@@ -4557,20 +5371,29 @@ export function createSubagentExecutor(deps) {
             const resultSummary = appendWorkflowOutputWarning(terminalSummary, outputWarning);
             const receiptState = status.state === "complete" ? "complete" : status.state === "paused" ? "paused" : status.state === "stopped" ? "stopped" : "failed";
             const terminalOutcome = workflowFailureTerminalOutcome(error, partial.children, usageBudgetState(workflowUsageBudget.budget, sumResultsCost(workflowResults)));
-            const receipt = terminalWorkflowReceipt(workflowRunId, receiptState, partial.children, workflowChildren, terminalOutcome, validHostStepNodes(status.workflowGraph));
+            const receipt = terminalWorkflowReceipt(workflowRunId, receiptState, partial.children, workflowChildren, terminalOutcome, validHostStepNodes(status.workflowGraph), workflowResource?.provenance, workflowArgsDigest);
+            delete status.workflowReceiptPath;
             let workflowReceipt;
             try {
               workflowReceipt = { path: writeWorkflowReceipt(asyncDir, receipt), receipt };
+              status.workflowReceiptPath = workflowReceipt.path;
             } catch (receiptError) {
               appendWorkflowEvent({ type: "subagent.workflow.receipt_write_failed", error: `Failed to persist async workflow receipt: ${receiptError instanceof Error ? receiptError.message : String(receiptError)}` });
             }
-            if (!writeWorkflowResult({ id: workflowRunId, runId: workflowRunId, toolCallId, agent: "workflow", mode: "workflow", success: status.state === "complete", state: status.state, summary: resultSummary, error: status.state === "complete" ? undefined : status.error, stopped: status.stopped, activityState: status.activityState, workflowChildren, ...terminalOutcome ? { terminalOutcome } : {}, results: partial.children.map((child) => ({ workflowKey: child.key, ...child.agent ? { agent: child.agent } : {}, ...child.runId ? { runId: child.runId } : {}, ...status.steps?.find((step) => step.workflowKey === child.key)?.sessionName ? { sessionName: status.steps?.find((step) => step.workflowKey === child.key)?.sessionName } : {}, ...workflowChildAccountingFields(child), output: child.output, outputState: child.output.trim() || child.structuredOutput !== undefined ? "present" : "absent", structuredOutput: child.structuredOutput, success: child.ok, ...child.outputReference ? { outputReference: child.outputReference } : {}, ...child.terminalOutcome ? { terminalOutcome: child.terminalOutcome } : {}, ...child.outputPathMapping ? { outputPathMapping: child.outputPathMapping } : {}, ...child.stopped ? { stopped: true } : {}, ...child.interrupted ? { interrupted: true } : {}, ...child.detached && status.state !== "complete" ? { detached: true } : {}, ...child.artifactPaths[0] ? { artifactPaths: { outputPath: child.artifactPaths[0] } } : {} })), workflow: status.workflow, ...workflowReceipt ? { workflowReceipt } : {}, asyncDir, cwd: workflowCwd, sessionId: currentSessionId, completionOwnerId, ...requestParams.scheduleOrigin ? { scheduleOrigin: requestParams.scheduleOrigin } : {}, timestamp: Date.now(), durationMs: Date.now() - startedAt }))
+            if (!writeWorkflowResult({ id: workflowRunId, runId: workflowRunId, toolCallId, agent: "workflow", mode: "workflow", success: status.state === "complete", state: status.state, summary: resultSummary, error: status.state === "complete" ? undefined : status.error, stopped: status.stopped, activityState: status.activityState, workflowChildren, ...terminalOutcome ? { terminalOutcome } : {}, results: workflowResultChildren(partial.children, status, true), workflow: status.workflow, ...workflowCapabilityCeiling ? { admissionCapabilityCeiling: workflowCapabilityCeiling } : {}, ...workflowReceipt ? { workflowReceipt } : {}, asyncDir, cwd: workflowCwd, sessionId: currentSessionId, completionOwnerId, ...requestParams.scheduleOrigin ? { scheduleOrigin: requestParams.scheduleOrigin } : {}, timestamp: Date.now(), durationMs: Date.now() - startedAt }))
+              return;
+            if (pendingResultPublication && !await pendingResultPublication)
               return;
             persist();
             deps.refreshResultDelivery?.();
             persistClosed = true;
-            appendWorkflowEvent({ type: "subagent.workflow.completed", state: status.state, ...terminalOutcome ? { terminalOutcome } : {}, ...status.error ? { error: status.error } : {}, ...status.activityState ? { activityState: status.activityState } : {} });
+            appendWorkflowEvent({ type: "subagent.workflow.completed", state: status.state, ...workflowArgsDigest ? { argsDigest: workflowArgsDigest } : {}, ...terminalOutcome ? { terminalOutcome } : {}, ...status.error ? { error: status.error } : {}, ...status.activityState ? { activityState: status.activityState } : {} });
           } finally {
+            try {
+              settleWorkflowSteerInbox();
+            } catch (error) {
+              console.error(`Failed to close async workflow steer inbox '${asyncDir}':`, error);
+            }
             persistClosed = true;
             deps.state.workflowControllers?.delete(workflowRunId);
             deps.state.workflowChildStops?.delete(workflowRunId);
@@ -4581,39 +5404,58 @@ export function createSubagentExecutor(deps) {
           content: [{ type: "text", text: `${workflowPreflight ? `${formatWorkflowPreflight(workflowPreflight)}
 
 ` : ""}${formatAsyncStartedMessage(`Async workflow [${workflowRunId}]`, ctx.hasUI === true)}` }],
-          details: { mode: "workflow", runId: workflowRunId, toolCallId, asyncId: workflowRunId, asyncDir, results: [], ...workflowPreflight ? { preflight: workflowPreflight } : {}, workflowChildren: status.workflowChildren, chatProgress, ...deps.state.activeAsyncCapacity ? { activeAsyncCapacity: deps.state.activeAsyncCapacity } : {} }
+          details: { mode: "workflow", runId: workflowRunId, toolCallId, asyncId: workflowRunId, asyncDir, results: [], ...workflowPreflight ? { preflight: workflowPreflight } : {}, workflow: status.workflow, workflowChildren: status.workflowChildren, chatProgress, ...deps.state.activeAsyncCapacity ? { activeAsyncCapacity: deps.state.activeAsyncCapacity } : {} }
         }, workflowFanoutBudget));
       }
-      const { workflowScript: _workflowScript, action: _action, agent: _agent, task: _task, resume: _resume, tasks: _tasks, chain: _chain, concurrency: _concurrency, async: _async, foregroundOnly: _foregroundOnly, clarify: _clarify, timeoutMs: _timeoutMs, maxRuntimeMs: _maxRuntimeMs, usageBudget: _usageBudget, chatProgress: _chatProgress, missionId: _missionId, mission: _mission, preflight: _preflight, ...workflowChildDefaults } = requestParams;
+      const { workflowScript: _workflowScript, args: _args, action: _action, agent: _agent, task: _task, resume: _resume, tasks: _tasks, chain: _chain, concurrency: _concurrency, async: _async, foregroundOnly: _foregroundOnly, clarify: _clarify, timeoutMs: _timeoutMs, maxRuntimeMs: _maxRuntimeMs, usageBudget: _usageBudget, chatProgress: _chatProgress, missionId: _missionId, mission: _mission, preflight: _preflight, globalConcurrencyLimit: _globalConcurrencyLimit, maxSubagentSpawnsPerRun: _maxSubagentSpawnsPerRun, ...workflowChildDefaults } = requestParams;
       const workflowOutput = typeof workflowChildDefaults.output === "string" || typeof workflowChildDefaults.output === "boolean" ? workflowChildDefaults.output : undefined;
       const configuredOutputBaseDir = resolveConfiguredSingleRunOutputBaseDir(deps);
-      const workflowAggregateOutputPath = resolveWorkflowAggregateOutputPath(workflowOutput, ctx.cwd, workflowCwd, resolveSingleRunOutputBaseDir(deps, workflowArtifactsDir, _id));
+      const workflowAggregateOutputPath = resolveSingleOutputPath(workflowOutput, ctx.cwd, workflowCwd, resolveSingleRunOutputBaseDir(deps, workflowArtifactsDir, foregroundWorkflowRunId));
       const claimedOutputPaths = new Map;
       const childOutputOverrides = new Map;
       const childOutputClaimPaths = new Map;
       const producedChildOutputPaths = new Set;
       const workflowResults = [];
       const workflowChildRunIds = new Map;
-      const runHostCommand = workflowHostCommandRunner({ workflowCwd, artifactsDir: workflowArtifactsDir, workflowRunId: _id, claimedOutputPaths, producedOutputPaths: producedChildOutputPaths });
+      const runHostCommand = workflowHostCommandRunner({
+        workflowCwd,
+        artifactsDir: workflowArtifactsDir,
+        workflowRunId: foregroundWorkflowRunId,
+        claimedOutputPaths,
+        producedOutputPaths: producedChildOutputPaths,
+        ...workflowResource ? { authorize: (key, params) => authorizeWorkflowResourceHost(workflowResource.permit, key, params.command) } : {}
+      });
+      const workflowHost = delegatedWorkflowPermit ? undefined : workflowResource ? workflowResource.authority.host ? runHostCommand : undefined : publicExecution ? undefined : runHostCommand;
       const workflowHostSteps = new Map;
-      let liveWorkflow = { trace: [], emits: [], console: [] };
-      let liveWorkflowChildren = workflowChildSummary({ parentToolCallId: _id, workflowRunId: _id, workflowState: "running", inventoryComplete: false });
+      let liveWorkflow = { trace: [], emits: [], console: [], ...workflowResource ? { resource: workflowResource.provenance } : {} };
+      const childProgress = new Map;
+      let activityTimer;
+      let lastProgressAt = 0;
+      let workflowProgressClosed = false;
       const workflowDeadlineAt = timeout === undefined ? undefined : Date.now() + timeout;
       const workflowCapabilityCeiling = intersectSubagentCapabilityCeilings(requestParams.capabilityCeiling, resolveCurrentSubagentCapabilityCeiling(resolveCurrentSessionId(ctx.sessionManager)));
       const sendWorkflowProgress = () => {
-        const update = workflowChatProgressUpdate(_id, chatProgress, liveWorkflow, liveWorkflowChildren, workflowPreflight);
-        if (update)
-          onUpdate?.(update);
+        if (workflowProgressClosed)
+          return;
+        if (activityTimer)
+          clearTimeout(activityTimer);
+        activityTimer = undefined;
+        lastProgressAt = Date.now();
+        const liveWorkflowChildren = workflowChildSummary({ parentToolCallId: _id, workflowRunId: foregroundWorkflowRunId, workflowState: "running", inventoryComplete: false, trace: liveWorkflow.trace, progress: childProgress });
+        onUpdate?.(workflowProgressUpdate(foregroundWorkflowRunId, chatProgress, liveWorkflow, liveWorkflowChildren, workflowPreflight));
       };
       try {
         const workflow = await runWorkflowScript({
           script: requestParams.workflowScript,
-          ...delegatedWorkflowPermit ? { oneUsePermit: { claim: (key) => claimWorkflowChildPermit(delegatedWorkflowPermit, _id, key) } } : {},
-          globalConcurrencyLimit: deps.config.globalConcurrencyLimit,
+          ...workflowArgs ? { args: workflowArgs } : {},
+          workflowRunId: foregroundWorkflowRunId,
+          processCwd: ctx.cwd,
+          ...delegatedWorkflowPermit ? { oneUsePermit: { claim: (key) => claimWorkflowChildPermit(delegatedWorkflowPermit, foregroundWorkflowRunId, key) } } : {},
+          globalConcurrencyLimit: requestParams.globalConcurrencyLimit ?? deps.config.globalConcurrencyLimit,
           timeoutMs: timeout,
           signal,
           ...workflowState ? { state: workflowState } : {},
-          ...!delegatedWorkflowPermit ? { host: runHostCommand } : {},
+          ...workflowHost ? { host: workflowHost } : {},
           onHostStep: (hostStep) => {
             workflowHostSteps.set(hostStep.id, { ...hostStep, ...hostStep.freshness ? { freshness: { ...hostStep.freshness } } : {} });
           },
@@ -4621,11 +5463,15 @@ export function createSubagentExecutor(deps) {
             const projectedTrace = annotateWorkflowPreflightTrace(trace, workflowPreflight);
             const preflightWarnings = workflowPreflightWarnings(workflowPreflight, trace);
             liveWorkflow = { ...liveWorkflow, trace: projectedTrace, ...preflightWarnings.length ? { preflightWarnings } : {} };
-            liveWorkflowChildren = workflowChildSummary({ parentToolCallId: _id, workflowRunId: _id, workflowState: "running", inventoryComplete: false, trace });
+            for (const entry of trace) {
+              if (entry.operation === "run" && ["completed", "failed", "stopped", "detached"].includes(entry.state))
+                childProgress.delete(entry.key);
+            }
             sendWorkflowProgress();
           },
-          admit: (calls) => {
-            const outputClaims = workflowChildOutputClaims({ ctxCwd: ctx.cwd, workflowCwd, artifactsDir: workflowArtifactsDir, workflowRunId: _id, aggregateOutputPath: workflowAggregateOutputPath, configuredOutputBaseDir, discoverAgents: discoverWorkflowAgents, agents: workflowAgents, workflowAgentScope: workflowChildDefaults.agentScope, state: deps.state, claimedOutputPaths, entries: calls });
+          admit: async (calls, admissionSignal) => {
+            await preflightWorkflowWorktrees({ workflowDefaults: workflowChildDefaults, defaultWorktree: deps.config.worktree, calls, ctxCwd: ctx.cwd, signal: admissionSignal, deadlineAt: workflowDeadlineAt });
+            const outputClaims = workflowChildOutputClaims({ ctxCwd: ctx.cwd, workflowCwd, artifactsDir: workflowArtifactsDir, workflowRunId: foregroundWorkflowRunId, aggregateOutputPath: workflowAggregateOutputPath, configuredOutputBaseDir, discoverAgents: discoverWorkflowAgents, agents: workflowAgents, workflowAgentScope: workflowChildDefaults.agentScope, state: deps.state, claimedOutputPaths, entries: calls });
             if (outputClaims.error)
               throw new Error(outputClaims.error);
             claimRunFanoutBatch(workflowFanoutBudget, calls.map(({ key }) => `workflow[${key}]`));
@@ -4656,7 +5502,7 @@ export function createSubagentExecutor(deps) {
               return workflowChildResult(key, buildRequestedModeError(childParams, usageBudgetExceededMessage(budgetState)), childParams, deps.state, { state: "partial", reason: "budget_exhausted" });
             const childPhase = typeof childParams.phase === "string" && childParams.phase.trim() ? childParams.phase.trim() : undefined;
             const childLabel = typeof childParams.label === "string" && childParams.label.trim() ? childParams.label.trim() : undefined;
-            recordMissionWorkflowChild(missionBinding, _id, key, {
+            recordMissionWorkflowChild(missionBinding, foregroundWorkflowRunId, key, {
               status: "running",
               ...typeof childParams.agent === "string" && childParams.agent.trim() ? { agent: childParams.agent.trim() } : {},
               ...childLabel ? { label: childLabel } : {},
@@ -4664,9 +5510,11 @@ export function createSubagentExecutor(deps) {
               heartbeat: { status: "running", ...childPhase ? { phase: childPhase } : {} }
             });
             let preparedChildParams;
-            const result = await runMissionWorkflowChild(missionBinding, _id, key, childPhase, () => {
-              const childRequest = bindMissionWorkflowChildAsyncLaunch({ ...prepareWorkflowChildLaunchParams({ workflowDefaults: workflowChildDefaults, childParams, parentWorkflowRunId: _id, workflowKey: key, ctxCwd: ctx.cwd, workflowCwd, artifactsDir: workflowArtifactsDir, aggregateOutputPath: workflowAggregateOutputPath, configuredOutputBaseDir, discoverAgents: discoverWorkflowAgents, agents: workflowAgents, workflowAgentScope: workflowChildDefaults.agentScope, outputOverride: childOutputOverrides.get(key), outputClaimPath: childOutputClaimPaths.get(key), options: { missionDetached: detachWorkflowChildMissions, suppressRoutineResultIntercom: chatProgress.mode === "live-card", runFanoutBudget: workflowFanoutBudget, parentDeadlineAt: workflowDeadlineAt, capabilityCeiling: workflowCapabilityCeiling } }), runFanoutAdmitted: admission.admitted }, missionBinding, deps.asyncByDefault);
+            const result = await runMissionWorkflowChild(missionBinding, foregroundWorkflowRunId, key, childPhase, () => {
+              const childRequest = bindMissionWorkflowChildAsyncLaunch({ ...prepareWorkflowChildLaunchParams({ workflowDefaults: workflowChildDefaults, childParams: delegatedWorkflowPermit ? { ...childParams, async: false } : childParams, parentWorkflowRunId: foregroundWorkflowRunId, workflowKey: key, ctxCwd: ctx.cwd, workflowCwd, artifactsDir: workflowArtifactsDir, aggregateOutputPath: workflowAggregateOutputPath, configuredOutputBaseDir, discoverAgents: discoverWorkflowAgents, agents: workflowAgents, workflowAgentScope: workflowChildDefaults.agentScope, outputOverride: childOutputOverrides.get(key), outputClaimPath: childOutputClaimPaths.get(key), options: { missionDetached: detachWorkflowChildMissions, suppressRoutineResultIntercom: chatProgress.mode === "live-card", runFanoutBudget: workflowFanoutBudget, parentDeadlineAt: workflowDeadlineAt, capabilityCeiling: workflowCapabilityCeiling } }), runFanoutAdmitted: admission.admitted }, missionBinding, deps.asyncByDefault, undefined, inheritedNestedRoute(deps)?.rootRunId);
               preparedChildParams = childRequest;
+              if (workflowUsageBudget.budget)
+                workflowOwnedUsageBudgets.set(childRequest, workflowUsageBudget.budget);
               if (delegatedWorkflowPermit) {
                 if (childRequest.async !== false)
                   throw new Error("Workflow child permit supports one foreground child only.");
@@ -4674,9 +5522,9 @@ export function createSubagentExecutor(deps) {
                 const childAgent = typeof childRequest.agent === "string" ? resolveAgentName(childRequest.agent, discoverWorkflowAgents(childCwd, resolveExecutionAgentScope(childRequest.agentScope)).agents).agent : undefined;
                 if (childAgent?.runner?.type === "external-cli" || childAgent?.runner?.type === "external-job")
                   throw new Error("Workflow child permit supports native DM children only.");
-                workflowPermitContexts.set(childRequest, { child: { permit: delegatedWorkflowPermit, workflowRunId: _id, childKey: key } });
+                workflowPermitContexts.set(childRequest, { child: { permit: delegatedWorkflowPermit, workflowRunId: foregroundWorkflowRunId, childKey: key } });
               }
-              workflowLaunchObservers.set(childRequest, (launch) => recordMissionWorkflowChild(missionBinding, _id, key, {
+              workflowLaunchObservers.set(childRequest, (launch) => recordMissionWorkflowChild(missionBinding, foregroundWorkflowRunId, key, {
                 status: "running",
                 agent: launch.agent,
                 ...launch.sessionFile ? { sessionPath: launch.sessionFile } : {}
@@ -4685,8 +5533,21 @@ export function createSubagentExecutor(deps) {
                 const progress = update.details.progress?.[0];
                 if (!progress)
                   return;
+                if (onUpdate && !workflowProgressClosed) {
+                  if (progress.status === "running")
+                    childProgress.set(key, workflowChildProgress(progress));
+                  else
+                    childProgress.delete(key);
+                  if (!activityTimer) {
+                    const delay = 100 - (Date.now() - lastProgressAt);
+                    if (delay <= 0)
+                      sendWorkflowProgress();
+                    else
+                      activityTimer = setTimeout(sendWorkflowProgress, delay);
+                  }
+                }
                 const progressStatus = progress.status === "completed" ? "completed" : progress.status === "failed" ? "failed" : "running";
-                recordMissionWorkflowChild(missionBinding, _id, key, {
+                recordMissionWorkflowChild(missionBinding, foregroundWorkflowRunId, key, {
                   status: progressStatus,
                   heartbeat: { status: progressStatus, ...childPhase ? { phase: childPhase } : {} }
                 });
@@ -4703,7 +5564,7 @@ export function createSubagentExecutor(deps) {
             if (child.runId)
               workflowChildRunIds.set(key, child.runId);
             const childStatus = missionWorkflowChildStatus(result);
-            recordMissionWorkflowChild(missionBinding, _id, key, {
+            recordMissionWorkflowChild(missionBinding, foregroundWorkflowRunId, key, {
               status: childStatus,
               ...child.runId ? { runId: child.runId } : {},
               ...result.details.results[0]?.agent ? { agent: result.details.results[0].agent } : {},
@@ -4715,17 +5576,18 @@ export function createSubagentExecutor(deps) {
             return child;
           },
           status: async (keyOrRunId, workflowSignal) => workflowChildResult(keyOrRunId, await execute(randomUUID(), { action: "status", id: keyOrRunId }, workflowSignal, undefined, ctx, preserveActiveSession, workflowParentModel)),
-          resolveResume: (reference) => resolveKeyedWorkflowResume(reference, deps.state),
-          steer: (key, message, options, workflowSignal) => steerWorkflowChildByKey({ state: deps.state, workflowRunId: _id, key, message, options, signal: workflowSignal, resolveRunId: () => workflowChildRunIds.get(key) })
+          resolveResume: (reference, _signal, index) => resolveWorkflowResume(reference, deps, ctx.sessionManager.getSessionFile() ?? null, index),
+          steer: (key, message, options, workflowSignal) => steerWorkflowChildByKey({ state: deps.state, workflowRunId: foregroundWorkflowRunId, key, message, options, signal: workflowSignal, resolveRunId: () => workflowChildRunIds.get(key) })
         });
         const finalPreflightWarnings = workflowPreflightWarnings(workflowPreflight, workflow.trace, { settled: true });
         const finalPreflightTrace = annotateWorkflowPreflightTrace(workflow.trace, workflowPreflight);
-        const workflowChildren = workflowChildSummary({ parentToolCallId: _id, workflowRunId: _id, workflowState: "completed", inventoryComplete: true, trace: workflow.trace, children: workflow.children });
-        const receipt = terminalWorkflowReceipt(_id, "complete", workflow.children, workflowChildren, undefined, [...workflowHostSteps.values()]);
+        const workflowChildren = workflowChildSummary({ parentToolCallId: _id, workflowRunId: foregroundWorkflowRunId, workflowState: "completed", inventoryComplete: true, trace: workflow.trace, children: workflow.children });
+        const receipt = terminalWorkflowReceipt(foregroundWorkflowRunId, "complete", workflow.children, workflowChildren, undefined, [...workflowHostSteps.values()], workflowResource?.provenance, workflowArgsDigest);
         const traceLines = finalPreflightTrace.map((entry) => `- ${entry.operation} ${entry.key}: ${entry.state}${entry.runId ? ` (${entry.runId})` : ""}${entry.durationMs !== undefined ? ` in ${entry.durationMs}ms` : ""}${entry.warning ? ` — ${entry.warning}` : ""}${entry.error ? ` — ${entry.error}` : ""}`);
+        const runningSummary = workflowRunningChildrenSummary(workflow.children);
         const sections = [
           ...workflowPreflight ? [formatWorkflowPreflight(workflowPreflight)] : [],
-          "Workflow completed.",
+          runningSummary ? `Workflow dispatch completed; ${runningSummary}` : "Workflow completed.",
           `Return:
 ${formatWorkflowValue(workflow.value)}`
         ];
@@ -4753,11 +5615,11 @@ ${traceLines.join(`
         const displayText = appendWorkflowOutputWarning(workflowText, outputWarning);
         return attachWorkflowMission(withRunFanoutBudget({
           content: [{ type: "text", text: displayText }],
-          details: compactOptional({ mode: "workflow", runId: _id, results: workflow.children.flatMap((child) => child.results ?? []), ...workflowPreflight ? { preflight: workflowPreflight } : {}, workflowChildren, totalChildUsage: sumResultsUsage(workflowResults), totalCost: sumResultsCost(workflowResults), usageBudget: usageBudgetState(workflowUsageBudget.budget, sumResultsCost(workflowResults)), workflow: { value: workflow.value, trace: finalPreflightTrace, emits: workflow.emits, console: workflow.console, ...finalPreflightWarnings.length ? { preflightWarnings: finalPreflightWarnings } : {}, receipt }, chatProgress })
+          details: compactOptional({ mode: "workflow", runId: foregroundWorkflowRunId, results: workflowDetailsResults(workflow.children), ...workflowPreflight ? { preflight: workflowPreflight } : {}, workflowChildren, totalChildUsage: sumResultsUsage(workflowResults), totalCost: sumResultsCost(workflowResults), usageBudget: usageBudgetState(workflowUsageBudget.budget, sumResultsCost(workflowResults)), workflow: { value: workflow.value, trace: finalPreflightTrace, emits: workflow.emits, console: workflow.console, ...workflowArgsEvidence ?? {}, ...workflowResource ? { resource: workflowResource.provenance } : {}, ...finalPreflightWarnings.length ? { preflightWarnings: finalPreflightWarnings } : {}, receipt }, chatProgress })
         }, workflowFanoutBudget));
       } catch (error) {
         const partial = error instanceof WorkflowScriptError ? error.partial : { trace: [], emits: [], console: [], children: [] };
-        const text = workflowFailureMessage(error, _id, partial.children);
+        const text = workflowFailureMessage(error, foregroundWorkflowRunId, partial.children);
         const finalPreflightWarnings = workflowPreflightWarnings(workflowPreflight, partial.trace, { settled: true });
         const finalPreflightTrace = annotateWorkflowPreflightTrace(partial.trace, workflowPreflight);
         const traceLines = finalPreflightTrace.map((entry) => `- ${entry.operation} ${entry.key}: ${entry.state}${entry.runId ? ` (${entry.runId})` : ""}${entry.warning ? ` — ${entry.warning}` : ""}${entry.error ? ` — ${entry.error}` : ""}`);
@@ -4787,20 +5649,35 @@ ${traceLines.join(`
 `);
         const outputWarning = writeWorkflowAggregateOutput(workflowAggregateOutputPath, workflowText, producedChildOutputPaths);
         const displayText = appendWorkflowOutputWarning(workflowText, outputWarning);
-        const workflowChildren = workflowChildSummary({ parentToolCallId: _id, workflowRunId: _id, workflowState: "failed", inventoryComplete: true, trace: partial.trace, children: partial.children });
+        const workflowChildren = workflowChildSummary({ parentToolCallId: _id, workflowRunId: foregroundWorkflowRunId, workflowState: "failed", inventoryComplete: true, trace: partial.trace, children: partial.children });
         const terminalOutcome = workflowFailureTerminalOutcome(error, partial.children, usageBudgetState(workflowUsageBudget.budget, sumResultsCost(workflowResults)));
-        const receipt = terminalWorkflowReceipt(_id, "failed", partial.children, workflowChildren, terminalOutcome, [...workflowHostSteps.values()]);
+        const receipt = terminalWorkflowReceipt(foregroundWorkflowRunId, "failed", partial.children, workflowChildren, terminalOutcome, [...workflowHostSteps.values()], workflowResource?.provenance, workflowArgsDigest);
         return attachWorkflowMission(withRunFanoutBudget({
           content: [{ type: "text", text: displayText }],
           isError: true,
-          details: compactOptional({ mode: "workflow", runId: _id, results: partial.children.flatMap((child) => child.results ?? []), ...workflowPreflight ? { preflight: workflowPreflight } : {}, workflowChildren, totalChildUsage: sumResultsUsage(workflowResults), totalCost: sumResultsCost(workflowResults), usageBudget: usageBudgetState(workflowUsageBudget.budget, sumResultsCost(workflowResults)), workflow: { trace: finalPreflightTrace, emits: partial.emits, console: partial.console, ...finalPreflightWarnings.length ? { preflightWarnings: finalPreflightWarnings } : {}, receipt }, chatProgress })
+          details: compactOptional({ mode: "workflow", runId: foregroundWorkflowRunId, results: workflowDetailsResults(partial.children), ...workflowPreflight ? { preflight: workflowPreflight } : {}, workflowChildren, totalChildUsage: sumResultsUsage(workflowResults), totalCost: sumResultsCost(workflowResults), usageBudget: usageBudgetState(workflowUsageBudget.budget, sumResultsCost(workflowResults)), workflow: { trace: finalPreflightTrace, emits: partial.emits, console: partial.console, ...workflowArgsEvidence ?? {}, ...workflowResource ? { resource: workflowResource.provenance } : {}, ...finalPreflightWarnings.length ? { preflightWarnings: finalPreflightWarnings } : {}, receipt }, chatProgress })
         }, workflowFanoutBudget));
+      } finally {
+        workflowProgressClosed = true;
+        if (activityTimer)
+          clearTimeout(activityTimer);
+        childProgress.clear();
       }
     }
     const directParams = requestParams;
-    const requestedCwd = directParams.cwd;
-    const requestCwd = resolveRequestedCwd(ctx.cwd, directParams.cwd);
-    const paramsWithResolvedCwd = directParams.cwd === undefined ? directParams : { ...directParams, cwd: requestCwd };
+    const placedByAgent = () => {
+      if (directParams.machine !== undefined || directParams.cwd === undefined || typeof directParams.agent !== "string")
+        return false;
+      try {
+        return resolveAgentName(directParams.agent, deps.discoverAgents(ctx.cwd, resolveExecutionAgentScope(directParams.agentScope)).agents).agent?.machine !== undefined;
+      } catch {
+        return false;
+      }
+    };
+    const remotePlacement = directParams.action === undefined && (directParams.machine !== undefined || placedByAgent());
+    const requestedCwd = remotePlacement ? undefined : directParams.cwd;
+    const requestCwd = remotePlacement ? ctx.cwd : resolveRequestedCwd(ctx.cwd, directParams.cwd);
+    const paramsWithResolvedCwd = directParams.cwd === undefined ? directParams : remotePlacement ? omitUndefinedProperties({ ...directParams, cwd: undefined, machineCwd: directParams.cwd }) : { ...directParams, cwd: requestCwd };
     const action = paramsWithResolvedCwd.action;
     let requestSessionId = "";
     let requestPiSessionId;
@@ -4865,7 +5742,8 @@ ${paramsWithResolvedCwd.handoffPath}`);
         if (!confirmed)
           return { content: [{ type: "text", text: "Worktree discard canceled; preserved worktrees were not changed." }], details: { mode: "management", results: [] } };
         try {
-          const discarded = discardPreservedWorktrees(path.isAbsolute(paramsWithResolvedCwd.handoffPath) ? paramsWithResolvedCwd.handoffPath : path.resolve(requestCwd, paramsWithResolvedCwd.handoffPath), { kind: decision === "confirm" ? "confirmed" : "policy", ...deps.config.authorityPolicy ? { policy: deps.config.authorityPolicy } : {} });
+          const manifestPath = path.isAbsolute(paramsWithResolvedCwd.handoffPath) ? paramsWithResolvedCwd.handoffPath : path.resolve(requestCwd, paramsWithResolvedCwd.handoffPath);
+          const discarded = await withWorktreeTransaction(() => discardPreservedWorktrees(manifestPath, { kind: decision === "confirm" ? "confirmed" : "policy", ...deps.config.authorityPolicy ? { policy: deps.config.authorityPolicy } : {} }));
           return { content: [{ type: "text", text: discarded.text }], details: { mode: "management", results: [] } };
         } catch (error) {
           return { content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }], isError: true, details: { mode: "management", results: [] } };
@@ -4900,6 +5778,23 @@ ${paramsWithResolvedCwd.handoffPath}`);
           return { content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }], isError: true, details: { mode: "management", results: [] } };
         }
       }
+      const policyAction = action === "stop" ? "stopRun" : action === "steer" ? "steerRun" : action === "schedule.create" ? "scheduleCreate" : action === "inspector.open" ? "inspectorOpen" : action === "project.open" ? "projectOpen" : undefined;
+      if (policyAction) {
+        if (deps.allowMutatingManagementActions === false && MUTATING_MANAGEMENT_ACTIONS.has(action)) {
+          return { content: [{ type: "text", text: `Action '${action}' is not available from child-safe subagent fanout mode.` }], isError: true, details: { mode: "management", results: [] } };
+        }
+        const decision = resolveAuthorityDecision({ action: policyAction, ...deps.config.authorityPolicy === undefined ? {} : { policy: deps.config.authorityPolicy } });
+        if (decision === "forbid") {
+          return { content: [{ type: "text", text: `Authority policy forbids action '${action}'.` }], isError: true, details: { mode: "management", results: [] } };
+        }
+        if (decision === "confirm") {
+          if (!ctx.hasUI)
+            return { content: [{ type: "text", text: `Authority policy requires user confirmation for action '${action}', but this session has no interactive UI.` }], isError: true, details: { mode: "management", results: [] } };
+          const confirmed = await ctx.ui.confirm(`Authorize subagent ${action}?`, `Authority policy requires confirmation before '${action}'.`);
+          if (!confirmed)
+            return { content: [{ type: "text", text: `Action '${action}' canceled; authority was not granted.` }], details: { mode: "management", results: [] } };
+        }
+      }
       if (HERDR_PROJECT_PANE_ACTIONS.includes(action)) {
         if (deps.allowMutatingManagementActions === false && MUTATING_MANAGEMENT_ACTIONS.has(action)) {
           return { content: [{ type: "text", text: `Action '${action}' is not available from child-safe subagent fanout mode.` }], isError: true, details: { mode: "management", results: [] } };
@@ -4907,16 +5802,17 @@ ${paramsWithResolvedCwd.handoffPath}`);
         deps.state.currentSessionId = resolveCurrentSessionId(ctx.sessionManager);
         return handleHerdrProjectPaneAction(action, paramsWithResolvedCwd, { cwd: requestCwd, state: deps.state, signal });
       }
-      if (HERDR_INSPECTOR_ACTIONS.includes(action)) {
+      if (INSPECTOR_ACTIONS.includes(action)) {
         if (deps.allowMutatingManagementActions === false && MUTATING_MANAGEMENT_ACTIONS.has(action)) {
           return { content: [{ type: "text", text: `Action '${action}' is not available from child-safe subagent fanout mode.` }], isError: true, details: { mode: "management", results: [] } };
         }
         deps.state.currentSessionId = resolveCurrentSessionId(ctx.sessionManager);
-        return handleHerdrInspectorAction(action, paramsWithResolvedCwd, {
+        return handleInspectorAction(action, paramsWithResolvedCwd, {
           state: deps.state,
           cwd: requestCwd,
           ...deps.config.missions ? { missions: deps.config.missions } : {},
           ...deps.config.authorityPolicy ? { authorityPolicy: deps.config.authorityPolicy } : {},
+          plugins: createBuiltinInspectorPlugins(),
           signal
         });
       }
@@ -4935,20 +5831,6 @@ ${paramsWithResolvedCwd.handoffPath}`);
           ...currentSessionId ? { currentSessionId } : {}
         });
       }
-      const policyAction = action === "stop" ? "stopRun" : action === "steer" ? "steerRun" : action === "schedule.create" ? "scheduleCreate" : undefined;
-      if (policyAction) {
-        const decision = resolveAuthorityDecision({ action: policyAction, ...deps.config.authorityPolicy === undefined ? {} : { policy: deps.config.authorityPolicy } });
-        if (decision === "forbid") {
-          return { content: [{ type: "text", text: `Authority policy forbids action '${action}'.` }], isError: true, details: { mode: "management", results: [] } };
-        }
-        if (decision === "confirm") {
-          if (!ctx.hasUI)
-            return { content: [{ type: "text", text: `Authority policy requires user confirmation for action '${action}', but this session has no interactive UI.` }], isError: true, details: { mode: "management", results: [] } };
-          const confirmed = await ctx.ui.confirm(`Authorize subagent ${action}?`, `Authority policy requires confirmation before '${action}'.`);
-          if (!confirmed)
-            return { content: [{ type: "text", text: `Action '${action}' canceled; authority was not granted.` }], details: { mode: "management", results: [] } };
-        }
-      }
       if (WATCHDOG_TOOL_ACTIONS.includes(action)) {
         if (deps.allowMutatingManagementActions === false && MUTATING_MANAGEMENT_ACTIONS.has(action)) {
           return {
@@ -5084,7 +5966,7 @@ Usage is not reset. Compaction keeps the same budget; a new parent session start
         }
         let orchestratorTarget;
         try {
-          orchestratorTarget = resolveIntercomSessionTarget(deps.dm.getSessionName(), ctx.sessionManager.getSessionId());
+          orchestratorTarget = resolveIntercomSessionTarget(deps.childRuntime?.intercomSessionName ?? deps.dm.getSessionName(), ctx.sessionManager.getSessionId());
         } catch (error) {
           if (!sessionError)
             sessionError = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
@@ -5136,7 +6018,7 @@ ${item.text}` } : item)
           }
           return withBudget(inspectSubagentStatus(paramsWithResolvedCwd, omitUndefinedProperties({ state: deps.state, nested: nestedScope, sessionRoots, abandonedSlotReleaseAfterMs: resolveAbandonedSlotReleaseAfterMs(deps.config.capacity?.abandonedSlotReleaseAfterMs) })));
         }
-        if (paramsWithResolvedCwd.view === "fleet") {
+        if (paramsWithResolvedCwd.view === "fleet" || paramsWithResolvedCwd.view === "transcript") {
           return withBudget(inspectSubagentStatus(paramsWithResolvedCwd, omitUndefinedProperties({ state: deps.state, nested: nestedScope, sessionRoots, abandonedSlotReleaseAfterMs: resolveAbandonedSlotReleaseAfterMs(deps.config.capacity?.abandonedSlotReleaseAfterMs) })));
         }
         if (targetRunId) {
@@ -5145,12 +6027,6 @@ ${item.text}` } : item)
             if (resolved?.kind === "foreground") {
               const foreground = getForegroundControl(deps.state, resolved.id);
               if (foreground) {
-                if (paramsWithResolvedCwd.view === "transcript") {
-                  return withBudget({
-                    content: [{ type: "text", text: "Live foreground transcript is already visible in the expanded running subagent result. Persisted session transcript becomes inspectable after the foreground run completes when sessions are enabled." }],
-                    details: { mode: "management", results: [] }
-                  });
-                }
                 return withBudget(foregroundStatusResult(foreground));
               }
             }
@@ -5160,19 +6036,24 @@ ${item.text}` } : item)
           }
         } else if (!hasDirectoryTarget) {
           const foreground = getForegroundControl(deps.state, undefined);
-          if (foreground && paramsWithResolvedCwd.view !== "transcript")
+          if (foreground)
             return withBudget(foregroundStatusResult(foreground));
-          if (foreground && paramsWithResolvedCwd.view === "transcript") {
-            return withBudget({
-              content: [{ type: "text", text: "Live foreground transcript is already visible in the expanded running subagent result. Pass an async run id to inspect a background transcript." }],
-              details: { mode: "management", results: [] }
-            });
-          }
         }
         return withBudget(inspectSubagentStatus(paramsWithResolvedCwd, omitUndefinedProperties({ state: deps.state, nested: nestedScope, sessionRoots, abandonedSlotReleaseAfterMs: resolveAbandonedSlotReleaseAfterMs(deps.config.capacity?.abandonedSlotReleaseAfterMs) })));
       }
       if (action === "resume") {
-        return resumeAsyncRun(omitUndefinedProperties({ params: paramsWithResolvedCwd, requestCwd, ctx, deps, parentModel: requestParentModel, signal }));
+        return resumeAsyncRun(omitUndefinedProperties({
+          params: paramsWithResolvedCwd,
+          requestCwd,
+          ctx,
+          deps,
+          parentModel: requestParentModel,
+          signal,
+          ...workflowLaunchObserver ? { onLaunch: (launch) => {
+            workflowLaunchObservers.delete(params);
+            workflowLaunchObserver(launch);
+          } } : {}
+        }));
       }
       if (action === "steer") {
         if (paramsWithResolvedCwd.mode !== undefined && resolveSteerDeliveryMode(paramsWithResolvedCwd.mode) === undefined) {
@@ -5189,10 +6070,7 @@ ${item.text}` } : item)
             const runId = location.resolvedId ?? targetRunId ?? path.basename(location.asyncDir ?? paramsWithResolvedCwd.dir);
             const directoryStatus = location.asyncDir ? readStatus(location.asyncDir) : null;
             if (directoryStatus?.mode === "workflow") {
-              const route = resolveWorkflowForegroundSteeringTarget({ state: deps.state, workflowRunId: directoryStatus.runId || runId, asyncDirRoot: DIRS.async });
-              if (!route.ok)
-                return { content: [{ type: "text", text: route.message }], isError: true, details: { mode: "management", results: [] } };
-              return steerWorkflowForegroundTarget({ target: route.target, message, mode: resolveSteerDeliveryMode(paramsWithResolvedCwd.mode), index: paramsWithResolvedCwd.index, signal });
+              return steerWorkflowRun({ state: deps.state, runId, asyncDir: location.asyncDir, message, mode: resolveSteerDeliveryMode(paramsWithResolvedCwd.mode), index: paramsWithResolvedCwd.index, signal });
             }
             if (location.asyncDir) {
               const unsupported = externalRunnerControlError(location.asyncDir, "steer");
@@ -5201,6 +6079,7 @@ ${item.text}` } : item)
             }
             return steerAsyncRun(compactOptional({
               state: deps.state,
+              findPendingAsks: deps.findPendingAsks,
               runId,
               message,
               mode: resolveSteerDeliveryMode(paramsWithResolvedCwd.mode),
@@ -5232,16 +6111,13 @@ ${item.text}` } : item)
           const route = resolveWorkflowForegroundSteeringTarget({ state: deps.state, childRunId: resolved.id, asyncDirRoot: DIRS.async });
           if (!route.ok)
             return { content: [{ type: "text", text: route.message }], isError: true, details: { mode: "management", results: [] } };
-          return steerWorkflowForegroundTarget({ target: route.target, message, mode: resolveSteerDeliveryMode(paramsWithResolvedCwd.mode), index: paramsWithResolvedCwd.index, signal });
+          return steerWorkflowForegroundTarget({ target: route.target, message, mode: resolveSteerDeliveryMode(paramsWithResolvedCwd.mode), index: paramsWithResolvedCwd.index });
         }
         if (resolved?.kind !== "async")
           return { content: [{ type: "text", text: `No async run found for '${targetRunId}'.` }], isError: true, details: { mode: "management", results: [] } };
         const resolvedStatus = resolved.location.asyncDir ? readStatus(resolved.location.asyncDir) : null;
         if (resolvedStatus?.mode === "workflow") {
-          const route = resolveWorkflowForegroundSteeringTarget({ state: deps.state, workflowRunId: resolvedStatus.runId || resolved.id, asyncDirRoot: DIRS.async });
-          if (!route.ok)
-            return { content: [{ type: "text", text: route.message }], isError: true, details: { mode: "management", results: [] } };
-          return steerWorkflowForegroundTarget({ target: route.target, message, mode: resolveSteerDeliveryMode(paramsWithResolvedCwd.mode), index: paramsWithResolvedCwd.index, signal });
+          return steerWorkflowRun({ state: deps.state, runId: resolved.id, asyncDir: resolved.location.asyncDir, message, mode: resolveSteerDeliveryMode(paramsWithResolvedCwd.mode), index: paramsWithResolvedCwd.index, signal });
         }
         if (resolved.location.asyncDir) {
           const unsupported = externalRunnerControlError(resolved.location.asyncDir, "steer");
@@ -5250,6 +6126,7 @@ ${item.text}` } : item)
         }
         return steerAsyncRun(compactOptional({
           state: deps.state,
+          findPendingAsks: deps.findPendingAsks,
           runId: resolved.id,
           message,
           mode: resolveSteerDeliveryMode(paramsWithResolvedCwd.mode),
@@ -5318,7 +6195,8 @@ ${item.text}` } : item)
       if (action === "stop") {
         const targetRunId = paramsWithResolvedCwd.runId ?? paramsWithResolvedCwd.id;
         const workflowController = targetRunId ? deps.state.workflowControllers?.get(targetRunId) : undefined;
-        if (workflowController) {
+        if (workflowController && targetRunId) {
+          const stopChild = deps.state.workflowChildStops?.get(targetRunId);
           if (paramsWithResolvedCwd.childId !== undefined) {
             const workflowRunId = targetRunId;
             const asyncJob = deps.state.asyncJobs.get(workflowRunId);
@@ -5332,7 +6210,6 @@ ${item.text}` } : item)
               return { content: [{ type: "text", text: resolution.message }], isError: true, details: { mode: "management", results: [] } };
             if (!isStoppableAsyncStatusStep(resolution.child.step))
               return { content: [{ type: "text", text: `Child '${paramsWithResolvedCwd.childId}' in async run '${targetRunId}' is ${resolution.child.step.status}; stop only supports pending or running children.` }], isError: true, details: { mode: "management", results: [] } };
-            const stopChild = deps.state.workflowChildStops?.get(targetRunId);
             if (!stopChild)
               return { content: [{ type: "text", text: `Workflow ${targetRunId} child stop is unavailable in this extension runtime.` }], isError: true, details: { mode: "management", results: [] } };
             if (!stopChild(resolution.child.id, `Workflow child '${resolution.child.id}' stopped.`))
@@ -5360,6 +6237,10 @@ ${item.text}` } : item)
             }
             return { content: [{ type: "text", text: `Stop requested for child ${resolution.child.id} in async workflow ${workflowRunId}.` }], details: { mode: "management", results: [] } };
           }
+          const asyncJob = deps.state.asyncJobs.get(targetRunId);
+          const status = asyncJob?.asyncDir ? readStatus(asyncJob.asyncDir) : undefined;
+          if (status)
+            stopStoppableAsyncStatusChildren(status, stopChild, "Workflow stopped.");
           workflowController.abort(new Error("Workflow stopped."));
           return { content: [{ type: "text", text: `Stop requested for async workflow ${targetRunId}.` }], details: { mode: "management", results: [] } };
         }
@@ -5446,10 +6327,12 @@ ${item.text}` } : item)
         cwd: requestCwd,
         config: deps.config,
         currentSessionId: deps.state.currentSessionId ?? ctx.sessionManager.getSessionId() ?? undefined,
-        runtimeAgentOwner: deps.dm
+        discoverAgentsAll: deps.discoverAgentsAll,
+        runtimeAgentOwner: deps.dm,
+        onAgentsChanged: deps.onAgentsChanged
       });
     }
-    const { blocked, depth, maxDepth } = checkSubagentDepth(deps.config.maxSubagentDepth);
+    const { blocked, depth, maxDepth } = checkSubagentDepth(deps.config.maxSubagentDepth, deps.childRuntime);
     if (blocked) {
       return {
         content: [
@@ -5466,6 +6349,9 @@ ${item.text}` } : item)
     if (normalized.error)
       return normalized.error;
     const normalizedParams = normalized.params;
+    const outputSchemaError = validateLaunchOutputSchemaOverrides(normalizedParams);
+    if (outputSchemaError)
+      return buildRequestedModeError(normalizedParams, outputSchemaError);
     let effectiveParams = applyForceTopLevelAsyncOverride(normalizedParams, depth, deps.config.forceTopLevelAsync === true);
     const runToolBudget = resolveToolBudget(effectiveParams.toolBudget, "toolBudget", allowZeroToolBudget ? { minimumHard: 0 } : undefined);
     if (runToolBudget.error)
@@ -5486,14 +6372,20 @@ ${item.text}` } : item)
     if (canonicalParams.error)
       return buildRequestedModeError(effectiveParams, canonicalParams.error);
     effectiveParams = canonicalParams.params;
+    if (effectiveParams.worktree === undefined && deps.config.worktree !== undefined) {
+      effectiveParams = { ...effectiveParams, worktree: deps.config.worktree };
+    }
     const modelScope = discovered.modelScope;
     effectiveParams = applySingleAgentLaunchDefaults(effectiveParams, discoveredAgents);
+    const typedVerifyConflict = describeTypedVerifyOutputSchemaConflict(effectiveParams, params);
+    if (typedVerifyConflict)
+      return buildRequestedModeError(effectiveParams, typedVerifyConflict);
     const contextPolicyResult = resolveAgentDefaultContextPolicy(effectiveParams, discoveredAgents, deps.config.defaultSubagentContext, canPreferFork(ctx.sessionManager));
     if ("error" in contextPolicyResult)
       return buildRequestedModeError(effectiveParams, contextPolicyResult.error);
     const contextPolicy = contextPolicyResult;
     effectiveParams = contextPolicy.params;
-    const sessionName = resolveIntercomSessionTarget(deps.dm.getSessionName(), ctx.sessionManager.getSessionId());
+    const sessionName = resolveIntercomSessionTarget(deps.childRuntime?.intercomSessionName ?? deps.dm.getSessionName(), ctx.sessionManager.getSessionId());
     const intercomBridge = resolveIntercomBridge({
       config: deps.config.intercomBridge,
       override: effectiveParams.intercomBridge,
@@ -5501,9 +6393,8 @@ ${item.text}` } : item)
       orchestratorTarget: sessionName
     });
     const agents = applyScopedIntercomBridgeToAgents(discoveredAgents, intercomBridge, contextPolicy);
-    const runId = randomUUID();
-    const inheritedNestedRoute = resolveInheritedNestedRouteFromEnv();
-    const nestedParentAddress = inheritedNestedRoute ? resolveNestedParentAddressFromEnv() : undefined;
+    const inheritedNestedRouteValue = inheritedNestedRoute(deps);
+    const nestedParentAddress = inheritedNestedRouteValue ? inheritedNestedParentAddress(deps) : undefined;
     const shareEnabled = effectiveParams.share === true;
     const hasChain = (effectiveParams.chain?.length ?? 0) > 0;
     const hasTasks = (effectiveParams.tasks?.length ?? 0) > 0;
@@ -5521,33 +6412,11 @@ ${item.text}` } : item)
       return;
     };
     let prepareForkSessionForIndex = async () => {};
-    let forkThinkingOverrideForIndex = () => {
-      return;
-    };
-    let prepareForkThinking = (_agentName, _index, _modelOverride, _modelOverrideFromParent) => {};
-    const forkThinkingRequirements = new Map;
-    const forkThinkingDowngrades = new Map;
     try {
-      const forkAvailableModels = contextPolicy.usesFork ? ctx.modelRegistry.getAvailable().map(toModelInfo) : [];
-      const parentModel = requestParentModel;
-      prepareForkThinking = (agentName, index, modelOverride, modelOverrideFromParent) => {
-        const agentConfig = agents.find((agent) => agent.name === agentName);
-        if (agentConfig?.runner?.type === "external-cli" || agentConfig?.runner?.type === "external-job") {
-          forkThinkingRequirements.set(index, true);
-          return;
-        }
-        const primaryModel = modelOverrideFromParent ? modelOverride : resolveEffectiveSubagentModel(modelOverride, agentConfig?.model, parentModel, forkAvailableModels, agentConfig?.modelProvider ?? parentModel?.provider, { source: "inherited" });
-        const candidates = buildModelCandidates(primaryModel, agentConfig?.fallbackModels, forkAvailableModels, agentConfig?.modelProvider ?? parentModel?.provider, { primaryModelFromParent: modelOverrideFromParent ?? inheritsParentModel(modelOverride, agentConfig?.model, parentModel) });
-        forkThinkingRequirements.set(index, candidates.length === 0 || candidates.some((candidate) => forkedChildRequiresThinkingOff(candidate, forkAvailableModels, parentModel?.provider)));
-      };
       const pruneSession = contextPolicy.usesFork && deps.config.forkContext?.mode === "pruned" ? await createPrunedForkSessionWriter(ctx, deps.config.forkContext, signal) : undefined;
-      const forkContextResolver = createForkContextResolver(ctx.sessionManager, contextPolicy.usesFork ? "fork" : undefined, {
-        forceThinkingOffForIndex: (index) => forkThinkingRequirements.get(index) ?? true,
-        ...pruneSession ? { pruneSession } : {}
-      });
+      const forkContextResolver = createForkContextResolver(ctx.sessionManager, contextPolicy.usesFork ? "fork" : undefined, pruneSession ? { pruneSession } : {});
       prepareForkSessionForIndex = forkContextResolver.prepareSessionForIndex;
       forkSessionFileForIndex = forkContextResolver.sessionFileForIndex;
-      forkThinkingOverrideForIndex = forkContextResolver.thinkingOverrideForIndex;
     } catch (error) {
       return toExecutionErrorResult(effectiveParams, error, contextPolicy.contextSummary);
     }
@@ -5560,13 +6429,21 @@ ${item.text}` } : item)
     if (externalAgent && (!effectiveAsync || effectiveParams.foregroundOnly === true)) {
       return buildRequestedModeError(effectiveParams, `Agent '${externalAgent.name}' uses runner.type='${externalAgent.runner?.type}', which currently supports async/background execution only. Omit async or pass async:true; clarify and foregroundOnly are unsupported.`);
     }
+    if (effectiveAsync && hasSingle && effectiveParams.resume === undefined && effectiveParams.worktree === true) {
+      try {
+        await preflightWorktreeSource(effectiveCwd, { signal });
+      } catch (error) {
+        return toExecutionErrorResult(effectiveParams, error, contextPolicy.contextSummary);
+      }
+    }
+    const runId = randomUUID();
     const foregroundTimeout = resolveSingleAgentLaunchTimeout(effectiveParams, effectiveAsync, resolveConfigDefaultTimeoutMs(deps.config.timeoutMs));
     if (foregroundTimeout.error)
       return buildRequestedModeError(effectiveParams, foregroundTimeout.error);
     const controlConfig = resolveControlConfig(deps.config.control, effectiveParams.control);
     const requestedWorkflowChildAsyncId = typeof effectiveParams.workflowChildAsyncId === "string" ? effectiveParams.workflowChildAsyncId.trim() : "";
     const asyncRunId = requestedWorkflowChildAsyncId && path.basename(requestedWorkflowChildAsyncId) === requestedWorkflowChildAsyncId ? requestedWorkflowChildAsyncId : randomUUID();
-    const topLevelAsyncCapacityEligible = depth === 0 && !inheritedNestedRoute && !effectiveParams.workflowParentRunId;
+    const topLevelAsyncCapacityEligible = depth === 0 && !inheritedNestedRouteValue && !effectiveParams.workflowParentRunId;
     const topLevelAsync = effectiveAsync && topLevelAsyncCapacityEligible;
     let activeAsyncCapacity;
     if (topLevelAsync) {
@@ -5590,8 +6467,8 @@ ${item.text}` } : item)
     }
     let runFanoutBudget;
     try {
-      const inheritedRunFanoutBudget = effectiveParams.runFanoutBudget ? undefined : decodeRunFanoutBudgetDescriptor(process.env[RUN_FANOUT_BUDGET_ENV]);
-      runFanoutBudget = effectiveParams.runFanoutBudget ?? (inheritedRunFanoutBudget ? { ...inheritedRunFanoutBudget, parentPath: `${inheritedRunFanoutBudget.parentPath ? `${inheritedRunFanoutBudget.parentPath}/` : ""}${runId}` } : undefined) ?? createRunFanoutBudget(runId, resolveMaxSubagentSpawnsPerRun(deps.config.maxSubagentSpawnsPerRun));
+      const inheritedRunFanoutBudgetValue = effectiveParams.runFanoutBudget ? undefined : inheritedRunFanoutBudget(deps);
+      runFanoutBudget = effectiveParams.runFanoutBudget ?? (inheritedRunFanoutBudgetValue ? { ...inheritedRunFanoutBudgetValue, parentPath: `${inheritedRunFanoutBudgetValue.parentPath ? `${inheritedRunFanoutBudgetValue.parentPath}/` : ""}${runId}` } : undefined) ?? createRunFanoutBudget(runId, resolveMaxSubagentSpawnsPerRun(deps.config.maxSubagentSpawnsPerRun));
       if (!effectiveParams.runFanoutAdmitted)
         claimRunFanoutBatch(runFanoutBudget, staticRunFanoutPaths(effectiveParams));
     } catch (error) {
@@ -5600,7 +6477,7 @@ ${item.text}` } : item)
         return runFanoutErrorResult(error, foregroundMode);
       return buildRequestedModeError(effectiveParams, error instanceof Error ? error.message : String(error));
     }
-    const nestedRoute = inheritedNestedRoute ?? createNestedRoute(runId);
+    const nestedRoute = inheritedNestedRouteValue ?? createNestedRoute(runId);
     const artifactConfig = omitUndefinedProperties({
       ...DEFAULT_ARTIFACT_CONFIG,
       enabled: effectiveParams.artifacts !== false,
@@ -5615,7 +6492,7 @@ ${item.text}` } : item)
     }
     let sessionRoot;
     if (effectiveParams.sessionDir) {
-      sessionRoot = path.resolve(deps.expandTilde(effectiveParams.sessionDir));
+      sessionRoot = path.join(path.resolve(deps.expandTilde(effectiveParams.sessionDir)), runId);
     } else {
       const baseSessionRoot = deps.config.defaultSessionDir ? path.resolve(deps.expandTilde(deps.config.defaultSessionDir)) : deps.getSubagentSessionRoot(parentSessionFile);
       sessionRoot = path.join(baseSessionRoot, runId);
@@ -5628,28 +6505,18 @@ ${item.text}` } : item)
       return toExecutionErrorResult(effectiveParams, new Error(`Failed to create session directory '${sessionRoot}': ${message}`), contextPolicy.contextSummary);
     }
     const sessionDirForIndex = (idx) => path.join(sessionRoot, `run-${idx ?? 0}`);
-    const forkSessionFileForTask = (agentName, idx = 0, modelOverride, modelOverrideFromParent) => {
+    const forkSessionFileForTask = (agentName, idx = 0) => {
       if (!shouldForkAgent(contextPolicy, agentName))
         return;
-      prepareForkThinking(agentName, idx, modelOverride, modelOverrideFromParent);
       return forkSessionFileForIndex(idx);
     };
-    const prepareForkSessionForTask = async (agentName, idx = 0, modelOverride, modelOverrideFromParent) => {
+    const prepareForkSessionForTask = async (agentName, idx = 0) => {
       if (!shouldForkAgent(contextPolicy, agentName))
         return;
-      prepareForkThinking(agentName, idx, modelOverride, modelOverrideFromParent);
       await prepareForkSessionForIndex(idx);
     };
-    const forkThinkingOverrideForTask = (agentName, idx = 0, modelOverride, modelOverrideFromParent) => {
-      if (!shouldForkAgent(contextPolicy, agentName))
-        return delegatedThinkingOverride;
-      prepareForkThinking(agentName, idx, modelOverride, modelOverrideFromParent);
-      const override = forkThinkingOverrideForIndex(idx);
-      if (override === "off")
-        forkThinkingDowngrades.set(idx, agentName);
-      return override ?? delegatedThinkingOverride;
-    };
-    const childSessionFileForTask = (agentName, idx, modelOverride, modelOverrideFromParent) => forkSessionFileForTask(agentName, idx, modelOverride, modelOverrideFromParent) ?? path.join(sessionDirForIndex(idx), "session.jsonl");
+    const thinkingOverrideForTask = () => delegatedThinkingOverride;
+    const childSessionFileForTask = (agentName, idx, modelOverride, modelOverrideFromParent, modelOrigin) => forkSessionFileForTask(agentName, idx, modelOverride, modelOverrideFromParent, modelOrigin) ?? path.join(sessionDirForIndex(idx), "session.jsonl");
     const childSessionFileForIndex = (idx) => path.join(sessionDirForIndex(idx), "session.jsonl");
     try {
       if (!(effectiveParams.clarify === true && ctx.hasUI) || deps.config.forkContext?.mode === "pruned") {
@@ -5724,18 +6591,20 @@ ${item.text}` } : item)
       sessionDirForIndex,
       sessionFileForIndex: childSessionFileForIndex,
       sessionFileForTask: childSessionFileForTask,
-      thinkingOverrideForTask: forkThinkingOverrideForTask,
+      thinkingOverrideForTask,
       artifactConfig,
       artifactsDir,
       backgroundRequestedWhileClarifying,
       effectiveAsync,
       asyncRunId,
       controlConfig,
+      ...delegatedExecution ? { suppressUnchangedDelegationUpdates: true } : {},
       intercomBridge,
       nestedRoute,
       timeoutMs: foregroundTimeout.timeoutMs,
       toolBudget: runToolBudget.toolBudget,
       usageBudget: usageBudget.budget,
+      inheritedUsageBudget,
       allowZeroToolBudget,
       configToolBudget: configToolBudget.toolBudget,
       configToolTimeoutMs: deps.config.toolTimeoutMs,
@@ -5751,15 +6620,12 @@ ${item.text}` } : item)
       workflowChildPermitLaunch
     });
     const foregroundDescription = selectedAgentNames.length === 1 ? `${selectedAgentNames[0]} child` : `${selectedAgentNames.length} live children`;
-    const parentWorkflowStatus = effectiveParams.workflowParentRunId ? readStatus(path.join(DIRS.async, effectiveParams.workflowParentRunId)) : null;
-    const workflowSteeringDir = effectiveParams.workflowParentRunId && requestSessionId && deps.state.workflowControllers?.has(effectiveParams.workflowParentRunId) && parentWorkflowStatus?.mode === "workflow" && (parentWorkflowStatus.state === "running" || parentWorkflowStatus.state === "queued") && parentWorkflowStatus.sessionId === requestSessionId ? workflowForegroundSteeringDir(DIRS.async, effectiveParams.workflowParentRunId, runId) : undefined;
     const foregroundControl = effectiveAsync ? undefined : compactOptional({
       runId,
       sessionId: requestSessionId,
       mode: foregroundMode,
       ...effectiveParams.workflowParentRunId ? { parentWorkflowRunId: effectiveParams.workflowParentRunId } : {},
       ...effectiveParams.workflowKey ? { workflowKey: effectiveParams.workflowKey } : {},
-      workflowSteeringDir,
       startedAt: Date.now(),
       updatedAt: Date.now(),
       cwd: effectiveCwd,
@@ -5811,7 +6677,7 @@ ${item.text}` } : item)
       deps.refreshResultDelivery?.();
     }
     const writeNestedForegroundEvent = (type, result) => {
-      if (!inheritedNestedRoute || !nestedParentAddress)
+      if (!inheritedNestedRouteValue || !nestedParentAddress)
         return;
       const now = Date.now();
       const details = result?.details;
@@ -5826,7 +6692,7 @@ ${item.text}` } : item)
           availableModels: ctx.modelRegistry.getAvailable().map(toModelInfo),
           currentProvider: requestParentModel?.provider,
           modelScope,
-          thinkingOverrideForTask: forkThinkingOverrideForTask,
+          thinkingOverrideForTask,
           dynamicFanoutMaxItems: deps.config.chain?.dynamicFanout?.maxItems
         });
       } catch (error) {
@@ -5836,7 +6702,7 @@ ${item.text}` } : item)
       const agentsForSummary = startedLaunches.map((launch) => launch.agent);
       const leafIntercomTarget = agentsForSummary[0] && intercomBridgeAppliesToAgent(intercomBridge, contextPolicy, agentsForSummary[0]) ? resolveSubagentIntercomTarget(runId, agentsForSummary[0], 0) : undefined;
       try {
-        writeNestedEvent(inheritedNestedRoute, compactOptional({
+        writeNestedEvent(inheritedNestedRouteValue, compactOptional({
           type,
           ts: now,
           parentRunId: nestedParentAddress.parentRunId,
@@ -5847,7 +6713,7 @@ ${item.text}` } : item)
             parentStepIndex: nestedParentAddress.parentStepIndex,
             depth: nestedParentAddress.depth,
             path: nestedParentAddress.path,
-            ownerIntercomTarget: process.env.DM_SUBAGENT_INTERCOM_SESSION_NAME,
+            ownerIntercomTarget: deps.childRuntime?.intercomSessionName,
             leafIntercomTarget,
             intercomTarget: leafIntercomTarget,
             ownerState: state === "running" ? "live" : "gone",
@@ -5902,7 +6768,7 @@ ${item.text}` } : item)
       const asyncResult = await runAsyncPath(execData, deps);
       if (asyncResult) {
         asyncLaunchFailed = asyncResult.isError === true;
-        return attachMission(withRunFanoutBudget(withResolvedContext(withForkThinkingNotes(asyncResult, forkThinkingDowngrades), contextPolicy.contextSummary), runFanoutBudget));
+        return attachMission(withRunFanoutBudget(withResolvedContext(asyncResult, contextPolicy.contextSummary), runFanoutBudget));
       }
       if (foregroundControl) {
         writeNestedForegroundEvent("subagent.nested.started");
@@ -5912,11 +6778,11 @@ ${item.text}` } : item)
       if (hasSingle) {
         const result = await runSinglePath(execData, deps);
         writeNestedForegroundEvent("subagent.nested.completed", result);
-        return attachMission(withRunFanoutBudget(withResolvedContext(withForkThinkingNotes(result, forkThinkingDowngrades), contextPolicy.contextSummary), runFanoutBudget, { annotateContent: runFanoutAnnotateContent }));
+        return attachMission(withRunFanoutBudget(withResolvedContext(result, contextPolicy.contextSummary), runFanoutBudget, { annotateContent: runFanoutAnnotateContent }));
       }
     } catch (error) {
       asyncLaunchFailed = effectiveAsync;
-      const errorResult = withForkThinkingNotes(toExecutionErrorResult(effectiveParams, error, contextPolicy.contextSummary), forkThinkingDowngrades);
+      const errorResult = toExecutionErrorResult(effectiveParams, error, contextPolicy.contextSummary);
       if (nestedForegroundStarted)
         writeNestedForegroundEvent("subagent.nested.completed", errorResult);
       return attachMission(errorResult);
@@ -5927,7 +6793,7 @@ ${item.text}` } : item)
         activeAsyncCapacity.rollback();
       if (foregroundControl) {
         settleForegroundSchedulingOwner(foregroundControl);
-        removeForegroundControlIfIdle(deps.state, runId);
+        removeForegroundControlIfIdle(deps.state, runId, deps.trackRetainedNestedRoute);
       }
     }
     return withResolvedContext({
@@ -5941,7 +6807,7 @@ ${item.text}` } : item)
     const requestParams = normalizedAction ? { ...params, action: normalizedAction } : params;
     if (normalizedAction)
       return execute(id, requestParams, signal, onUpdate, ctx).then(withAggregatedToolUsage);
-    const { depth } = checkSubagentDepth(deps.config.maxSubagentDepth);
+    const { depth } = checkSubagentDepth(deps.config.maxSubagentDepth, deps.childRuntime);
     const dispatchParams = applyForceTopLevelAsyncOverride(requestParams, depth, deps.config.forceTopLevelAsync === true);
     const runsForeground = dispatchParams.clarify === true || (dispatchParams.async ?? deps.asyncByDefault) !== true;
     if (!runsForeground)
@@ -5960,10 +6826,25 @@ ${item.text}` } : item)
     if (!normalized.ok) {
       return Promise.resolve({ content: [{ type: "text", text: normalized.error }], isError: true, details: { mode: normalized.mode, results: [] } });
     }
-    const loaded = loadWorkflowScriptPath(normalized.params, ctx.cwd);
+    let publicParams = normalized.params;
+    if (publicParams.workflow !== undefined) {
+      const resolved = resolveWorkflowResource(publicParams.workflow, publicParams.args, ctx.sessionManager.getSessionId() ?? undefined);
+      if (!resolved.ok)
+        return Promise.resolve({ content: [{ type: "text", text: resolved.error }], isError: true, details: { mode: "workflow", results: [] } });
+      const { workflow: _workflow, args: _args, ...withoutResourceInput } = publicParams;
+      publicParams = { ...withoutResourceInput, workflowScript: resolved.resource.script };
+      workflowResourcePermits.set(publicParams, resolved.resource.permit);
+    } else if (publicParams.workflowScript !== undefined || publicParams.workflowScriptPath !== undefined) {
+      const normalizedArgs = normalizeWorkflowArgs(publicParams.args);
+      if ("error" in normalizedArgs)
+        return Promise.resolve({ content: [{ type: "text", text: normalizedArgs.error }], isError: true, details: { mode: publicParams.action ? "management" : "workflow", results: [] } });
+      publicParams = { ...publicParams, args: deepFreezeWorkflowArgs(normalizedArgs.args) };
+    }
+    const loaded = loadWorkflowScriptPath(publicParams, ctx.cwd);
     if (loaded.error) {
-      return Promise.resolve({ content: [{ type: "text", text: loaded.error }], isError: true, details: { mode: normalized.params.action ? "management" : "workflow", results: [] } });
+      return Promise.resolve({ content: [{ type: "text", text: loaded.error }], isError: true, details: { mode: publicParams.action ? "management" : "workflow", results: [] } });
     }
+    publicExecutions.add(loaded.params);
     return executeWithSingleDispatchGuard(id, loaded.params, signal, onUpdate, ctx);
   };
   const executeDelegated = async (id, params, signal, onUpdate, ctx) => {
@@ -5986,15 +6867,26 @@ ${item.text}` } : item)
   };
   const executeScheduled = (id, params, signal, ctx) => {
     const ownerSessionId = resolveCurrentSessionId(ctx.sessionManager);
-    let ownerExecutor = scheduledOwnerExecutors.get(ownerSessionId);
-    if (!ownerExecutor) {
-      ownerExecutor = createSubagentExecutor({
-        ...deps,
-        state: createScheduledOwnerState(deps.state, ownerSessionId, ctx)
-      });
-      scheduledOwnerExecutors.set(ownerSessionId, ownerExecutor);
+    const runtimeOwnerId = ctx.sessionManager.getSessionId() || null;
+    let ownerExecutors = scheduledOwnerExecutors.get(runtimeOwnerId);
+    if (!ownerExecutors) {
+      ownerExecutors = new Map;
+      scheduledOwnerExecutors.set(runtimeOwnerId, ownerExecutors);
+    }
+    let owner = ownerExecutors.get(ownerSessionId);
+    if (!owner) {
+      const state = createScheduledOwnerState(deps.state, ownerSessionId, ctx);
+      owner = { state, executor: createSubagentExecutor({ ...deps, state }) };
+      ownerExecutors.set(ownerSessionId, owner);
     }
-    return ownerExecutor.execute(id, params, signal, undefined, ctx);
+    return owner.executor.executePublic(id, params, signal, undefined, ctx);
   };
-  return { execute: executeWithSingleDispatchGuard, executePublic, executeDelegated, executeScheduled };
+  function* getCurrentSupervisorOwnerStates() {
+    const ownerId = deps.state.supervisorOwnerSessionId;
+    if (!ownerId)
+      return;
+    for (const owner of scheduledOwnerExecutors.get(ownerId)?.values() ?? [])
+      yield owner.state;
+  }
+  return { execute: executeWithSingleDispatchGuard, executePublic, executeDelegated, executeScheduled, getCurrentSupervisorOwnerStates };
 }