@howarewoo/pi-subagents 0.1.1 → 0.2.0

package/src/coordinator.ts

@@ -1,42 +1,22 @@
-import {
-  leafDenial,
-  toolProvenance,
-  type ToolMetadata,
-  type CapabilityDenial,
-} from "./capabilities.ts";
+import { requireSupportedHost } from "./supported-host.ts";
+import { leafDenial, toolProvenance, type CapabilityDenial } from "./capabilities.ts";
 import { randomUUID } from "node:crypto";
-import { mkdir } from "node:fs/promises";
-import { join } from "node:path";
 import {
-  createAgentSession,
-  createExtensionRuntime,
-  DefaultResourceLoader,
   SessionManager,
-  SettingsManager,
   type AgentSession,
   type AgentSessionEvent,
-  type ExtensionToolContext,
-  type ResourceLoader,
-  type Skill,
-  type ToolDefinition,
 } from "@earendil-works/pi-coding-agent";
-import {
-  resultValidator,
-  submissionParameters,
-  saveOutcomeArtifact,
-  type StructuredOutcome,
-} from "./outcomes.ts";
-import type { Validator } from "@earendil-works/pi-schema";
+import { resultValidator } from "./outcomes.ts";
 import {
   allowsModel,
   sameSelection,
   validateModelSelection,
   type ModelSelection,
 } from "./model-policy.ts";
-import { parentModelRuntime } from "./model-adapter.ts";
-import { resolveWorkspace, workspaceArguments } from "./workspace.ts";
+import { resolveWorkspace } from "./workspace.ts";
 import {
   DEFAULT_POLICY,
+  resolveScheduling,
   narrowLimits,
   validatePolicy,
   type ExecutionLimits,
@@ -59,111 +39,44 @@ const MAX_WAITERS = 64;
 const MAX_WAIT_MS = 60000;
 const MAX_GENERATIONS = 64;
 
-export type DelegationMessage = {
-  id: string;
-  sender: ChildRef | "root";
-  recipient: ChildRef | "root";
-  text: string;
-  mode: "inbox" | "steer" | "followUp";
-  status: "accepted" | "queued" | "handled" | "delivered" | "not-running" | "error";
-  error?: string;
-};
-export type CoordinationWait =
-  | { status: "timeout" | "cancelled" | "shutdown" }
-  | { status: "messages"; messages: DelegationMessage[] }
-  | { status: "message"; message: DelegationMessage }
-  | {
-      status: "outcome";
-      outcome: Pick<ChildSnapshot, "id" | "generation" | "status" | "limitReason">;
-    };
-export type ChildRef = Readonly<{ id: string; generation: number }>;
-export type ChildSnapshot = Readonly<
-  ChildRef & {
-    parentId: string;
-    parentGeneration?: number;
-    depth: number;
-    writerLease: boolean;
-    limits: ExecutionLimits;
-    limitReason?: string;
-    toolCalls: number;
-    status: "queued" | "setup" | "running" | "draining" | "settled" | "failed" | "cancelled";
-    profile: string;
-    tools: readonly BuiltinTool[];
-    leafTools?: readonly string[];
-    skills?: readonly string[];
-    capabilityDenials?: readonly CapabilityDenial[];
-    cwd?: string;
-    assignment: string;
-    activity: string;
-    progress: string;
-    result: string;
-    model: { provider: string; id: string };
-    effort: string | null;
-    prewalk?: {
-      target: ModelSelection;
-      status: "armed" | "handed-off" | "suppressed-exact" | "no-op";
-    };
-    telemetry: {
-      requests: number | null;
-      tokens: ReturnType<AgentSession["getSessionStats"]>["tokens"] | null;
-      cost: number | null;
-      context: ReturnType<AgentSession["getContextUsage"]> | null;
-    };
-    outcome?: StructuredOutcome;
-    artifacts?: { text?: string; structured?: string; error?: string };
-    error?: string;
-    transcript?: string;
-    disposed: boolean;
-    createdAt: number;
-    endedAt: number | null;
-  }
->;
-export type RegistryEvent = Readonly<{
-  type: "changed" | "sdk";
-  child: ChildSnapshot;
-  event?: AgentSessionEvent;
-}>;
-export type StartTask = {
-  cwd?: string;
-  model?: ModelSelection;
-  resultSchema?: unknown;
-  assignment: string;
-  profile: Profile;
-  skills: Skill[];
-  context: ExtensionToolContext;
-  assertTools: (names: readonly string[]) => void;
-  toolMetadata?: () => readonly ToolMetadata[];
-  availableSkills?: () => readonly Skill[];
-  capabilityDenials?: CapabilityDenial[];
-  leafProvenance?: Readonly<Record<string, string>>;
-  callerId: string;
-  parent?: ChildRef;
-  limits?: Partial<ExecutionLimits>;
-  coordinationTools?: (actor: ChildRef) => ToolDefinition[];
-  nestedTool?: (parent: ChildRef) => ToolDefinition;
-};
-type ChildSelection = Pick<
-  ExtensionToolContext,
-  "model" | "modelRegistry" | "scopedModels" | "thinkingLevel" | "cwd"
->;
-type Entry = {
-  validator?: Validator;
-  input: StartTask;
-  selection: ChildSelection;
+export type {
+  DelegationMessage,
+  CoordinationWait,
+  ChildRef,
+  ChildSnapshot,
+  RegistryEvent,
+  StartTask,
+} from "./delegation-types.ts";
+import type {
+  DelegationMessage,
+  CoordinationWait,
+  ChildRef,
+  ChildSnapshot,
+  RegistryEvent,
+  StartTask,
+} from "./delegation-types.ts";
+import { createChildExecution, type ExecutionRecord } from "./child-execution.ts";
+export { childResources } from "./child-execution.ts";
+
+type Entry = ExecutionRecord & {
   done: Promise<void>;
   finish: () => void;
-  timer?: ReturnType<typeof setTimeout>;
   spawned: number;
-  state: ChildSnapshot;
   finalizedMessages?: AgentSession["messages"];
   setup?: Promise<void>;
-  run?: Promise<void>;
-  session?: AgentSession;
-  unsubscribe?: () => void;
-  cancelled: boolean;
+  resuming?: boolean;
+  pauseDrain?: Promise<void>;
   callerId: string;
 };
 
+function broadenedGrant(profile: Profile, grant: Profile) {
+  return (["tools", "skills", "leafTools", "spawn", "coordination"] as const).find((key) =>
+    (profile[key] ?? []).some(
+      (value) => !(grant[key] as readonly string[] | undefined)?.includes(value),
+    ),
+  );
+}
+
 function admittedModel(entry: Entry, selection: ModelSelection): boolean {
   return entry.input.profile.models === undefined
     ? sameSelection(selection, {
@@ -173,31 +86,15 @@ function admittedModel(entry: Entry, selection: ModelSelection): boolean {
     : allowsModel(entry.input.profile, selection);
 }
 
-export function childResources(prompt: string, skills: Skill[] = []): ResourceLoader {
-  const extensions = { extensions: [], errors: [], runtime: createExtensionRuntime() };
-  return {
-    getExtensions: () => extensions,
-    getSkills: () => ({ skills, diagnostics: [] }),
-    getPrompts: () => ({ prompts: [], diagnostics: [] }),
-    getThemes: () => ({ themes: [], diagnostics: [] }),
-    getAgentsFiles: () => ({ agentsFiles: [] }),
-    getSystemPrompt: () =>
-      prompt +
-      "\nYou are a delegated child. Complete only this assignment; use only explicitly granted tools and spawn roles.",
-    getSystemPromptSource: () => undefined,
-    getAppendSystemPrompt: () => [],
-    getAppendSystemPromptSources: () => [],
-    extendResources: () => {},
-    reload: async () => {},
-  };
-}
-
 /** Authoritative parent-lifetime registry. IDs are never reused; controls require their generation. */
 export class DelegationCoordinator {
   private entries = new Map<string, Entry>();
   private queue = new Set<Entry>();
   private history = new Map<string, { state: ChildSnapshot; messages: AgentSession["messages"] }>();
-  private presence = new Map<string, "active" | "idle" | "parked" | "stopped">();
+  private presence = new Map<
+    string,
+    "active" | "pausing" | "paused" | "idle" | "parked" | "stopped"
+  >();
   private coordinationListeners = new Set<() => void>();
   private coordinationMessages: DelegationMessage[] = [];
   private mailboxes = new Map<string, DelegationMessage[]>();
@@ -291,10 +188,11 @@ export class DelegationCoordinator {
   }
   private active(): Entry[] {
     return [...this.entries.values()].filter(
-      (entry) => !entry.state.disposed && entry.state.status !== "queued",
+      (entry) =>
+        !entry.state.disposed && entry.state.status !== "queued" && entry.state.status !== "paused",
     );
   }
-  private validate(input: StartTask): ChildSelection {
+  private validate(input: StartTask): ExecutionRecord["selection"] {
     if (this.closing) throw new Error("Parent shut down");
     if (!input.assignment.trim()) throw new Error("A nonempty assignment is required");
     const selection = {
@@ -334,27 +232,14 @@ export class DelegationCoordinator {
       throw new Error("Shared checkout writer conflict: in-flight parent mutation");
     if (input.parent) {
       const parent = this.entry(input.parent);
-      if (parent.cancelled || parent.state.disposed)
+      if (parent.cancelled || parent.paused || parent.state.disposed)
         throw new Error("Delegating parent is no longer active");
-      if (
-        !admittedModel(parent, effective) ||
-        input.profile.models?.some((model) => !admittedModel(parent, model)) ||
-        (input.profile.prewalk && !input.model && !admittedModel(parent, input.profile.prewalk))
-      )
-        throw new Error("Descendant cannot broaden ancestor model grants");
+      this.assertDescendantModels(parent, input.profile, effective, input.model);
       if (!parent.input.profile.spawn?.includes(input.profile.name))
         throw new Error("Ancestor spawn role denied");
       if (parent.state.depth >= Math.min(this.policy.depth, parent.state.limits.depth))
         throw new Error("Delegation depth limit");
-      if (
-        input.profile.tools.some((tool) => !parent.input.profile.tools.includes(tool)) ||
-        input.profile.skills.some((skill) => !parent.input.profile.skills.includes(skill)) ||
-        input.profile.leafTools?.some((name) => !parent.input.profile.leafTools?.includes(name)) ||
-        input.profile.spawn?.some((role) => !parent.input.profile.spawn?.includes(role)) ||
-        input.profile.coordination?.some(
-          (action) => !parent.input.profile.coordination?.includes(action),
-        )
-      )
+      if (broadenedGrant(input.profile, parent.input.profile))
         throw new Error("Descendant cannot broaden ancestor grants");
       let ancestor: Entry | undefined = parent;
       while (ancestor) {
@@ -365,8 +250,142 @@ export class DelegationCoordinator {
     }
     return selection;
   }
+  private assertDescendantModels(
+    parent: Entry,
+    profile: Profile,
+    effective: ModelSelection,
+    explicit?: ModelSelection,
+  ): void {
+    if (
+      !admittedModel(parent, effective) ||
+      profile.models?.some((model) => !admittedModel(parent, model)) ||
+      (profile.prewalk && !explicit && !admittedModel(parent, profile.prewalk))
+    )
+      throw new Error("Descendant cannot broaden ancestor model grants");
+  }
+  private assertActive(entry: Entry): void {
+    let current: Entry | undefined = entry;
+    while (current) {
+      if (
+        this.entry(current.state) !== current ||
+        current.cancelled ||
+        current.paused ||
+        current.state.disposed ||
+        this.closing
+      )
+        throw new Error("Delegating parent is no longer active");
+      current = current.input.parent ? this.entry(current.input.parent) : undefined;
+    }
+  }
+  /** Each action is bounded by its admission and fresh policy for the whole lineage. */
+  private async authorize(
+    ref: ChildRef,
+    allows: (profile: Profile, index: number) => boolean,
+    denial: string,
+  ): Promise<void> {
+    const lineage: Entry[] = [];
+    let current: Entry | undefined = this.entry(ref);
+    while (current) {
+      this.assertActive(current);
+      if (!allows(current.input.profile, lineage.length)) throw new Error(denial);
+      lineage.push(current);
+      current = current.input.parent ? this.entry(current.input.parent) : undefined;
+    }
+    for (const [index, entry] of lineage.entries()) {
+      const { profile } = await resolveProfile(
+        entry.input.profile.name,
+        entry.input.context.cwd,
+        entry.input.context.isProjectTrusted(),
+        undefined,
+        entry.input.availableSkills?.() ?? entry.input.skills,
+      );
+      if (!allows(profile, index)) throw new Error(denial);
+    }
+    // Policy loading yields: cancellation, pause, shutdown and generation changes win.
+    this.assertActive(lineage[0]);
+  }
+  private effectiveCapabilities(
+    profile: Profile,
+    source: Pick<StartTask, "context" | "toolMetadata">,
+    cwd: string,
+  ) {
+    const callable = new Set(source.context.tools.map((tool) => tool.name));
+    const capabilityDenials: CapabilityDenial[] = [];
+    const leafTools: string[] = [];
+    const leafProvenance: Record<string, string> = {};
+    if (profile.name === "general") {
+      const metadata = source.toolMetadata?.() ?? [];
+      const sameWorkspace = cwd === resolveWorkspace(undefined, source.context.cwd);
+      for (const tool of metadata) {
+        if (profile.tools.includes(tool.name as BuiltinTool)) continue;
+        const reason = !callable.has(tool.name)
+          ? "tool is not live callable"
+          : leafDenial(tool, profile.leafTools ?? [], sameWorkspace);
+        if (reason) capabilityDenials.push({ name: tool.name, reason });
+        else {
+          leafTools.push(tool.name);
+          leafProvenance[tool.name] = toolProvenance(tool);
+        }
+      }
+      for (const name of profile.leafTools ?? [])
+        if (!metadata.some((tool) => tool.name === name))
+          capabilityDenials.push({ name, reason: "tool metadata unavailable" });
+    }
+    return {
+      profile: { ...profile, leafTools, tools: profile.tools.filter((name) => callable.has(name)) },
+      capabilityDenials,
+      leafProvenance,
+    };
+  }
+  async authorizeSpawn(
+    ref: ChildRef,
+    profile: Profile,
+    model?: ModelSelection,
+    source?: Pick<StartTask, "context" | "toolMetadata" | "cwd">,
+  ): Promise<void> {
+    const parent = this.entry(ref);
+    this.assertDescendantModels(
+      parent,
+      profile,
+      model ??
+        profile.model ?? {
+          ...parent.state.model,
+          effort: parent.state.effort as ModelSelection["effort"],
+        },
+      model,
+    );
+    // Compare effective capabilities, not unavailable configured ceilings.
+    profile = this.effectiveCapabilities(
+      profile,
+      source ?? parent.input,
+      resolveWorkspace(source?.cwd ?? parent.selection.cwd, (source ?? parent.input).context.cwd),
+    ).profile;
+    const roles = [profile.name];
+    let current: Entry | undefined = this.entry(ref);
+    while (current) {
+      roles.push(current.input.profile.name);
+      current = current.input.parent ? this.entry(current.input.parent) : undefined;
+    }
+    await this.authorize(
+      ref,
+      (grant, index) => !!grant.spawn?.includes(roles[index]) && !broadenedGrant(profile, grant),
+      "Current or admitted ancestor spawn grant denied; descendant cannot broaden ancestor grants",
+    );
+  }
+  async admit(
+    inputs: StartTask[],
+    replacement?: ChildRef,
+    signal?: AbortSignal,
+  ): Promise<ChildRef[]> {
+    requireSupportedHost();
+    for (const input of inputs)
+      if (input.parent) await this.authorizeSpawn(input.parent, input.profile, input.model, input);
+    signal?.throwIfAborted();
+    for (const input of inputs) if (input.parent) this.assertActive(this.entry(input.parent));
+    return this.admitAuthorized(inputs, replacement);
+  }
   /** Whole-batch synchronous validation precedes registry insertion, disk setup or dispatch. */
-  admit(inputs: StartTask[], replacement?: ChildRef): ChildRef[] {
+  private admitAuthorized(inputs: StartTask[], replacement?: ChildRef): ChildRef[] {
     const previous = replacement ? this.entry(replacement) : undefined;
     inputs = inputs.map((input) => {
       const cwd = resolveWorkspace(
@@ -379,39 +398,28 @@ export class DelegationCoordinator {
         throw new Error("Follow-up must retain its original workspace");
       if (typeof input.assertTools !== "function")
         throw new Error("Delegation requires a parent builtin provenance validator");
-      const callable = new Set(input.context.tools.map((tool) => tool.name));
-      const capabilityDenials: CapabilityDenial[] = [];
-      const leafTools: string[] = [];
-      const leafProvenance: Record<string, string> = {};
-      if (input.profile.name === "general") {
-        const metadata = input.toolMetadata?.() ?? [];
-        const sameWorkspace = cwd === resolveWorkspace(undefined, input.context.cwd);
-        for (const tool of metadata) {
-          if (input.profile.tools.includes(tool.name as BuiltinTool)) continue;
-          const reason = !callable.has(tool.name)
-            ? "tool is not live callable"
-            : leafDenial(tool, input.profile.leafTools ?? [], sameWorkspace);
-          if (reason) capabilityDenials.push({ name: tool.name, reason });
-          else {
-            leafTools.push(tool.name);
-            leafProvenance[tool.name] = toolProvenance(tool);
-          }
-        }
-        for (const name of input.profile.leafTools ?? [])
-          if (!metadata.some((tool) => tool.name === name))
-            capabilityDenials.push({ name, reason: "tool metadata unavailable" });
-      }
-      const profile = {
-        ...input.profile,
-        leafTools,
-        tools: input.profile.tools.filter((name) => callable.has(name)),
-      };
+      const { profile, capabilityDenials, leafProvenance } = this.effectiveCapabilities(
+        input.profile,
+        input,
+        cwd,
+      );
       if (!profile.tools.length)
         throw new Error(
           `Profile ${profile.name} has no callable parent builtin tools; enable an allowed parent tool or choose a usable profile`,
         );
       input.assertTools(profile.tools);
-      return { ...input, profile, cwd, capabilityDenials, leafProvenance };
+      // Capture the admitted ceiling, but keep root/ancestor revocation live. A nested
+      // task uses the root dispatcher context, not its immediate parent's SDK context.
+      const inheritedCodemode = input.parent
+        ? this.entry(input.parent).input.codemodeEnabled
+        : undefined;
+      const enabled =
+        !!input.codemodeEnabled?.() &&
+        (!input.parent || !!inheritedCodemode?.()) &&
+        (!previous || !!previous.input.codemodeEnabled?.());
+      const codemodeEnabled = () =>
+        enabled && !!input.codemodeEnabled?.() && (!input.parent || !!inheritedCodemode?.());
+      return { ...input, profile, cwd, capabilityDenials, leafProvenance, codemodeEnabled };
     });
     if (previous) {
       if (
@@ -434,13 +442,7 @@ export class DelegationCoordinator {
         throw new Error("Follow-up cannot broaden previous model grants");
       if (
         profile.name !== previous.input.profile.name ||
-        profile.tools.some((tool) => !previous.input.profile.tools.includes(tool)) ||
-        profile.skills.some((skill) => !previous.input.profile.skills.includes(skill)) ||
-        profile.leafTools?.some((name) => !previous.input.profile.leafTools?.includes(name)) ||
-        profile.spawn?.some((role) => !previous.input.profile.spawn?.includes(role)) ||
-        profile.coordination?.some(
-          (action) => !previous.input.profile.coordination?.includes(action),
-        )
+        broadenedGrant(profile, previous.input.profile)
       )
         throw new Error("Follow-up cannot broaden previous grants");
     }
@@ -465,18 +467,7 @@ export class DelegationCoordinator {
       return narrowLimits(maximum, input.limits ?? {});
     });
     const queued = this.queue.size;
-    const pending = [...this.queue].map((entry) => entry.input).concat(inputs);
-    let slots = Math.max(0, this.policy.concurrency - this.active().length);
-    let writerBusy = !!this.writer || !!this.parentMutations.size;
-    let dispatchable = 0;
-    for (const input of pending) {
-      if (!slots || (isWriter(input.profile) && writerBusy)) break;
-      slots--;
-      dispatchable++;
-      if (isWriter(input.profile)) writerBusy = true;
-    }
-    if (pending.length - dispatchable > this.policy.queue)
-      throw new Error("Delegation queue capacity limit");
+    this.assertQueueCapacity(inputs);
     const parents = new Map<Entry, number>();
     for (const input of inputs)
       if (input.parent) {
@@ -523,6 +514,9 @@ export class DelegationCoordinator {
           writerLease: false,
           limits: limits[index],
           toolCalls: 0,
+          spawned: previous?.spawned ?? 0,
+          window: 1,
+          retainedContext: false,
           profile: input.profile.name,
           tools: [...input.profile.tools],
           leafTools: [...(input.profile.leafTools ?? [])],
@@ -558,7 +552,10 @@ export class DelegationCoordinator {
       };
       return entry;
     });
-    for (const [parent, count] of parents) parent.spawned += count;
+    for (const [parent, count] of parents) {
+      parent.spawned += count;
+      this.update(parent, { spawned: parent.spawned });
+    }
     if (previous)
       this.history.set(this.key(previous.state), {
         state: structuredClone(previous.state),
@@ -579,7 +576,7 @@ export class DelegationCoordinator {
     return entries.map((entry) => ({ id: entry.state.id, generation: entry.state.generation }));
   }
   async start(input: StartTask): Promise<ChildRef> {
-    const [ref] = this.admit([input]);
+    const [ref] = await this.admit([input]);
     await this.entry(ref).setup;
     return ref;
   }
@@ -592,7 +589,8 @@ export class DelegationCoordinator {
     }
     return parent && { id: parent.id, generation: parent.generation };
   }
-  renew(ref: ChildRef, input: StartTask): ChildRef {
+  async renew(ref: ChildRef, input: StartTask, signal?: AbortSignal): Promise<ChildRef> {
+    requireSupportedHost();
     const previous = this.entry(ref);
     this.renewalParent(ref);
     const profile = intersectProfileGrants(input.profile, previous.input.profile);
@@ -600,24 +598,41 @@ export class DelegationCoordinator {
       previous.state.prewalk && ["handed-off", "no-op"].includes(previous.state.prewalk.status)
         ? previous.state.prewalk.target
         : previous.input.model;
-    const next = this.admit(
-      [
-        {
-          ...input,
-          model: retained ?? input.model,
-          profile,
-          skills: input.skills.filter((skill) => profile.skills.includes(skill.filePath)),
-          resultSchema:
-            input.resultSchema === undefined ? previous.input.resultSchema : input.resultSchema,
-          limits: narrowLimits(previous.state.limits, input.limits ?? {}),
-        },
-      ],
-      ref,
+    const next = (
+      await this.admit(
+        [
+          {
+            ...input,
+            model: retained ?? input.model,
+            profile,
+            skills: input.skills.filter((skill) => profile.skills.includes(skill.filePath)),
+            resultSchema:
+              input.resultSchema === undefined ? previous.input.resultSchema : input.resultSchema,
+            limits: narrowLimits(previous.state.limits, input.limits ?? {}),
+          },
+        ],
+        ref,
+        signal,
+      )
     )[0];
     if (previous.state.prewalk && previous.state.prewalk.status !== "armed")
       this.update(this.entry(next), { prewalk: previous.state.prewalk });
     return next;
   }
+  private assertQueueCapacity(inputs: StartTask[]): void {
+    const pending = [...this.queue].map((entry) => entry.input).concat(inputs);
+    let slots = Math.max(0, this.policy.concurrency - this.active().length);
+    let writerBusy = !!this.writer || !!this.parentMutations.size;
+    let dispatchable = 0;
+    for (const input of pending) {
+      if (!slots || (isWriter(input.profile) && writerBusy)) break;
+      slots--;
+      dispatchable++;
+      if (isWriter(input.profile)) writerBusy = true;
+    }
+    if (pending.length - dispatchable > this.policy.queue)
+      throw new Error("Delegation queue capacity limit");
+  }
   private pump(): void {
     if (this.closing) return;
     for (const entry of this.queue) {
@@ -633,445 +648,346 @@ export class DelegationCoordinator {
         writerLease: writer,
         activity: "Preparing SDK child",
       };
-      entry.setup = this.create(entry, entry.input, entry.selection);
+      entry.setup = entry.session
+        ? Promise.resolve().then(() => {
+            if (!entry.paused && !entry.cancelled) return entry.prompt!(entry.resumeText!);
+          })
+        : this.create(entry);
       this.update(entry, {});
       void entry.setup.catch(() => {});
     }
   }
-  private limit(entry: Entry, reason: string): void {
-    if (
-      entry.cancelled ||
-      entry.state.disposed ||
-      entry.state.limitReason ||
-      ["settled", "failed", "cancelled"].includes(entry.state.status)
-    )
-      return;
-    this.update(entry, { limitReason: reason, error: `Execution limit: ${reason}` });
-    void this.stop(entry.state);
+  /** Mark the entire active subtree before aborting any SDK or releasing any permit. */
+  private pause(ref: ChildRef): Promise<void> {
+    const root = this.entry(ref);
+    if (root.pauseDrain) return root.pauseDrain;
+    const entries: Entry[] = [];
+    const collect = (entry: Entry) => {
+      if (entry.cancelled || entry.state.disposed || entry.paused) return;
+      entries.push(entry);
+      for (const child of this.children(entry)) collect(child);
+    };
+    collect(root);
+    for (const entry of entries) {
+      entry.paused = true;
+      this.presence.set(entry.state.id, "pausing");
+      clearTimeout(entry.timer);
+      this.queue.delete(entry);
+    }
+    for (const entry of entries)
+      this.update(entry, {
+        status: "pausing",
+        pauseReason: entry === root ? "deadline" : "ancestor deadline",
+        activity: "Deadline reached; aborting and draining before pause",
+      });
+    const drain = async (entry: Entry) => {
+      await entry.setup?.catch(() => {});
+      await entry.session?.abort();
+      await entry.run;
+    };
+    // Start aborts concurrently: an ancestor may be awaiting its descendant's outcome.
+    const drains = new Map(entries.map((entry) => [entry, drain(entry)]));
+    const completions = new Map<Entry, Promise<void>>();
+    const complete = (entry: Entry): Promise<void> => {
+      const existing = completions.get(entry);
+      if (existing) return existing;
+      const completion = Promise.all([
+        drains.get(entry),
+        // Independently pausing children already own their abort and subtree drain.
+        ...this.children(entry).map((child) =>
+          drains.has(child) ? complete(child) : child.pauseDrain,
+        ),
+      ]).then(() => {
+        if (entry.cancelled || this.closing || entry.state.disposed) return;
+        if (this.writer === entry.state.id) this.writer = undefined;
+        this.presence.set(entry.state.id, "paused");
+        this.update(entry, {
+          status: "paused",
+          writerLease: false,
+          retainedContext: !!entry.session,
+          activity: "Paused; explicitly resume to continue retained conversation",
+        });
+        entry.finish();
+        this.pump();
+      });
+      completions.set(entry, completion);
+      entry.pauseDrain = completion;
+      return completion;
+    };
+    const paused = Promise.all(entries.map(complete)).then(() => {});
+    return paused;
   }
-  private async create(entry: Entry, input: StartTask, selection: ChildSelection): Promise<void> {
+  /** Continue a drained window without replacing the identity or SDK conversation. */
+  async resume(ref: ChildRef, text: string): Promise<ChildRef> {
+    requireSupportedHost();
+    const entry = this.entry(ref);
+    if (entry.resuming || entry.state.status !== "paused" || entry.cancelled || this.closing)
+      throw new Error("Resume requires a drained paused assignment; duplicate resume rejected");
+    if (!text.trim()) throw new Error("Nonempty continuation text is required");
+    entry.resuming = true;
     try {
-      await mkdir(this.root, { recursive: true });
-      const taskDir = join(
-        this.root,
-        entry.state.generation === 1
-          ? entry.state.id
-          : `${entry.state.id}-g${entry.state.generation}`,
-      );
-      await mkdir(taskDir); // exclusive ownership: never reuse an existing task record
-      const agentDir = join(taskDir, "agent");
-      await mkdir(agentDir);
-      const target =
-        entry.state.prewalk?.status === "armed"
-          ? validateModelSelection(input.context, entry.state.prewalk.target)
-          : undefined;
-      let policyError: string | undefined;
-      const effective = (): ModelSelection => ({
+      const parent = this.renewalParent(ref);
+      const input = entry.input;
+      const policy = await resolveScheduling(input.context.cwd, input.context.isProjectTrusted());
+      this.configure(policy);
+      const limits = { ...entry.state.limits };
+      for (const key of Object.keys(limits) as (keyof ExecutionLimits)[])
+        limits[key] = Math.min(
+          limits[key],
+          policy[key],
+          parent ? this.entry(parent).state.limits[key] : Infinity,
+        );
+      let current: Entry | undefined = entry;
+      let descendant: Entry | undefined;
+      const selected: ModelSelection = {
         ...entry.state.model,
         effort: entry.state.effort as ModelSelection["effort"],
-      });
-      const revalidate = async (selected: ModelSelection, requirePrewalk: boolean) => {
-        let current: Entry | undefined = entry;
-        while (current) {
-          const policy = (
-            await resolveProfile(
-              current.input.profile.name,
-              input.context.cwd,
-              input.context.isProjectTrusted(),
-              undefined,
-              current.input.availableSkills?.() ?? current.input.skills,
-            )
-          ).profile;
-          if (
-            (current.input.profile.models !== undefined && policy.models === undefined) ||
-            !allowsModel(policy, selected) ||
-            !admittedModel(current, selected)
-          )
-            throw new Error("Current or admitted model policy denied selection");
-          if (
-            current === entry &&
-            requirePrewalk &&
-            (!policy.prewalk || !sameSelection(policy.prewalk, entry.state.prewalk!.target))
-          )
-            throw new Error("Current prewalk grant revoked");
-          current = current.input.parent ? this.entry(current.input.parent) : undefined;
-        }
-        validateModelSelection(input.context, selected);
       };
-      const runtime = await parentModelRuntime(
-        selection,
-        agentDir,
-        () => {
-          if (policyError) throw new Error(policyError);
-          validateModelSelection(input.context, effective());
-          if (entry.cancelled || this.closing) throw new Error("Delegation cancelled");
-          if ((entry.state.telemetry.requests ?? 0) >= entry.state.limits.requests) {
-            this.limit(entry, "requests");
-            throw new Error("Direct request limit");
-          }
-          this.update(entry, {
-            telemetry: {
-              ...entry.state.telemetry,
-              requests: (entry.state.telemetry.requests ?? 0) + 1,
-            },
-          });
-        },
-        target ? [target] : [],
-      );
-      const resources = childResources(
-        input.profile.prompt +
-          (target
-            ? "\nPrewalk: investigate and plan using only granted context/tools. After the first completed edit or write the same conversation switches once to the explicitly granted implementation target; all normal budgets still apply."
-            : "") +
-          `\nYour delegation identity is ${entry.state.id} generation ${entry.state.generation}; parent ${entry.state.parentId}. Coordination, if granted, is limited to family identities explicitly supplied to you.` +
-          (entry.validator
-            ? "\nThis assignment requires a structured result. Call submit_result with the actual value; final prose is not a submission."
-            : ""),
-        input.skills,
+      while (current) {
+        const { profile } = await resolveProfile(
+          current.input.profile.name,
+          input.context.cwd,
+          input.context.isProjectTrusted(),
+          undefined,
+          current.input.availableSkills?.() ?? current.input.skills,
+        );
+        if (
+          (current.input.profile.models !== undefined && profile.models === undefined) ||
+          !allowsModel(profile, selected) ||
+          !admittedModel(current, selected)
+        )
+          throw new Error("Resume denied: current or admitted model policy revoked");
+        if (descendant && !profile.spawn?.includes(descendant.input.profile.name))
+          throw new Error("Resume denied: ancestor spawn role revoked");
+        // Reject revoked grants instead of rebuilding an SDK tool/resource graph. This never
+        // broadens the original admission and leaves the paused conversation recoverable.
+        const revoked = broadenedGrant(input.profile, profile);
+        if (revoked) throw new Error(`Resume denied: current ${revoked} grant revoked`);
+        if (
+          current === entry &&
+          entry.state.prewalk?.status === "armed" &&
+          (!profile.prewalk || !sameSelection(profile.prewalk, entry.state.prewalk.target))
+        )
+          throw new Error("Resume denied: prewalk grant revoked");
+        descendant = current;
+        current = current.input.parent ? this.entry(current.input.parent) : undefined;
+      }
+      validateModelSelection(input.context, selected);
+      const auth = await input.context.modelRegistry.getApiKeyAndHeaders(
+        validateModelSelection(input.context, selected),
       );
-      const loader = new DefaultResourceLoader({
-        cwd: selection.cwd,
-        agentDir,
-        settingsManager: SettingsManager.inMemory(),
-        noExtensions: true,
-        noSkills: true,
-        noPromptTemplates: true,
-        noThemes: true,
-        noContextFiles: true,
-        extensionFactories: [
-          (pi) => {
-            pi.on("turn_start", async () => {
-              try {
-                await revalidate(effective(), entry.state.prewalk?.status === "armed");
-              } catch (error) {
-                policyError = String(error);
-              }
-            });
-            pi.on("turn_end", async (event) => {
-              if (
-                !entry.cancelled &&
-                !this.closing &&
-                entry.state.prewalk?.status === "armed" &&
-                event.toolResults.some(
-                  (result) =>
-                    (result.toolName === "edit" || result.toolName === "write") &&
-                    input.profile.tools.includes(result.toolName),
-                )
-              ) {
-                try {
-                  const next = entry.state.prewalk.target;
-                  await revalidate(next, true);
-                  if (entry.cancelled || this.closing) return;
-                  await entry.session!.setModel(target!);
-                  entry.session!.setThinkingLevel(next.effort);
-                  if (entry.session!.thinkingLevel !== next.effort)
-                    throw new Error("SDK coerced prewalk effort");
-                  this.update(entry, {
-                    model: { provider: next.provider, id: next.id },
-                    effort: next.effort,
-                    prewalk: { target: next, status: "handed-off" },
-                  });
-                } catch (error) {
-                  policyError = String(error);
-                }
-              }
-            });
-          },
-        ],
-      });
-      await loader.reload();
-      resources.getExtensions = () => loader.getExtensions();
-      const tools: ToolDefinition[] = [
-        ...input.profile.tools,
-        ...(input.profile.leafTools ?? []),
-      ].map((name) => {
-        const tool = input.context.tools.find((tool) => tool.name === name);
-        if (!tool) throw new Error(`Admitted parent tool is no longer callable: ${name}`);
-        return {
-          name,
-          label: name,
-          description: tool.description,
-          parameters: tool.parameters,
-          execute: async (_id, args, signal, onUpdate) => {
-            if (entry.cancelled || this.closing) throw new Error("Delegation cancelled");
-            if (!input.context.tools.some((tool) => tool.name === name))
-              throw new Error(`Admitted parent tool is no longer callable: ${name}`);
-            const builtin = input.profile.tools.includes(name as BuiltinTool);
-            // Re-read configuration for this generation and every ancestor before dispatch.
-            let current: Entry | undefined = entry;
-            while (current) {
-              const { profile } = await resolveProfile(
-                current.input.profile.name,
-                input.context.cwd,
-                input.context.isProjectTrusted(),
-                undefined,
-                current.input.availableSkills?.() ?? current.input.skills,
-              );
-              if (
-                builtin
-                  ? !profile.tools.includes(name as BuiltinTool)
-                  : !profile.leafTools?.includes(name)
-              )
-                throw new Error(`Current capability grant revoked: ${name}`);
-              current = current.input.parent ? this.entry(current.input.parent) : undefined;
-            }
-            if (entry.cancelled || this.closing) throw new Error("Delegation cancelled");
-            if (builtin) input.assertTools([name]);
-            else {
-              const metadata = input.toolMetadata?.().find((tool) => tool.name === name);
-              if (
-                !metadata ||
-                leafDenial(
-                  metadata,
-                  input.profile.leafTools ?? [],
-                  selection.cwd === resolveWorkspace(undefined, input.context.cwd),
-                ) ||
-                toolProvenance(metadata) !== input.leafProvenance?.[name]
-              )
-                throw new Error(`Leaf capability revoked or reclassified: ${name}`);
-            }
-            if (!input.context.tools.some((tool) => tool.name === name))
-              throw new Error(`Admitted parent tool is no longer callable: ${name}`);
-            // The public parent dispatcher preserves validation and permission hooks. Do not
-            // call a raw create*Tool.execute here: that would bypass operator policy.
-            const outcome = await input.context.executeTool(
-              name,
-              builtin
-                ? workspaceArguments(name as BuiltinTool, args, selection.cwd, input.context.cwd)
-                : args,
-              { signal, onUpdate },
-            );
-            return { ...outcome.result, isError: outcome.isError };
-          },
-        };
-      });
-      if (entry.validator) {
-        const submission: ToolDefinition<typeof submissionParameters> = {
-          name: "submit_result",
-          label: "Submit result",
-          exposure: "model-only",
-          description: `Submit the assignment's required structured JSON value exactly once. Invalid values return errors and can be corrected within normal limits. Submission is provisional until prompt/tools/descendants drain; it never overrides cancellation or failure. Required schema: ${JSON.stringify(input.resultSchema)}`,
-          parameters: submissionParameters,
-          execute: async (_id, args, signal) => {
-            signal?.throwIfAborted();
-            if (
-              entry.cancelled ||
-              this.closing ||
-              entry.state.disposed ||
-              entry.state.status !== "running"
-            )
-              throw new Error("Submission identity is no longer running");
-            const outcome = entry.state.outcome!;
-            if (outcome.validation === "submitted")
-              throw new Error("A result was already submitted; duplicate submission rejected");
-            const checked = entry.validator!.validate(args.value);
-            if (!checked.ok) {
-              const errors = checked.errors
-                .map((error) => `${error.path || "/"}: ${error.message}`)
-                .slice(0, 32);
-              this.update(entry, {
-                outcome: {
-                  validation: "invalid",
-                  attempts: outcome.attempts + 1,
-                  errors,
-                  finalized: false,
-                },
-              });
-              throw new Error(
-                "Invalid structured result; correct and resubmit: " + errors.join("; "),
-              );
-            }
-            this.update(entry, {
-              outcome: {
-                validation: "submitted",
-                attempts: outcome.attempts + 1,
-                errors: [],
-                value: structuredClone(args.value),
-                finalized: false,
-              },
-            });
-            return {
-              content: [
-                {
-                  type: "text",
-                  text: "Structured value submitted; final outcome awaits prompt/tool/descendant drain.",
-                },
-              ],
-              details: {},
-            };
-          },
-        };
-        tools.push(submission);
+      if (!auth.ok) throw new Error(auth.error);
+      if (entry.state.prewalk?.status === "armed") {
+        const target = validateModelSelection(input.context, entry.state.prewalk.target);
+        const targetAuth = await input.context.modelRegistry.getApiKeyAndHeaders(target);
+        if (!targetAuth.ok) throw new Error(targetAuth.error);
       }
-      if (input.profile.coordination?.length && input.coordinationTools)
-        tools.push(
-          ...input.coordinationTools({ id: entry.state.id, generation: entry.state.generation }),
-        );
-      if (input.profile.spawn?.length && input.nestedTool)
-        tools.push(input.nestedTool(entry.state));
-      for (const tool of tools) {
-        const execute = tool.execute;
-        tool.execute = async (...args) => {
-          if (entry.cancelled || this.closing) throw new Error("Delegation cancelled");
-          if (entry.state.toolCalls >= entry.state.limits.tools) {
-            this.limit(entry, "tools");
-            throw new Error("Tool call limit");
-          }
-          this.update(entry, { toolCalls: entry.state.toolCalls + 1 });
-          return execute(...args);
-        };
+      input.assertTools(input.profile.tools);
+      for (const name of [...input.profile.tools, ...(input.profile.leafTools ?? [])]) {
+        if (!input.context.tools.some((tool) => tool.name === name))
+          throw new Error(`Resume denied: admitted tool no longer callable: ${name}`);
+        if (input.profile.leafTools?.includes(name)) {
+          const metadata = input.toolMetadata?.().find((tool) => tool.name === name);
+          if (
+            !metadata ||
+            leafDenial(
+              metadata,
+              input.profile.leafTools,
+              entry.selection.cwd === resolveWorkspace(undefined, input.context.cwd),
+            ) ||
+            toolProvenance(metadata) !== input.leafProvenance?.[name]
+          )
+            throw new Error(`Resume denied: leaf capability revoked or reclassified: ${name}`);
+        }
       }
-      const { session, modelFallbackMessage } = await createAgentSession({
-        cwd: selection.cwd,
-        agentDir,
-        modelRuntime: runtime,
-        model: selection.model,
-        thinkingLevel: selection.thinkingLevel,
-        scopedModels: [
-          { model: selection.model!, thinkingLevel: selection.thinkingLevel },
-          ...(target ? [{ model: target, thinkingLevel: input.profile.prewalk!.effort }] : []),
-        ],
-        resourceLoader: resources,
-        tools: tools.map((tool) => tool.name),
-        customTools: tools,
-        settingsManager: SettingsManager.inMemory({
-          compaction: { enabled: false },
-          retry: { enabled: false },
-        }),
-        sessionManager: SessionManager.create(selection.cwd, join(taskDir, "transcripts")),
-      });
-      entry.session = session;
-      if (session.thinkingLevel !== selection.thinkingLevel)
-        throw new Error("SDK did not preserve selected effort");
       if (
-        modelFallbackMessage ||
-        session.model?.id !== selection.model?.id ||
-        session.model?.provider !== selection.model?.provider
+        (entry.state.telemetry.requests ?? 0) >= limits.requests ||
+        entry.state.toolCalls >= limits.tools ||
+        entry.spawned > limits.spawns
       )
-        throw new Error("SDK did not preserve selected model");
-      let markStarted!: () => void;
-      const started = new Promise<void>((resolve) => {
-        markStarted = resolve;
-      });
-      entry.unsubscribe = session.subscribe((event) => {
-        const patch: { -readonly [K in keyof ChildSnapshot]?: ChildSnapshot[K] } = {};
-        if (event.type === "agent_start") {
-          patch.status = entry.cancelled ? "draining" : "running";
-          markStarted();
-        }
-        if (event.type === "message_update" && event.assistantMessageEvent.type === "text_delta") {
-          patch.progress = (entry.state.progress + event.assistantMessageEvent.delta).slice(-4096);
-          patch.activity = patch.progress;
-        }
-        if (event.type === "message_end" && event.message.role === "user") {
-          const text =
-            typeof event.message.content === "string"
-              ? event.message.content
-              : event.message.content
-                  .filter((block) => block.type === "text")
-                  .map((block) => block.text)
-                  .join("");
-          for (const message of this.coordinationMessages)
-            if (
-              message.recipient !== "root" &&
-              this.key(message.recipient) === this.key(entry.state) &&
-              text ===
-                `Delegation message ${message.id} from ${message.sender === "root" ? "root" : this.key(message.sender)}: ${message.text}`
-            )
-              message.status = "delivered";
-          this.notifyCoordination();
-        }
-        if (event.type === "tool_execution_start") patch.activity = `Tool: ${event.toolName}`;
-        if (event.type === "message_end" && event.message.role === "assistant") {
-          const stats = session.getSessionStats();
-          patch.telemetry = {
-            ...entry.state.telemetry,
-            tokens: stats.tokens,
-            cost: stats.cost,
-            context: session.getContextUsage() ?? null,
-          };
-        }
-        this.update(entry, patch, event);
+        throw new Error("Resume denied: cumulative execution budget exhausted");
+      if (entry.state.depth > limits.depth)
+        throw new Error("Resume denied: delegation depth limit");
+      // Reuse the original admission's writer and nested no-lending checks, without
+      // admitting another task or charging another spawn.
+      this.validate(input);
+      this.renewalParent(ref);
+      const available =
+        this.active().length < policy.concurrency &&
+        (!isWriter(input.profile) || (!this.writer && !this.parentMutations.size));
+      if (parent && (this.queue.size || !available))
+        throw new Error("Nested capacity unavailable; no permit lending");
+      this.assertQueueCapacity([input]);
+      if (
+        entry.cancelled ||
+        this.closing ||
+        entry.state.disposed ||
+        entry.state.status !== "paused"
+      )
+        throw new Error("Resume cancelled by stop or shutdown");
+      entry.done = new Promise<void>((resolve) => {
+        entry.finish = resolve;
       });
-      this.update(entry, { transcript: session.sessionFile });
-      if (this.closing || entry.cancelled) {
-        this.update(entry, { status: "cancelled" });
-        this.dispose(entry);
-        return;
-      }
-      entry.run = session
-        .prompt(input.assignment, { expandPromptTemplates: false })
-        .then(async () => {
-          await this.stopMany(this.children(entry).map((child) => child.state));
-          const last = session.messages.filter((message) => message.role === "assistant").at(-1);
-          const failed = !last || last.stopReason === "error";
-          const stats = session.getSessionStats();
-          this.update(entry, { status: "draining", activity: "Finalizing outcome artifacts" });
-          const result = session.getLastAssistantText() ?? "";
-          const artifacts: NonNullable<ChildSnapshot["artifacts"]> = {};
-          try {
-            artifacts.text = await saveOutcomeArtifact(
-              taskDir,
-              "result.txt",
-              last?.content
-                .filter((block) => block.type === "text")
-                .map((block) => block.text)
-                .join("") ?? "",
-            );
-            if (entry.state.outcome?.validation === "submitted")
-              artifacts.structured = await saveOutcomeArtifact(
-                taskDir,
-                "structured.json",
-                JSON.stringify(entry.state.outcome.value),
-              );
-          } catch (error) {
-            artifacts.error = `Outcome artifact persistence failed: ${String(error)}`;
-          }
-          const missing = entry.validator && entry.state.outcome?.validation !== "submitted";
-          this.update(entry, {
-            artifacts,
-            outcome: entry.state.outcome ? { ...entry.state.outcome, finalized: true } : undefined,
-            status:
-              entry.cancelled || last?.stopReason === "aborted"
-                ? "cancelled"
-                : failed || missing || artifacts.error
-                  ? "failed"
-                  : "settled",
-            result,
-            error: entry.state.limitReason
-              ? entry.state.error
-              : failed
-                ? (last?.errorMessage ?? "No final assistant outcome")
-                : missing
-                  ? "Required structured result was not submitted successfully"
-                  : artifacts.error,
-            activity: "Prompt completed",
-            telemetry: {
-              requests: entry.state.telemetry.requests,
-              tokens: stats.assistantMessages ? stats.tokens : null,
-              cost: stats.assistantMessages ? stats.cost : null,
-              context: session.getContextUsage() ?? null,
-            },
-          });
-        })
-        .catch(async (error) => {
-          await this.stopMany(this.children(entry).map((child) => child.state));
-          this.update(entry, {
-            status: entry.cancelled ? "cancelled" : "failed",
-            error: entry.state.limitReason ? entry.state.error : String(error),
-          });
-        })
-        .finally(() => this.dispose(entry));
-      // prompt preparation precedes abort-signal ownership; acknowledge only abortable work.
-      await Promise.race([started, entry.run]);
-    } catch (error) {
+      entry.paused = false;
+      this.presence.set(entry.state.id, "active");
+      entry.pauseDrain = undefined;
+      entry.resumeText =
+        !entry.prompted && entry.resumeText ? entry.resumeText + "\n\n" + text : text;
+      entry.run = undefined;
+      this.queue.add(entry);
       this.update(entry, {
-        status: entry.cancelled || this.closing ? "cancelled" : "failed",
-        error: String(error),
+        status: "queued",
+        pauseReason: undefined,
+        error: undefined,
+        limits,
+        window: (entry.state.window ?? 1) + 1,
+        activity: "Continuation queued for admission",
       });
-      this.dispose(entry);
-      throw error;
+      const window = entry.state.window;
+      entry.timer = setTimeout(() => {
+        if (entry.state.window === window) this.limit(entry, "deadline");
+      }, limits.deadlineMs);
+      this.pump();
+      return { id: ref.id, generation: ref.generation };
+    } finally {
+      entry.resuming = false;
+    }
+  }
+  private limit(entry: Entry, reason: string): void {
+    if (
+      entry.cancelled ||
+      entry.state.disposed ||
+      entry.state.limitReason ||
+      ["settled", "failed", "cancelled"].includes(entry.state.status)
+    )
+      return;
+    if (reason === "deadline") {
+      void this.pause(entry.state);
+      return;
+    }
+    this.update(entry, { limitReason: reason, error: `Execution limit: ${reason}` });
+    void this.stop(entry.state);
+  }
+  private chargeToolCall(entry: Entry): void {
+    if (entry.state.toolCalls >= entry.state.limits.tools) {
+      this.limit(entry, "tools");
+      throw new Error("Tool call limit");
+    }
+    this.update(entry, { toolCalls: entry.state.toolCalls + 1 });
+  }
+  private async revalidateExecutionModel(
+    entry: Entry,
+    selected: ModelSelection,
+    requirePrewalk: boolean,
+  ): Promise<void> {
+    const { input } = entry;
+    let current: Entry | undefined = entry;
+    while (current) {
+      const policy = (
+        await resolveProfile(
+          current.input.profile.name,
+          input.context.cwd,
+          input.context.isProjectTrusted(),
+          undefined,
+          current.input.availableSkills?.() ?? current.input.skills,
+        )
+      ).profile;
+      if (
+        (current.input.profile.models !== undefined && policy.models === undefined) ||
+        !allowsModel(policy, selected) ||
+        !admittedModel(current, selected)
+      )
+        throw new Error("Current or admitted model policy denied selection");
+      if (
+        current === entry &&
+        requirePrewalk &&
+        (!policy.prewalk || !sameSelection(policy.prewalk, entry.state.prewalk!.target))
+      )
+        throw new Error("Current prewalk grant revoked");
+      current = current.input.parent ? this.entry(current.input.parent) : undefined;
+    }
+    validateModelSelection(input.context, selected);
+  }
+  private assertExecutionTool(
+    entry: Entry,
+    name: string,
+    builtin: boolean,
+    signal?: AbortSignal,
+  ): void {
+    const { input, selection } = entry;
+    this.assertActive(entry);
+    signal?.throwIfAborted();
+    if (builtin) input.assertTools([name]);
+    else {
+      const metadata = input.toolMetadata?.().find((tool) => tool.name === name);
+      if (
+        !metadata ||
+        leafDenial(
+          metadata,
+          input.profile.leafTools ?? [],
+          selection.cwd === resolveWorkspace(undefined, input.context.cwd),
+        ) ||
+        toolProvenance(metadata) !== input.leafProvenance?.[name]
+      )
+        throw new Error(`Leaf capability revoked or reclassified: ${name}`);
+    }
+    if (!input.context.tools.some((tool) => tool.name === name))
+      throw new Error(`Admitted parent tool is no longer callable: ${name}`);
+  }
+  private chargeExecutionRequest(entry: Entry): void {
+    const { input } = entry;
+    validateModelSelection(input.context, {
+      ...entry.state.model,
+      effort: entry.state.effort as ModelSelection["effort"],
+    });
+    if (entry.cancelled || entry.paused || this.closing) throw new Error("Delegation cancelled");
+    if ((entry.state.telemetry.requests ?? 0) >= entry.state.limits.requests) {
+      this.limit(entry, "requests");
+      throw new Error("Direct request limit");
     }
+    this.update(entry, {
+      telemetry: {
+        ...entry.state.telemetry,
+        requests: (entry.state.telemetry.requests ?? 0) + 1,
+      },
+    });
+  }
+  private observeExecutionMessage(entry: Entry, text: string): void {
+    for (const message of this.coordinationMessages)
+      if (
+        message.recipient !== "root" &&
+        this.key(message.recipient) === this.key(entry.state) &&
+        text ===
+          `Delegation message ${message.id} from ${message.sender === "root" ? "root" : this.key(message.sender)}: ${message.text}`
+      )
+        message.status = "delivered";
+    this.notifyCoordination();
+  }
+  private create(entry: Entry): Promise<void> {
+    const isClosing = () => this.closing;
+    return createChildExecution(this.root, entry, {
+      get closing() {
+        return isClosing();
+      },
+      update: (patch, event) => this.update(entry, patch, event),
+      revalidateModel: (selected, requirePrewalk) =>
+        this.revalidateExecutionModel(entry, selected, requirePrewalk),
+      authorizeTool: (name, builtin) =>
+        this.authorize(
+          entry.state,
+          (profile) =>
+            builtin
+              ? profile.tools.includes(name as BuiltinTool)
+              : !!profile.leafTools?.includes(name),
+          `Current capability grant revoked: ${name}`,
+        ),
+      assertTool: (name, builtin, signal) => this.assertExecutionTool(entry, name, builtin, signal),
+      chargeRequest: () => this.chargeExecutionRequest(entry),
+      chargeToolCall: () => this.chargeToolCall(entry),
+      observeUserMessage: (text) => this.observeExecutionMessage(entry, text),
+      drainDescendants: () => this.stopMany(this.children(entry).map((child) => child.state)),
+      dispose: () => this.dispose(entry),
+    });
   }
   private closeDescendantPresence(entry: Entry): void {
     for (const child of this.entries.values())
@@ -1093,11 +1009,17 @@ export class DelegationCoordinator {
     // Retain immutable evidence, not the disposed SDK session graph, while idle/parked.
     entry.unsubscribe = undefined;
     entry.session = undefined;
+    entry.prompt = undefined;
+    entry.resumeText = undefined;
+    entry.setup = undefined;
+    entry.run = undefined;
+    entry.pauseDrain = undefined;
     if (this.writer === entry.state.id) this.writer = undefined;
     this.closeDescendantPresence(entry);
     this.presence.set(entry.state.id, entry.cancelled || this.closing ? "stopped" : "idle");
     this.update(entry, {
       disposed: true,
+      retainedContext: false,
       endedAt: Date.now(),
       writerLease: false,
       outcome: entry.state.outcome ? { ...entry.state.outcome, finalized: true } : undefined,
@@ -1108,7 +1030,10 @@ export class DelegationCoordinator {
   private key(ref?: ChildRef): string {
     return ref ? `${ref.id}/${ref.generation}` : "root";
   }
-  private actor(ref: ChildRef | undefined, action: CoordinationAction): Entry | undefined {
+  private async actor(
+    ref: ChildRef | undefined,
+    action: CoordinationAction,
+  ): Promise<Entry | undefined> {
     if (this.closing) throw new Error("Parent shut down");
     if (!ref) return;
     const actor = this.entry(ref);
@@ -1116,6 +1041,12 @@ export class DelegationCoordinator {
       throw new Error("Sender is no longer running");
     if (!actor.input.profile.coordination?.includes(action))
       throw new Error(`Coordination action denied: ${action}`);
+    await this.authorize(
+      ref,
+      (profile) => !!profile.coordination?.includes(action),
+      `Coordination action denied: ${action}`,
+    );
+    if (actor.state.status !== "running") throw new Error("Sender is no longer running");
     return actor;
   }
   private target(actor: Entry | undefined, ref: ChildRef): Entry {
@@ -1140,8 +1071,11 @@ export class DelegationCoordinator {
       throw new Error("Coordination target outside granted family");
     return target;
   }
-  inbox(actor?: ChildRef): DelegationMessage[] {
-    this.actor(actor, "inbox");
+  async inbox(actor?: ChildRef, signal?: AbortSignal): Promise<DelegationMessage[]> {
+    const sender = await this.actor(actor, "inbox");
+    if (sender) this.assertActive(sender);
+    if (this.closing) throw new Error("Parent shut down");
+    signal?.throwIfAborted();
     return this.takeInbox(actor);
   }
   async message(
@@ -1149,8 +1083,13 @@ export class DelegationCoordinator {
     target: ChildRef | undefined,
     text: string,
     mode: "inbox" | "steer" | "followUp" = "inbox",
+    signal?: AbortSignal,
   ): Promise<DelegationMessage> {
-    const sender = this.actor(actor, "message");
+    if (mode !== "inbox") requireSupportedHost();
+    const sender = await this.actor(actor, "message");
+    if (sender) this.assertActive(sender);
+    if (this.closing) throw new Error("Parent shut down");
+    signal?.throwIfAborted();
     if (typeof text !== "string" || !text.trim() || Buffer.byteLength(text) > MAX_MESSAGE_BYTES)
       throw new Error("Message requires 1–4096 UTF-8 bytes");
     if (!target && !sender) throw new Error("Root cannot message itself");
@@ -1215,7 +1154,10 @@ export class DelegationCoordinator {
     signal?: AbortSignal,
     messageId?: string,
   ): Promise<CoordinationWait> {
-    const sender = this.actor(actor, "wait");
+    const sender = await this.actor(actor, "wait");
+    if (sender) this.assertActive(sender);
+    if (signal?.aborted) return { status: "cancelled" };
+    if (this.closing) return { status: "shutdown" };
     if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MAX_WAIT_MS)
       throw new Error("Wait timeout must be 1–60000ms");
     if (this.waiterCount >= MAX_WAITERS) throw new Error("Parent waiter limit");
@@ -1297,6 +1239,7 @@ export class DelegationCoordinator {
         if (
           sender &&
           (sender.cancelled ||
+            sender.paused ||
             sender.state.disposed ||
             this.entries.get(sender.state.id) !== sender)
         )
@@ -1318,7 +1261,7 @@ export class DelegationCoordinator {
               });
           }
         } else if (destination) {
-          if (destination.state.disposed)
+          if (destination.state.disposed || destination.state.status === "paused")
             return finish({
               status: "outcome",
               outcome: {
@@ -1326,6 +1269,9 @@ export class DelegationCoordinator {
                 generation: destination.state.generation,
                 status: destination.state.status,
                 limitReason: destination.state.limitReason,
+                ...(destination.state.pauseReason
+                  ? { pauseReason: destination.state.pauseReason }
+                  : {}),
               },
             });
         } else if ((this.mailboxes.get(sourceKey)?.length ?? 0) > 0)
@@ -1347,22 +1293,19 @@ export class DelegationCoordinator {
     this.notifyCoordination();
     return structuredClone(messages);
   }
-  taskInputRead(ref: ChildRef): void {
+  async taskInputRead(ref: ChildRef, signal?: AbortSignal): Promise<void> {
+    await this.authorize(
+      ref,
+      (profile) => profile.tools.includes("read"),
+      "Delegating parent has no active read grant",
+    );
     const entry = this.entry(ref);
-    if (
-      entry.cancelled ||
-      entry.state.disposed ||
-      this.closing ||
-      !entry.input.profile.tools.includes("read")
-    )
-      throw new Error("Delegating parent has no active read grant");
-    if (entry.state.toolCalls >= entry.state.limits.tools) {
-      this.limit(entry, "tools");
-      throw new Error("Tool call limit");
-    }
-    this.update(entry, { toolCalls: entry.state.toolCalls + 1 });
+    this.assertActive(entry);
+    signal?.throwIfAborted();
+    this.chargeToolCall(entry);
   }
   async steer(ref: ChildRef, text: string): Promise<"queued" | "handled"> {
+    requireSupportedHost();
     const entry = this.entry(ref);
     if (!text.trim()) throw new Error("Nonempty steering text is required");
     if (entry.state.status !== "running" || entry.cancelled) throw new Error("No running child");
@@ -1401,6 +1344,7 @@ export class DelegationCoordinator {
     await Promise.all([descendants, entry.state.disposed ? undefined : entry.session?.abort()]);
     if (entry.state.disposed) return;
     await entry.run;
+    if (!entry.state.disposed) this.update(entry, { status: "cancelled" });
     this.dispose(entry);
   }
   async wait(ref: ChildRef): Promise<ChildSnapshot> {