@nklisch/pi-enhanced 0.1.2 → 0.1.4

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/state/local-lock-filesystem.js

@@ -1,17 +1,19 @@
 import { chmod, lstat, mkdir, statfs, } from "node:fs/promises";
-import { isAbsolute, join, relative, resolve, sep, parse } from "node:path";
+import { isAbsolute, resolve } from "node:path";
 const PRIVATE_DIRECTORY_MODE = 0o700;
 const PRIVATE_DATABASE_MODE = 0o600;
 /**
- * Filesystem types whose locking semantics are known to be local enough for
- * the SQLite adapter. The allowlist is intentionally conservative: an
- * unknown mount is a capability failure, not permission to silently fall back
- * to process-local coordination.
+ * Platforms where `statfs.f_type` carries a Linux-style filesystem magic
+ * number that identifies local-enough locking semantics for the SQLite
+ * adapter. This is a Linux-only signal: libuv returns `0` on Windows
+ * (libuv does not expose an NTFS magic via `statfs`), and on FreeBSD
+ * `statfs.f_type` is the kernel-assigned `vfc_typenum` (a small enum like
+ * `0x0095` for UFS, `0x0023` for ZFS), not the disk magics people sometimes
+ * copy from Linux headers — so an integer allowlist keyed on Linux magics
+ * would always fail closed there. Darwin is the same story (vestigial
+ * `0x1a`); see `verifyLocalFilesystemCapability` for the platform dispatch.
  */
-const LOCAL_FILESYSTEM_TYPES_BY_PLATFORM = {
-    // Only filesystems whose SQLite locking behavior is covered by this
-    // adapter's capability boundary are accepted. Unknown platform/type pairs
-    // fail closed rather than inheriting a Linux guess.
+const LOCAL_FILESYSTEM_MAGIC_BY_PLATFORM = {
     linux: new Set([
         0x0000ef53, // ext2/3/4
         0x01021994, // tmpfs
@@ -24,9 +26,6 @@ const LOCAL_FILESYSTEM_TYPES_BY_PLATFORM = {
         0x2fc12fc1, // zfs
         0x858458f6, // ramfs
     ]),
-    win32: new Set([0x5346544e]), // NTFS
-    darwin: new Set([0x41504653, 0x48465300]), // APFS, HFS+
-    freebsd: new Set([0x011954, 0x09011954]), // UFS, UFS2
 };
 function filesystemMode(mode) {
     return mode & 0o777;
@@ -34,47 +33,31 @@ function filesystemMode(mode) {
 function filesystemFailure(message) {
     return new Error(message);
 }
-async function ensureDirectory(path) {
-    try {
-        const stats = await lstat(path);
-        if (stats.isSymbolicLink())
-            throw filesystemFailure("lock root contains a symbolic link");
-        if (!stats.isDirectory())
-            throw filesystemFailure("lock root component is not a directory");
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
-        try {
-            await mkdir(path, { mode: PRIVATE_DIRECTORY_MODE });
-        }
-        catch (mkdirError) {
-            // Another process may create the same first-use component after our
-            // ENOENT observation. Accept only that race, then revalidate the winner
-            // without following a symlink below.
-            if (mkdirError.code !== "EEXIST")
-                throw mkdirError;
-        }
-        const stats = await lstat(path);
-        if (stats.isSymbolicLink() || !stats.isDirectory()) {
-            throw filesystemFailure("lock root component is not a private directory");
-        }
-    }
-}
-/** Create and validate a private root without following any path symlink. */
+/**
+ * Create and validate the lock root, then enforce that the leaf itself is
+ * private. The 0o700 leaf mode is the actual security boundary: no other
+ * local user can write into a directory the runtime user owns at 0o700,
+ * regardless of how the path arrived there.
+ *
+ * Earlier versions walked every ancestor and rejected any path component
+ * symlink. That defense assumed an attacker with write access to a parent of
+ * the lock root — at which point the user is already compromised — while it
+ * broke legitimate OS-managed symlinks such as macOS `/tmp → /private/tmp`.
+ * The walk is gone; the leaf check is what carries the guarantee.
+ */
 export async function ensurePrivateLockRoot(input) {
     if (typeof input !== "string" || input.length === 0 || !isAbsolute(input)) {
         throw new TypeError("lockRoot must be a non-empty absolute path");
     }
     const root = resolve(input);
-    const parsed = parse(root);
-    const remainder = relative(parsed.root, root);
-    let current = parsed.root;
-    for (const component of remainder.split(sep)) {
-        if (component.length === 0)
-            continue;
-        current = join(current, component);
-        await ensureDirectory(current);
+    try {
+        await mkdir(root, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });
+    }
+    catch (mkdirError) {
+        // A concurrent creator may win the race after our first attempt. Accept
+        // only that race; the leaf revalidation below catches anything else.
+        if (mkdirError.code !== "EEXIST")
+            throw mkdirError;
     }
     await chmod(root, PRIVATE_DIRECTORY_MODE);
     const stats = await lstat(root);
@@ -87,12 +70,25 @@ export async function ensurePrivateLockRoot(input) {
  * Verify the mounted filesystem rather than assuming that a successful SQLite
  * open proves cross-process exclusion. Callers may inject a stricter policy
  * when a platform has a better local-filesystem classifier.
+ *
+ * The integer magic-number allowlist applies only to Linux, where
+ * `statfs.f_type` carries a filesystem magic. On every other platform
+ * (Darwin, Windows, FreeBSD, AIX, etc.) the gate is a no-op: libuv returns
+ * `0` on Windows, FreeBSD's `f_type` is a kernel enum (`vfc_typenum`), and
+ * Darwin's is vestigial `0x1a` (issue #2). A fail-closed stance on those
+ * platforms has no signal and breaks real startup. SQLite locking works
+ * empirically on those platforms; the allowlist is a defense against
+ * known-broken network filesystems on Linux, not a pre-condition for the
+ * adapter to function. Callers needing a real classification on other
+ * platforms must inject `verifyLocalFilesystem`.
  */
 export async function verifyLocalFilesystemCapability(root) {
+    const supportedTypes = LOCAL_FILESYSTEM_MAGIC_BY_PLATFORM[process.platform];
+    if (supportedTypes === undefined)
+        return;
     const stats = await statfs(root);
     const type = Number(stats.type);
-    const supportedTypes = LOCAL_FILESYSTEM_TYPES_BY_PLATFORM[process.platform];
-    if (supportedTypes === undefined || !Number.isSafeInteger(type) || !supportedTypes.has(type >>> 0)) {
+    if (!Number.isSafeInteger(type) || !supportedTypes.has(type >>> 0)) {
         throw filesystemFailure("filesystem locking capability is unknown or unsupported on this platform");
     }
 }

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/state/local-lock-filesystem.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-lock-filesystem.js","sourceRoot":"","sources":["../../../src/infrastructure/state/local-lock-filesystem.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,KAAK,EACL,KAAK,EACL,MAAM,GACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAE5E,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,kCAAkC,GAAkD;IACxF,oEAAoE;IACpE,0EAA0E;IAC1E,oDAAoD;IACpD,KAAK,EAAE,IAAI,GAAG,CAAC;QACb,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM;QAClB,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,MAAM;QAClB,UAAU,EAAE,YAAY;QACxB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,OAAO;QACnB,UAAU,EAAE,MAAM;QAClB,UAAU,EAAE,QAAQ;KACrB,CAAC;IACF,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO;IACrC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,EAAE,aAAa;IACxD,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,EAAE,YAAY;CACvD,CAAC;AAEF,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,MAAM,iBAAiB,CAAC,oCAAoC,CAAC,CAAC;QAC1F,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAAE,MAAM,iBAAiB,CAAC,wCAAwC,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,oEAAoE;YACpE,wEAAwE;YACxE,qCAAqC;YACrC,IAAK,UAAoC,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,UAAU,CAAC;QAChF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACnD,MAAM,iBAAiB,CAAC,gDAAgD,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACrC,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,sBAAsB,EAAE,CAAC;QAC5G,MAAM,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,IAAY;IAChE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,cAAc,GAAG,kCAAkC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QACnG,MAAM,iBAAiB,CAAC,0EAA0E,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAChE,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC"}
+{"version":3,"file":"local-lock-filesystem.js","sourceRoot":"","sources":["../../../src/infrastructure/state/local-lock-filesystem.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,KAAK,EACL,KAAK,EACL,MAAM,GACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhD,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,MAAM,kCAAkC,GAAkD;IACxF,KAAK,EAAE,IAAI,GAAG,CAAC;QACb,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM;QAClB,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,MAAM;QAClB,UAAU,EAAE,YAAY;QACxB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,OAAO;QACnB,UAAU,EAAE,MAAM;QAClB,UAAU,EAAE,QAAQ;KACrB,CAAC;CACH,CAAC;AAEF,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QACpB,wEAAwE;QACxE,qEAAqE;QACrE,IAAK,UAAoC,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,UAAU,CAAC;IAChF,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,sBAAsB,EAAE,CAAC;QAC5G,MAAM,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,IAAY;IAChE,MAAM,cAAc,GAAG,kCAAkC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO;IACzC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,iBAAiB,CAAC,0EAA0E,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAChE,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/runtime/mcp/pi-mcp-adapter-package.js

@@ -2,10 +2,10 @@ import { probePublishedPackage, } from "../published-package-receipt.js";
 import { createPiMcpRuntime, } from "./pi-mcp-adapter-runtime.js";
 export const PI_MCP_ADAPTER_RECEIPT = Object.freeze({
     packageName: "@nklisch/pi-mcp-adapter",
-    version: "2.11.0-nklisch.7",
+    version: "2.20.1-nklisch.0",
     license: "MIT",
     nodeEngine: ">=22.19.0",
-    piPeerRange: ">=0.79.1 <1",
+    piPeerRange: ">=0.82.0 <1",
     requiredExports: [".", "./programmatic"],
     piExtensions: ["./index.ts"],
 });

package/node_modules/@nklisch/pi-plugins/dist/runtime/mcp/pi-mcp-adapter-runtime.js

@@ -4,9 +4,9 @@ import { BoundaryError, DiagnosticSchema, ErrorCodeRegistry, diagnosticFromZodEr
 const PACKAGE_PROVIDER = Object.freeze({
     kind: "published-package",
     packageName: "@nklisch/pi-mcp-adapter",
-    version: "2.11.0-nklisch.7",
+    version: "2.20.1-nklisch.0",
     nodeEngine: ">=22.19.0",
-    piPeerRange: ">=0.79.1 <1",
+    piPeerRange: ">=0.82.0 <1",
     contractVersion: 1,
 });
 function safeIdentity(identity) {

package/node_modules/@nklisch/pi-plugins/dist/runtime/subagents/pi-subagents-lifecycle.js

@@ -7,7 +7,7 @@ const PACKAGE_INTEGRITY = "sha512-33Q8JDffXUuiT1M3XjLXCI4If9p+3AOwsUp/b5f1+B7Y5J
 const PACKAGE_RELEASE_TAG = "pi-subagents-v18.0.4-nklisch.1";
 const PACKAGE_COMMIT = "43efffb459f64e2f5f9aaee50d8ae5afa564f4f3";
 const PACKAGE_NODE_ENGINE = ">=22";
-const PACKAGE_PI_PEER_RANGE = ">=0.75.0";
+const PACKAGE_PI_PEER_RANGE = ">=0.80.5";
 const PACKAGE_CONTINUATION_BUDGET = 3;
 // This digest covers the three unchanged portable conformance vectors: the
 // reusable trace contract, its negative controls, and its port integration.

package/node_modules/@nklisch/pi-plugins/dist/runtime/subagents/pi-subagents-package.js

@@ -6,10 +6,10 @@ import { createJiti } from "jiti/static";
 import { probePublishedPackage, } from "../published-package-receipt.js";
 export const PI_SUBAGENTS_RECEIPT = Object.freeze({
     packageName: "@nklisch/pi-subagents",
-    version: "18.0.4-nklisch.1",
+    version: "18.1.0-nklisch.0",
     license: "MIT",
     nodeEngine: ">=22",
-    piPeerRange: ">=0.75.0",
+    piPeerRange: ">=0.80.5",
     requiredExports: [".", "./settings"],
     piExtensions: ["./src/index.ts"],
 });

package/node_modules/@nklisch/pi-plugins/node_modules/@nklisch/pi-subagents/README.md

@@ -18,18 +18,17 @@ Run them in foreground or background, steer them mid-run, resume completed sessi
 - **In-process & native** — agents run inside the same pi runtime (no spawned subprocesses), sharing tool names, calling conventions, and UI patterns (`subagent`, `get_subagent_result`, `steer_subagent`) — feels native
 - **Parallel background agents** — spawn multiple agents that run concurrently with automatic queuing (configurable concurrency limit, default 4) and individual completion notifications
 - **Live widget UI** — persistent above-editor widget with animated spinners, live tool activity, token counts, and colored status icons
-- **Session transcripts** — open any subagent's full session transcript (running or evicted) in pi's native read-only viewer via `/subagents:sessions`
-- **Custom agent types** — define agents in `.pi/agents/<name>.md` with YAML frontmatter: custom system prompts, model selection, thinking levels, tool restrictions
+- **Session transcripts** — open any subagent's full session transcript, including records whose heavy live session has been released, in pi's native read-only viewer via `/subagents:sessions`
+- **Custom agent types** — define project agents in `.pi/agents/<name>.md` or the shared `.agents/agents/<name>.md` convention, with YAML frontmatter for prompts, models, thinking, and built-in tools
 - **Mid-run steering** — inject messages into running agents to redirect their work without restarting
 - **Session resume** — pick up where an agent left off, preserving full conversation context
 - **Graceful turn limits** — agents get a "wrap up" warning before hard abort, producing clean partial results instead of cut-off output
-- **Case-insensitive agent types** — `"explore"`, `"Explore"`, `"EXPLORE"` all work.
-  Unknown types fall back to general-purpose with a note
+- **Policy-aware agent types** — unambiguous names resolve case-insensitively. Unknown names default to `general-purpose`, can target another enabled fallback, or can fail closed via `fallbackSubagent`
 - **Fuzzy model selection** — specify models by name (`"haiku"`, `"sonnet"`) instead of full IDs, with automatic filtering to only available/configured models
 - **Context inheritance** — optionally fork the parent conversation into a sub-agent so it knows what's been discussed
 - **Styled completion notifications** — background agent results render as themed, compact notification boxes (icon, stats, result preview) instead of raw XML.
   Expandable to show full output
-- **Event bus** — lifecycle events (`subagents:created`, `started`, `completed`, `failed`, `steered`, `compacted`) emitted via `pi.events`, enabling other extensions to react to sub-agent activity
+- **Event bus** — lifecycle events (`subagents:created`, `started`, `completed`, `failed`, `resumed`, `steered`, `compacted`) emitted via `pi.events`, enabling other extensions to react to sub-agent activity
 
 ## Install
 
@@ -108,12 +107,11 @@ The LLM receives structured `<task-notification>` XML for parsing, while the use
 
 | Type              | Tools                      | Model                         | Prompt Mode            | Description                                                                                      |
 | ----------------- | -------------------------- | ----------------------------- | ---------------------- | ------------------------------------------------------------------------------------------------ |
-| `general-purpose` | all 7                      | inherit                       | `append` (parent twin) | Inherits the parent's full system prompt — same rules, CLAUDE.md, project conventions            |
-| `Explore`         | read, bash, grep, find, ls | haiku (falls back to inherit) | `replace`              | Fast codebase exploration (read-only); inherits the parent prompt as a base                      |
-| `Plan`            | read, bash, grep, find, ls | inherit                       | `replace`              | Software architect for implementation planning (read-only); inherits the parent prompt as a base |
+| `general-purpose` | all 7                      | inherit                       | `append` (parent twin) | Inherits the parent's full system prompt — same rules, CLAUDE.md, project conventions |
+| `Explore`         | read, bash, grep, find, ls | haiku (falls back to inherit) | `replace`              | Fast codebase exploration (read-only); inherits the parent prompt as a base           |
 
 The `general-purpose` agent is a **parent twin** — it receives the parent's entire system prompt plus a sub-agent context bridge, so it follows the same rules the parent does.
-Explore and Plan use `replace` mode: the parent prompt is the cacheable base and their specialist read-only instructions are appended last, giving them the final say.
+Explore uses `replace` mode: the parent prompt is the cacheable base and its specialist read-only instructions are appended last, giving those instructions the final say.
 
 Default agents can be **overridden** by creating a `.md` file with the same name (e.g. `.pi/agents/general-purpose.md`), or **disabled** per-project with `enabled: false` frontmatter.
 
@@ -123,14 +121,15 @@ Define custom agent types by creating `.md` files.
 The filename becomes the agent type name.
 Any name is allowed — using a default agent's name overrides it.
 
-Agents are discovered from two locations (higher priority wins):
+Agents are discovered from three locations (higher priority wins):
 
-| Priority    | Location                                                                         | Scope                         |
-| ----------- | -------------------------------------------------------------------------------- | ----------------------------- |
-| 1 (highest) | `.pi/agents/<name>.md`                                                           | Project — per-repo agents     |
-| 2           | `$PI_CODING_AGENT_DIR/agents/<name>.md` (default `~/.pi/agent/agents/<name>.md`) | Global — available everywhere |
+| Priority    | Location                                                                         | Scope                                  |
+| ----------- | -------------------------------------------------------------------------------- | -------------------------------------- |
+| 1 (highest) | `.pi/agents/<name>.md`                                                           | Pi project authority                   |
+| 2           | `.agents/agents/<name>.md`                                                       | Shared cross-tool project definitions  |
+| 3           | `$PI_CODING_AGENT_DIR/agents/<name>.md` (default `~/.pi/agent/agents/<name>.md`) | Global — available everywhere          |
 
-Project-level agents override global ones with the same name, so you can customize a global agent for a specific project.
+`.agents/agents` is read-only to this extension. `.pi/agents` overrides it and the global location on name collisions.
 The global location follows the upstream `PI_CODING_AGENT_DIR` env var — set it to relocate all pi-coding-agent state (agents, skills, settings) to a custom directory.
 
 ### Example: `.pi/agents/auditor.md`
@@ -169,9 +168,9 @@ All fields are optional — sensible defaults for everything.
 | ------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `description`       | filename       | Agent description shown in tool listings                                                                                                                                                                                                                                                                                |
 | `display_name`      | —              | Display name for UI (e.g. widget, agent list)                                                                                                                                                                                                                                                                           |
-| `tools`             | all 7          | Comma-separated built-in tools: read, bash, edit, write, grep, find, ls. `none` for no tools                                                                                                                                                                                                                            |
+| `tools`             | all 7          | Comma-separated built-in tools: read, bash, edit, write, grep, find, ls. `none` denies all built-ins. Parent extension tools remain inheritable and are narrowed by extension policy                                                                                                                                                                                                                            |
 | `model`             | inherit parent | Model — `provider/modelId` or fuzzy name (`"haiku"`, `"sonnet"`)                                                                                                                                                                                                                                                        |
-| `thinking`          | inherit        | off, minimal, low, medium, high, xhigh                                                                                                                                                                                                                                                                                  |
+| `thinking`          | inherit        | off, minimal, low, medium, high, xhigh, max (actual support depends on host and model)                                                                                                                                                                                                                                                                                  |
 | `max_turns`         | unlimited      | Max agentic turns before graceful shutdown. `0` or omit for unlimited                                                                                                                                                                                                                                                   |
 | `prompt_mode`       | `append`       | `replace`: parent prompt is the cacheable base; body is appended last with full control (no `<sub_agent_context>` bridge, no `<agent_instructions>` wrapper). `append`: parent prompt is the base; body is wrapped in `<agent_instructions>` and a sub-agent context bridge is injected (agent acts as a "parent twin") |
 | `inherit_context`   | `false`        | Fork parent conversation into agent                                                                                                                                                                                                                                                                                     |
@@ -194,15 +193,23 @@ Launch a sub-agent.
 | `description`       | string       | yes      | Short 3-5 word summary (shown in UI)                             |
 | `subagent_type`     | string       | yes      | Agent type (built-in or custom)                                  |
 | `model`             | string       | no       | Model — `provider/modelId` or fuzzy name (`"haiku"`, `"sonnet"`) |
-| `thinking`          | string       | no       | Thinking level: off, minimal, low, medium, high, xhigh           |
+| `thinking`          | string       | no       | Thinking level: off, minimal, low, medium, high, xhigh, max      |
 | `max_turns`         | number       | no       | Max agentic turns. Omit for unlimited (default)                  |
 | `run_in_background` | boolean      | no       | Run without blocking                                             |
-| `resume`            | string       | no       | Agent ID to resume a previous session                            |
+| `resume`            | string       | no       | Retained, finished agent ID to continue with the same history    |
 | `inherit_context`   | boolean      | no       | Fork parent conversation into agent                              |
 
+### Choosing the next action
+
+- Let background agents finish normally. Completion automatically wakes the parent with a result preview; do not poll.
+- Use `steer_subagent` to redirect an agent that is still running.
+- Use `resume` after an agent finishes when it should continue with the same retained conversation history.
+- Launch a new subagent without `resume` when prior conversation history is unnecessary.
+- Use `get_subagent_result` only for full output, verbose conversation, an explicit status check or synchronization point, or recovery after a missed notification.
+
 ### `get_subagent_result`
 
-Check status and retrieve results from a background agent.
+Inspect status or retrieve full results from a background agent. It is not the normal completion path because completion notifications wake the parent automatically.
 
 | Parameter  | Type    | Required | Description                   |
 | ---------- | ------- | -------- | ----------------------------- |
@@ -224,17 +231,17 @@ The message interrupts after the current tool execution.
 
 | Command               | Description                                            |
 | --------------------- | ------------------------------------------------------ |
-| `/subagents:settings` | Configure subagent settings (concurrency, turn limits) |
+| `/subagents:settings` | Configure concurrency, turn limits, retention, interrupt behavior, and unknown-type fallback |
 | `/subagents:sessions` | View a subagent's session transcript (read-only)       |
 
 ### `/subagents:settings`
 
-Interactive list to tune runtime settings — max concurrency, default max turns, and grace turns.
+Interactive list to tune max concurrency, default/grace turns, consumed and unconsumed live-session retention, abort-all-on-ESC behavior, and unknown-agent fallback.
 Changes persist across pi restarts (see [Persistent Settings](#persistent-settings)).
 
 ### `/subagents:sessions`
 
-Pick any subagent — running or already evicted — and read its full session transcript in pi's native per-entry viewer.
+Pick any subagent — running, completed, or retained after its live session was released — and read its full session transcript in pi's native per-entry viewer.
 Read-only: no steering, no session takeover (steering lives in the `steer_subagent` tool and the background widget).
 
 Creating and editing agent definitions is not a command — write an agent `.md` file in your editor, or ask a pi session to generate one (see [Custom Agents](#custom-agents)).
@@ -257,14 +264,13 @@ Instead of hard-aborting at the turn limit, agents get a graceful shutdown:
 ## Concurrency
 
 Background agents are subject to a configurable concurrency limit (default: 4).
-Excess agents are automatically queued and start as running agents complete.
-The widget shows queued agents as a collapsed count.
+Excess agents are automatically queued and start as running agents complete. The widget shows each queued agent with its effective model and queued state. Stopping a queued agent follows the normal terminal lifecycle and reports that no work started.
 
-Foreground agents bypass the queue — they block the parent anyway.
+Foreground agents bypass the queue — they block the parent anyway. Completion nudges are held while the parent is running and flushed at the parent run boundary, preventing a pulled result from also arriving as a duplicate notification.
 
 ## Persistent Settings
 
-Runtime tuning values set via `/subagents:settings` (max concurrency, default max turns, grace turns) persist across pi restarts.
+Runtime tuning values set via `/subagents:settings` persist across pi restarts. Terminal records remain available for the whole parent session. Their heavy live sessions are released after the consumed or unconsumed retention window; the result and persisted transcript pointer remain available.
 Two files, merged on load:
 
 - **Global:** `~/.pi/agent/subagents.json` — your machine-wide defaults.
@@ -273,7 +279,7 @@ Two files, merged on load:
   Written by `/subagents:settings`.
 
 **Precedence:** project overrides global on any field present in both.
-Missing fields fall back to the hardcoded defaults (max concurrency `4`, default max turns unlimited, grace turns `5`).
+Missing fields use these defaults: max concurrency `4`, max turns unlimited, grace turns `5`, consumed-session retention `10` minutes, unconsumed-session retention `720` minutes, abort all on parent ESC enabled, and unknown-agent fallback `general-purpose`.
 
 **Example — global defaults for a beefy machine:**
 
@@ -282,12 +288,15 @@ mkdir -p ~/.pi/agent
 cat > ~/.pi/agent/subagents.json <<'EOF'
 {
   "maxConcurrent": 16,
-  "graceTurns": 10
+  "graceTurns": 10,
+  "unconsumedSessionRetentionMinutes": 1440,
+  "abortAllOnInterrupt": false,
+  "fallbackSubagent": false
 }
 EOF
 ```
 
-Every project now starts with concurrency 16 and grace 10, without ever touching the command.
+Every project now starts with concurrency 16, grace 10, a one-day unconsumed retention cap, background agents surviving parent ESC, and unknown agent types failing closed.
 Individual projects can still override via `/subagents:settings`.
 
 **Failure behavior:** missing file is silent; malformed JSON logs a `[pi-subagents] Ignoring malformed settings at …` warning to stderr; invalid/out-of-range field values are dropped per-field; write failures downgrade the `/subagents:settings` toast to a warning with `(session only; failed to persist)`.
@@ -301,6 +310,7 @@ Agent lifecycle events are emitted via `pi.events.emit()` so other extensions ca
 | `subagents:created`          | Background agent registered                             | `id`, `type`, `description`, `isBackground`                                                                          |
 | `subagents:started`          | Agent transitions to running (including queued→running) | `id`, `type`, `description`                                                                                          |
 | `subagents:completed`        | Agent finished successfully                             | `id`, `type`, `durationMs`, `tokens` (lifetime `{ input, output, total }`), `toolUses`, `result`                     |
+| `subagents:resumed`          | A resumed turn reached a terminal state                 | completed-event shape plus `status` and `error`                                                                     |
 | `subagents:failed`           | Agent errored, stopped, or aborted                      | same as completed + `error`, `status`                                                                                |
 | `subagents:steered`          | Steering message sent                                   | `id`, `message`                                                                                                      |
 | `subagents:compacted`        | Agent's session successfully compacted                  | `id`, `type`, `description`, `reason` (`"manual"` / `"threshold"` / `"overflow"`), `tokensBefore`, `compactionCount` |
@@ -320,7 +330,7 @@ The earlier `isolation: "worktree"` spawn flag and `isolation:` frontmatter key
 ## Removed: agent memory and skill preloading
 
 Persistent agent memory (the `memory:` frontmatter key) and skill preloading (the `skills:` frontmatter key) were removed when the core was slimmed down.
-Children now always inherit the parent's skills and extensions, so the `isolated`, `extensions`, and `skills` frontmatter keys no longer exist.
+Children always inherit the parent's skills and extensions, so the `isolated`, `extensions`, and `skills` frontmatter keys no longer exist. Child creation uses a denylist rather than a registration-time allowlist: extension tools—including tools registered during lifecycle hooks—remain available, while disallowed built-ins and the three recursive orchestration tools stay excluded.
 
 ## Migrating from `disallowed_tools`
 

package/node_modules/@nklisch/pi-plugins/node_modules/@nklisch/pi-subagents/dist/public.d.ts

@@ -87,7 +87,7 @@ interface SubagentLifecycleRegistration {
 /** Agent type: any string name (built-in defaults or user-defined). */
 type SubagentType = string;
 interface AgentInvocation {
-    /** Short display name, e.g. "haiku" — only set when different from parent. */
+    /** Exact effective model label in `provider/id` form. */
     modelName?: string;
     thinking?: ThinkingLevel;
     maxTurns?: number;
@@ -239,6 +239,7 @@ interface SubagentsService {
 declare const SUBAGENT_EVENTS: {
     readonly STARTED: "subagents:started";
     readonly COMPLETED: "subagents:completed";
+    readonly RESUMED: "subagents:resumed";
     readonly FAILED: "subagents:failed";
     readonly COMPACTED: "subagents:compacted";
     readonly CREATED: "subagents:created";

package/node_modules/@nklisch/pi-plugins/node_modules/@nklisch/pi-subagents/docs/FORK-MAINTENANCE.md

@@ -1,22 +1,24 @@
 # Maintained-fork policy
 
 `@nklisch/pi-subagents` is a published MIT fork of `@gotgenes/pi-subagents`,
-most recently cut as `18.0.4-nklisch.0` on the upstream 18.0.4 release
-(upstream base commit `c76a294a777a990950da23fc06cb0caf51da7ac6` line).
+initially cut as `18.0.4-nklisch.0` from upstream base commit
+`c76a294a777a990950da23fc06cb0caf51da7ac6`, whose package version is 18.0.3.
+The fork version did not correspond to an upstream 18.0.4 release.
 Since 2026-07 its home is the `nklisch/pi-extensions` monorepo
 (`packages/pi-subagents`); earlier history lives in the `nklisch/pi-packages`
 fork.
 
-The fork retains upstream history, copyright notices, license, exports, Pi
-extension behavior, peer ranges, and package layout. Its intentional delta is
-the documented ordered lifecycle-interceptor provider seam (ADR 0005) and its
-tests.
+The fork retains upstream history, copyright notices, license, exports, and
+package layout. Its intentional delta includes the documented ordered
+lifecycle-interceptor provider seam (ADR 0005), exact model/runtime visibility,
+and selected post-base reliability adaptations. It requires Pi coding-agent
+`>=0.80.5` so completion nudges can synchronize on `agent_settled`.
 
 ## Release policy
 
 Each fork release must:
 
-1. rebase the narrow generic commits onto a current verified upstream release;
+1. selectively rebase or port current verified upstream changes, preserving the fork's lifecycle-interceptor and exact model/runtime contracts;
 2. choose a `-nklisch.N` suffix on the upstream version it tracks;
 3. capture registry integrity and tag/commit provenance;
 4. run the package and consumer qualification suites (pi-plugins' bundled
@@ -32,7 +34,11 @@ only, not lifecycle semantics or consumer contracts.
 
 ## Scope guard
 
-The published package excludes the experimental UI layer that existed
-mid-refactor on the import branch (agent editors, wizards, conversation
-viewers). Reviving any UI direction is a new decision, not a restoration —
-see ADR 0004 for the history.
+The published package keeps the narrow built-in background widget, session
+navigator, and settings command accepted by ADR 0004. These status surfaces
+show each subagent's exact effective model and elapsed or final runtime. The
+package excludes the retired agent editors, wizards, and bespoke conversation
+viewer from the import branch. Reviving those surfaces is a new decision, not
+a restoration. Children inherit extension tools through a registration-open
+denylist policy; scheduling, memory, nested delegation, worktrees, and RPC stay
+outside the core.

package/node_modules/@nklisch/pi-plugins/node_modules/@nklisch/pi-subagents/docs/VISION.md

@@ -8,8 +8,9 @@ order — capability the observational lifecycle events cannot provide.
 
 ## Product shape
 
-- A minimal core that owns configuration, models, sessions, tools, queueing,
-  concurrency, persistence, workspaces, turn limits, and disposal.
+- A minimal core that owns configuration, model-runtime inheritance, sessions,
+  tools, queueing, concurrency, consumption-aware retention, workspaces, turn
+  limits, and disposal.
 - Extensions — including the fork's own interceptor seam — compose on that
   core rather than forking it (ADR 0002).
 - Two public entrypoints only: the root service contract and `./settings`.
@@ -19,14 +20,20 @@ order — capability the observational lifecycle events cannot provide.
 ## Consumers and compatibility
 
 The root export is loaded by pi-plugins through a verified packaged loader;
-its shape is a hard compatibility surface. The published package
-deliberately excludes the experimental UI layer that existed mid-refactor
-on the import branch (see ADR 0004 for the UI direction history).
+its shape is a hard compatibility surface. The published package includes a narrow built-in operator UI: the background
+status widget, session navigator, and settings command. Every subagent status
+surface identifies the exact effective model and elapsed or final runtime. The
+package excludes the retired experimental editors, wizards, and bespoke
+conversation viewer from the import branch (see ADR 0004 for the UI direction
+history). Child sessions inherit parent extension tools through a denylist
+policy so synchronous and lifecycle-time registrations remain available without
+exposing recursive orchestration tools.
 
 ## Fork posture
 
-Track `gotgenes/pi-packages` for upstream releases and security reports;
-rebase the narrow fork delta onto verified upstream releases; contribute
+Track `gotgenes/pi-packages` and the original `tintinweb/pi-subagents` lineage
+for releases and security reports; selectively port verified changes without
+surrendering the fork's stronger contracts; contribute
 the generic seam upstream when its contract is proven. Returning to
 upstream must change package selection only, never lifecycle semantics or
 consumer contracts. See `FORK-MAINTENANCE.md`.

package/node_modules/@nklisch/pi-plugins/node_modules/@nklisch/pi-subagents/docs/architecture/architecture.md

@@ -15,8 +15,7 @@ This document describes the architecture of the pi-subagents fork: a focused, co
    The max-concurrent admission gate is not scheduling in this sense — concurrency management stays in core.
 5. **UI is an in-core, substitutable consumer** — [ADR-0004](../decisions/0004-reconsider-ui-direction.md) records the per-component decision: the widget shrinks to background agents only, the bespoke conversation viewer is replaced by native session navigation, the `/agents` command is dissolved into focused surfaces, and the surviving UI stays in the core as a reactive consumer (not extracted to a separate package).
    Extraction remains an available future option because the composition invariant holds — the core is byte-for-byte identical with or without a given UI consumer.
-6. **Snapshot, don't capture** — mutable parent state (ctx, session, model) is read once at spawn time and frozen into a `ParentSnapshot` data object.
-   No live references survive past the spawn call.
+6. **Snapshot identity; share the canonical runtime** — mutable parent identity and prompt state are frozen into `ParentSnapshot` at spawn. The parent `ModelRuntime` is deliberately shared so child sessions preserve runtime provider and authentication registrations; no live session context is captured.
 7. **Subscribe, don't thread** — observation of agent progress uses direct session-event subscription, not callback parameters threaded through multiple layers.
 8. **Construct complete** — objects are born with all their dependencies.
    If state isn't available yet, the object that needs it doesn't exist yet.
@@ -180,6 +179,7 @@ classDiagram
         +systemPrompt: string
         +model: unknown
         +modelRegistry: unknown
+        +modelRuntime?: unknown
         +parentContext?: string
     }
 
@@ -208,6 +208,7 @@ stateDiagram-v2
     [*] --> queued : spawn (background, at capacity)
     [*] --> running : spawn (foreground or under limit)
     queued --> running : capacity available
+    queued --> stopped : stopped before admission
     running --> completed : all turns finished
     running --> error : unhandled exception
     running --> aborted : abort() called
@@ -233,6 +234,10 @@ stateDiagram-v2
 Note: `markStopped` always succeeds regardless of current status.
 Other terminal transitions guard against overwriting `stopped` — once an agent is stopped, only `resetForResume` can return it to `running`.
 
+Terminal outcomes also carry orthogonal consumption state. Foreground delivery, `get_subagent_result`, and a queued completion notification mark the outcome consumed. Records remain available for the parent session; only their heavy live child sessions are released after the configured consumed or unconsumed retention window. Released records keep their result and persisted transcript pointer but cannot resume.
+
+Completion notifications are held while the parent agent run is active and flushed on `agent_settled`, rechecking consumption before enqueueing a follow-up. Child session creation shares the parent model runtime and leaves extension-tool registration open; a denylist removes disallowed built-ins and recursive orchestration tools across registry refreshes.
+
 ## Execution flow
 
 ```mermaid
@@ -265,7 +270,7 @@ sequenceDiagram
     Ag-->>Mgr: update Subagent
     Mgr-->>Tool: Subagent
     Tool-->>LLM: formatted result
-    Note over Mgr: disposeSession() fires `disposed` at cleanup (resume-detectable)
+    Note over Mgr: retention releases heavy sessions but keeps terminal records and transcript pointers
 ```
 
 ## Module organization
@@ -287,7 +292,7 @@ src/
 │
 ├── config/                         agent type definitions and resolution
 │   ├── agent-types.ts              AgentTypeRegistry class
-│   ├── default-agents.ts           built-in agent configs (general-purpose, Explore, Plan)
+│   ├── default-agents.ts           built-in agent configs (general-purpose, Explore)
 │   ├── custom-agents.ts            user-defined agent .md file loader
 │   └── invocation-config.ts        per-call config merge
 │
@@ -481,6 +486,7 @@ The core emits events on `pi.events` that any extension can observe:
 | --------------------- | ----------------------------------------------------------------------------------- | --------------------------------------------- |
 | `subagents:started`   | `{ id, type, description }`                                                         | Agent begins running                          |
 | `subagents:completed` | `{ id, type, description, status, result?, error?, toolUses, durationMs, tokens? }` | Agent finishes successfully                   |
+| `subagents:resumed`   | same as `completed` (`buildEventData` shape)                                        | A retained session's resumed turn finishes    |
 | `subagents:failed`    | same as `completed` (`buildEventData` shape)                                        | Agent ends in `error`/`stopped`/`aborted`     |
 | `subagents:compacted` | `{ id, type, description, reason, tokensBefore, compactionCount }`                  | Child session compacts                        |
 | `subagents:created`   | `{ id, type, description, isBackground }`                                           | Background agent created (pre-admission)      |
@@ -943,21 +949,7 @@ Directory organization is healthy (seven domain directories, six root files) —
 
 #### ✅ Step 1 — Extract result delivery from `Subagent` ([#535])
 
-Smell: Category C (anemic domain / misplaced state, Law of Demeter, scattered resets) — the result-delivery domain named in the first-principles refinement is still fused into the execution record.
-Target files:
-
-- `src/lifecycle/subagent.ts` — drop `_notification` / `notification`; stop constructing `NotificationState` from `parentSession.toolCallId`.
-- `src/observation/notification.ts` — `NotificationManager` owns consumed-state keyed by agent id behind a single tell operation (e.g. `consume(id)`) that also cancels the pending nudge.
-- `src/observation/notification-state.ts` — dissolve into the manager or move wholly into the observation domain.
-- `src/observation/subagent-events-observer.ts`, `src/tools/get-result-tool.ts` — call the new delivery interface instead of reaching through the record.
-
-The `toolCallId` needed by `formatTaskNotification` already travels on `execution.parentSession`; expose it without routing through a notification object.
-The pre-await consumption ordering (the "Bug 1" race tests in `test/lifecycle/subagent-manager.test.ts`) is a preserved invariant — consuming before awaiting must still suppress the completion nudge.
-
-Outcome: zero `record.notification?.` reach-throughs in `src/`; `Subagent` carries no notification field; delivery state lives in the observation domain.
-
-Landed: `notification-state.ts` deleted; `Subagent.toolCallId` getter added over `execution.parentSession`; `NotificationManager` owns `consumed: Set<string>` behind one `consume(id)` tell that adds to the set and cancels the pending nudge atomically.
-Collapsing the old two-step reset (`markConsumed()` + `cancelNudge()`) into one atomic operation structurally eliminates the historical "Bug 1" race rather than just reordering it — `consume()` now suppresses the nudge regardless of whether it runs before or after the completion promise resolves, as long as it runs within the 200 ms hold window.
+Result delivery evolved twice. `notification-state.ts` was first dissolved and `Subagent.toolCallId` moved to execution identity. Consumption now lives as domain state on `SubagentState`, where retention and every push/pull delivery path can consult it. `NotificationManager` owns only delivery timing: it withholds records during a parent run and rechecks consumption at `agent_settled`, eliminating the uncancellable follow-up race rather than relying on a timer window.
 
 `Release: batch "result-delivery"`