@selesai/code 0.13.15 → 0.13.18

package/dist/extensions/pi-subagents/src/runs/foreground/execution.ts

@@ -2,8 +2,7 @@
  * Core execution logic for running subagents
  */
 
-import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
 import type { Message } from "@earendil-works/pi-ai";
 import { discoverAgents, formatUnknownAgentError, unknownAgentDiagnosticContext, type AgentConfig } from "../../agents/agents.ts";
@@ -31,7 +30,6 @@ import {
 	type AcceptanceLedger,
 	type ResolvedAcceptanceConfig,
 	truncateOutput,
-	getSubagentDepthEnv,
 } from "../../shared/types.ts";
 import {
 	DEFAULT_CONTROL_CONFIG,
@@ -60,22 +58,22 @@ import { effectiveToolTimeoutMs, formatToolTimeoutMessage, resolveToolTimeoutMs,
 import { evaluateCompletionMutationGuard, expectsImplementationMutation, hasMutationToolCapability, validateImplementationToolContract } from "../shared/completion-guard.ts";
 import { planCompletionEvidence } from "../shared/completion-evidence.ts";
 import { planAbortRecovery } from "../shared/abort-recovery.ts";
+import { planReadonlyModelContinuation, type LogicalRecoveryState } from "../shared/readonly-model-continuation.ts";
+import { getReadonlySessionEvidence, requestReadonlySessionEvidence, type SettledReadonlyEvidence } from "../shared/readonly-session-evidence.ts";
+import { getReadonlyChildModels } from "../shared/child-session.ts";
 import { arbitrateCompletionGuardRescue } from "../shared/llm-intent-arbiter.ts";
-import { getPiSpawnCommand } from "../shared/pi-spawn.ts";
 import { preflightLaunchCwd } from "../shared/launch-cwd.ts";
 import { createJsonlWriter } from "../../shared/jsonl-writer.ts";
 import { createOrcaProgressTab, type OrcaProgressTab } from "../shared/orca-progress-tabs.ts";
-import { attachPostExitStdioGuard, trySignalChild } from "../../shared/post-exit-stdio-guard.ts";
 import { resolvePermissionRules } from "../shared/permissions.ts";
-import { applyThinkingSuffix, buildPiArgs, cleanupTempDir, deriveForkPromptCacheKey, projectLaunchResolvedChildExtensions, resolvePiLaunchToolPlan, type SubagentTaskDelivery } from "../shared/pi-args.ts";
+import { applyThinkingSuffix, deriveForkPromptCacheKey } from "../shared/child-tool-plan.ts";
 import { deriveChildSessionName } from "../../shared/child-session-name.ts";
-import { readRuntimeAcknowledgedExtensions } from "../shared/runtime-acknowledged-extensions.ts";
-import { assertAgentAllowedByCapabilityCeiling, decodeSubagentCapabilityCeiling, intersectSubagentCapabilityCeilings, resolveCurrentSubagentCapabilityCeiling, SUBAGENT_CAPABILITY_CEILING_ENV } from "../shared/capability-ceiling.ts";
+import { assertAgentAllowedByCapabilityCeiling, intersectSubagentCapabilityCeilings, resolveCurrentSubagentCapabilityCeiling } from "../shared/capability-ceiling.ts";
 import { resolveEffectiveThinking } from "../../shared/model-info.ts";
-import { assertThinkingWithinCeiling, decodeThinkingCeiling, intersectThinkingCeilings, SUBAGENT_THINKING_CEILING_ENV } from "../../shared/thinking-ceiling.ts";
-import { clearStructuredOutputCaptures, MISSING_STRUCTURED_OUTPUT_CALL_ERROR, readStructuredOutput, readStructuredOutputAcceptanceReport } from "../shared/structured-output.ts";
-import { formatMidToolExitError, formatProcessSignalError, isOrdinaryToolForMidToolExit, isUnexplainedProcessSignal } from "../shared/process-signal.ts";
-import { readChildToolDiagnosticError } from "../shared/tool-availability.ts";
+import { assertThinkingWithinCeiling, intersectThinkingCeilings } from "../../shared/thinking-ceiling.ts";
+import { MISSING_STRUCTURED_ACCEPTANCE_REPORT_ERROR, MISSING_STRUCTURED_OUTPUT_CALL_ERROR } from "../shared/structured-output.ts";
+import { formatMidToolExitError, isOrdinaryToolForMidToolExit } from "../shared/process-signal.ts";
+import { formatChildToolDiagnostic } from "../shared/tool-availability.ts";
 import { buildTimeoutRecoverySummary, collectTrackedMutationEvidence, snapshotTrackedMutations } from "../shared/mutation-evidence.ts";
 import { captureSingleOutputSnapshot, extractChildWrittenOutput, finalizeSingleOutput, formatSavedOutputReference, hasSingleOutputChangedSinceSnapshot, injectOutputPathSystemPrompt, resolveSingleOutput, validateFileOnlyOutputMode, type SingleOutputSnapshot } from "../shared/single-output.ts";
 import {
@@ -86,14 +84,6 @@ import {
 	isRetryableModelFailureAttempt,
 	recordRetryableModelFailure,
 } from "../shared/model-fallback.ts";
-import {
-	SUBAGENT_STARTUP_RETRY_DELAYS_MS,
-	formatSubagentExtensionConflictError,
-	formatSubagentStartupRetryExhaustedError,
-	formatSubagentStartupRetryNote,
-	isRetryableSubagentStartupFailure,
-	waitForSubagentStartupRetry,
-} from "../shared/subagent-startup-retry.ts";
 import {
 	createMutatingFailureState,
 	didMutatingToolFail,
@@ -107,12 +97,12 @@ import {
 } from "../shared/long-running-guard.ts";
 import { acceptanceFailureMessage, buildSkippedAcceptanceLedger, evaluateAcceptance, formatAcceptancePrompt, resolveEffectiveAcceptance, stripAcceptanceReport, validateAcceptanceInput } from "../shared/acceptance.ts";
 import { PROMPT_REDACTED } from "../../shared/utils.ts";
-import { attachContractProjections, isAgentContractV1 } from "../shared/agent-contract.ts";
+import { attachContractProjections, isAgentContract } from "../shared/agent-contract.ts";
 import { initialToolBudgetState, toolBudgetState } from "../shared/tool-budget.ts";
 import { resolveWatchdogConfig } from "../../watchdog/settings.ts";
 import { agentDefinitionDigest, launchBindingDigest } from "../../shared/launch-contract.ts";
 import { consumeWorkflowChildPermit } from "../../shared/workflow-child-permit.ts";
-import { createBoundedByteTail, createBoundedLineReader, formatProtocolOutputLimit, MAX_CHILD_STDERR_BYTES, PI_AGGREGATE_EVENT_PROJECTOR, projectChildLifecycle, type ChildLifecycleAction, type ChildLifecycleState, type ProtocolOutputLimit } from "../shared/child-protocol.ts";
+import { projectChildLifecycle, type ChildLifecycleAction, type ChildLifecycleState } from "../shared/child-lifecycle.ts";
 import {
 	acceptChildWatchdogEvent,
 	applyChildWatchdogMessage,
@@ -120,7 +110,10 @@ import {
 	isChildWatchdogStatusEvent,
 	resolveChildWatchdogConfig,
 	type ChildWatchdogStateSnapshot,
+	type ChildWatchdogStatusEvent,
 } from "../../watchdog/child-status.ts";
+import { buildInProcessChildLaunch, createReportedChildSessionInput } from "../shared/child-launch.ts";
+import { childSessionFactory, projectChildSessionEventForJson, type ChildSession, type ChildSessionEvent } from "../shared/child-session.ts";
 
 const artifactOutputByResult = new WeakMap<SingleResult, string>();
 const acceptanceOutputByResult = new WeakMap<SingleResult, string>();
@@ -288,8 +281,8 @@ function snapshotResult(result: SingleResult, progress: AgentProgress): SingleRe
 /**
  * Streaming variant of snapshotResult for `onUpdate` progress events: it drops the
  * unbounded `messages` transcript in favour of compact tool-call summaries so a
- * single `tool_execution_update` line stays well under the child-stdout protocol
- * cap (`MAX_CHILD_PENDING_LINE_BYTES`). Non-streaming consumers such as
+ * single `tool_execution_update` event stays small; the parent records every
+ * one in its transcript and `events.jsonl`. Non-streaming consumers such as
  * foreground detach receipts and terminal consumers use snapshotResult directly.
  */
 function snapshotStreamResult(result: SingleResult, progress: AgentProgress): SingleResult {
@@ -350,6 +343,10 @@ function structuredDelegationProgressChanged(
 
 const AFTER_COMPACTION_SETTLEMENT = Symbol("afterCompactionSettlement");
 type AbortRecoverySingleResult = SingleResult & { [AFTER_COMPACTION_SETTLEMENT]?: true };
+const settledReadonlySource = new WeakMap<SingleResult, ChildSession>();
+
+const STOPPED_BEFORE_COMPLETION_ERROR = "Subagent stopped before completion.";
+
 
 async function runSingleAttempt(
 	runtimeCwd: string,
@@ -360,6 +357,7 @@ async function runSingleAttempt(
 	shared: {
 		sessionEnabled: boolean;
 		systemPrompt: string;
+		acceptancePrompt: string;
 		resolvedSkillNames?: string[];
 		modelCandidates?: string[];
 		skillsWarning?: string;
@@ -369,10 +367,12 @@ async function runSingleAttempt(
 		attemptNotes: string[];
 		outputSnapshot?: SingleOutputSnapshot;
 		originalTask?: string;
-		taskDelivery?: SubagentTaskDelivery;
 		orcaProgressTab?: OrcaProgressTab;
 		launchWarnings: { emitted: boolean };
 		verifyModel: boolean;
+		readonlyExpected?: SettledReadonlyEvidence;
+		readonlyModel?: string;
+		readonlyHandoffAllowed?: () => boolean;
 	},
 ): Promise<SingleResult> {
 	const effectiveThinking = options.thinkingOverride ?? agent.thinking;
@@ -380,9 +380,9 @@ async function runSingleAttempt(
 	assertThinkingWithinCeiling({ model: modelArg, configThinking: effectiveThinking, ceiling: options.thinkingCeiling, agent: agent.name, runId: options.runId });
 	const expectedModelForVerification = shared.verifyModel ? modelArg : undefined;
 	const resolvedThinking = resolveEffectiveThinking(modelArg, effectiveThinking);
-	// Display name for the child session: applied inside the child via
-	// SELESAI_SUBAGENT_SESSION_NAME and echoed back on the result payload so hosts
-	// can label this run without reading the child's session file.
+	// Display name for the child session: applied inside the child through its
+	// runtime config and echoed back on the result payload so hosts can label
+	// this run without reading the child's session file.
 	const childSessionName = deriveChildSessionName({ agent: agent.name, task: shared.originalTask ?? task });
 	const watchdogConfig = resolveWatchdogConfig(options.cwd ?? runtimeCwd);
 	const childWatchdog = watchdogConfig.ok
@@ -397,15 +397,12 @@ async function runSingleAttempt(
 	const permissionAuditPath = permissionRules && options.artifactsDir
 		? path.join(options.artifactsDir, "permission-audit", `${options.runId}-${options.index ?? 0}.jsonl`)
 		: undefined;
-	const { args, env: sharedEnv, tempDir, toolDiagnosticPath, runtimeAcknowledgedExtensionsPath, capabilityAudit, warnings } = buildPiArgs({
-		baseArgs: ["--mode", "json", "-p"],
-		task,
-		taskDelivery: shared.taskDelivery,
+	let onWatchdogStatus: ((event: ChildWatchdogStatusEvent) => void) | undefined;
+	const launch = buildInProcessChildLaunch({
 		sessionEnabled: shared.sessionEnabled,
 		sessionDir: options.sessionDir,
 		sessionFile: options.sessionFile,
 		model: modelArg,
-		thinking: effectiveThinking,
 		systemPromptMode: agent.systemPromptMode,
 		inheritProjectContext: agent.inheritProjectContext,
 		inheritGlobalContext: agent.inheritGlobalContext,
@@ -416,66 +413,45 @@ async function runSingleAttempt(
 		allowNestedSubagents: agent.allowNestedSubagents,
 		extensions: agent.extensions,
 		subagentOnlyExtensions: agent.subagentOnlyExtensions,
-		systemPrompt: shared.systemPrompt,
+		// Exact terminal protocol belongs to session resources, not compactable history.
+		systemPrompt: shared.acceptancePrompt ? `${shared.systemPrompt}\n${shared.acceptancePrompt}` : shared.systemPrompt,
 		mcpDirectTools: agent.mcpDirectTools,
 		cwd: options.cwd ?? runtimeCwd,
-		promptFileStem: agent.name,
 		intercomSessionName: options.intercomSessionName,
 		sessionName: childSessionName,
 		orchestratorIntercomTarget: options.orchestratorIntercomTarget,
 		runId: options.runId,
 		childAgentName: agent.name,
 		childIndex: options.index ?? 0,
-		parentEventSink: options.nestedRoute?.eventSink,
-		parentControlInbox: options.nestedRoute?.controlInbox,
-		parentRootRunId: options.nestedRoute?.rootRunId,
-		parentCapabilityToken: options.nestedRoute?.capabilityToken,
+		nestedRoute: options.nestedRoute,
 		runFanoutBudget: options.runFanoutBudget,
 		parentSessionId: options.parentSessionId,
 		forkCacheKey: options.context === "fork" ? deriveForkPromptCacheKey(options.parentSessionId) : undefined,
-		steerInboxDir: options.steerInboxDir,
-		steerCapabilityPath: options.steerCapabilityPath,
-		steerAckDir: options.steerAckDir,
 		structuredOutput: options.structuredOutput,
 		fast: options.fast ?? agent.fast,
 		modelCandidates: shared.modelCandidates,
 		toolBudget: options.toolBudget,
-		allowZeroToolBudget: options.allowZeroToolBudget,
 		permissionRules,
 		permissionAuditPath,
 		childWatchdog,
+		// registerChildWatchdog returns before reading the sink when no watchdog exists.
+		watchdogStatus: childWatchdog ? (event) => onWatchdogStatus?.(event) : undefined,
 		waitToolEnabled: options.waitToolEnabled,
 		waitToolDefaultTimeoutMs: options.waitToolDefaultTimeoutMs,
 		capabilityCeiling: options.capabilityCeiling,
 		thinkingCeiling: options.thinkingCeiling,
-		extensionBindings: options.extensionBindings,
+		maxSubagentDepth: options.maxSubagentDepth,
 		runtimeSnapshotHost: options.runtimeSnapshotHost,
+		inherited: options.childRuntime,
+		host: "parent",
 	});
+	const { toolPlan, capabilityAudit, warnings, launchResolvedExtensions, capture } = launch;
 	if (!shared.launchWarnings.emitted && warnings.length > 0) {
 		for (const warning of warnings) console.warn(`[pi-subagents] ${warning}`);
 		shared.launchWarnings.emitted = true;
 	}
 
 	const effectiveSystemPrompt = shared.systemPrompt;
-	const toolPlan = resolvePiLaunchToolPlan({
-		tools: agent.tools,
-		allowNestedSubagents: agent.allowNestedSubagents,
-		extensions: agent.extensions,
-		subagentOnlyExtensions: agent.subagentOnlyExtensions,
-		mcpDirectTools: agent.mcpDirectTools,
-		cwd: options.cwd ?? runtimeCwd,
-		requireReadTool: Boolean(shared.resolvedSkillNames?.length),
-		structuredOutput: Boolean(options.structuredOutput),
-		excludeTools: agent.excludeTools,
-		fast: options.fast ?? agent.fast,
-		model: modelArg,
-		modelCandidates: shared.modelCandidates,
-		capabilityCeiling: options.capabilityCeiling,
-		inheritedCapabilityCeiling: decodeSubagentCapabilityCeiling(process.env[SUBAGENT_CAPABILITY_CEILING_ENV]),
-		agentName: agent.name,
-		permissionRules,
-		runtimeSnapshotHost: options.runtimeSnapshotHost,
-	});
 	const contractTools = toolPlan.explicitToolAllowlist ? toolPlan.effectiveToolAllowlist : undefined;
 	const contractError = validateImplementationToolContract({
 		agent: agent.name,
@@ -488,7 +464,6 @@ async function runSingleAttempt(
 		completionGuard: agent.completionGuard,
 	});
 	if (contractError) {
-		cleanupTempDir(tempDir);
 		return {
 			index: options.index ?? 0,
 			agent: agent.name,
@@ -507,7 +482,6 @@ async function runSingleAttempt(
 			...(toolPlan.capabilityAudit ? { capabilityAudit: toolPlan.capabilityAudit } : {}),
 		};
 	}
-	const launchResolvedExtensions = projectLaunchResolvedChildExtensions(toolPlan);
 	const launchContractDigest = launchBindingDigest({
 		definitionDigest: agentDefinitionDigest(agent),
 		task: shared.originalTask ?? task,
@@ -554,17 +528,6 @@ async function runSingleAttempt(
 		...(capabilityAudit ? { capabilityAudit } : {}),
 	}, options.context);
 	const startTime = Date.now();
-	if (options.structuredOutput) {
-		const cleanupError = clearStructuredOutputCaptures(options.structuredOutput);
-		if (cleanupError) {
-			cleanupTempDir(tempDir);
-			result.exitCode = 1;
-			result.error = cleanupError;
-			result.finalOutput = cleanupError;
-			result.progressSummary = { toolCount: 0, tokens: 0, durationMs: Date.now() - startTime };
-			return result;
-		}
-	}
 	const controlConfig = options.controlConfig ?? DEFAULT_CONTROL_CONFIG;
 	let interruptedByControl = false;
 	const allControlEvents: ControlEvent[] = [];
@@ -599,7 +562,6 @@ async function runSingleAttempt(
 	result.progress = progress;
 	const attemptTimeout = resolveAttemptTimeout(options);
 	if (attemptTimeout?.remainingMs === 0) {
-		cleanupTempDir(tempDir);
 		result.exitCode = 1;
 		result.timedOut = true;
 		result.error = attemptTimeout.message;
@@ -613,7 +575,6 @@ async function runSingleAttempt(
 		};
 		return result;
 	}
-	const spawnEnv = { ...process.env, ...sharedEnv, ...getSubagentDepthEnv(options.maxSubagentDepth) };
 	const mutationSnapshot = snapshotTrackedMutations(options.cwd ?? runtimeCwd);
 	let observedMutationAttempt = false;
 	let structuredOutputToolInvoked = false;
@@ -621,7 +582,6 @@ async function runSingleAttempt(
 	let toolAvailabilityError: string | undefined;
 	let abortedBySignal = options.signal?.aborted === true;
 
-	const spawnSpec = getPiSpawnCommand(args);
 	if (options.workflowChildPermitLaunch) {
 		const permitError = consumeWorkflowChildPermit(options.workflowChildPermitLaunch.permit, {
 			workflowRunId: options.workflowChildPermitLaunch.workflowRunId,
@@ -632,7 +592,6 @@ async function runSingleAttempt(
 			runner: "pi",
 		});
 		if (permitError) {
-			cleanupTempDir(tempDir);
 			result.exitCode = 1;
 			result.error = permitError;
 			result.finalOutput = permitError;
@@ -641,16 +600,13 @@ async function runSingleAttempt(
 			return result;
 		}
 	}
+	const childSessions = options.childSessionFactory ?? childSessionFactory();
 	let afterCompactionSettlement = false;
 	const exitCode = await new Promise<number>((resolve) => {
-		const proc = spawn(spawnSpec.command, spawnSpec.args, {
-			cwd: options.cwd ?? runtimeCwd,
-			env: spawnEnv,
-			stdio: ["ignore", "pipe", "pipe"],
-			windowsHide: true,
-		});
-		const jsonlWriter = createJsonlWriter(shared.jsonlPath, proc.stdout);
-		let processClosed = false;
+		const jsonlWriter = createJsonlWriter(shared.jsonlPath, { pause() {}, resume() {} });
+		let session: ChildSession | undefined;
+		let unsubscribe: (() => void) | undefined;
+		let sessionSettled = false;
 		let lifecycleFinished = false;
 		let detached = false;
 		let intercomStarted = false;
@@ -659,26 +615,26 @@ async function runSingleAttempt(
 		let removeInterruptListener: (() => void) | undefined;
 		let activityTimer: NodeJS.Timeout | undefined;
 		let timeoutTimer: NodeJS.Timeout | undefined;
-		let timeoutTerminationTimer: NodeJS.Timeout | undefined;
-		let timeoutHardKillTimer: NodeJS.Timeout | undefined;
-		let protocolHardKillTimer: NodeJS.Timeout | undefined;
+		let timeoutHardFinishTimer: NodeJS.Timeout | undefined;
 		const clearTimeoutTimers = () => {
 			if (timeoutTimer) {
 				clearTimeout(timeoutTimer);
 				timeoutTimer = undefined;
 			}
-			if (timeoutTerminationTimer) {
-				clearTimeout(timeoutTerminationTimer);
-				timeoutTerminationTimer = undefined;
-			}
-			if (timeoutHardKillTimer) {
-				clearTimeout(timeoutHardKillTimer);
-				timeoutHardKillTimer = undefined;
+			if (timeoutHardFinishTimer) {
+				clearTimeout(timeoutHardFinishTimer);
+				timeoutHardFinishTimer = undefined;
 			}
 		};
+		const abortChild = (): void => {
+			if (!session || sessionSettled || lifecycleFinished) return;
+			void session.abort().catch(() => {
+				// The session settles through its prompt promise; abort failures are not separately actionable.
+			});
+		};
 
 		const detachForeground = (reason: string): boolean => {
-			if (detached || processClosed || lifecycleFinished || options.signal?.aborted) return false;
+			if (detached || sessionSettled || lifecycleFinished || options.signal?.aborted) return false;
 			const receiptProgress = snapshotProgress(progress);
 			receiptProgress.status = "detached";
 			receiptProgress.durationMs = Date.now() - startTime;
@@ -713,20 +669,21 @@ async function runSingleAttempt(
 			}
 			if (!accepted) return false;
 			detached = true;
+			if (session) session.detached = true;
 			return true;
 		};
 
-		// If the child emits a terminal assistant stop but never exits,
-		// give it a short grace period to flush naturally, then clean it up.
+		// If the child emits a terminal assistant stop but its run never settles
+		// (a hook is stuck), abort it after a short grace period and then finish
+		// without it.
 		const FINAL_STOP_GRACE_MS = 1000;
-		const HARD_KILL_MS = 3000;
-		let childExited = false;
-		let forcedTerminationSignal = false;
+		const HARD_FINISH_MS = 3000;
+		let forcedTermination = false;
 		let cleanTerminalAssistantStopReceived = false;
 		let agentSettledReceived = false;
 		let compactionStartedReceived = false;
 		let finalDrainTimer: NodeJS.Timeout | undefined;
-		let finalHardKillTimer: NodeJS.Timeout | undefined;
+		let finalHardFinishTimer: NodeJS.Timeout | undefined;
 		let watchdogTailTimer: NodeJS.Timeout | undefined;
 		let childWatchdogState: ChildWatchdogStateSnapshot | undefined;
 		const updateChildWatchdogState = (snapshot: ChildWatchdogStateSnapshot): void => {
@@ -745,9 +702,9 @@ async function runSingleAttempt(
 				clearTimeout(finalDrainTimer);
 				finalDrainTimer = undefined;
 			}
-			if (finalHardKillTimer) {
-				clearTimeout(finalHardKillTimer);
-				finalHardKillTimer = undefined;
+			if (finalHardFinishTimer) {
+				clearTimeout(finalHardFinishTimer);
+				finalHardFinishTimer = undefined;
 			}
 		};
 		const startFinalDrain = () => {
@@ -755,25 +712,24 @@ async function runSingleAttempt(
 				armWatchdogTail();
 				return;
 			}
-			if (childExited || finalDrainTimer || lifecycleFinished || processClosed) return;
+			if (sessionSettled || finalDrainTimer || lifecycleFinished) return;
 			finalDrainTimer = setTimeout(() => {
-				if (lifecycleFinished || processClosed) return;
-				const termSent = trySignalChild(proc, "SIGTERM");
-				if (!termSent) return;
-				forcedTerminationSignal = true;
+				if (lifecycleFinished || sessionSettled) return;
+				forcedTermination = true;
 				if (!cleanTerminalAssistantStopReceived && !agentSettledReceived && !assistantError) {
-					result.error = result.error ?? `Subagent process did not exit within ${FINAL_STOP_GRACE_MS}ms after its terminal event. Forcing termination.`;
+					result.error = result.error ?? `Subagent session did not settle within ${FINAL_STOP_GRACE_MS}ms after its terminal event. Aborting it.`;
 				}
-				finalHardKillTimer = setTimeout(() => {
-					if (lifecycleFinished || processClosed) return;
-					forcedTerminationSignal = trySignalChild(proc, "SIGKILL") || forcedTerminationSignal;
-				}, HARD_KILL_MS);
-				finalHardKillTimer.unref?.();
+				abortChild();
+				finalHardFinishTimer = setTimeout(() => {
+					if (lifecycleFinished || sessionSettled) return;
+					settle(undefined, true);
+				}, HARD_FINISH_MS);
+				finalHardFinishTimer.unref?.();
 			}, FINAL_STOP_GRACE_MS);
 			finalDrainTimer.unref?.();
 		};
 		function armWatchdogTail(): void {
-			if ((!cleanTerminalAssistantStopReceived && !agentSettledReceived) || watchdogTailTimer || lifecycleFinished || processClosed) return;
+			if ((!cleanTerminalAssistantStopReceived && !agentSettledReceived) || watchdogTailTimer || lifecycleFinished || sessionSettled) return;
 			watchdogTailTimer = setTimeout(() => {
 				watchdogTailTimer = undefined;
 				updateChildWatchdogState({
@@ -799,7 +755,7 @@ async function runSingleAttempt(
 		const childLifecycleState: ChildLifecycleState = { compactionRetryActive: false };
 
 		const unsubscribeIntercomDetach = options.intercomEvents?.on?.(INTERCOM_DETACH_REQUEST_EVENT, (payload) => {
-			if (!options.allowIntercomDetach || processClosed) return;
+			if (!options.allowIntercomDetach || sessionSettled) return;
 			if (!payload || typeof payload !== "object") return;
 			const event = payload as { requestId?: unknown; runId?: unknown; agent?: unknown; childIndex?: unknown };
 			const requestId = event.requestId;
@@ -819,13 +775,8 @@ async function runSingleAttempt(
 			lifecycleFinished = true;
 			clearFinalDrainTimers();
 			clearWatchdogTailTimer();
-			clearStdioGuard();
 			clearTimeoutTimers();
 			clearAllToolTimeouts();
-			if (protocolHardKillTimer) {
-				clearTimeout(protocolHardKillTimer);
-				protocolHardKillTimer = undefined;
-			}
 			if (activityTimer) {
 				clearInterval(activityTimer);
 				activityTimer = undefined;
@@ -833,7 +784,16 @@ async function runSingleAttempt(
 			unsubscribeIntercomDetach?.();
 			removeAbortListener?.();
 			removeInterruptListener?.();
-			resolve(code);
+			unsubscribe?.();
+			onWatchdogStatus = undefined;
+			void jsonlWriter.close().catch(() => {
+				// JSONL artifact flush is best effort.
+			});
+			// Report the run only after the child's extensions have shut down.
+			void Promise.resolve().then(() => session?.dispose()).catch(() => undefined).then(() => {
+				if (session && getReadonlySessionEvidence(session)) settledReadonlySource.set(result, session);
+				resolve(code);
+			});
 		};
 
 		const drainPendingControlEvents = (): ControlEvent[] | undefined => {
@@ -996,7 +956,7 @@ async function runSingleAttempt(
 
 		let lastStructuredDelegationProgressState: StructuredDelegationProgressState | undefined;
 		const emitUpdateSnapshot = (text: string) => {
-			if (!options.onUpdate || processClosed) return;
+			if (!options.onUpdate || sessionSettled) return;
 			const progressSnapshot = snapshotProgress(progress);
 			const resultSnapshot = snapshotStreamResult(result, progressSnapshot);
 			const controlEvents = drainPendingControlEvents();
@@ -1012,7 +972,7 @@ async function runSingleAttempt(
 		};
 
 		const fireUpdate = () => {
-			if (!options.onUpdate || processClosed) return;
+			if (!options.onUpdate || sessionSettled) return;
 			progress.durationMs = Date.now() - startTime;
 			if (options.suppressUnchangedDelegationUpdates) {
 				if (lastStructuredDelegationProgressState && !structuredDelegationProgressChanged(lastStructuredDelegationProgressState, progress, result)) return;
@@ -1022,20 +982,9 @@ async function runSingleAttempt(
 			emitUpdateSnapshot(output || "(running...)");
 		};
 
-		const rawStdoutTail = createBoundedByteTail();
-		const processLine = (line: string) => {
-			if (!line.trim()) return;
-			jsonlWriter.writeLine(line);
-			let evt: { type?: string; message?: Message; toolName?: string; toolCallId?: string; args?: unknown; willRetry?: unknown };
-			try {
-				evt = JSON.parse(line) as { type?: string; message?: Message; toolName?: string; toolCallId?: string; args?: unknown; willRetry?: unknown };
-			} catch {
-				rawStdoutTail.push(`${line}\n`);
-				shared.transcriptWriter?.writeStdoutLine(line);
-				shared.orcaProgressTab?.append(`${line}\n`);
-				// Non-JSON stdout lines are expected; only structured events are parsed.
-				return;
-			}
+		const processEvent = (evt: ChildSessionEvent & { message?: Message; toolName?: string; toolCallId?: string; args?: unknown; willRetry?: unknown }) => {
+			if (lifecycleFinished) return;
+			jsonlWriter.writeLine(JSON.stringify(projectChildSessionEventForJson(evt)));
 			shared.transcriptWriter?.writeChildEvent(evt);
 			shared.orcaProgressTab?.event(evt);
 			if (evt.type === "compaction_start") compactionStartedReceived = true;
@@ -1047,6 +996,20 @@ async function runSingleAttempt(
 				compactionStartedReceived = false;
 				afterCompactionSettlement = false;
 			}
+			if (evt.type === "agent_start") {
+				const diagnostic = capture.toolDiagnostic();
+				if (diagnostic) {
+					const message = formatChildToolDiagnostic(diagnostic, { host: "parent" });
+					toolAvailabilityError = message;
+					result.error = message;
+					result.finalOutput = message;
+					progress.status = "failed";
+					progress.error = message;
+					fireUpdate();
+					abortChild();
+					return;
+				}
+			}
 			const lifecycleAction = projectChildLifecycle(evt, false, childLifecycleState);
 			if (evt.type === "agent_settled" && lifecycleAction === "start-drain") {
 				agentSettledReceived = true;
@@ -1150,14 +1113,18 @@ async function runSingleAttempt(
 						progress.model = evt.message.model;
 						if (!result.model) result.model = evt.message.model;
 						if (expectedModelForVerification && !hasToolCall) {
-							const modelVerificationError = formatSubagentModelVerificationError(expectedModelForVerification, evt.message.model, options.availableModels);
+							const modelVerificationError = formatSubagentModelVerificationError(expectedModelForVerification, evt.message.model, options.availableModels, options.modelResponseAliases);
 							if (modelVerificationError && !result.error) result.error = modelVerificationError;
 						}
 					}
 					if (evt.message.errorMessage) assistantError = evt.message.errorMessage;
+					else if (hasToolCall && evt.message.stopReason === "toolUse") {
+						// A recovered request can finish via a terminating tool, without a text stop.
+						assistantError = undefined;
+					}
 					const assistantText = extractTextFromContent(evt.message.content);
 					appendRecentOutput(progress, assistantText.split("\n").slice(-10));
-					// Final assistant message: start the exit drain window.
+					// Final assistant message: start the settle drain window.
 					if (terminalAssistantStop) {
 						if (!evt.message.errorMessage && assistantText.trim()) assistantError = undefined;
 						cleanTerminalAssistantStopReceived ||= !evt.message.errorMessage;
@@ -1219,11 +1186,12 @@ async function runSingleAttempt(
 				fireUpdate();
 			}
 		};
+		onWatchdogStatus = (event) => processEvent(event as unknown as Parameters<typeof processEvent>[0]);
 
 		fireUpdate();
 		if (controlConfig.enabled || options.onUpdate) {
 			activityTimer = setInterval(() => {
-				if (processClosed || lifecycleFinished) {
+				if (sessionSettled || lifecycleFinished) {
 					return;
 				}
 				updateActivityState(Date.now());
@@ -1234,7 +1202,7 @@ async function runSingleAttempt(
 
 		if (attemptTimeout) {
 			timeoutTimer = setTimeout(() => {
-				if (processClosed || lifecycleFinished || interruptedByControl) return;
+				if (sessionSettled || lifecycleFinished || interruptedByControl) return;
 				result.timedOut = true;
 				clearAllToolTimeouts();
 				result.error = attemptTimeout.message;
@@ -1243,17 +1211,12 @@ async function runSingleAttempt(
 				progress.error = attemptTimeout.message;
 				progress.durationMs = Date.now() - startTime;
 				fireUpdate();
-				trySignalChild(proc, "SIGINT");
-				timeoutTerminationTimer = setTimeout(() => {
-					if (processClosed || lifecycleFinished) return;
-					trySignalChild(proc, "SIGTERM");
-				}, 1000);
-				timeoutTerminationTimer.unref?.();
-				timeoutHardKillTimer = setTimeout(() => {
-					if (processClosed || lifecycleFinished) return;
-					trySignalChild(proc, "SIGKILL");
+				abortChild();
+				timeoutHardFinishTimer = setTimeout(() => {
+					if (sessionSettled || lifecycleFinished) return;
+					settle(undefined, true);
 				}, 4000);
-				timeoutHardKillTimer.unref?.();
+				timeoutHardFinishTimer.unref?.();
 			}, attemptTimeout.remainingMs);
 			timeoutTimer.unref?.();
 		}
@@ -1261,8 +1224,7 @@ async function runSingleAttempt(
 		let toolTimeoutSequence = 0;
 		const activeToolTimeouts = new Map<string, { toolName: string; timer: ReturnType<typeof setTimeout> }>();
 		const activeToolTimeoutKeysByName = new Map<string, string[]>();
-		let toolTimeoutTerminationTimer: ReturnType<typeof setTimeout> | undefined;
-		let toolTimeoutHardKillTimer: ReturnType<typeof setTimeout> | undefined;
+		let toolTimeoutHardFinishTimer: ReturnType<typeof setTimeout> | undefined;
 		const removeToolTimeoutKey = (key: string): void => {
 			const active = activeToolTimeouts.get(key);
 			if (!active) return;
@@ -1284,17 +1246,13 @@ async function runSingleAttempt(
 		};
 		const clearAllToolTimeouts = (): void => {
 			for (const key of [...activeToolTimeouts.keys()]) removeToolTimeoutKey(key);
-			if (toolTimeoutTerminationTimer) {
-				clearTimeout(toolTimeoutTerminationTimer);
-				toolTimeoutTerminationTimer = undefined;
-			}
-			if (toolTimeoutHardKillTimer) {
-				clearTimeout(toolTimeoutHardKillTimer);
-				toolTimeoutHardKillTimer = undefined;
+			if (toolTimeoutHardFinishTimer) {
+				clearTimeout(toolTimeoutHardFinishTimer);
+				toolTimeoutHardFinishTimer = undefined;
 			}
 		};
 		const terminateForToolTimeout = (message: string): void => {
-			if (processClosed || lifecycleFinished || interruptedByControl) return;
+			if (sessionSettled || lifecycleFinished || interruptedByControl) return;
 			result.timedOut = true;
 			result.error = message;
 			result.finalOutput = message;
@@ -1302,17 +1260,12 @@ async function runSingleAttempt(
 			progress.error = message;
 			progress.durationMs = Date.now() - startTime;
 			fireUpdate();
-			trySignalChild(proc, "SIGINT");
-			toolTimeoutTerminationTimer = setTimeout(() => {
-				if (processClosed || lifecycleFinished) return;
-				trySignalChild(proc, "SIGTERM");
-			}, 1000);
-			toolTimeoutTerminationTimer.unref?.();
-			toolTimeoutHardKillTimer = setTimeout(() => {
-				if (processClosed || lifecycleFinished) return;
-				trySignalChild(proc, "SIGKILL");
+			abortChild();
+			toolTimeoutHardFinishTimer = setTimeout(() => {
+				if (sessionSettled || lifecycleFinished) return;
+				settle(undefined, true);
 			}, 4000);
-			toolTimeoutHardKillTimer.unref?.();
+			toolTimeoutHardFinishTimer.unref?.();
 		};
 		const armToolTimeout = (event: { toolCallId?: unknown; toolName: string }): void => {
 			const timeoutForTool = effectiveToolTimeoutMs(event.toolName, options.toolTimeoutMs);
@@ -1333,111 +1286,42 @@ async function runSingleAttempt(
 			activeToolTimeoutKeysByName.set(toolName, keys);
 		};
 
-		const stderrTail = createBoundedByteTail();
-		const failProtocol = (limit: ProtocolOutputLimit): void => {
-			if (result.protocolError) return;
-			result.protocolError = limit;
-			result.error = formatProtocolOutputLimit(limit);
-			progress.status = "failed";
-			progress.error = result.error;
-			progress.durationMs = Date.now() - startTime;
-			fireUpdate();
-			if (!childExited) {
-				trySignalChild(proc, "SIGTERM");
-				protocolHardKillTimer = setTimeout(() => {
-					if (!childExited) trySignalChild(proc, "SIGKILL");
-				}, 3000);
-				protocolHardKillTimer.unref?.();
-			}
-		};
-		const stdoutReader = createBoundedLineReader({
-			oversizedLineProjector: PI_AGGREGATE_EVENT_PROJECTOR,
-			onLine: processLine,
-			onLimit: failProtocol,
-		});
-		const stderrReader = createBoundedLineReader({
-			stream: "stderr",
-			maxPendingLineBytes: MAX_CHILD_STDERR_BYTES,
-			onLine: (line) => shared.transcriptWriter?.writeStderrLine(line),
-			onLimit: (limit) => shared.transcriptWriter?.writeStderrLine(formatProtocolOutputLimit(limit)),
-		});
-
-		const clearStdioGuard = attachPostExitStdioGuard(proc, { idleMs: 2000, hardMs: 8000 });
-		proc.stdout.on("data", (chunk: Buffer) => stdoutReader.push(chunk));
-		proc.stderr.on("data", (chunk: Buffer) => {
-			stderrTail.push(chunk);
-			stderrReader.push(chunk);
-			shared.orcaProgressTab?.append(chunk.toString("utf-8"));
-		});
-		proc.on("exit", () => {
-			childExited = true;
+		/** The child run ended (or was forced to end); fold in the captures and finish. */
+		const settle = (promptError: unknown, forced = false): void => {
+			if (lifecycleFinished || sessionSettled) return;
+			sessionSettled = true;
 			clearFinalDrainTimers();
-		});
-		proc.on("close", (code, signal) => {
-			if (lifecycleFinished) return;
-			processClosed = true;
-			clearFinalDrainTimers();
-			clearStdioGuard();
-			void jsonlWriter.close().catch(() => {
-				// JSONL artifact flush is best effort.
-			});
-			const toolDiagnosticError = readChildToolDiagnosticError(toolDiagnosticPath);
+			const diagnostic = capture.toolDiagnostic();
+			const toolDiagnosticError = diagnostic ? formatChildToolDiagnostic(diagnostic, { host: "parent" }) : undefined;
 			toolAvailabilityError = toolDiagnosticError;
-			result.runtimeAcknowledgedExtensions = readRuntimeAcknowledgedExtensions(runtimeAcknowledgedExtensionsPath);
-			cleanupTempDir(tempDir);
-			stdoutReader.end();
-			stderrReader.end();
-			const stderr = stderrTail.text();
-			const rawStdout = rawStdoutTail.text();
+			result.runtimeAcknowledgedExtensions = capture.runtimeAcknowledgedExtensions();
 			let closeError = result.error ?? toolDiagnosticError ?? assistantError;
-			const forcedDrainAfterFinalSuccess = Boolean(forcedTerminationSignal || signal) && (cleanTerminalAssistantStopReceived || agentSettledReceived) && !closeError;
-			const forcedDrainAfterEmptyTerminal = forcedDrainAfterFinalSuccess && hasEmptyTerminalAssistantResponse(result.messages ?? []);
-			if (signal) result.processSignal = signal;
-			if (!closeError && forcedDrainAfterEmptyTerminal && stderr.trim()) {
-				closeError = stderr.trim();
-			}
-			if (!closeError && isUnexplainedProcessSignal({
-				processSignal: signal,
-				interrupted: result.interrupted,
-				timedOut: result.timedOut,
-				stopped: result.stopped,
-				forcedDrainAfterFinalSuccess: forcedDrainAfterFinalSuccess && !forcedDrainAfterEmptyTerminal,
-			})) {
-				closeError = formatProcessSignalError(signal!);
+			if (!closeError && promptError !== undefined) {
+				closeError = promptError instanceof Error ? promptError.message : String(promptError);
 			}
-			if (code !== 0 && rawStdout.trim() && !closeError && !forcedDrainAfterFinalSuccess) {
-				closeError = rawStdout.trim();
+			const forcedDrainAfterFinalSuccess = (forced || forcedTermination) && (cleanTerminalAssistantStopReceived || agentSettledReceived) && !closeError;
+			const forcedDrainAfterEmptyTerminal = forcedDrainAfterFinalSuccess && hasEmptyTerminalAssistantResponse(result.messages ?? []);
+			if (!closeError && (abortedBySignal || session?.shutDown) && !result.interrupted && !result.timedOut) {
+				closeError = session?.shutDown ? "Subagent stopped because the parent session shut down." : STOPPED_BEFORE_COMPLETION_ERROR;
 			}
-			if (code !== 0 && stderr.trim() && !closeError && !forcedDrainAfterFinalSuccess) {
-				closeError = stderr.trim();
+			if (!closeError && forced && !forcedDrainAfterFinalSuccess) {
+				closeError = "Subagent session did not settle after it was aborted.";
 			}
-			const finalCode = forcedDrainAfterFinalSuccess && !forcedDrainAfterEmptyTerminal ? 0 : forcedTerminationSignal || signal ? (code ?? 1) : (code ?? 0);
+			const finalCode = forcedDrainAfterFinalSuccess && !forcedDrainAfterEmptyTerminal ? 0 : closeError || promptError !== undefined ? 1 : 0;
 			if (!result.error && closeError) result.error = closeError;
 			finish(finalCode);
-		});
-		proc.on("error", (error) => {
-			if (lifecycleFinished) return;
-			processClosed = true;
-			clearFinalDrainTimers();
-			clearStdioGuard();
-			void jsonlWriter.close().catch(() => {
-				// JSONL artifact flush is best effort.
-			});
-			cleanupTempDir(tempDir);
-			stdoutReader.end();
-			stderrReader.end();
-			if (!result.error) {
-				result.error = error instanceof Error ? error.message : String(error);
-			}
-			finish(1);
-		});
+		};
 
 		if (options.signal) {
 			const kill = () => {
-				if (processClosed || lifecycleFinished) return;
+				if (sessionSettled || lifecycleFinished) return;
 				abortedBySignal = true;
-				proc.kill("SIGTERM");
-				setTimeout(() => !proc.killed && proc.kill("SIGKILL"), 3000);
+				abortChild();
+				const hardTimer = setTimeout(() => {
+					if (sessionSettled || lifecycleFinished) return;
+					settle(undefined, true);
+				}, 3000);
+				hardTimer.unref?.();
 			};
 			if (options.signal.aborted) kill();
 			else {
@@ -1448,7 +1332,7 @@ async function runSingleAttempt(
 
 		if (options.interruptSignal) {
 			const interrupt = () => {
-				if (processClosed || lifecycleFinished) return;
+				if (sessionSettled || lifecycleFinished) return;
 				if (result.timedOut) return;
 				interruptedByControl = true;
 				clearTimeoutTimers();
@@ -1459,11 +1343,12 @@ async function runSingleAttempt(
 				result.finalOutput = "Interrupted. Waiting for explicit next action.";
 				progress.activityState = undefined;
 				fireUpdate();
-				trySignalChild(proc, "SIGINT");
-				setTimeout(() => {
-					if (lifecycleFinished || processClosed) return;
-					trySignalChild(proc, "SIGTERM");
-				}, 1000).unref?.();
+				abortChild();
+				const hardTimer = setTimeout(() => {
+					if (sessionSettled || lifecycleFinished) return;
+					settle(undefined, true);
+				}, 3000);
+				hardTimer.unref?.();
 			};
 			if (options.interruptSignal.aborted) interrupt();
 			else {
@@ -1478,9 +1363,37 @@ async function runSingleAttempt(
 			options.onDetachReady?.((reason = "user request") => detachForeground(reason));
 		} catch (error) {
 			// A consumer callback is advisory. Keep the child attached and observable
-			// rather than rejecting this attempt and orphaning its live process.
+			// rather than rejecting this attempt and orphaning its live session.
 			appendRecentOutput(progress, [`Foreground detach callback failed: ${error instanceof Error ? error.message : String(error)}`]);
 		}
+
+		void (async () => {
+			try {
+				const input = createReportedChildSessionInput(launch, shared.transcriptWriter);
+				requestReadonlySessionEvidence(input, shared.readonlyExpected);
+				if (shared.readonlyHandoffAllowed && !shared.readonlyHandoffAllowed()) throw new Error("Read-only continuation handoff vetoed.");
+				const created = await childSessions.create(input);
+				if (lifecycleFinished) {
+					void created.dispose();
+					return;
+				}
+				session = created;
+				created.detached = detached;
+				unsubscribe = created.subscribe((event) => processEvent(event as Parameters<typeof processEvent>[0]));
+				if (abortedBySignal || interruptedByControl || result.timedOut) {
+					abortChild();
+				}
+				options.onChildSession?.({ steer: (text) => created.steer(text), followUp: (text) => created.followUp(text) });
+				const actualReadonlyModel = shared.readonlyExpected && getReadonlyChildModels(created)?.current;
+				if (shared.readonlyExpected && (!actualReadonlyModel || actualReadonlyModel.fullId !== shared.readonlyModel
+					|| actualReadonlyModel.api !== shared.readonlyExpected.api || created.modelId !== shared.readonlyModel || abortedBySignal || interruptedByControl || result.timedOut
+					|| !shared.readonlyHandoffAllowed?.())) throw new Error("Read-only continuation handoff vetoed.");
+				await created.prompt(`Task: ${task}`);
+				settle(undefined);
+			} catch (error) {
+				settle(error ?? new Error("Child session failed."));
+			}
+		})();
 	});
 	result.exitCode = exitCode;
 	if (afterCompactionSettlement) {
@@ -1506,20 +1419,10 @@ async function runSingleAttempt(
 		&& !abortedBySignal
 		&& !result.timedOut
 		&& !result.stopped
-		&& !result.protocolError
 		&& !toolAvailabilityError) {
-		const processExitCode = result.exitCode;
 		result.exitCode = 1;
-		result.error = formatMidToolExitError({
-			toolName: progress.currentTool,
-			exitCode: processExitCode,
-			processSignal: result.processSignal,
-		});
+		result.error = formatMidToolExitError({ toolName: progress.currentTool });
 	}
-	result.error = formatSubagentExtensionConflictError(result.error, {
-		agent: agent.name,
-		ambientExtensionsEnabled: !launchResolvedExtensions.disableAmbientExtensions,
-	});
 	if (result.error && result.exitCode === 0) {
 		result.exitCode = 1;
 	}
@@ -1527,27 +1430,23 @@ async function runSingleAttempt(
 	if (options.structuredOutput && result.exitCode === 0 && !result.error) {
 		result.structuredOutputSchemaPath = options.structuredOutput.schemaPath;
 		result.structuredOutputPath = options.structuredOutput.outputPath;
-		if (!structuredOutputToolInvoked) {
+		const structured = capture.structuredOutput();
+		if (!structuredOutputToolInvoked || !structured.called) {
 			result.exitCode = 1;
 			result.error = MISSING_STRUCTURED_OUTPUT_CALL_ERROR;
 			result.structuredOutputFailed = true;
 		} else {
-			const structured = await readStructuredOutput({
-				schema: options.structuredOutput.schema,
-				schemaPath: options.structuredOutput.schemaPath,
-				outputPath: options.structuredOutput.outputPath,
-			});
-			if (structured.error) {
-				result.exitCode = 1;
-				result.error = structured.error;
-				result.structuredOutputFailed = true;
-			} else {
-				result.structuredOutput = structured.value;
-				const acceptanceReport = readStructuredOutputAcceptanceReport(options.structuredOutput);
-				(result as SingleResult & { structuredAcceptanceReport?: unknown; structuredAcceptanceReportError?: string }).structuredAcceptanceReport = acceptanceReport.value;
-				(result as SingleResult & { structuredAcceptanceReport?: unknown; structuredAcceptanceReportError?: string }).structuredAcceptanceReportError = acceptanceReport.error;
-				validatedStructuredOutput = true;
-			}
+			result.structuredOutput = structured.value;
+			const acceptanceMode = options.structuredOutput.acceptanceReportPath
+				? options.structuredOutput.acceptanceReportRequired ? "required" : "optional"
+				: undefined;
+			const acceptanceReportError = acceptanceMode === "required" && !structured.acceptanceReportProvided
+				? MISSING_STRUCTURED_ACCEPTANCE_REPORT_ERROR
+				: undefined;
+			(result as SingleResult & { structuredAcceptanceReport?: unknown; structuredAcceptanceReportError?: string }).structuredAcceptanceReport = acceptanceMode ? structured.acceptanceReport : undefined;
+			(result as SingleResult & { structuredAcceptanceReport?: unknown; structuredAcceptanceReportError?: string }).structuredAcceptanceReportError = acceptanceReportError;
+			writeStructuredOutputArtifacts(options.structuredOutput, structured.value, acceptanceMode ? structured.acceptanceReport : undefined);
+			validatedStructuredOutput = true;
 		}
 	}
 	if (result.exitCode === 0 && !result.error) {
@@ -1600,7 +1499,7 @@ async function runSingleAttempt(
 			const outputChanged = hasSingleOutputChangedSinceSnapshot(options.outputPath, shared.outputSnapshot);
 			requiredOutputMissing = outputChanged === undefined ? undefined : !outputChanged;
 		} else if (options.structuredOutput) {
-			requiredOutputMissing = !existsSync(options.structuredOutput.outputPath);
+			requiredOutputMissing = !capture.structuredOutput().called;
 		}
 		result.timeoutRecovery = buildTimeoutRecoverySummary({
 			termination: "timed-out",
@@ -1617,7 +1516,7 @@ async function runSingleAttempt(
 			? `${timeoutMessage}\n\n${result.timeoutRecovery.message}\n\nPartial output before timeout:\n${fullOutput}`
 			: `${timeoutMessage}\n\n${result.timeoutRecovery.message}`;
 	}
-	const completionGuardEnabled = isAgentContractV1(options.agentContract) ? agent.completionGuard === true : agent.completionGuard !== false;
+	const completionGuardEnabled = isAgentContract(options.agentContract) ? agent.completionGuard === true : agent.completionGuard !== false;
 	const completionGuard = ((result.exitCode === 0 && !result.error) || toolAvailabilityError) && completionGuardEnabled
 		? evaluateCompletionMutationGuard({
 			agent: agent.name,
@@ -1657,7 +1556,7 @@ async function runSingleAttempt(
 		mutationAttemptObserved,
 		mutationEvidence,
 		arbiterRescued,
-		agentContractV1: isAgentContractV1(options.agentContract),
+		agentContractEnabled: isAgentContract(options.agentContract),
 	});
 	if (completionEvidence.fileMutation) {
 		result.effects = {
@@ -1719,6 +1618,20 @@ async function runSingleAttempt(
 	return result;
 }
 
+/** Keep the structured output artifact files other consumers read by path. */
+function writeStructuredOutputArtifacts(runtime: NonNullable<RunSyncOptions["structuredOutput"]>, value: unknown, acceptanceReport: unknown): void {
+	try {
+		mkdirSync(path.dirname(runtime.outputPath), { recursive: true });
+		writeFileSync(runtime.outputPath, JSON.stringify(value), { mode: 0o600 });
+		if (runtime.acceptanceReportPath) {
+			if (acceptanceReport !== undefined) writeFileSync(runtime.acceptanceReportPath, JSON.stringify(acceptanceReport), { mode: 0o600 });
+			else rmSync(runtime.acceptanceReportPath, { force: true });
+		}
+	} catch {
+		// The captured value is already on the result; the file is observability only.
+	}
+}
+
 /**
  * Run a subagent synchronously (blocking until complete)
  */
@@ -1744,7 +1657,7 @@ async function runSyncCompletionInner(
 	}
 	options = {
 		...options,
-		capabilityCeiling: intersectSubagentCapabilityCeilings(options.capabilityCeiling ?? resolveCurrentSubagentCapabilityCeiling(options.parentSessionId), decodeSubagentCapabilityCeiling(process.env[SUBAGENT_CAPABILITY_CEILING_ENV])),
+		capabilityCeiling: intersectSubagentCapabilityCeilings(options.capabilityCeiling ?? resolveCurrentSubagentCapabilityCeiling(options.parentSessionId), options.childRuntime?.capabilityCeiling),
 	};
 	const childSessionName = deriveChildSessionName({ agent: agentName, task });
 	const agent = agents.find((a) => a.name === agentName);
@@ -1766,7 +1679,7 @@ async function runSyncCompletionInner(
 		thinkingCeiling: intersectThinkingCeilings(
 			options.thinkingCeiling,
 			agent.maxThinking,
-			decodeThinkingCeiling(process.env[SUBAGENT_THINKING_CEILING_ENV]),
+			options.childRuntime?.thinkingCeiling,
 		),
 	};
 	try {
@@ -1839,7 +1752,7 @@ async function runSyncCompletionInner(
 		dynamicGroup: options.acceptanceContext?.dynamicGroup,
 		agentContract: options.agentContract,
 	});
-	const acceptancePrompt = formatAcceptancePrompt(effectiveAcceptance, { reportOptional: isAgentContractV1(options.agentContract), structuredOutput: Boolean(options.structuredOutput?.acceptanceReportPath) });
+	const acceptancePrompt = formatAcceptancePrompt(effectiveAcceptance, { reportOptional: isAgentContract(options.agentContract), structuredOutput: Boolean(options.structuredOutput?.acceptanceReportPath) });
 	const taskWithAcceptance = acceptancePrompt ? `${task}\n${acceptancePrompt}` : task;
 	options.onEffectivePrompt?.(taskWithAcceptance);
 	const sessionEnabled = Boolean(options.sessionFile || options.sessionDir) || shareEnabled;
@@ -1990,21 +1903,33 @@ async function runSyncCompletionInner(
 	};
 	let lastResult: SingleResult | undefined;
 	const modelsToTry = candidates.length > 0 ? candidates : [undefined];
-	// Escalated to "file" after an unexplained zero-activity startup failure so
-	// retries keep the task text out of argv (endpoint pre-exec scans may deny it).
-	let taskDeliveryOverride: SubagentTaskDelivery | undefined;
-	let abortRecoveryAttempted = false;
-	let nextAttemptTask = taskWithAcceptance;
+	let recoveryState: LogicalRecoveryState = "unused";
+	let readonlyExpected: SettledReadonlyEvidence | undefined;
+	let readonlyModel: string | undefined;
+	let readonlySource: ChildSession | undefined;
+	// Ordinary startup retries retain their per-attempt timeout. Only retained
+	// continuation uses the original logical deadline, never a renewed allowance.
+	const continuationDeadline = options.deadlineAt ?? (options.timeoutMs === undefined ? undefined : Date.now() + options.timeoutMs);
+	const readonlyHandoffAllowed = () => !options.signal?.aborted && !options.interruptSignal?.aborted
+		&& !intercomDetached && !detachedReason && !options.workflowChildPermitLaunch
+		&& options.usageBudget === undefined && options.toolBudget === undefined
+		&& (continuationDeadline === undefined || Date.now() < continuationDeadline)
+		&& (!readonlySource || getReadonlySessionEvidence(readonlySource) === readonlyExpected)
+		&& !readonlySource?.detached && !readonlySource?.shutDown;
+	let nextAttemptTask = task;
 	modelAttemptsLoop: for (let modelIndex = 0; modelIndex < modelsToTry.length; modelIndex++) {
 		const candidate = modelsToTry[modelIndex];
-		for (let startupAttemptIndex = 0; ; startupAttemptIndex++) {
-			const recoveringAbort = abortRecoveryAttempted;
+		// The inner loop re-runs the same candidate at most once, for abort recovery.
+		for (;;) {
+			const recoveringAbort = recoveryState === "abort-recovery";
 			const attemptTask = nextAttemptTask;
 			const verifyModel = Boolean(candidate) && !(options.modelOverrideFromParent && modelIndex === 0);
 			const outputSnapshot = captureSingleOutputSnapshot(options.outputPath);
+			if (recoveryState === "readonly-continuation") attemptOptions.deadlineAt = continuationDeadline;
 			const result = await runSingleAttempt(runtimeCwd, agent, attemptTask, candidate, attemptOptions, {
 				sessionEnabled,
 				systemPrompt,
+				acceptancePrompt,
 				resolvedSkillNames: resolvedSkills.length > 0 ? resolvedSkills.map((skill) => skill.name) : undefined,
 				skillsWarning: missingSkills.length > 0 ? `Skills not found: ${missingSkills.join(", ")}` : undefined,
 				jsonlPath,
@@ -2016,13 +1941,15 @@ async function runSyncCompletionInner(
 					.filter((modelCandidate): modelCandidate is string => Boolean(modelCandidate)),
 				outputSnapshot,
 				originalTask: task,
-				taskDelivery: taskDeliveryOverride,
 				orcaProgressTab,
 				launchWarnings,
 				verifyModel,
+				readonlyExpected,
+				readonlyModel,
+				readonlyHandoffAllowed: readonlyExpected ? readonlyHandoffAllowed : undefined,
 			});
 			lastResult = result;
-			if (!recoveringAbort && startupAttemptIndex === 0) {
+			if (!recoveringAbort) {
 				if (result.model) attemptedModels.push(result.model);
 				else if (candidate) attemptedModels.push(candidate);
 			}
@@ -2038,6 +1965,46 @@ async function runSyncCompletionInner(
 				usage: { ...result.usage },
 			};
 			modelAttempts.push(attempt);
+			// A consumed retained continuation is terminal even on a startup error or abort.
+			if (recoveryState === "readonly-continuation") break modelAttemptsLoop;
+			const source = settledReadonlySource.get(result);
+			const evidence = source && getReadonlySessionEvidence(source);
+			const models = source && getReadonlyChildModels(source);
+			// Deny non-text retained inputs, including unknown blocks. Count bytes once,
+			// not restored usage (the latter belongs to earlier attempts/runs).
+			const textOnly = evidence && (JSON.parse(evidence.contextJson) as Array<{ role: string; content: unknown }>).every((message) =>
+				typeof message.content === "string" || Array.isArray(message.content) && message.content.every((block) =>
+					block?.type === "text" || message.role === "assistant" && block?.type === "toolCall"));
+			const retainedBytes = evidence && models ? Buffer.byteLength(evidence.contextJson) + models.requestBytes : Infinity;
+			const resolvedCandidates = modelsToTry.map((reference, index) => index === modelIndex ? models?.current : reference ? models?.resolve(reference) : undefined);
+			const continuation = planReadonlyModelContinuation({
+				source, recoveryState, currentIndex: modelIndex,
+				candidates: resolvedCandidates.map((resolved, index) => {
+					// A conservative byte ceiling includes serialized history, actual system
+					// prompt/tools, framing/continuation headroom and full output allowance.
+					const required = resolved?.maxTokens ? retainedBytes + 4096 + resolved.maxTokens : Infinity;
+					return {
+						resolved: resolved?.api ? { provider: resolved.provider, model: resolved.id, api: resolved.api } : undefined,
+						tried: index <= modelIndex,
+						compatibility: textOnly && resolved?.input?.includes("text") && (resolved.contextWindow ?? 0) >= required ? "compatible" as const : "unknown" as const,
+					};
+				}),
+				lifecycleAllowsContinuation: !attemptSucceeded && readonlyHandoffAllowed() && !result.stopped && !result.detached && !result.interrupted && !result.timedOut,
+				effectsAllowContinuation: !result.structuredOutputFailed && !result.toolBudgetBlocked && !result.progress?.currentTool
+					&& !result.outputSaveError && (!result.effects?.fileMutation || result.effects.fileMutation.status === "not-applicable"),
+				budget: options.toolBudget ? "tool-budget-configured" : options.usageBudget ? "unknown" : "unconfigured",
+				knownContextOverflow: Boolean(result.contextOverflow || isContextOverflow(result.error)),
+			});
+			if (continuation.kind === "continue") {
+				recoveryState = continuation.recoveryState; // consume BEFORE any sibling creation
+				readonlyExpected = continuation.expected;
+				readonlySource = source;
+				readonlyModel = resolvedCandidates[continuation.candidateIndex]?.fullId;
+				nextAttemptTask = continuation.prompt;
+				attemptNotes.push(`[readonly-continuation] ${attempt.model} failed with HTTP 429 after read-only progress; continuing retained session once with ${readonlyModel}.`);
+				modelIndex = continuation.candidateIndex - 1;
+				continue modelAttemptsLoop;
+			}
 			if (!attemptSucceeded) {
 				const afterCompactionSettlement = (result as AbortRecoverySingleResult)[AFTER_COMPACTION_SETTLEMENT];
 				const abortRecovery = planAbortRecovery({
@@ -2045,7 +2012,7 @@ async function runSyncCompletionInner(
 					error: result.error,
 					processSignal: result.processSignal,
 					sessionAvailable: Boolean(options.sessionFile && existsSync(options.sessionFile)),
-					alreadyResumed: abortRecoveryAttempted,
+					alreadyResumed: recoveryState !== "unused",
 					stopped: result.stopped || result.detached || options.signal?.aborted,
 					interrupted: result.interrupted || intercomDetached || options.interruptSignal?.aborted,
 					timedOut: result.timedOut,
@@ -2057,7 +2024,7 @@ async function runSyncCompletionInner(
 					afterCompactionSettlement,
 				});
 				if (abortRecovery.action === "resume") {
-					abortRecoveryAttempted = true;
+					recoveryState = "abort-recovery";
 					nextAttemptTask = abortRecovery.prompt;
 					attemptNotes.push("[abort-recovery] provider/transport abort after useful progress; resuming the retained child session once.");
 					continue;
@@ -2072,75 +2039,10 @@ async function runSyncCompletionInner(
 			if (options.workflowChildPermitLaunch && !attemptSucceeded) break modelAttemptsLoop;
 			// Preserve the legacy intercom handoff contract: once this logical run has
 			// been handed to a supervisor, terminating that attempt must not launch a
-			// startup retry or model fallback. Explicit user detach retains fallback.
+			// model fallback. Explicit user detach retains fallback.
 			if (intercomDetached || result.timedOut) break modelAttemptsLoop;
 			if (attemptSucceeded) break modelAttemptsLoop;
 
-			const startupFailure = isRetryableSubagentStartupFailure({
-				exitCode: result.exitCode,
-				error: result.error,
-				finalOutput: result.finalOutput,
-				messageCount: result.messages?.length ?? 0,
-				toolCount: result.progressSummary?.toolCount ?? 0,
-				usage: result.usage,
-				durationMs: result.progressSummary?.durationMs ?? Number.POSITIVE_INFINITY,
-				protocolError: result.protocolError,
-				processSignal: result.processSignal,
-				detached: result.detached,
-				interrupted: result.interrupted,
-				timedOut: result.timedOut,
-				stopped: result.stopped,
-			});
-			const retryDelayMs = SUBAGENT_STARTUP_RETRY_DELAYS_MS[startupAttemptIndex];
-			if (startupFailure && retryDelayMs !== undefined) {
-				const retryNote = formatSubagentStartupRetryNote({
-					model: attempt.model,
-					attempt: startupAttemptIndex + 1,
-					maxAttempts: SUBAGENT_STARTUP_RETRY_DELAYS_MS.length + 1,
-					delayMs: retryDelayMs,
-				});
-				const shouldRetry = await waitForSubagentStartupRetry(retryDelayMs, [options.signal, options.interruptSignal]);
-				if (!shouldRetry) {
-					if (options.interruptSignal?.aborted) {
-						result.exitCode = 0;
-						result.interrupted = true;
-						result.error = undefined;
-						result.finalOutput = "Interrupted. Waiting for explicit next action.";
-						if (result.progress) {
-							result.progress.status = "running";
-							result.progress.error = undefined;
-						}
-					} else {
-						const cancellationError = "Subagent startup retry cancelled before relaunch.";
-						result.error = cancellationError;
-						result.finalOutput = cancellationError;
-						attempt.error = cancellationError;
-						if (result.progress) result.progress.error = cancellationError;
-					}
-					break modelAttemptsLoop;
-				}
-				if (!taskDeliveryOverride && result.processSignal === "SIGKILL") {
-					taskDeliveryOverride = "file";
-					attemptNotes.push("[startup-retry] retrying with file task delivery to keep the task text out of the child process argv.");
-				}
-				attempt.error = retryNote;
-				attemptNotes.push(retryNote);
-				continue;
-			}
-			if (startupFailure) {
-				const startupError = formatSubagentStartupRetryExhaustedError({
-					model: attempt.model,
-					attempts: startupAttemptIndex + 1,
-				});
-				result.error = startupError;
-				result.finalOutput = startupError;
-				if (result.progress) {
-					result.progress.error = startupError;
-					result.progress.status = "failed";
-				}
-				attempt.error = startupError;
-				break modelAttemptsLoop;
-			}
 			const retryableModelFailure = isRetryableModelFailureAttempt({ error: result.error, messages: result.messages, toolCount: result.progressSummary?.toolCount });
 			if (retryableModelFailure) recordRetryableModelFailure(result.model ?? candidate, result.error);
 			if (isContextOverflow(result.error)) {
@@ -2233,7 +2135,7 @@ async function runSyncCompletionInner(
 					? { content: childWrittenOutput, path: options.outputPath, authoritative: options.outputMode === "file-only", durable: result.savedOutputPath !== undefined }
 					: undefined,
 				cwd: options.cwd ?? runtimeCwd,
-				reportOptional: isAgentContractV1(options.agentContract),
+				reportOptional: isAgentContract(options.agentContract),
 				artifactsDir: options.artifactsDir,
 				runId: options.runId,
 				watchdog: result.watchdog,
@@ -2245,7 +2147,7 @@ async function runSyncCompletionInner(
 	}
 	const acceptanceFailure = acceptanceFailureMessage(result.acceptance);
 	stripAcceptanceReportsFromMessages(result.messages);
-	if (acceptanceFailure && result.acceptance.explicit && result.exitCode === 0 && !result.interrupted && !result.timedOut && !isAgentContractV1(options.agentContract)) {
+	if (acceptanceFailure && result.acceptance.explicit && result.exitCode === 0 && !result.interrupted && !result.timedOut && !isAgentContract(options.agentContract)) {
 		result.exitCode = 1;
 		if (result.savedOutputPath) {
 			result.finalOutput = finalizeSingleOutput({
@@ -2278,7 +2180,7 @@ async function runSyncCompletionInner(
 			result.progress.error = result.error;
 		}
 	}
-	if (isAgentContractV1(options.agentContract)) attachContractProjections(result);
+	if (isAgentContract(options.agentContract)) attachContractProjections(result);
 	redactResultPrompt(result);
 	try {
 		persistResultMetadata(result);
@@ -2323,7 +2225,7 @@ export async function runSync(
 ): Promise<SingleResult> {
 	// Capture the strict contract before consumer-owned objects can be mutated
 	// after a detached receipt is published.
-	const strictContract = isAgentContractV1(options.agentContract);
+	const strictContract = isAgentContract(options.agentContract);
 	let detachedReason: string | undefined;
 	let publishedReceipt: SingleResult | undefined;
 	let activeDetachAttempt: ((reason?: string) => boolean) | undefined;
@@ -2421,13 +2323,13 @@ export async function runSync(
 	});
 
 	let terminalCallbackInvoked = false;
-	void authoritativeCompletion.then((terminalResult) => {
+	void authoritativeCompletion.then(async (terminalResult) => {
 		if (!detachedReason || terminalCallbackInvoked) return;
 		terminalCallbackInvoked = true;
 		terminalResult.detached = undefined;
 		terminalResult.detachedReason = detachedReason;
 		try {
-			options.onDetachedExit?.(terminalResult);
+			await options.onDetachedExit?.(terminalResult);
 		} catch {
 			// The authoritative result has settled. Consumer callback failures are
 			// contained here; each consumer owns cleanup through its own finally block.