@sema-agent/core 5.55.0 → 5.57.0

package/CHANGELOG.md

@@ -1,5 +1,145 @@
 # Changelog
 
+## 5.57.0 — 2026-08-23
+
+### Added
+- **key×URL pairing adjudicator** (#309 cross-repo case, [5060]-[5063] consensus): `adjudicateModelRoute`
+  is the single source of the credential-pairing law. Per-model credential = paired by construction;
+  the deployment-config credential passes only on the deployment's own declared root; absent credential
+  is legal keyless except for an entry declaring its own off-root URL. Codes `route.credential_mismatch`
+  / `route.credential_missing` (refusal detail carries entry id + both URL halves + a one-line fixHint,
+  fail-closed by ruling). The three first-party brains gate inside buildRequest (refusal terminates
+  before any fetch) and expose `Brain.adjudicateRoute`; routing/failover/degrading/circuit-breaker
+  re-judge per leg (failover serves from the paired leg; a broken degrading hop is skipped). Two-leg
+  disposition: a NAMED model surfaces the refusal; a DERIVED model (compaction summarize, auto-mode
+  classifier, suggestions) pre-flights and falls back to the primary with a `route.fallback_to_primary`
+  notice; `route.base_url_changed_key_unchanged` mints at swapModels. `ROUTE_ADJUDICATION_CONFORMANCE_CORPUS`
+  (16 vectors) exported as the cross-codebase anchor. **Narrowings (each with a fixHint)**: declared-root
+  deployments' off-root entries now refuse instead of silently borrowing the gateway credential; an
+  entry-declared auth header now wins over the deployment key. Preserved byte-identical: unpinned
+  quick-start, keyless single-gateway, header-only boot token, gateway dual-auth.
+- **Per-model auth seats for WebFetch summarizer and team surfaces** (#417): `getApiKeyAndHeaders`
+  on `WebFetchSummarizerOptions` / `TeamDiscussionOptions` / `runScenario` (absent seat = byte-identical).
+- **Compound-prefix permission rules** (#364 case B, ruled; registered divergence): `Bash(cd /tmp && adb pull:*)`
+  — leading segments byte-exact, only the final segment takes arguments. The validator accepts the
+  chain form (a `*` in any other position still refuses); the matcher admits on segment-count equality
+  + byte-prefix at a word boundary (a single-command prefix still never admits a compound; the segment
+  deny/ask fence stays strictly ahead of the allow lane); the suggester mints the compound-prefix
+  sibling at index 1 when the final segment fits the same grammar as the simple seat; the card-edit
+  face accepts the respelling; org tighten gains the same grammar (a compound-prefix deny is enforceable
+  instead of bricking its snapshot). **Widenings**: validator accepts the new form; eligible compounds
+  offer 2 seats; card edit + import accept it; org snapshots carrying it are enforceable. **Mixed-fleet
+  note**: older engines quarantine compound-prefix rows (bytes preserved, disclosed) — do not publish
+  compound-prefix org rules before the fleet is level.
+- **Generic prefix grammar for rule suggestions** (#364 R1, CC 2.1.223 iNo corpus): the prefix arm
+  uses the corpus rule `^[a-z][a-z0-9]*(-[a-z0-9]+)*$` with the interpreter/wrapper blacklist; the
+  125-line lexicon demotes to a bonus for multi-word deepening; ASCII-closed head-name screen.
+- **`precheckEditedRuleText(text, command)`** (#428, server pickup): the card-edit face's three text
+  gates (spelling normalization → grammar → coverage bound) extracted to one shared body and exported
+  (`EditedRuleTextPrecheck`). `ok` means SUBMITTABLE (record-level gates stay with `confirmRuleApproval`);
+  `canonicalRule` may differ from the submitted bytes; refusal words match `edit_rejected.detail`
+  verbatim (`code` rides validator refusals only). The entry screens unrenderable command bytes loudly
+  (`config.invalid_argument`).
+- **ScheduleWakeup honesty family** (#424 A-1/A-4): the wakeup intent carries `lifetime:"session"`
+  where the backend vouched for the reap contract; an undeclared backend keeps the historic durable
+  intent with receipt + description disclosure; `reason` rides `details.reason`. An incomplete
+  replace (stale wakeup possibly still armed) is disclosed on the receipt.
+- **SendMessage completion promises follow mount truth** (#424 A-6): `notificationWired?` / `oneShot?`
+  seats (defaults preserve wired behavior byte-identical); the unwired arm teaches retrieval, the
+  one-shot arm instructs blocking retrieval now; ten sites across two wordings guarded.
+
+### Fixed
+- **Derived-route pre-flight can never sink the main task** (pre-ship rescan P1): the judge call and
+  the whole seat (including URL normalization of garbage catalog values) now abstain on throw instead
+  of failing task preparation and leaking the acquired session view; both derived seats share the
+  guarded helper.
+- **Route URL comparison is wire-equivalent** (rescan): scheme/host case-fold + default-port elision
+  (path half stays byte-ordered; parse failure falls back to raw) — case-only respellings of the same
+  endpoint no longer refuse as `credential_mismatch`.
+- **MCP revocation copy tells the standing truth at all four outlets** (rescan; #424 A-5 completed):
+  the ListMcpResources arm joins the other three ("stays on this run's roster; every call refused
+  the same way"), with an extinction tripwire for the old sentence.
+- **AgentHarness auth carriers refuse loudly at the two host seats** (rescan hardening): a
+  deployment-wide auth header in `streamOptions.headers` is refused with a migration hint instead of
+  silently riding beside per-model credentials; `stripAuthHeaders` retired (zero callers).
+- **ExitWorktree parameter texts describe this tool** (#424 A-8): detached worktrees have no branch;
+  a changed tree is KEPT (not refused) — CC originals and reasoning recorded at the schema.
+- **Read-only memory notice restores CC's recall-framing paragraph** (#424 A-9, byte-compared).
+- **MCP/scheduler small truths** (rescan): the wakeup mount note is led by the `supportsSessionWakeup:false`
+  arm; an explicitly-declared `supportsSessionLifetime:false` backend behaves like an undeclared one
+  (seam defines the two spellings as one state — the refusal arm from an unshipped interim build rolled back).
+
+### Bench (not part of the package surface)
+- LLM distillation arm for the memory benchmark (three-clause instruction arc: retained 20.8%→100%,
+  convergence restored; distillation quality flat with the hand-authored ceiling on this corpus's
+  measurable axes); live provider key no longer travels to the loopback observation plane.
+
+## 5.56.0 — 2026-08-23
+
+### Fixed
+- **A2A covering rules join the mcp form** (#410, ruled): `a2a__peer` / `a2a__peer__*` deny, ask
+  and allow now fire in all five name-keyed lanes (rule DSL, allow/deny policy, approval policy,
+  frozen projection replay, persisted session rules) via the protocol-table-driven
+  `namespacedRuleNameCovers`. **Narrowings**: a frozen projection replayed under 5.56 honors
+  covering spellings it previously read as inert (heaviest); covering-name parenthesised rules
+  refuse (`unsupported.covering_paren`, additive union member); empty-peer spellings refuse at
+  construction. **Widening / false-refusal repair**: real minted names with separator-bearing tool
+  segments (`mcp__srv____foo` and twins) that previously THREW at construction now compile as
+  exact entries (the name-set screen judges the peer boundary only).
+- **Delegation entry caps cover every local spawn leg** (#385, anchor campaign): sync spawn,
+  sync fork and background fork now pass the same concurrency/cumulative gate as background
+  spawns (one pool, four admit sites; in-flight reservations returned on settle). Sync legs mint
+  `delegation.concurrency_cap` / `delegation.session_cap` under the `Sub-agent not started: `
+  prefix (new code+prefix combination); counted nouns drop the word "background";
+  `AgentDefinition.background: true` is honored (previously a dead field); no-principal mounts
+  fold to the engine default pool instead of skipping the gate.
+- **Every deployment hook seat is time-bounded** (#388, anchor campaign): the ten `Hooks` seats
+  ride one bounded family (default 600s; `Hooks.timeoutMs` knob, bad values refused loudly).
+  Decision seats fail closed on expiry (preToolUse → deny + permissionDenied(source "hook");
+  userPromptSubmit → block; stop → run ends); observation seats discard and shrink to a 1s grace
+  after task abort; hook contexts carry `signal` and live tracked `cwd`. Pre-ship rescan closures:
+  the runSpec hook mirror now carries `timeoutMs` (a deployment's bound was silently replaced by
+  the default on composed runs); stopFailure reads the deadline rather than a constant grace; the
+  post-abort grace caps remaining time instead of restarting the clock.
+- **interrupt() keeps accepted user input; an interrupt leaves CC's transcript marker** (#389,
+  anchor campaign): steer queues survive `interrupt()` (one-way abort latch + in-flight slot);
+  a durable park migrates queued steers onto the checkpoint (idempotent CAS verb) and the
+  undrained account announces only the remainder; an explicit interrupt that won the abort mints
+  CC's verbatim `[Request interrupted by user]` marker (double-gated); unknown
+  `SystemInjectionPriority` values refuse and the unimplemented `"now"` ladder is disclosed once
+  per run (`task.injection_priority_unimplemented`); the untrusted caller steer lane gains CC's
+  mid-turn delivery frame.
+- **A SendMessage name that changed hands refuses instead of silently redirecting** (CC's
+  `send_message_pin_guard` rebound arm): "Nothing was sent." plus both ways forward; a precise
+  task_id is never refused and re-pins; the tool description states the refusal.
+- **A legacy-decided parked row converges** (#400, test P0-KPI): the live reconcile's resolved
+  skip now means "a claim is in flight" (read from the store row) — a checkpoint decided by the
+  task-level legacy lane settles the row instead of leaving a process-lifetime zombie; the
+  decision is re-read immediately before the verdict so a reopen CAS is never judged dead.
+- **Compaction PTL retries disclose what they dropped** (#407, test P0-KPI):
+  `CompactionDetails.unsummarizedMessages` accumulates the true uncovered count across split
+  legs, with a shell-copy clause and an import-gate check. The summary prompt carries CC's
+  `<example>` skeleton and a compliant `<summary>` envelope is unwrapped in the persisted body
+  (pre-ship rescan closure: a fence-only EMPTY response is refused loudly, same class and wording
+  as the bare-empty arm — it could previously persist a footer-only summary).
+  `keepRecentToolResults` floors at 1 and refuses NaN/negative loudly.
+- **#384 (keepRecentTokens default) closed as REFUTED, with evidence**: the anchor-campaign claim
+  that the 0 default meant "no kept tail" was disproved on a real Runner — `findCutPoint` has a
+  structural floor, the kept tail is never empty, and the pinned behavior matches CC's posture
+  via the other knob. The default is unchanged; the floor is now pinned
+  (test/compaction-keep-tail-floor.test.ts) and four stale anchor comments were corrected.
+
+### Notes
+- Anchor-campaign satellite dispositions ride along (A3/A4/A8/A14 candidate tables in the
+  respective cars' receipts): truthfulness rewrites, registry entries, and the
+  PermissionDenied trigger-surface divergence registered.
+- Erratum owed to sibling repos (also stated in src/core/hooks.ts): "CC fails open on hook
+  faults except exit 2" is true only of the command(shell) hook channel; CC's in-process
+  callback channel is fail-closed with dedicated copy — cited as a fail-open precedent it is
+  the wrong channel.
+- Residuals filed, not shipped silently: #417-#423 (auth seats, Agent(<type>) governance,
+  lifecycle legs, postToolUse payload asymmetry, reopen fence, classic-arm Trust-but-verify).
+
 ## 5.55.0 — 2026-08-23
 
 ### BREAKING

package/dist/agents/send-message-tool.d.ts

@@ -33,6 +33,17 @@ export interface SendMessageToolOptions {
     notify?: (n: TaskNotificationPayload, opts?: {
         priority?: "now" | "next" | "later";
     }) => void;
+    /** Whether a completion notification really reaches the sender — drives every "you will be notified"
+     *  sentence on this face (description + four receipts), mirroring TaskOutput's `notificationWired`.
+     *  Default = `notify !== undefined`, which is the truth on both the first-party mount and a direct
+     *  mount that wires its own sink here. Pass `true` only when the deployment announces a finished
+     *  agent through a channel of its own (this tool then keeps the wired wording); `false` states the
+     *  degraded truth explicitly. */
+    notificationWired?: boolean;
+    /** RB-220 mirror of {@link import("../core/types.js").TaskSpec.oneShot} (the Runner mount fills it):
+     *  this run's process exits when the turn ends, so no completion notification can ever land — checked
+     *  AHEAD of {@link notificationWired}, since no amount of wiring makes a later turn exist. */
+    oneShot?: boolean;
     /** Steer-handle sink: the revived run re-emits a FRESH handle (design/122 risk-table contract). */
     sink?: (handle: SubagentSteerHandle) => void;
     /**

package/dist/agents/send-message-tool.js

@@ -5,6 +5,7 @@ import { announceTranscriptIntegrityGapOnce, canAccessAgentRecord, clearRevivedR
 import { uuidv7 } from "../internal/harness.js";
 import { MAILBOX_TOMBSTONED_RECIPIENT_CODE } from "../core/mailbox-store.js";
 import { escapeAttributeValue, escapeEnvelopeTag, isObserverTaskId, OBSERVER_SENDMESSAGE_SENDER_REFUSAL, OBSERVER_SENDMESSAGE_TARGET_REFUSAL, } from "./observer.js";
+import { inlineUntrusted } from "../core/untrusted-text.js";
 import { SUBAGENT_RESUME_CAP, SubagentRetainLedger, getSessionRetainLedger } from "./retain-ledger.js";
 import { createSubagentResume } from "./subagent.js";
 import { appendHopToken, judgePeerAdmission, peerAxisToken, resolvePeerAdmissionConfig, PEER_MESSAGE_NOTICE, } from "./peer-admission.js";
@@ -45,6 +46,50 @@ function targetLaneKey(scope, targetId) {
 const OPERATOR_CONTINUATION_CTX = Symbol("sema.operator_continuation");
 export function createSendMessageTool(opts) {
     const tier3Capable = opts.agentStore !== undefined && opts.mailbox !== undefined && opts.reviveSpawn !== undefined;
+    const completionMode = opts.oneShot === true ? "one_shot" : (opts.notificationWired ?? opts.notify !== undefined) ? "notified" : "silent";
+    const notifyWired = completionMode === "notified";
+    const NO_COMPLETION_NOTICE = completionMode === "one_shot"
+        ? "this is a ONE-SHOT submission — there is no later turn for a completion notification to land in, so retrieve its result NOW with TaskOutput(task_id, block: true) rather than ending your turn"
+        : "its completion is NOT announced on this mount — retrieve its status and result with TaskOutput(task_id) where mounted";
+    const AWAIT_COMPLETION = notifyWired
+        ? "Wait for its completion notification"
+        : completionMode === "one_shot"
+            ? "Wait for it NOW with TaskOutput(task_id, block: true) — this one-shot submission ends with this turn"
+            : "Check for its completion with TaskOutput(task_id) where mounted";
+    const awaitCompletion = notifyWired
+        ? "wait for its completion notification"
+        : completionMode === "one_shot"
+            ? "wait for it NOW with TaskOutput(task_id, block: true) — this one-shot submission ends with this turn"
+            : "check for its completion with TaskOutput(task_id) where mounted";
+    const sendMessagePins = new Map();
+    const pinGuard = (targetId, targetName, rung, to) => {
+        if (rung === "other")
+            return undefined;
+        const pinKey = normalizeAgentName(targetName ?? "");
+        if (pinKey === "")
+            return undefined;
+        const pinned = sendMessagePins.get(pinKey);
+        if (pinned === undefined || pinned.id === targetId) {
+            sendMessagePins.set(pinKey, { id: targetId, name: targetName ?? to });
+            return undefined;
+        }
+        if (rung === "ref") {
+            sendMessagePins.set(pinKey, { id: targetId, name: targetName ?? to });
+            return undefined;
+        }
+        if (targetName !== undefined && normalizeAgentName(to) === pinKey && normalizeAgentName(pinned.name) !== pinKey) {
+            return undefined;
+        }
+        return {
+            content: `Message not sent: "${inlineUntrusted(to, 120)}" now resolves to a different agent than it did earlier in ` +
+                `this run — this name previously resolved to ${pinned.id.slice(0, 64)}, which it no longer reaches. Nothing was sent.\n` +
+                `It now resolves to ${targetId.slice(0, 64)}. To message that agent, re-send with its task_id: ` +
+                `{"to": "${targetId.slice(0, 64)}", …}. To reach the earlier agent, use its task_id ` +
+                `${pinned.id.slice(0, 64)} from its spawn result.`,
+            details: { error: "rebound", to, taskId: targetId, previousTaskId: pinned.id },
+            isError: true,
+        };
+    };
     return defineTool({
         name: SEND_MESSAGE_TOOL_NAME,
         contract: { contractId: "core.send_message@1", implementationRevision: "1" },
@@ -54,9 +99,13 @@ export function createSendMessageTool(opts) {
             `'to' is the agent's name (set at spawn via Agent({name})) or its task_id (a…). A RUNNING agent receives the ` +
             `message at its next turn (queued — never interrupts its current work); a FINISHED agent resumes as a new ` +
             `background run with its full prior conversation preserved, so don't re-explain what it already knows. Names ` +
-            `keep working after an agent completes; when a newer agent took the name, the newest wins — use the task_id to ` +
-            `address an older one. You will be notified automatically when it completes — prefer ending your turn; do not ` +
-            `poll. ` +
+            `keep working after an agent completes; but if a name you already messaged is later taken by a NEWER agent, the ` +
+            `send is refused rather than silently redirected — re-send with the task_id of whichever agent you meant. ` +
+            (notifyWired
+                ? `You will be notified automatically when it completes — prefer ending your turn; do not poll. `
+                : completionMode === "one_shot"
+                    ? `This is a ONE-SHOT submission: there is no later turn for a completion notification to land in, so do NOT end your turn expecting one — wait actively with TaskOutput(task_id, block: true) when you need a continued agent's result. `
+                    : `A finished agent is NOT announced on this mount — check on it with TaskOutput(task_id) where mounted rather than ending your turn to wait for a notification that never comes. `) +
             (tier3Capable
                 ? `Continuing a finished agent works for agents with a durable record — by name or task_id, even across restarts — and for runs that retain sub-agent sessions; when neither covers it you get an honest error and should launch a new agent with the needed context instead.`
                 : `Continuing a finished agent requires the run to retain sub-agent sessions; when the session was not ` +
@@ -224,7 +273,7 @@ export function createSendMessageTool(opts) {
                 if (row.status === "running") {
                     if (row.writerId === opts.registry.writerId) {
                         return {
-                            content: `Message not sent: ${whoT3} is currently running in this process but its mid-run delivery channel is not reachable from here. Wait for its completion notification, then send again to continue it.`,
+                            content: `Message not sent: ${whoT3} is currently running in this process but its mid-run delivery channel is not reachable from here. ${AWAIT_COMPLETION}, then send again to continue it.`,
                             details: { error: "still_running", to },
                             isError: true,
                         };
@@ -237,7 +286,7 @@ export function createSendMessageTool(opts) {
                         };
                     }
                     return {
-                        content: `Message not sent: ${whoT3} is running on another host — this process has no delivery channel to it. Wait for its completion notification, then send again to continue it.`,
+                        content: `Message not sent: ${whoT3} is running on another host — this process has no delivery channel to it. ${AWAIT_COMPLETION}, then send again to continue it.`,
                         details: { error: "running_elsewhere", to },
                         isError: true,
                     };
@@ -470,7 +519,9 @@ export function createSendMessageTool(opts) {
                     const priorCount = lease.messages.length - 1;
                     return {
                         content: `Message sent — ${whoT3} was revived in the background with its prior context intact${priorCount > 0 ? ` (${priorCount} earlier pending message(s) delivered with it)` : ""}. ` +
-                            `You will be notified automatically when it completes. Continue with other work — do not poll.`,
+                            (notifyWired
+                                ? `You will be notified automatically when it completes. Continue with other work — do not poll.`
+                                : `${NO_COMPLETION_NOTICE.charAt(0).toUpperCase()}${NO_COMPLETION_NOTICE.slice(1)}.`),
                         details: { type: "send-message", status: "revived", to, task_id: handle, seq: nextSeq, ...(priorCount > 0 ? { priorMessages: priorCount } : {}) },
                     };
                 }
@@ -523,6 +574,11 @@ export function createSendMessageTool(opts) {
                         }
                     }
                     if (rosterHit !== undefined) {
+                        {
+                            const guard = pinGuard(rosterHit.agentId, to, "name", to);
+                            if (guard !== undefined)
+                                return guard;
+                        }
                         const revived = await tier3Revive(rosterHit.agentId);
                         if (revived !== undefined)
                             return revived;
@@ -563,6 +619,16 @@ export function createSendMessageTool(opts) {
             if (row.type !== "background_agent") {
                 return { content: `Message not sent: ${targetId} is a ${row.type} task, not a background agent.`, details: { error: "wrong_type", to }, isError: true };
             }
+            {
+                const rung = idRow !== undefined
+                    ? "ref"
+                    : row.name !== undefined && (row.name === to || normalizeAgentName(row.name) === normalizeAgentName(to))
+                        ? "name"
+                        : "other";
+                const guard = pinGuard(targetId, row.name, rung, to);
+                if (guard !== undefined)
+                    return guard;
+            }
             if (row.status === "running" || row.status === "pending") {
                 return await withTargetLane(targetLaneKey(access.scope, targetId), async () => {
                     const liveRecipientKey = peerAxisToken(resolvedAccess.scope, "h", targetId);
@@ -582,10 +648,10 @@ export function createSendMessageTool(opts) {
                     }, { priority: "next" });
                     if (delivered.ok) {
                         const receiptText = delivered.disposition === "parked"
-                            ? `Message parked for ${who}: the agent finished before reading it — it will be delivered when the agent is next continued. You will be notified of its completion; continue with other work.`
+                            ? `Message parked for ${who}: the agent finished before reading it — it will be delivered when the agent is next continued. ${notifyWired ? "You will be notified of its completion; continue with other work." : `Note: ${NO_COMPLETION_NOTICE}.`}`
                             : delivered.disposition === "pending"
-                                ? `Message accepted for ${who} but delivery is UNCONFIRMED (its channel did not confirm within the wait window) — it stays queued and will deliver if the channel binds. You will be notified of the agent's completion either way; resend then if it went unanswered. ${DEDUP_RETRY_NOTE}`
-                                : `Message queued for delivery to ${who} at its next turn. If it finishes before reading it, the message may not survive — you will be notified of its completion either way; resend then if it went unanswered. Continue with other work; do not poll. ${DEDUP_RETRY_NOTE}`;
+                                ? `Message accepted for ${who} but delivery is UNCONFIRMED (its channel did not confirm within the wait window) — it stays queued and will deliver if the channel binds. ${notifyWired ? "You will be notified of the agent's completion either way" : `Note: ${NO_COMPLETION_NOTICE}`}; resend then if it went unanswered. ${DEDUP_RETRY_NOTE}`
+                                : `Message queued for delivery to ${who} at its next turn. If it finishes before reading it, the message may not survive — ${notifyWired ? "you will be notified of its completion either way" : NO_COMPLETION_NOTICE}; resend then if it went unanswered. ${notifyWired ? "Continue with other work; do not poll. " : ""}${DEDUP_RETRY_NOTE}`;
                         return {
                             content: receiptText,
                             details: { type: "send-message", status: "delivered_running", disposition: delivered.disposition, to, task_id: targetId, summary },
@@ -593,7 +659,7 @@ export function createSendMessageTool(opts) {
                     }
                     if (delivered.reason === "no_channel") {
                         return {
-                            content: `Message not sent: ${who} is still running and this deployment has no mid-run delivery channel for it. Wait for its completion notification, then SendMessage to continue it. ${DEDUP_RETRY_NOTE}`,
+                            content: `Message not sent: ${who} is still running and this deployment has no mid-run delivery channel for it. ${AWAIT_COMPLETION}, then SendMessage to continue it. ${DEDUP_RETRY_NOTE}`,
                             details: { error: "still_running", to },
                             isError: true,
                         };
@@ -659,7 +725,7 @@ export function createSendMessageTool(opts) {
             }
             if (ledger.get(resumeToolUseId)?.running === true) {
                 return {
-                    content: `Message not sent: ${who} (or a prior follow-up to it) is still running — wait for its completion notification.`,
+                    content: `Message not sent: ${who} (or a prior follow-up to it) is still running — ${awaitCompletion}.`,
                     details: { error: "steering.still_running", to },
                     isError: true,
                 };
@@ -715,7 +781,9 @@ export function createSendMessageTool(opts) {
                     const marker = await resume(`${fromPrefix}[${safeSummary}] ${safeMessage}`);
                     return {
                         content: `Message sent — ${who} resumed in the background with its prior context intact (correlation marker [${marker}]).\n` +
-                            `You will be notified automatically when it completes; its reply will carry [${marker}]. Continue with other work — do not poll.`,
+                            (notifyWired
+                                ? `You will be notified automatically when it completes; its reply will carry [${marker}]. Continue with other work — do not poll.`
+                                : `Its reply will carry [${marker}], but ${NO_COMPLETION_NOTICE}.`),
                         details: { type: "send-message", status: "resumed", to, task_id: targetId, marker, summary },
                     };
                 }
@@ -732,7 +800,7 @@ export function createSendMessageTool(opts) {
                                     ? `${who} reached its resume cap (${SUBAGENT_RESUME_CAP} follow-ups per agent) — relaunch a new agent instead.`
                                     : code === "steering.still_running"
                                         ?
-                                            `${who} (or a prior follow-up to it) is still running — wait for its completion notification. ${DEDUP_RETRY_NOTE}`
+                                            `${who} (or a prior follow-up to it) is still running — ${awaitCompletion}. ${DEDUP_RETRY_NOTE}`
                                         : code === "resume.row_recycling"
                                             ?
                                                 `${who}'s registry row is being adjudicated right now (a revival claim or a reap sweep holds it) — send again in a moment. ${DEDUP_RETRY_NOTE}`