@sema-agent/core 5.8.0 → 5.10.0

package/CHANGELOG.md

@@ -1,5 +1,87 @@
 # Changelog
 
+## 5.10.0 — 2026-08-04
+
+### Added
+
+- **`TaskSpec.checkpointStore` is three-valued**: `null` explicitly gives THIS run no durable store, even on a deployment that wired one (`undefined` still inherits `RunnerDeps.checkpointStore`; a store still overrides). All four legs into `status:"suspended"` (approval park / resource-slice / platform `env_lifetime`·`usage_window` / `plan_review`) are gated on a store being present, so a store-null run cannot reach `suspended` by construction and can never leave a pending checkpoint nobody resumes — the machine-started-run form (notification redelivery, maintenance sweeps). Existing no-store semantics apply: asks resolve at a live `onAsk` or fail-closed deny; limits are loud terminals; the plan/question durable faces are not mounted. Delegated children inherit it (sync/bg/fork/workflow spawn lanes). New Runner-filled `ToolExecuteContext.checkpointStoreDisabledForChildren` tells custom delegation tools to copy it. **Consumer notes**: `preempt()` becomes a documented no-op on store-null runs (existing `preempt.ignored` trace — "preemptible" is now two-valued; schedulers keep runs preemptible by leaving the field unset); a resume config carrying `null` refuses loudly (`checkpoint.not_found`) instead of silently resuming against deps.
+
+### Fixed
+
+- **Eight `tool_end.structured` cards were minted and then dropped before the wire.** The projection allowlist (`details.type`) had never been reconciled against the tools that mint cards, so a host got nothing structured for: `ReportFindings` (worst case — its model face is deliberately compressed to `"N findings reported."`, so the findings reached *neither* the model *nor* the host), `ScheduleWakeup`, `SendMessage`, `AgentTranscript`, the A2A peer tools, the PDF `document` card (whose own 48K base64 budget was written against a size gate it never reached), the `bash_readonly` out-of-root refusal, and the **completed** delegation report — the one card `tool_end.structured`'s own contract names by name, while only the `async_launched` receipt could actually arrive. Registered words added: `report-findings`, `schedule-wakeup`, `send-message`, `agent-transcript`, `a2a`, `document`, `readonly_out_of_root`. Two mint sites gained the `type` discriminant they lacked (`ReportFindings`; the three `bash_readonly` refusal arms, following the `path_not_in_root` precedent) — `details.code` is untouched for existing readers. Model faces are byte-unchanged everywhere; this is purely the host face that was missing. **Consumer notes**: a shell that prose-matched any of these can now read fields; a probe asserting `structured === undefined` for them reds.
+
+- **An interrupted tool call's synthetic `tool_end` finally carries a body — and the wake/crash leg emits one at all.** Both reconcile legs closed orphan calls in the transcript with the full `[INTERRUPTED]` explanation the model reads, while the event stream got `isError: true` and nothing else: a consumer rendering tool output from frames showed an empty result for every interrupted call, and the two faces of one call disagreed. The frames now carry `output` (the exact persisted text, same projection as every live tool result) and `errorCode` (`interrupted_never_started` | `interrupted_outcome_unknown` — the persisted `details.errorKind`, so a consumer discriminates on a code instead of prose-matching), plus the tool's display `label` and the usual `eventId`/subagent attribution. Separately, the **wake/crash** leg (a previous PROCESS died holding the calls) used to repair the transcript and tell the stream *nothing*: no `tool_end`, no `message_committed`. It now replays the same pair at run open — the only channel through which that news can ever arrive, since the process that owned those calls is gone. `ReconcileReport.recovered` entries gained `text` and `errorKind` (new exported type `RecoveredOrphan`, `ReconciledErrorKind`). **Consumer flips**: a probe pinning "the interrupted `tool_end` has no `output`" reds; a resumed run on a crashed session now emits one `tool_end` + one `message_committed` per orphan before its first turn, so an exact event-count or first-event assertion on that path reds (there is deliberately no matching `tool_start` — the start belonged to the dead process's stream).
+
+- **The idle-park notification redelivery carries task identity.** A notification parked while the session sat idle is redelivered on the next run's stream as the same `task_notification` family — but that push shipped with no `eventId`, and for a subagent no `parentToolCallId`/`sourceTaskId`, so a consumer keying a child's frames by task silently attributed every redelivered frame to the wrong task. The cause was structural rather than a missing field: the identity minter was declared later in the run body than the redelivery drain, so the drain could not call it. It is now minted as soon as the prepared run exists. Live-lane frames are unchanged (they always had identity).
+
+- **Read-before-write state follows the SESSION, not just the task.** An ordinary continuation turn used to start with an empty read-state (the seed lane existed only for durable-checkpoint resume), so turn 2 paid a forced re-read for every file turn 1 had read whole. The prepare step now replays the session transcript on continuation turns: whole-file-provable Read/Write records seed entries whose hash comes from what the transcript recorded — never from disk — so staleness is unchanged by construction (a file changed between turns is still refused), and Edit/NotebookEdit records retract their path (a self-edit is never misread as a foreign change). Resume legs, first turns, and post-Edit paths are byte-identical to before. **Consumer flip**: a probe pinning "a continuation-turn edit is always refused as not-read" reds.
+
+- **Memory recall: an unknown write time is incomparable, not 1970.** A note whose `ts` failed to parse used to sort as epoch 0 — it lost every `[[name]]` collision (permanently unreachable through links) and rendered a fabricated age ("written 678 months ago"). `MemoryNoteHeader.timestampMissing` (new, optional) is minted at the single parse point; the one recency comparison treats missing as a tie (the incumbent keeps the name — an unknown-time note neither sinks nor poses as newest), and the render face says "write time unknown — verify it's still current". A literal 1970 timestamp string stays a real time (the numeric value is never the signal; negative pins lock this). Bonus: a wire row with NO `ts` key used to throw and kill the whole scope's manifest build. **Consumer flip**: a probe pinning the fabricated-age wording or the sink-to-bottom collision outcome reds.
+- **Three awaited rescue timers are REF'd + cleared-on-settle** (subagent observer drain, teacher abortFallback, WebFetch deadline): unref'd, the process could exit before the rescue fired when the wedged arm held no live handles — the settle never completed. The bg notify drain window keeps its unref by design (a background lane must not pin the process).
+- **A harness-side throw around ONE tool call becomes that call's disclosed error result — the batch survives.** Worker exceptions that are not cancellation (a rejected `tool_execution_update` delivery, a sink failure) used to reject the whole parallel batch, orphan the sibling calls, and on the worst path rewrite a COMMITTED side effect into `[tool execution harness failed: …]` — inviting the model to re-run an already-effective write. Progress deliveries now settle at one point; a delivery failure on an executed tool keeps `content`/`isError` untouched and rides `details.toolProgressDeliveryFailed` (total by construction: hostile accessors or exotic `details` decline the annotation, never the outcome; `afterToolCall` cannot erase it). Cancellation — including one wrapped in the harness's own `AgentHarnessError` (`cause`-chain walk) — stays a hard batch failure on every lane, and the in-stream lane closes admission immediately. The sequential lane shares the same disclosure band. **Consumer flips**: probes pinning the old `[tool execution harness failed]` rewrite or `isError:true` on a delivery-failed success red — re-pin on the new shape plus a retired-dialect tripwire.
+- **openai lane: an evidence-free `tool_calls` fragment no longer fabricates an unnamed-call disclosure.** The evidence gate sits at the finalize disclosure point (slot assignment also routes id-less continuations, so gating there corrupted two real calls); the stream's own verdict wins — `finish_reason:"tool_calls"` with zero survivors, or an empty slot beside real calls, discloses loudly; an isolated terminal fragment with `stop`/`length` stays silent.
+- **A throwing tool keeps its machine-readable marks on BOTH legs.** Two strip points, one class: the `defineTool` adapter rewrapped a ToolSpec throw as a bare `Error` (marks died even LIVE — a ToolSpec throw carrying `details.code` got no `errorCode` lift while a native tool's identical error did), and the durable-resume batch's catch stringified the message alone (breaking the live/resume frame-parity contract). Both carry `details`/`errorKind` through now; message text unchanged.
+- **Cache-break attribution: an aborted / usage-missing row is "unknown", not a cold cache.** Feeding it to the design/31 detector minted a false `server-or-ttl` finding and poisoned the warm baseline for the next real turn. Such rows are skipped; a genuine cacheRead collapse still fires.
+- **A usage-ledger charge that does not settle discloses loudly — and is never abandoned.** Both commit points (turn boundary, end-of-task flush) fire a single deployment-sink disclosure after 10s and keep awaiting (abandoning a sequential ledger write would double-charge on the next flush). A wedged ledger store still wedges what it always wedged, now visibly.
+- **The `abortResultDetails` seam is total.** A throwing host callback degrades to "no details" (the abort text is the contract; the marker is additive) instead of escalating a per-tool abort into an unpaired `tool_execution_start` plus an uncaught task-level rejection.
+
+### BREAKING
+
+- **The `tool_end.structured` card vocabulary is now a two-way contract — three words leave it, and `type:"agent"` gains a second shape.** Removed: `multiedit`, `memory-saved`, `memory-recall`. No tool in the tree has ever minted any of the three (a batch MultiEdit replay mints `type:"edit"` with an `edits[]` array; core mounts no memory tool at all), so they were a promise to consumers that nothing could keep — a host switching on the closed set had dead branches. Closed-set consumers: **drop those three arms**; a fixture that fabricates one of them to assert it passes the allowlist reds. Separately, `type:"agent"` used to imply "background launch receipt" because the completed delivery was silently dropped; it now carries **both** Agent shapes, told apart by `status` — `"async_launched"` is the receipt, any other value is the completed landing report (`result` / `stats` / `resolvedModel` / `toolStats` / kept `worktreePath` / failure attribution). **Branch on `status`, never on which keys are present.** The completed card is an explicit field whitelist over the child `TaskResult`, not a spread: `checkpointToken` (the resume capability) and `checkpointGate` never leave the process, and a future `TaskResult` field does not join the wire by default. A new test gate walks the tree in both directions (every minted card registered; every registered word produced), so neither direction can drift back.
+
+- **Brain lanes disclose an unnamed tool call instead of skipping it in silence.** A `tool_use` block / `tool_calls` slot / `function_call` item arriving with NO tool name now rides the same disclosure path as a call with truncated arguments on all three lanes (anthropic / openai / open-responses): a `[note: N tool call(s) arrived with no tool name …]` block in the assistant content, and — when the turn produced nothing else usable — `stopReason: "error"` with the cause named. Previously such a turn finalized as `[{type:"text",text:""}]` with `stopReason: "stop"` and no error code, so a run whose only action was dropped reported `completed` with an empty answer. **Consumer flips**: a probe pinning the silent empty-`completed` shape reds; a probe asserting assistant content exact-equality gains a note block; "dropped tool call" is now two-cause (`not valid JSON` truncation | `no tool name`) — judge by the named cause, never by the single historic wording; the two causes may be joined with `" | "` in one errorMessage.
+- **`StrategyStore` refuses non-honorable knobs instead of folding them to 0.** `find(scope, query, limit)` requires a non-negative integer or `Infinity` — `Infinity` now means "no cap" and returns everything (it used to return NOTHING); NaN/negative/fractional throw `config.strategy_find_limit_invalid`. `prune(scope, maxSize)` and the `InMemoryStrategyStore` constructor require a non-negative integer and refuse `Infinity` by name (a capacity cap can be widened, not turned off): `config.strategy_max_size_invalid`. A NaN capacity used to silently disable eviction (unbounded growth). Vocabulary additions (closed-set consumers admit two members): `config.strategy_find_limit_invalid`, `config.strategy_max_size_invalid`.
+
+- **The three stop clocks gained a crossing contract: `usage_window` > `env_lifetime` > stall.** When the governance window and the environment lifetime come due at the SAME turn boundary, the window wins (loud terminal `usage.window_exhausted` + `retryAfterMs`, or a `usage_window` checkpoint with its resume hint) — it is the only cause carrying an actionable wait; env-first reporting dropped it. With an enforceable env lifetime, the ledger READ races an absolute deadline (a stalled ledger stops the run for the env and disclosingly skips window enforcement for that boundary); the CHARGE is never raced. **Probes pinning "both due ⇒ `env.lifetime_expired`" red.**
+- **Durable-resume deferred siblings are fully paired: each `[DEFERRED]` `tool_end` is preceded by a synthetic `tool_start`** (same id/name/label, the model's real arguments recovered from the transcript, adjacent and unconditional; deliberately NOT in `startedToolCallIds` — the call never executed and interrupt-reconcile still reads it as safe-to-reissue). Exact event-count / first-frame probes on the resume leg red. Delegation tick counters count issued `tool_use` blocks (their declared semantics), so a deferred sibling's start now counts once as issued — the old shape UNDERcounted.
+- **Manual compaction gains two mooted disclosure frames** (`compaction_outcome{mooted, manual, cancelled}` on parked-caller cancel; `{mooted, manual, task_ending}` at run settle/teardown with a parked request), and `TaskStream.compact()` called in a failed run's teardown window returns `"mooted"` instead of hanging forever. "No compaction frame on this path" probes red.
+- **Delegation inheritance seats (one-way tighten, narrowings enumerable):** ① a read-only parent's delegated children carry NO write hands (`handsReadOnly` is a trusted ctx seat, one-way); ② a hard-headless parent's children no longer mount `AskUserQuestion` at all (the content-ask seat `onQuestion` is resolved once at prepare and handed down UNWRAPPED — parent and child share the SAME function object; identity questions read `AskQuestionRequest.sourceTaskId`/`principal`, never closure identity); ③ teacher helper/advisor legs inherit deployment auth/principal/clientContext/promptProfile plus the one-way clamps (a read-only/headless student's teacher legs lose write hands and questions); ④ the verify leg runs hard-headless always (`interactiveTools:false`) with principal + tool-face controls; ⑤ `oneShot` propagates true-ward. The child roster went from "never has AskUserQuestion" to "has it iff the parent face allows" — closed-set tool-roster probes on children red. Legs that OUTLIVE the spawning request (session-scoped/fork background, durable revival, SendMessage wake) never take turn-bound faces; resume rows take the union of clamps.
+- **Every limits door refuses unevaluable values (`config.limit_invalid`), fourth wave of the no-silent-folding rule:** `runTeamDiscussion`'s cumulative `maxTokens`/`maxCostUsd` (NaN silently disarmed the only cumulative stop; refused before any dispatch, 0 stays an honest exhausted window); workflow governance's TRUSTED half (a baseline/`WorkflowChildCaps` NaN/Infinity read as the 0/negative "no ceiling" sentinel and could silently drop an axis — refused loudly, sentinel semantics unchanged); `TaskSpec.resourceSuspend.{totalBudgetUsd,totalTokens,maxSlices,ttlMs}` + non-empty `scope` (NaN blinded even the validated per-slice window through `Math.min`) — refused at the RB-458 door as a failed result before any resource acquisition.
+- **Agent completed card vocabulary additions** (closed-set consumers admit members): `retryAfterMs` (machine-actionable pair of `errorCode` — `retryable` answers "re-issue as-is NOW?", `retryAfterMs` answers "when does the refusal lift"), `degraded` (reduced-quality attribution), and `modelFallback:"inherit_no_tier_binding"` (the requested model word did not bind — no roster / not on the roster — and the child ran on its inherited default; fallback behavior itself unchanged; also stamped on background roster rows). Workflow `agent_end` gains `modelResolved` (the served model, from `TaskResult.model`; `agent_start.model` stays the requested word verbatim — absent on replayed rows and model-less runs).
+- **Two runtime prose strings changed with the retired-scenario vocabulary sweep** (an A2A fence reason and two prompt lines); probes byte-pinning them red. CC-anchored verbatim material (loop sentinels, prompt sections) is exempt by an explicit per-file allowance in the new vocabulary ratchet gate.
+
+## 5.9.0 (2026-08-04)
+
+### Added
+
+- **A delegated child's permission ask reaches the parent's approval channel.** The parent run's effective approver (`spec.onAsk ?? deps.onAsk`) rides the trusted tool context into every child spec (sync / background / fork lanes share the one construction point), wrapped once with frozen provenance: `AskRequest.delegation` (new, optional, readonly) carries `{ parentToolCallId, depth, agentName? }` so an approval UI can render *which* delegation is asking — the innermost (true-origin) frame wins on grandchildren. New exported type `AskDelegationProvenance`. An approver is consulted once per gated call: the single-frame dedup compares approver identity *through* the wrapper (`askApproverIdentity`), so the provenance wrapper cannot split one consultation into two approval cards. **Consumer flips**: a probe pinning "a child's ask resolves at `deps.onAsk` when the parent supplied `spec.onAsk`" now resolves at the parent's approver; the `delegation` field is additive and ignorable.
+- **`tool_end.errorCode` (new, optional, additive)** — present iff `isError` is true and the harness result's `details` carried a string `code`; a machine-readable discriminator so a consumer never parses the result text. Engine vocabulary today: `"tool.not_found"` and `"gate.parked"` (an abort short-circuit poisoned this call because a durable gate parked the batch — the "Operation aborted" family; a plain user interrupt carries NO marker, pinned both ways). The abort texts are byte-identical to before — an exact-equality anchor on `"Operation aborted"` is unaffected. Frame-shape change, additive: this is the [2513]-process disclosure. Library embedders get the seam directly as `abortResultDetails` on the harness options / loop config.
+
+- `createOpenResponsesBrain` (+ `OpenResponsesBrainConfig`) — a Brain for the Open Responses wire form (`POST /responses`: typed input/output items, an SSE stream terminated by `response.completed` / `response.incomplete` / `response.failed` with no `[DONE]` sentinel). One adapter for the whole family of endpoints that speak it, instead of one per vendor. It is **stateless by contract**: `store` / `previous_response_id` / `conversation` are never sent, cannot be injected through `Model.extraBody` (all three are reserved for this API family), and every turn replays the full transcript — this engine stays the single transcript authority. Reasoning arrives as first-class `reasoning` items and is stored as normal `thinking` blocks (item id in `thinkingSignature`), replayed on tool-call turns. Terminal events map onto the existing vocabulary — no new `errorKind` or brain-error code is minted: a `max_output_tokens` cut with no answer text is `length_empty`, a content-filter cut and a streamed refusal are `[refusal]`, a stream with no terminal event is `[stream_torn]`, and `response.failed` maps by code onto `rate_limit` / `auth` / `invalid_request` / `server`. Because the wire form offers no capability discovery and endpoints have been observed to accept-and-ignore parameters, the adapter audits the `response.created` echo against what it requested and records divergences (state held that was never asked for, a reasoning tier not honored, serialized tool calls) as a `responses_capability` diagnostic on the final message. `StreamOptions.stop` has no field in this wire form and is REFUSED rather than silently dropped. Type-surface correction from the landing review: `OpenAIResponsesCompat` now declares exactly the knobs the adapter consumes (`supportsReasoningEffort` / `reasoningEffortLevels`); its two former fields (`sendSessionIdHeader` / `supportsLongCacheRetention`) had zero consumers anywhere in the engine and are removed — type-level only, no runtime behavior existed behind them.
+
+### BREAKING
+
+- **Declared-only fields removed from the public type surface (type-level only — no runtime behavior existed behind any of them).** A new gate, `gate:field-liveness`, walks every interface reachable from `src/index.ts` (directly exported, or reachable through a field of something that is) and reds on a member no production code under `src/` mentions. Its first run found 59; 34 are removed here. Setting any of them compiled, type-checked, and did nothing.
+  - `OpenAICompletionsCompat`: `supportsStore`, `supportsDeveloperRole`, `supportsUsageInStreaming`, `requiresToolResultName`, `requiresAssistantAfterToolResult`, `requiresThinkingAsText`, `openRouterRouting`, `vercelGatewayRouting`, `zaiToolStream`, `supportsStrictMode`, `cacheControlFormat`, `sendSessionAffinityHeaders`, `supportsLongCacheRetention`. Several documented a "Default: auto-detected from URL" that no code performs. The knobs the completions brain does read are unchanged: `supportsReasoningEffort`, `reasoningEffortLevels`, `maxTokensField`, `requiresReasoningContentOnAssistantMessages`, `thinkingFormat`.
+  - `AnthropicMessagesCompat`: `supportsEagerToolInputStreaming`, `supportsLongCacheRetention`, `sendSessionAffinityHeaders`, `supportsCacheControlOnTools`. The Anthropic brain performs each of those behaviours unconditionally or not at all, so declaring the opposite changed nothing. `thinkingMode`, `effortLevels`, `supportsTemperature`, `contextManagement`, `interleavedThinking` are unchanged.
+  - `OpenRouterRouting` and `VercelGatewayRouting` are removed entirely: both existed only as the types of the two removed routing fields, so nothing they described (fallbacks, ZDR, quantizations, price ceilings, throughput/latency floors, provider order) was ever sent on any request.
+  - `TextContent.textSignature` and its payload type `TextSignatureV1` — no brain wrote it and no replay path read it. The live equivalent is `ThinkingContent.thinkingSignature`.
+  - `ToolCall.thoughtSignature` — Google-specific, and there is no Google brain in this tree.
+  - `Model.mediaInput` — claimed to carry provider media limits "used by attachment preprocessing"; the image pipeline's caps come from `RunnerDeps.mediaByteCapBytes` and the resizer seam.
+  - `TraceEvent` (`kind: "brain.call"`): `callCap` and `capThinkingSkipped`, orphans of the design/130 per-call deadline shrink retired in 5.8.0 — the emitter went with the mechanism, the declaration stayed. `stopReason` is unchanged (its JSDoc no longer instructs consumers to judge cap binding by a field that is never emitted).
+  - `SemaTaskHandle.outputOffset` — never written by the registry and never read by anything.
+  - Migration: setting any removed field is now a compile error at the assignment. There is no runtime change to migrate — the behaviour a consumer sees is exactly what it saw before, because none of these fields ever reached code. The remaining 25 declared-only members are registered with a reason and an owner in `test/field-liveness-allowlist.json` (deployment-implemented adapter contracts, foreign on-disk formats, nominal brand phantoms, and the published recall seam); two of them carry a `PENDING VERDICT` marker with a review date rather than a clearance.
+- `LspDiagnosticsRegistry` is DEPLOYMENT-scoped (one per LSP manager, shared by every task), but its delivered-set had no run boundary: a diagnostic injected into one run was filtered out of every later run's drain for the lifetime of the process — a second session could not see it at all unless it happened to edit that file — and the set grew without bound. The delivered set is now keyed by run: `drain(runIdent)` and `fileEdited(runIdent, uri)` take the run key (both signatures changed), and the new `releaseRun(runIdent)` drops a finished run's keys. The engine passes the session id and releases at the run's terminal; direct callers of the registry must pass a key of their own.
+
+### Changed
+
+- Session permission rules: an `allowDirs` confinement now PATH-CONFINES `NotebookEdit` instead of denying it outright. Previously `createSessionRulePolicy` only knew the `file_path`-keyed write tools, so while `allowDirs` was active every `NotebookEdit` call fell into the "mutating but not path-confinable" arm and was denied — even for a notebook inside an allowed directory — while `createFsWriteGatePolicy` had always confined the same tool by its `notebook_path`. Both faces now share one covered set and one target extractor, so a notebook inside `allowDirs` is allowed, one outside is denied, and a decoy `file_path` never outranks the real `notebook_path` target. **A probe pinning "NotebookEdit is denied under `allowDirs`" will now flip** — re-pin it as a path verdict (in-dir allow / out-of-dir deny). Deliberately unchanged: every other mutating tool that cannot be path-confined (bash, deployment-authored write tools, tools with an unknown effect) is still fail-closed denied under `allowDirs`, and the skill-manifest `allowPaths` face still denies `NotebookEdit` — widening that one is a separate decision.
+
+### Changed
+
+- **A subagent's durable pause is reported as what it is.** The sync and fork report arms minted `status: failed` with "treat this delegation as failed; do not retry" when the child parked at an approval gate — a fabrication that buried the recovery path. They now mint one honest constructor: `status: suspended`, the checkpoint named, the deployment's approval channel named as the only release path, anti-retry guidance kept, `isError: true` now explicit on the report. `details.error` vocabulary: `unexpected.suspended` → `suspended.awaiting_approval`, `unexpected.needs_review` → `suspended.needs_review` (the TaskResult-level `unexpected.*` codes elsewhere are unchanged). The ineligible-background settle keeps its mechanism byte-for-byte but its row/summary/notification faces now say which disposition happened: new `errorCode` values `suspended.awaiting_approval` (checkpoint still pending, resolvable out-of-band) and `suspended.checkpoint_expired` (destroyed by the no-orphans rule — stop waiting). **Consumer flips**: probes pinning the old `status: failed` wording or the `unexpected.*` codes on delegation reports will red; anything pinning a closed set of background-failure `errorCode`s must admit the two new members.
+- Resumed-batch `tool_end` frames (durable-approval resume) carry the result body — `output` / `truncated` / `totalChars` / `structured` from the same projection the live loop uses; the deferred-sibling closes carry the `[DEFERRED]` body the transcript records. A client rendering tool output from frames no longer shows an empty card for every approved call ([2513] W2; zero shape change — these are the frame's existing optional fields, previously absent). The same frames now also carry `eventId` (+ `parentToolCallId`/`sourceTaskId` when running as a subagent) and reach a parent's `forwardSubagentEvents` pane — a child's durable-approved call no longer leaves the parent's viewing pane spinner open forever.
+
+### Fixed
+
+- Workflow resilience knobs (`stallMs` / `agentMaxRetries` / `throttleBackoffMs` / `totalTimeoutMs`) refuse non-finite values loudly instead of silently changing behavior — a NaN used to disarm the stall watchdog, zero the retry budget, or turn the total deadline into an instant abort (`stallMs <= 0` stays the documented explicit-off). `WebFetchConfig.maxBytes` likewise refuses non-finite/non-positive values (`config.web_max_bytes_invalid`) — NaN/Infinity used to disable the byte budget entirely, streaming unbounded into memory (±Infinity gets its own message: the cap cannot be turned off, only widened).
+- The WebFetch binary sniffer consumes the shared magic-byte table (`BINARY_MAGIC_SIGNATURES`) instead of a private eight-format if-chain — one data source; edge behavior tightens slightly (full-length signatures) and labels adopt the table's human-readable names.
+- Platform terminals (`env.lifetime_expired` / `usage.window_exhausted`) now carry `salvagedOutput` like every other salvage-eligible terminal (the eligibility set is one closed construction point) — **a consumer pinning "salvagedOutput is empty on every non-completed result" will flip**. `TaskResult.retryAfterMs` (new, optional) rides a `usage.window_exhausted` terminal with the window's reopen hint; presence condition documented on the field — judge the cause by `errorCode`, never by this field's presence.
+- `assertWorkflowDeterminism` reaches the package root alongside its two conformance siblings (the determinism battery an out-of-repo workflow runner needs; additive).
+
+
+- `runCascade` no longer reaches its tail with nothing dispatched. A non-finite `config.maxEscalations` is refused at the door (`Error.code = "config.cascade_invalid"`) instead of making the iteration bound `NaN` and running zero rungs; a `totalTimeoutMs` already spent at entry returns the cascade's own terminal (`status: "failed"`, `errorCode: "cascade.budget_exhausted"`, empty `attempts`, `finalRung: -1`) instead of throwing a bare `TypeError`. `CascadeRunResult.finalRung` can therefore be `-1` (no rung produced the result).
+
 ## 5.8.0 (2026-08-04)
 
 _The limits restructure: time leaves the task-limit axis, tokens become the primary budget, and every default is empty. One release, five construction stages — there is no intermediate version. Old usage fails loudly (compile errors for removed fields; a typed refusal for unknown limit keys at runtime) — nothing is silently ignored._

package/dist/agents/cascade.js

@@ -3,6 +3,13 @@ import { mapNestedSuspend, isDurablePause } from "./suspend-guard.js";
 import { buildCumulativeStats } from "./cumulative-stats.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
 const CASCADE_ON_RUNG_SITE = "cascade.onRung";
+const CASCADE_CONFIG_ERROR_CODE = "config.cascade_invalid";
+const CASCADE_NO_DISPATCH_ERROR_CODE = "cascade.budget_exhausted";
+function cascadeConfigError(message) {
+    const e = new Error(message);
+    e.code = CASCADE_CONFIG_ERROR_CODE;
+    return e;
+}
 function createDefaultGate(spec) {
     const requiresStructured = spec.outputSchema != null;
     return (result) => result.status === "completed" && (!requiresStructured || result.structuredOutput !== undefined);
@@ -13,6 +20,9 @@ export async function runCascade(runner, spec, config) {
         throw new Error("runCascade: config.ladder must have at least one rung");
     }
     const maxEscalations = config.maxEscalations ?? ladder.length - 1;
+    if (typeof maxEscalations !== "number" || !Number.isFinite(maxEscalations)) {
+        throw cascadeConfigError(`runCascade: config.maxEscalations must be a finite number (got ${String(config.maxEscalations)}) — an unevaluable escalation ceiling is not a ceiling, and folding it to a default would run the cascade under a bound nobody chose.`);
+    }
     const maxRungs = Math.min(ladder.length, Math.max(0, maxEscalations) + 1);
     const gate = config.gate ?? createDefaultGate(spec);
     const startedAt = Date.now();
@@ -179,6 +189,20 @@ export async function runCascade(runner, spec, config) {
             break;
         }
     }
+    if (lastResult === undefined) {
+        return {
+            taskId: spec.taskId ?? "",
+            sessionId: "",
+            status: "failed",
+            result: `runCascade: the overall wall-clock budget (totalTimeoutMs ${config.totalTimeoutMs}ms) was already spent when the ladder was entered — no rung dispatched`,
+            errorCode: CASCADE_NO_DISPATCH_ERROR_CODE,
+            stats: { tokens: 0, turns: 0, costMicroUsd: 0 },
+            cascadeOutcome: "exhausted",
+            escalated: false,
+            finalRung: -1,
+            attempts,
+        };
+    }
     const base = lastResult;
     const finalRung = attempts.length - 1;
     return {

package/dist/agents/roster-store.d.ts

@@ -5,6 +5,7 @@ export interface RosterEntry {
     toolUseId?: string;
     rootSessionId?: string;
     model?: string;
+    modelFallback?: "inherit_no_tier_binding";
     owner: string;
     scope: string;
     sessionScoped?: boolean;

package/dist/agents/send-message-tool.js

@@ -528,6 +528,12 @@ export function createSendMessageTool(opts) {
                     ...(row.createdAt !== undefined ? { rowSpawnedAt: row.createdAt } : {}),
                     ...(opts.onNotifyError !== undefined ? { onNotifyError: opts.onNotifyError } : {}),
                     ...(opts.notify ? { currentParentNotify: opts.notify } : {}),
+                    ...(ctx.onQuestion !== undefined && row.sessionScoped !== true ? { currentOnQuestion: ctx.onQuestion } : {}),
+                    currentClamps: {
+                        ...(ctx.handsReadOnly === true ? { handsReadOnly: true } : {}),
+                        ...(ctx.interactiveTools === false ? { interactiveTools: false } : {}),
+                        ...(ctx.oneShot === true ? { oneShot: true } : {}),
+                    },
                 });
                 const fromPrefix = senderIsChild ? `(message from teammate "${senderLabel}")\n` : "";
                 try {

package/dist/agents/subagent.d.ts

@@ -43,6 +43,33 @@ export declare function classifySubagentError(child: {
     errorKind: SubagentErrorKind;
     retryable: boolean;
 } | undefined;
+export declare function completedAgentCard(child: {
+    taskId: string;
+    sessionId: string;
+    status: string;
+    model?: string;
+    result: string;
+    salvagedOutput?: string;
+    blockedReason?: string;
+    errorMessage?: string;
+    errorCode?: string;
+    retryAfterMs?: number;
+    degraded?: unknown;
+    structuredOutput?: unknown;
+    stats: unknown;
+}, extras: {
+    subagentType?: string;
+    error?: {
+        errorKind: SubagentErrorKind;
+        retryable: boolean;
+    } | undefined;
+    worktreePath?: string;
+    toolStats?: SubagentToolStats;
+    modelFallback?: "inherit_no_tier_binding";
+}): Record<string, unknown>;
+export declare const SUBAGENT_SUSPENDED_AWAITING_APPROVAL = "suspended.awaiting_approval";
+export declare const SUBAGENT_SUSPENDED_NEEDS_REVIEW = "suspended.needs_review";
+export declare const SUBAGENT_SUSPENDED_CHECKPOINT_EXPIRED = "suspended.checkpoint_expired";
 export interface SubagentSteerHandle {
     parentToolCallId: string;
     agentName?: string;
@@ -63,6 +90,12 @@ export declare function createSubagentResume(deps: {
     currentParentNotify?: (n: TaskNotificationPayload, opts?: {
         priority?: "now" | "next" | "later";
     }) => void;
+    currentOnQuestion?: import("../core/ask-question.js").OnQuestion;
+    currentClamps?: {
+        handsReadOnly?: true;
+        interactiveTools?: false;
+        oneShot?: true;
+    };
     taskId?: string;
     taskAccess?: import("../core/task-registry.js").TaskAccess;
     bgSink?: (event: import("../core/types.js").BackgroundChildEvent) => void;

package/dist/agents/subagent.js

@@ -1,5 +1,6 @@
 import { Type } from "typebox";
 import { isAbsolute } from "node:path";
+import { withDelegationProvenance } from "../core/tool-policy.js";
 import { resolveModel, resolveModelDisplayLabel } from "../core/roles.js";
 import { OUTPUT_TOOL_NAME, REPORT_BLOCKED_TOOL_NAME } from "../core/runner/synthetic-tools.js";
 import { TOOL_SEARCH_NAME } from "../core/runner/tool-disclosure.js";
@@ -231,6 +232,64 @@ export function classifySubagentError(child) {
                     : "logic";
     return { errorKind, retryable: errorKind !== "logic" };
 }
+export function completedAgentCard(child, extras) {
+    return {
+        type: "agent",
+        ...(extras.subagentType !== undefined ? { subagent_type: extras.subagentType } : {}),
+        status: child.status,
+        taskId: child.taskId,
+        sessionId: child.sessionId,
+        result: child.result,
+        ...(child.salvagedOutput !== undefined ? { salvagedOutput: child.salvagedOutput } : {}),
+        ...(child.structuredOutput !== undefined ? { structuredOutput: child.structuredOutput } : {}),
+        ...(child.blockedReason !== undefined ? { blockedReason: child.blockedReason } : {}),
+        ...(child.errorMessage !== undefined ? { errorMessage: child.errorMessage } : {}),
+        ...(child.errorCode !== undefined ? { errorCode: child.errorCode } : {}),
+        ...(child.retryAfterMs !== undefined ? { retryAfterMs: child.retryAfterMs } : {}),
+        ...(child.degraded !== undefined ? { degraded: child.degraded } : {}),
+        ...(extras.error ? { error_kind: extras.error.errorKind, retryable: extras.error.retryable } : {}),
+        stats: child.stats,
+        ...(child.model !== undefined ? { model: child.model, resolvedModel: child.model } : {}),
+        ...(extras.modelFallback !== undefined ? { modelFallback: extras.modelFallback } : {}),
+        ...(extras.worktreePath !== undefined ? { worktreePath: extras.worktreePath } : {}),
+        ...(extras.toolStats !== undefined ? { toolStats: extras.toolStats } : {}),
+    };
+}
+export const SUBAGENT_SUSPENDED_AWAITING_APPROVAL = "suspended.awaiting_approval";
+export const SUBAGENT_SUSPENDED_NEEDS_REVIEW = "suspended.needs_review";
+export const SUBAGENT_SUSPENDED_CHECKPOINT_EXPIRED = "suspended.checkpoint_expired";
+function durablePauseDelegationReport(reportLabel, child) {
+    const needsReview = child.status === "needs_review";
+    const token = child.checkpointToken;
+    return {
+        isError: true,
+        content: `[Sub-agent report${reportLabel}]\n` +
+            `status: suspended\n` +
+            `This delegation is PARKED at an approval gate — it did not fail, and it is not finished. ` +
+            `${needsReview ? "A human review" : "An approval"} it cannot grant itself is pending` +
+            `${token !== undefined ? `, held by checkpoint ${token}` : " (the run reported no checkpoint token)"}. ` +
+            `The gated action has NOT run.\n` +
+            `Only the deployment's approval channel can release it: you cannot approve it from here, and no ` +
+            `result from it will arrive in this turn. Do not re-issue the same approval-gated action — an ` +
+            `identical retry parks again and resolves nothing. Carry on with work that does not depend on ` +
+            `this delegation, or report that it is awaiting approval.`,
+        details: {
+            error: needsReview ? SUBAGENT_SUSPENDED_NEEDS_REVIEW : SUBAGENT_SUSPENDED_AWAITING_APPROVAL,
+            ...(token !== undefined ? { checkpointToken: token } : {}),
+        },
+    };
+}
+function unparkedDurablePauseReason(d) {
+    return d.kind === "no_park_lane"
+        ? `the agent hit an approval gate and paused durably, but this delegation cannot be parked ` +
+            `(parking needs an explicitly named child plus a durable agent row, a checkpoint store and the ` +
+            `durable-session capability). Its checkpoint ${d.checkpointToken} is still committed and the ` +
+            `approval must be resolved through the deployment's approval channel; the gated action never ran.`
+        : `the agent hit an approval gate and paused durably, but the park did not take (` +
+            `${d.cause === "capability_veto" ? "the durable-session capability refused" : "a concurrent stop won the arbitration"}` +
+            `), so its checkpoint was expired under the no-orphans rule. Nothing is pending approval and the ` +
+            `gated action never ran — re-run this delegation with an approver attached.`;
+}
 function errorKindClause(c) {
     return c !== undefined ? ` (error_kind: ${c.errorKind}, retryable: ${c.retryable})` : "";
 }
@@ -338,6 +397,10 @@ export function createSubagentResume(deps) {
                 objective: createResumePrompt(marker, content),
                 sessionId: entry.childSessionId,
                 requireExistingSession: true,
+                ...(deps.currentOnQuestion !== undefined ? { onQuestion: deps.currentOnQuestion } : {}),
+                ...(entry.specSnapshot.handsReadOnly === true || deps.currentClamps?.handsReadOnly === true ? { handsReadOnly: true } : {}),
+                ...(entry.specSnapshot.interactiveTools === false || deps.currentClamps?.interactiveTools === false ? { interactiveTools: false } : {}),
+                ...(entry.specSnapshot.oneShot === true || deps.currentClamps?.oneShot === true ? { oneShot: true } : {}),
                 signal: abort.signal,
             };
             if (deps.registry !== undefined && deps.taskId !== undefined && deps.taskAccess !== undefined) {
@@ -844,7 +907,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             `- Finding a known symbol/class/definition, or searching within 2-3 known files → use Grep/Glob/Read.\n` +
             `- A lookup where you already know what you want and roughly where it is → just do it. Delegate open-ended INVESTIGATIONS (you don't know where the answer is), not lookups.\n\n` +
             `Writing the 'prompt' — brief the agent like a smart colleague who just walked into the room — it hasn't seen this conversation, doesn't know what you've tried, doesn't understand why this task matters:\n` +
-            `- Make it fully self-contained and highly detailed: the sub-agent does the whole task autonomously in one shot — you can't course-correct mid-run.\n` +
+            `- Make it fully self-contained and highly detailed: the sub-agent does the whole task end-to-end in one shot — you can't course-correct mid-run.\n` +
             `- State exactly what it must RETURN (e.g. "report the file:line of each call site", not "look into the call sites").\n` +
             `- Say explicitly whether you want it to WRITE CODE or only RESEARCH/REPORT — otherwise it may guess wrong.\n` +
             `- Never delegate understanding. Don't write "based on your findings, fix the bug" or "based on the research, implement it." Those phrases push synthesis onto the agent instead of doing it yourself. Write prompts that prove you understood: include file paths, line numbers, what specifically to change.\n\n` +
@@ -1035,6 +1098,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     }
                 }
             }
+            const modelFallback = !wantsFork && requestedModel !== undefined && perCallModel === undefined ? "inherit_no_tier_binding" : undefined;
             let worktreeDir;
             if (reviveClaim === undefined && (a.isolation ?? def?.isolation) === "worktree") {
                 const iso = ctx.worktreeIsolation;
@@ -1297,11 +1361,17 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             };
             const drainAndReleaseObserver = async () => {
                 if (observerPairing) {
+                    let drainRescue;
                     const timeout = new Promise((resolve) => {
-                        const t = setTimeout(() => resolve("timeout"), 60_000);
-                        t.unref?.();
+                        drainRescue = setTimeout(() => resolve("timeout"), 60_000);
                     });
-                    const outcome = await Promise.race([observerPairing.drain().then(() => "drained"), timeout]);
+                    let outcome;
+                    try {
+                        outcome = await Promise.race([observerPairing.drain().then(() => "drained"), timeout]);
+                    }
+                    finally {
+                        clearTimeout(drainRescue);
+                    }
                     observerPairing.retire(outcome === "timeout" ? "stopped" : "retired");
                     if (outcome === "timeout")
                         noteObserverFailure(new Error("observer unresponsive at settle (delivery drain timed out)"));
@@ -1403,6 +1473,14 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 ...(ctx.onSubagentSpawn ? { onSubagentSpawn: ctx.onSubagentSpawn } : {}),
             };
             const childThinking = def?.thinking ?? ctx.thinkingLevel;
+            const provenanceAgentName = agentName ?? def?.name;
+            const childOnAsk = ctx.onAsk !== undefined
+                ? withDelegationProvenance(ctx.onAsk, {
+                    parentToolCallId: ctx.toolCallId,
+                    depth: depth + 1,
+                    ...(provenanceAgentName !== undefined ? { agentName: provenanceAgentName } : {}),
+                })
+                : undefined;
             const buildChildSpec = (signal) => ({
                 objective: prompt,
                 ...(childModel ? { model: childModel } : { modelRole: "subagent" }),
@@ -1412,6 +1490,12 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 ...(def?.memory ? { memory: def.memory } : {}),
                 ...(def?.skills?.length ? { skills: def.skills } : {}),
                 ...(ctx.principal !== undefined ? { principal: ctx.principal } : {}),
+                ...(ctx.checkpointStoreDisabledForChildren === true ? { checkpointStore: null } : {}),
+                ...(childOnAsk !== undefined ? { onAsk: childOnAsk } : {}),
+                ...(ctx.onQuestion !== undefined ? { onQuestion: ctx.onQuestion } : {}),
+                ...(ctx.interactiveTools === false ? { interactiveTools: false } : {}),
+                ...(ctx.handsReadOnly === true ? { handsReadOnly: true } : {}),
+                ...(ctx.oneShot === true ? { oneShot: true } : {}),
                 ...(ctx.clientContext !== undefined ? { clientContext: ctx.clientContext } : {}),
                 ...(ctx.excludeTools !== undefined ? { excludeTools: [...ctx.excludeTools] } : {}),
                 ...(ctx.deferTools !== undefined ? { deferTools: [...ctx.deferTools] } : {}),
@@ -1428,7 +1512,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 if (!ledger)
                     return undefined;
                 const childSessionId = preMintedSessionId ?? uuidv7();
-                const { signal: _spawnSignal, ...plainSpec } = buildChildSpec(undefined);
+                const { signal: _spawnSignal, onQuestion: _spawnTurnQuestionFace, ...plainSpec } = buildChildSpec(undefined);
                 let entry = ledger.register(ctx.toolCallId, {
                     childSessionId,
                     runner: opts.runner,
@@ -1508,7 +1592,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 if (ledger !== undefined && !ledger.disposed) {
                     if (opts.background)
                         ensureSessionReapHook(opts.background.registry);
-                    const { signal: _spawnSignal, ...plainSpec } = buildChildSpec(undefined);
+                    const { signal: _spawnSignal, onQuestion: _spawnTurnQuestionFace, ...plainSpec } = buildChildSpec(undefined);
                     const entry = ledger.register(ctx.toolCallId, {
                         childSessionId,
                         runner: opts.runner,
@@ -1626,6 +1710,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         else if (!sessionScopedBg)
                             ctx.signal.addEventListener("abort", onHostAbort, { once: true });
                     }
+                    const dropTurnBoundQuestionFace = sessionScopedBg ? { onQuestion: undefined } : {};
                     const shortDesc = `fork: ${(typeof a.description === "string" && a.description.trim() ? a.description.trim() : prompt).slice(0, 180)}`;
                     const bgOwner = sessionScopedBg ? ctx.sessionId : ctx.taskId ?? bg.owner;
                     const bgScope = treeScope;
@@ -1690,7 +1775,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         }, { priority: "later" }), "subagent.reapTerminalNotify");
                     });
                     if (agentName !== undefined) {
-                        recordRosterSpawn(ctx.roster, { name: agentName, agentId: taskId, sessionId: forkedId, toolUseId: ctx.toolCallId, owner: bgOwner, scope: bgScope, ...((typeof childModel === "string" ? resolveModelDisplayLabel(childModel) : childModel?.id) !== undefined ? { model: typeof childModel === "string" ? childModel : childModel?.id } : {}), ...((ctx.rootSessionId ?? ctx.sessionId) !== undefined ? { rootSessionId: ctx.rootSessionId ?? ctx.sessionId } : {}), ...(sessionScopedBg ? { sessionScoped: true } : {}), createdAt: Date.now() }, (err) => opts.onObserverError?.(err, { site: "roster.recordSpawn" }));
+                        recordRosterSpawn(ctx.roster, { name: agentName, agentId: taskId, sessionId: forkedId, toolUseId: ctx.toolCallId, owner: bgOwner, scope: bgScope, ...((typeof childModel === "string" ? resolveModelDisplayLabel(childModel) : childModel?.id) !== undefined ? { model: typeof childModel === "string" ? childModel : childModel?.id } : {}), ...(modelFallback !== undefined ? { modelFallback } : {}), ...((ctx.rootSessionId ?? ctx.sessionId) !== undefined ? { rootSessionId: ctx.rootSessionId ?? ctx.sessionId } : {}), ...(sessionScopedBg ? { sessionScoped: true } : {}), createdAt: Date.now() }, (err) => opts.onObserverError?.(err, { site: "roster.recordSpawn" }));
                     }
                     const bgSink = ctx.onBackgroundChildEvent;
                     const sinkEmit = (event) => {
@@ -1718,7 +1803,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         startedAt: Date.now(),
                     });
                     const forkBgStartedAt = Date.now();
-                    const bgForkSpec = { ...buildChildSpec(abort.signal), sessionId: forkedId, requireExistingSession: true, objective: forkObjective };
+                    const bgForkSpec = { ...buildChildSpec(abort.signal), sessionId: forkedId, requireExistingSession: true, objective: forkObjective, ...dropTurnBoundQuestionFace };
                     const s2ForkNotifyReady = (inject) => {
                         bg.registry.attachAgentNotify(taskId, inject);
                     };
@@ -1971,11 +2056,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     costMicroUsd: rollupDelegatedCost(forkChild.stats, nsf),
                 });
                 if (isDurablePause(forkChild.status)) {
-                    return {
-                        content: `[Sub-agent report · ${FORK_SUBAGENT_TYPE}]\nstatus: failed\nerror: unexpected durable pause (${forkChild.status}, checkpoint ` +
-                            `${String(forkChild.checkpointToken ?? "?")}) — treat this fork as failed; do not retry the same gated action.`,
-                        details: { error: forkChild.status === "needs_review" ? "unexpected.needs_review" : "unexpected.suspended", checkpointToken: forkChild.checkpointToken },
-                    };
+                    return durablePauseDelegationReport(` · ${FORK_SUBAGENT_TYPE}`, forkChild);
                 }
                 const wtLine = await finishWorktree();
                 const forkErr = classifySubagentError(forkChild);
@@ -1998,16 +2079,15 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 ].filter(Boolean);
                 return {
                     content: forkLines.join("\n"),
-                    details: {
-                        ...forkChild,
-                        ...(forkErr ? { error_kind: forkErr.errorKind, retryable: forkErr.retryable } : {}),
+                    details: completedAgentCard(forkChild, {
+                        subagentType: FORK_SUBAGENT_TYPE,
+                        error: forkErr,
                         ...(worktreeKeptPath !== undefined ? { worktreePath: worktreeKeptPath } : {}),
-                        ...(forkChild.model !== undefined ? { resolvedModel: forkChild.model } : {}),
                         ...(() => {
                             const ts = toolStatsCounter.snapshot();
                             return ts !== undefined ? { toolStats: ts } : {};
                         })(),
-                    },
+                    }),
                 };
             }
             if (wantsBackground) {
@@ -2017,12 +2097,13 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 const reviveRow = reviveClaim?.row;
                 const parkedResume = reviveClaim?.parkedResume;
                 const sessionScopedBg = reviveRow !== undefined ? reviveRow.sessionScoped : ctx.backgroundScope === "session" && ctx.sessionId !== undefined;
+                const outlivesThisRequest = sessionScopedBg || reviveRow !== undefined;
                 const onHostAbort = () => abort.abort();
                 const dropHostAbortListener = () => ctx.signal?.removeEventListener("abort", onHostAbort);
                 if (ctx.signal) {
                     if (ctx.signal.aborted)
                         abort.abort();
-                    else if (!sessionScopedBg && reviveRow === undefined)
+                    else if (!outlivesThisRequest)
                         ctx.signal.addEventListener("abort", onHostAbort, { once: true });
                 }
                 const shortDesc = reviveRow?.description ?? String(a.description ?? "sub-agent").slice(0, 200);
@@ -2188,6 +2269,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     sessionId: bgChildSessionId,
                     ...(forwardDurableApproval ? { durableApproval: { ...ctx.durableApprovalForChildren } } : {}),
                     ...(reviveRow !== undefined ? { requireExistingSession: true } : {}),
+                    ...(outlivesThisRequest ? { onQuestion: undefined } : {}),
                 };
                 let reviveAttachedResolve;
                 const reviveAttached = reviveRow !== undefined ? new Promise((r) => (reviveAttachedResolve = r)) : undefined;
@@ -2408,6 +2490,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         else
                             bgRetainLedger?.markSettled(ctx.toolCallId);
                     }
+                    let unparkedPause;
                     if (isDurablePause(child.status) && child.checkpointToken !== undefined) {
                         const cpStore = bg.checkpointStore;
                         const expireByStoreScope = async (token2) => {
@@ -2452,14 +2535,27 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                                 if (parked === "parked")
                                     return;
                                 await expireByStoreScope(token);
+                                unparkedPause = { kind: "checkpoint_expired", cause: attested ? "park_lost" : "capability_veto" };
                             }
                         }
+                        else {
+                            unparkedPause = { kind: "no_park_lane", checkpointToken: child.checkpointToken };
+                        }
                     }
                     const ok = child.status === "completed";
                     const reaped = !ok && abort.signal.aborted;
                     const collateral = reaped && bg.registry.getAccessibleTask(taskId, { ...(bgOwner !== undefined ? { owner: bgOwner } : {}), ...(bgScope !== undefined ? { scope: bgScope } : {}) })?.status === "running";
                     const failedBg = !ok && !reaped;
-                    const errCodeBg = failedBg ? (child.errorCode ?? extractErrorCode(child.errorMessage)) : undefined;
+                    const unparkedPauseReason = unparkedPause !== undefined && failedBg ? unparkedDurablePauseReason(unparkedPause) : undefined;
+                    const errCodeBg = failedBg
+                        ? unparkedPause !== undefined
+                            ? unparkedPause.kind === "no_park_lane"
+                                ? child.status === "needs_review"
+                                    ? SUBAGENT_SUSPENDED_NEEDS_REVIEW
+                                    : SUBAGENT_SUSPENDED_AWAITING_APPROVAL
+                                : SUBAGENT_SUSPENDED_CHECKPOINT_EXPIRED
+                            : (child.errorCode ?? extractErrorCode(child.errorMessage))
+                        : undefined;
                     const errClassBg = failedBg
                         ? classifySubagentError({ status: "failed", ...(child.errorCode !== undefined ? { errorCode: child.errorCode } : {}), ...(child.errorMessage !== undefined ? { errorMessage: child.errorMessage } : {}) })
                         : undefined;
@@ -2468,7 +2564,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         status: ok ? "completed" : reaped ? "killed" : "failed",
                         seq: seqAtSettle ?? 1,
                         ...resultSettleFields(child.result),
-                        ...(!ok ? { error: reaped ? (collateral ? BG_AGENT_COLLATERAL_REAP_REASON : BG_AGENT_REAP_STOP_ERROR) : child.errorMessage ?? String(child.status) } : {}),
+                        ...(!ok ? { error: reaped ? (collateral ? BG_AGENT_COLLATERAL_REAP_REASON : BG_AGENT_REAP_STOP_ERROR) : unparkedPauseReason ?? child.errorMessage ?? String(child.status) } : {}),
                         ...(errCodeBg !== undefined ? { errorCode: errCodeBg } : {}),
                         ...(errClassBg !== undefined ? { retryable: errClassBg.retryable, errorKind: errClassBg.errorKind } : {}),
                     }) ??
@@ -2486,7 +2582,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     const observerNote = observerNoteFor(await startBoundedObserverDrain());
                     const residual = residualFields();
                     const resumableBg = bgRetain !== undefined && settled !== "killed";
-                    const failReasonBg = settled === "failed" ? child.errorMessage : undefined;
+                    const failReasonBg = settled === "failed" ? unparkedPauseReason ?? child.errorMessage : undefined;
                     const bgTerminalSummary = failReasonBg !== undefined
                         ? `Agent "${shortDesc}" failed: ${failReasonBg}${ccElapsedTag(Date.now() - bgStartedAt)}${observerNote}`.slice(0, 300) + errorKindClause(errClassBg)
                         : `${ccCompletionText(shortDesc, settled, String(child.status), Date.now() - bgStartedAt)}${observerNote}`;
@@ -2674,6 +2770,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         sink: ctx.onSubagentSpawn,
                         ...(opts.background ? { registry: opts.background.registry } : {}),
                         ...(opts.onObserverError !== undefined ? { onNotifyError: (f) => opts.onObserverError?.(f.error, { site: f.site }) } : {}),
+                        ...(ctx.onQuestion !== undefined ? { currentOnQuestion: ctx.onQuestion } : {}),
                     });
                     notifier.notify(() => ctx.onSubagentSpawn?.(createSteerHandle(stream, ctx.toolCallId, childAgentName, settled, {
                         resume,
@@ -2728,12 +2825,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             if (isDurablePause(child.status)) {
                 if (retainEntry)
                     ctx.subagentRetain?.abandon(ctx.toolCallId);
-                return {
-                    content: `[Sub-agent report${def ? ` · ${def.name}` : ""}]\n` +
-                        `status: failed\nerror: unexpected durable pause (${child.status}, checkpoint ${String(child.checkpointToken ?? "?")}) — ` +
-                        `treat this delegation as failed; do not retry with the same approval-gated action.`,
-                    details: { error: child.status === "needs_review" ? "unexpected.needs_review" : "unexpected.suspended", checkpointToken: child.checkpointToken },
-                };
+                return durablePauseDelegationReport(def ? ` · ${def.name}` : "", child);
             }
             let failureRetained = false;
             if (!retainEntry) {
@@ -2804,16 +2896,16 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             ].filter(Boolean);
             return {
                 content: lines.join("\n"),
-                details: {
-                    ...child,
-                    ...(errClass ? { error_kind: errClass.errorKind, retryable: errClass.retryable } : {}),
+                details: completedAgentCard(child, {
+                    ...(def !== undefined ? { subagentType: def.name } : {}),
+                    error: errClass,
+                    ...(modelFallback !== undefined ? { modelFallback } : {}),
                     ...(worktreeKeptPath !== undefined ? { worktreePath: worktreeKeptPath } : {}),
-                    ...(child.model !== undefined ? { resolvedModel: child.model } : {}),
                     ...(() => {
                         const ts = toolStatsCounter.snapshot();
                         return ts !== undefined ? { toolStats: ts } : {};
                     })(),
-                },
+                }),
             };
         },
     };