@xneog/dsh-subagent 0.1.0 → 0.1.2-rc.1

package/lib/index.js

@@ -1,11 +1,15 @@
-import { Service } from "@xneog/cordis";
+import { AttachmentError, admitPromptContent } from "@xneog/dsh-attachment";
 import { scopeTarget } from "@xneog/dsh-scope";
 import { assertObjectJsonSchema } from "@xneog/dsh-tools";
-import { HarnessError, boundContextSummary, createUserMessage, errorChain } from "@xneog/dsh-llm";
+import { canonicalClientTimeZone } from "@xneog/dsh-util-time";
+import { Remote, RemoteError, TypertRemoteService } from "@xneog/dsh-typert-protocol";
+import { z } from "zod";
+import { HarnessError, ReasoningEffortId, boundContextSummary, contentHasImage, createUserMessage, errorChain } from "@xneog/dsh-llm";
 import { randomUUID } from "node:crypto";
 import { foldConsumedWork } from "@xneog/dsh-agent";
-import { Session, SessionId, snapshotJsonValue } from "@xneog/dsh-session";
-import { z } from "zod";
+import { Session, SessionLogOffset, SessionSeq } from "@xneog/dsh-session";
+import { brandString } from "@xneog/dsh-brand";
+import { snapshotJsonValue } from "@xneog/dsh-util-values";
 import { accessSync, constants, statSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 //#region lib/types/error.js
@@ -22,6 +26,101 @@ var SubagentError = class extends HarnessError {
 	}
 };
 //#endregion
+//#region lib/types/control.js
+/**
+* Browser-facing subagent control assembly: the catalog view sampled against
+* the live Agent registry, one browser zone's validation, and the stable
+* failure codes the Remote surface answers with.
+*
+* @module @xneog/dsh-subagent
+*/
+const SESSION_ID_SCHEMA = z.string().min(1);
+const CONTROL_ID_SCHEMAS = {
+	"subagent.list": z.object({ parentSessionId: SESSION_ID_SCHEMA }),
+	"subagent.prompt": z.object({
+		parentSessionId: SESSION_ID_SCHEMA,
+		childSessionId: SESSION_ID_SCHEMA,
+		mode: z.literal("continuable")
+	}),
+	"subagent.interrupt": z.object({
+		parentSessionId: SESSION_ID_SCHEMA,
+		childSessionId: SESSION_ID_SCHEMA,
+		mode: z.literal("continuable")
+	})
+};
+/**
+* Apply the subagent payload checks that are stricter than generated
+* branded-string codecs.
+* @param method - method name carried in the failure message.
+* @param payload - decoded control fields to validate.
+* @throws {RemoteError} `gateway/bad-request` with the original Zod issues.
+*/
+function validateControlRequest(method, payload) {
+	const parsed = CONTROL_ID_SCHEMAS[method].safeParse(payload);
+	if (!parsed.success) throw new RemoteError("gateway/bad-request", `invalid payload for ${method}`, { issues: parsed.error.issues });
+}
+/**
+* Project one durable listing onto the catalog view, replacing each row's
+* store-derived activity with the live Agent driver's status and reporting
+* whether the exact parent Agent is live. Without an Agent registry no driver
+* runs at all, so every row is inactive and the parent is unavailable.
+* @param ctx - Host context that may carry the Agent registry.
+* @param parentSessionId - the listed parent.
+* @param entries - the durable direct-child listing.
+* @returns the catalog view answered to one browser.
+*/
+function catalogView(ctx, parentSessionId, entries) {
+	const agents = ctx.get("agents");
+	return {
+		entries: entries.map((entry) => entry.kind === "child" ? {
+			...entry,
+			activity: agents?.get(entry.id)?.status === "running" ? "running" : "inactive"
+		} : entry),
+		parentAvailable: agents?.get(parentSessionId) !== void 0
+	};
+}
+/**
+* Refuse one catalog read while preserving cancellation and a missing
+* projections registry as distinct failures.
+* @param error - the thrown value.
+* @param signal - the caller's cancellation.
+* @returns Never — the refusal is thrown.
+* @throws {RemoteError} always.
+*/
+function rejectCatalogRead(error, signal) {
+	if (isCancellation(error, signal)) throw new RemoteError("gateway/cancelled", "subagent catalog read was cancelled", {}, { cause: error });
+	if (error instanceof SubagentError && error.code === "SUBAGENT_CONTROL_PROJECTIONS_UNAVAILABLE") throw new RemoteError("subagent/projections-unavailable", "subagent catalog is unavailable: this deployment does not mount the sessionProjections registry (load @xneog/dsh-session-projection)", {}, { cause: error });
+	throw new RemoteError("gateway/internal", "subagent catalog read failed", {}, { cause: error });
+}
+/**
+* Refuse one continuation prompt without exposing provider detail: admission
+* failures the caller can act on keep their own code, everything else is
+* internal.
+* @param error - the thrown value.
+* @param childSessionId - the addressed child.
+* @param signal - the caller's cancellation.
+* @returns Never — the refusal is thrown.
+* @throws {RemoteError} always.
+*/
+function rejectPrompt(error, childSessionId, signal) {
+	if (isCancellation(error, signal)) throw new RemoteError("gateway/cancelled", "subagent prompt was cancelled", {}, { cause: error });
+	if (error instanceof AttachmentError) throw new RemoteError("subagent/attachment-invalid", error.message, { reason: error.code }, { cause: error });
+	if (error instanceof SubagentError) switch (error.code) {
+		case "MODEL_DOES_NOT_SUPPORT_IMAGES": throw new RemoteError("subagent/attachment-invalid", error.message, { reason: error.code }, { cause: error });
+		case "NOT_RESUMABLE": throw new RemoteError("subagent/not-resumable", "subagent cannot be resumed", { childSessionId }, { cause: error });
+		case "UNAUTHORIZED": throw new RemoteError("subagent/unauthorized", "subagent does not belong to this parent", { childSessionId }, { cause: error });
+		case "DRAINING":
+		case "ACTIVATION_CLOSING":
+		case "CONTINUATION_UNAVAILABLE":
+		case "PERSISTENCE_UNAVAILABLE": throw new RemoteError("subagent/delivery-unavailable", "subagent follow-up is temporarily unavailable", { childSessionId }, { cause: error });
+		default: break;
+	}
+	throw new RemoteError("gateway/internal", "subagent prompt failed", {}, { cause: error });
+}
+function isCancellation(error, signal) {
+	return signal.aborted || error instanceof SubagentError && error.code === "CANCELLED";
+}
+//#endregion
 //#region lib/types/depth.js
 /**
 * Delegation-depth accounting: the recursion budget a parent passes to its
@@ -228,16 +327,16 @@ function createActivationObserver(emit, provider, childId, parent) {
 		id: childId,
 		local: true
 	};
-	let boundary = 0;
+	let boundary = SessionLogOffset(0);
 	let captured = { stopReason: "completed" };
 	const terminal = (failure) => failure === void 0 ? captured : { stopReason: "error" };
 	return {
 		start: (child) => {
-			boundary = child.session.events.length;
+			boundary = child.session.seq;
 			emit("subagent/start", identity, parent);
 		},
 		capture: (child) => {
-			const own = child.session.events.slice(boundary);
+			const own = child.session.snapshotEvents(boundary);
 			const output = finalAssistantOutput(own);
 			captured = {
 				stopReason: epochStopReason(own),
@@ -325,7 +424,7 @@ function renderThrown(value) {
 * Supporting another composition input is a deliberate version change, never
 * an implicit extra field.
 */
-const SUBAGENT_DESCRIPTOR_VERSION = 2;
+const SUBAGENT_DESCRIPTOR_VERSION = 3;
 const DESCRIPTOR_BASE_KEYS = [
 	"version",
 	"mode",
@@ -337,6 +436,7 @@ const CONTINUABLE_DESCRIPTOR_KEYS = new Set([
 	...DESCRIPTOR_BASE_KEYS,
 	"agentProvider",
 	"agentModel",
+	"agentReasoningEffort",
 	"persona",
 	"toolFilter"
 ]);
@@ -383,7 +483,7 @@ function parseSubagentDescriptor(value) {
 	if (!isRecord(value)) throw new Error("persisted subagent descriptor payload must be an object");
 	const version = value["version"];
 	if (typeof version !== "number") throw new Error("persisted subagent descriptor version must be a number");
-	if (version !== 2) return void 0;
+	if (version !== 3) return void 0;
 	const mode = value["mode"];
 	if (mode !== "one-shot" && mode !== "continuable") throw new Error("persisted subagent descriptor mode must be \"one-shot\" or \"continuable\"");
 	assertKnownKeys(value, mode === "one-shot" ? ONE_SHOT_DESCRIPTOR_KEYS : CONTINUABLE_DESCRIPTOR_KEYS, "payload");
@@ -392,7 +492,7 @@ function parseSubagentDescriptor(value) {
 	if (mode === "one-shot") {
 		const label = optionalString(value, "label");
 		return {
-			version: 2,
+			version: 3,
 			mode,
 			provider,
 			...label !== void 0 ? { label } : {}
@@ -402,32 +502,35 @@ function parseSubagentDescriptor(value) {
 	if (typeof label !== "string") throw new Error("persisted subagent descriptor label must be a string");
 	const agentProvider = optionalString(value, "agentProvider");
 	const agentModel = optionalString(value, "agentModel");
+	const agentReasoningEffort = optionalString(value, "agentReasoningEffort");
 	const persona = optionalString(value, "persona");
 	const toolFilter = Object.hasOwn(value, "toolFilter") ? parseToolFilter(value["toolFilter"]) : void 0;
 	return {
-		version: 2,
+		version: 3,
 		mode,
 		provider,
 		label,
 		...agentProvider !== void 0 ? { agentProvider } : {},
 		...agentModel !== void 0 ? { agentModel } : {},
+		...agentReasoningEffort !== void 0 ? { agentReasoningEffort } : {},
 		...persona !== void 0 ? { persona } : {},
 		...toolFilter !== void 0 ? { toolFilter } : {}
 	};
 }
 function snapshotSubagentDescriptor(input) {
 	const snapshot = snapshotJsonValue(input.mode === "one-shot" ? {
-		version: 2,
+		version: 3,
 		mode: input.mode,
 		provider: input.provider,
 		...input.label !== void 0 ? { label: input.label } : {}
 	} : {
-		version: 2,
+		version: 3,
 		mode: input.mode,
 		provider: input.provider,
 		label: input.label,
 		...input.agentProvider !== void 0 ? { agentProvider: input.agentProvider } : {},
 		...input.agentModel !== void 0 ? { agentModel: input.agentModel } : {},
+		...input.agentReasoningEffort !== void 0 ? { agentReasoningEffort: input.agentReasoningEffort } : {},
 		...input.persona !== void 0 ? { persona: input.persona } : {},
 		...input.toolFilter !== void 0 ? { toolFilter: input.toolFilter } : {}
 	});
@@ -490,25 +593,51 @@ function resolveChildDepth(parent, maxDepth) {
 	return childDepth;
 }
 /**
-* Resolve the child's `AgentOptions`: the parent's provider/model/maxTokens
-* route unless the request overrides it, stamped with the child's own
-* delegation depth.
+* Resolve the parent values inherited by a child. The latest request header
+* owns provider, model, and reasoning effort after request-time selection;
+* creation options remain the fallback before the first request and retain
+* the configured output-token limit.
+* @param parent - delegating parent Agent.
+* @returns detached Agent options for child-option merging.
+*/
+function parentAgentOptionsForDelegation(parent) {
+	const requestConfig = parent.session.requestHeader()?.config;
+	if (requestConfig === void 0) return { ...parent.options };
+	const { provider: _createdProvider, model: _createdModel, reasoningEffort: _createdReasoningEffort, ...createdOptions } = parent.options;
+	return {
+		...createdOptions,
+		provider: requestConfig.provider,
+		model: requestConfig.model,
+		...requestConfig.reasoningEffort === void 0 ? {} : { reasoningEffort: requestConfig.reasoningEffort }
+	};
+}
+/**
+* Resolve the child's `AgentOptions`: the parent's provider/model,
+* reasoning-effort, and maxTokens values unless the request overrides them,
+* stamped with the child's own delegation depth. Changing the route without
+* naming an effort clears the parent's route-owned effort so the selected
+* model resolves its own default.
 * @param parent - the delegating parent whose route the child inherits.
 * @param requested - per-child overrides, if any.
 * @param childDepth - the resolved delegation depth to stamp.
 * @returns the resolved options for `ctx.agents.create()`.
 */
 function resolveChildAgentOptions(parent, requested, childDepth) {
-	const parentProvider = parent.options.provider;
-	const parentModel = parent.options.model;
-	const parentMaxTokens = parent.options.maxTokens;
-	return {
+	const parentOptions = parentAgentOptionsForDelegation(parent);
+	const parentProvider = parentOptions.provider;
+	const parentModel = parentOptions.model;
+	const parentReasoningEffort = parentOptions.reasoningEffort;
+	const parentMaxTokens = parentOptions.maxTokens;
+	const resolved = {
 		...parentProvider !== void 0 ? { provider: parentProvider } : {},
 		...parentModel !== void 0 ? { model: parentModel } : {},
+		...parentReasoningEffort !== void 0 ? { reasoningEffort: parentReasoningEffort } : {},
 		...parentMaxTokens !== void 0 ? { maxTokens: parentMaxTokens } : {},
 		...requested,
 		subagentDepth: childDepth
 	};
+	if ((resolved.provider !== parentProvider || resolved.model !== parentModel) && requested?.reasoningEffort === void 0) delete resolved.reasoningEffort;
+	return resolved;
 }
 /**
 * Build the child session's durable creation metadata: the parent's workspace,
@@ -524,19 +653,19 @@ function resolveChildAgentOptions(parent, requested, childDepth) {
 * child never had.
 * @param parent - the delegating parent agent.
 * @param childDepth - the resolved delegation depth to persist.
-* @param lineageSeedLength - how many leading events came from the parent's log.
+* @param isSeeded - whether this child inherits a parent-log prefix, including an explicitly empty one.
 * @returns the `meta` for `ctx.agents.create()`.
 */
-function childSessionMeta(parent, childDepth, lineageSeedLength) {
+function childSessionMeta(parent, childDepth, isSeeded) {
 	const parentHeader = parent.session.header;
 	const agentPreset = parent.ctx.get("agentPresets")?.composedPreset(parent.ctx);
 	return {
 		...parentHeader.cwd !== void 0 ? { cwd: parentHeader.cwd } : {},
 		...agentPreset === void 0 ? {} : { agentPreset },
 		parentSession: parentHeader.id,
+		isSeeded,
 		origin: "subagent",
-		delegationDepth: childDepth,
-		...lineageSeedLength > 0 ? { seedLength: lineageSeedLength } : {}
+		delegationDepth: childDepth
 	};
 }
 /**
@@ -571,12 +700,12 @@ function applyChildComposition(childCtx, parent, composition) {
 	childCtx.get("agentPresets")?.composeFrom(childCtx, parent.ctx);
 	childCtx.systemPrompt.context({
 		name: "subagent:delegation",
-		order: 120,
+		order: childCtx.systemPrompt.getContextOrder("SUBAGENT_DELEGATION"),
 		text: SUBAGENT_DELEGATION_CONTEXT
 	});
 	if (composition.persona !== void 0) childCtx.systemPrompt.section({
 		name: "deployment:persona",
-		order: 0,
+		order: childCtx.systemPrompt.getSectionOrder("DEPLOYMENT_PERSONA"),
 		text: composition.persona
 	});
 	if (composition.toolFilter !== void 0) childCtx.tools.restrict(composition.toolFilter);
@@ -638,9 +767,32 @@ function appendDelegatedPolicyOverrides(childSession, overrides) {
 function seedDescriptorTurn(childId, seed, descriptor) {
 	const staged = Session.create(childId, seed);
 	staged.append("subagent/descriptor", descriptor);
-	return [...staged.events];
+	return staged.snapshotEvents();
 }
 //#endregion
+//#region lib/types/internal.js
+/**
+* Continuation integration markers and host adapters outside the public
+* Service Definition and model-facing Agent messaging contract.
+* @module @xneog/dsh-subagent/internal
+*/
+/** Process-stable identity carried only by the standard adjacent-Agent messaging tool. */
+const adjacentAgentSendMessageTool = Symbol.for("dsh.subagent.adjacentAgentSendMessageTool");
+/**
+* Test whether one visible definition is the standard adjacent-Agent messaging tool.
+* @param definition - the scope-resolved `send_message` candidate.
+* @returns whether the definition carries the internal standard-tool identity.
+*/
+function isAdjacentAgentSendMessageTool(definition) {
+	return definition !== void 0 && definition[adjacentAgentSendMessageTool] === true;
+}
+/**
+* Process-stable symbol-keyed host delivery shared by the bundled runtime
+* entry and this unbundled internal subpath.
+* @internal
+*/
+const deliverSubagentPrompt = Symbol.for("dsh.subagent.deliverPrompt");
+//#endregion
 //#region lib/types/continuation.js
 /**
 * Internal continuable-subagent manager: stable child ids, descriptor
@@ -664,6 +816,64 @@ function seedDescriptorTurn(childId, seed, descriptor) {
 *
 * @module @xneog/dsh-subagent
 */
+var __addDisposableResource$1 = function(env, value, async) {
+	if (value !== null && value !== void 0) {
+		if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+		var dispose, inner;
+		if (async) {
+			if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+			dispose = value[Symbol.asyncDispose];
+		}
+		if (dispose === void 0) {
+			if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+			dispose = value[Symbol.dispose];
+			if (async) inner = dispose;
+		}
+		if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+		if (inner) dispose = function() {
+			try {
+				inner.call(this);
+			} catch (e) {
+				return Promise.reject(e);
+			}
+		};
+		env.stack.push({
+			value,
+			dispose,
+			async
+		});
+	} else if (async) env.stack.push({ async: true });
+	return value;
+};
+var __disposeResources$1 = (function(SuppressedError) {
+	return function(env) {
+		function fail(e) {
+			env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+			env.hasError = true;
+		}
+		var r, s = 0;
+		function next() {
+			while (r = env.stack.pop()) try {
+				if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+				if (r.dispose) {
+					var result = r.dispose.call(r.value);
+					if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) {
+						fail(e);
+						return next();
+					});
+				} else s |= 1;
+			} catch (e) {
+				fail(e);
+			}
+			if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+			if (env.hasError) throw env.error;
+		}
+		return next();
+	};
+})(typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed, message) {
+	var e = new Error(message);
+	return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
 /**
 * Read one Activation's current disposal transaction. This indirection exists
 * because TypeScript would otherwise narrow repeated reads of the mutable field
@@ -674,6 +884,32 @@ function seedDescriptorTurn(childId, seed, descriptor) {
 function disposalOf(activation) {
 	return activation.disposal;
 }
+/** Build durable attribution for one adjacent-Agent message. */
+function agentMessageSource(sender) {
+	return {
+		kind: "agent-message",
+		form: "relay",
+		senderSessionId: sender.id
+	};
+}
+/** Build the model-visible and durable representation of one adjacent-Agent message. */
+function agentMessage(sender, content) {
+	return createUserMessage({
+		content: [{
+			type: "text",
+			text: `Agent ${sender.id} sent a message:`
+		}, ...content],
+		source: agentMessageSource(sender)
+	});
+}
+/** Append adjacent-Agent return guidance to a continuable child's initial task. */
+function continuableInitialPrompt(parentId, prompt) {
+	const encodedParentId = JSON.stringify(parentId);
+	return [...prompt, {
+		type: "text",
+		text: `Your parent agent id is ${encodedParentId}. Before you finish, send your result to that agent with send_message({ agent_id: ${encodedParentId}, message: "<self-contained result>" }). The parent shares your workspace but does not automatically receive your transcript, tool output, or reasoning. Send earlier messages as well when a finding changes what the parent should do next; sending a message does not end your turn.`
+	}];
+}
 /**
 * One line telling a parent that a background child is finished and why, in
 * the parent's own task vocabulary.
@@ -723,7 +959,6 @@ var ChildLock = class {
 var SubagentContinuationManager = class {
 	ctx;
 	host;
-	setupRegistry;
 	/** Child session id → its live Activation. Process-local, never durable. */
 	activations = /* @__PURE__ */ new Map();
 	/** Materializations admitted before drain, tracked through publication or rollback. */
@@ -739,10 +974,9 @@ var SubagentContinuationManager = class {
 	*/
 	closingScopes = /* @__PURE__ */ new Map();
 	draining = false;
-	constructor(ctx, host, setupRegistry) {
+	constructor(ctx, host) {
 		this.ctx = ctx;
 		this.host = host;
-		this.setupRegistry = setupRegistry;
 		const scope = ctx.plugin(function activationOwner() {});
 		this.ownerCtx = scope.ctx;
 		ctx.on("agent/disposed", ({ agent }) => {
@@ -772,83 +1006,202 @@ var SubagentContinuationManager = class {
 		const request = spec.request;
 		const parent = request.parent;
 		this.assertAdmitting(parent);
-		this.requirePersistence();
+		const persistence = this.requirePersistence();
 		assertSubagentMaxDepth(request.maxDepth);
-		const childId = SessionId(randomUUID());
+		const childId = spec.childId ?? brandString(randomUUID());
+		this.assertChildIdAvailable(childId);
 		const childDepth = resolveChildDepth(parent, request.maxDepth);
-		const agentProvider = request.agentOptions?.provider ?? parent.options.provider;
-		const agentModel = request.agentOptions?.model ?? parent.options.model;
+		const agentOptions = resolveChildAgentOptions(parent, request.agentOptions, childDepth);
+		const agentProvider = agentOptions.provider;
+		const agentModel = agentOptions.model;
+		const agentReasoningEffort = agentOptions.reasoningEffort;
 		const descriptor = snapshotSubagentDescriptor({
 			mode: "continuable",
 			provider: spec.provider,
 			label: spec.label,
 			...agentProvider !== void 0 ? { agentProvider } : {},
 			...agentModel !== void 0 ? { agentModel } : {},
+			...agentReasoningEffort !== void 0 ? { agentReasoningEffort } : {},
 			...request.persona !== void 0 ? { persona: request.persona } : {},
 			...request.toolFilter !== void 0 ? { toolFilter: request.toolFilter } : {}
 		});
 		const delegatedPolicies = captureDelegatedPolicyOverrides(parent);
-		const prepared = await this.host.prepareContinuable(spec.provider, {
-			sessionId: childId,
-			parent,
-			signal: spec.signal
-		});
-		spec.signal.throwIfAborted();
-		this.assertAdmitting(parent);
-		const lineageSeedLength = prepared.seed?.length ?? 0;
-		const seed = seedDescriptorTurn(childId, prepared.seed, descriptor);
-		return {
-			childId,
-			messageId: await this.locks.run(childId, async () => {
-				const activation = await this.materialize({
-					childId,
-					provider: spec.provider,
-					parent,
-					create: {
-						seed,
-						meta: childSessionMeta(parent, childDepth, lineageSeedLength),
-						delegatedPolicies
-					},
-					agentOptions: resolveChildAgentOptions(parent, request.agentOptions, childDepth),
-					composition: {
-						persona: request.persona,
-						toolFilter: request.toolFilter
-					},
-					signal: spec.signal
-				});
-				return this.submitMaterialized(activation, request.prompt, { kind: "user" }, parent, spec.signal);
-			})
+		const releaseHold = this.holdOwnership(parent, childId);
+		try {
+			const prepared = await this.host.prepareContinuable(spec.provider, {
+				sessionId: childId,
+				parent,
+				signal: spec.signal
+			});
+			spec.signal.throwIfAborted();
+			this.assertAdmitting(parent);
+			const inheritedEventCount = SessionLogOffset(prepared.seed?.length ?? 0);
+			const seed = seedDescriptorTurn(childId, prepared.seed, descriptor);
+			return {
+				childId,
+				messageId: await this.locks.run(childId, async () => {
+					spec.signal.throwIfAborted();
+					this.assertAdmitting(parent);
+					this.assertChildIdAvailable(childId);
+					if (spec.childId !== void 0) {
+						const persisted = await persistence.stat(childId, { signal: spec.signal });
+						spec.signal.throwIfAborted();
+						this.assertAdmitting(parent);
+						this.assertChildIdAvailable(childId);
+						if (persisted !== void 0) throw new SubagentError(`subagent "${childId}" already exists`, "DUPLICATE_CHILD");
+					}
+					const activation = await this.materialize({
+						childId,
+						provider: spec.provider,
+						parent,
+						create: {
+							seed,
+							meta: childSessionMeta(parent, childDepth, prepared.seed !== void 0),
+							inheritedEventCount,
+							delegatedPolicies
+						},
+						agentOptions,
+						composition: {
+							persona: request.persona,
+							toolFilter: request.toolFilter
+						},
+						signal: spec.signal
+					});
+					return this.submitMaterialized(activation, isAdjacentAgentSendMessageTool(this.ctx.get("tools")?.get("send_message", activation.handle.agent)) ? continuableInitialPrompt(parent.id, request.prompt) : request.prompt, {
+						source: { kind: "user" },
+						signal: spec.signal,
+						delivery: "queue"
+					}, parent);
+				})
+			};
+		} catch (error) {
+			releaseHold();
+			throw error;
+		}
+	}
+	/**
+	* Pre-register `childId` in a continuation-managed parent's owned set so the
+	* parent cannot settle while a caller is still establishing or resuming that
+	* child. Returns a releaser for the failure path; it removes only a hold
+	* this call added, and leaves ownership in place once a live Activation for
+	* the child exists (an admitted delivery owns it from then on). A parent
+	* without an Activation needs no hold: only this manager settles parents.
+	* @param parent - the live direct parent the operation is admitted under.
+	* @param childId - the durable child the operation addresses.
+	* @returns the failure-path releaser; a no-op when nothing was added.
+	* @throws {SubagentError} `ACTIVATION_CLOSING` when the parent's own
+	*   disposal transaction is already open.
+	*/
+	holdOwnership(parent, childId) {
+		const parentActivation = this.activations.get(parent.id);
+		if (parentActivation === void 0 || parentActivation.handle.agent !== parent) return () => {};
+		if (parentActivation.disposal !== void 0) throw new SubagentError(`subagent parent "${parent.id}" is being disposed; the child was not established`, "ACTIVATION_CLOSING");
+		if (parentActivation.ownedChildren.has(childId)) return () => {};
+		parentActivation.ownedChildren.add(childId);
+		return () => {
+			const live = this.activations.get(childId);
+			/* v8 ignore next 4 -- reaching this arm needs another delivery to establish the child
+			* between this operation's failure and its releaser running, which no test can schedule
+			* deterministically: the ownership edge then belongs to that live Activation, so the
+			* conservative keep leaves it for finishDisposal's releaseOwnership. */
+			if (live !== void 0 && live.disposal === void 0) return;
+			if (parentActivation.ownedChildren.delete(childId)) this.wake(parentActivation);
 		};
 	}
+	/** Reject one child identity already owned by a live Agent or Session. */
+	assertChildIdAvailable(childId) {
+		if (this.ctx.agents.get(childId) !== void 0 || this.ctx.get("sessions")?.get(childId) !== void 0) throw new SubagentError(`subagent "${childId}" already exists`, "DUPLICATE_CHILD");
+	}
 	/**
-	* Deliver one later message to a known continuable child as its next FIFO
-	* turn. Routing depends only on Activation residency: a `running` Activation
-	* enqueues, a `waiting` one wakes the same Agent, and an absent one
-	* cold-resumes a new Activation from the persisted Session. The Agent inbox
-	* is the only queue, so every accepted message has one observable order.
-	*
-	* The caller signal owns lookup, materialization, and admission only until
-	* inbox acceptance; afterwards the accepted turn cannot be cancelled through
-	* this service.
-	* @param parent - the exact live direct parent authorizing this delivery.
-	* @param childId - the durable child session id.
-	* @param content - the user-role content to deliver.
-	* @param options - the message source fields and caller cancellation.
+	* Deliver one model-authored message to a direct continuable child or to the
+	* sender's direct parent. Both directions use Steer: a running target admits
+	* the message at its nearest step boundary, while an idle target starts a
+	* turn. A missing direct child cold-resumes through the ordinary continuation
+	* lifecycle. The caller signal owns the operation only until inbox acceptance.
+	* @param sender - exact live Agent authorizing and originating the message.
+	* @param targetId - durable direct-parent or direct-child session id.
+	* @param content - model-authored content to deliver.
+	* @param options - caller cancellation before acceptance.
 	* @returns the accepted message's inbox id.
-	* @throws when parent authority, availability, or admission rejects the delivery.
+	* @throws when adjacency, availability, or admission rejects delivery.
 	*/
-	async followup(parent, childId, content, options) {
+	async sendMessage(sender, targetId, content, options) {
+		if (this.ctx.agents.get(sender.id) !== sender) throw new SubagentError("message delivery requires the exact live sender agent", "UNAUTHORIZED");
+		this.assertAdmitting(sender);
+		const senderActivation = this.activations.get(sender.id);
+		if (senderActivation !== void 0 && senderActivation.handle.agent === sender && senderActivation.parentSession === targetId) {
+			options.signal.throwIfAborted();
+			return this.sendToParent(senderActivation, sender, content);
+		}
+		if (sender.session.header.parentSession === targetId) throw new SubagentError(`agent "${sender.id}" is not a resident continuable child and cannot send to parent "${targetId}"`, "UNAUTHORIZED");
+		return this.deliverToChild(sender, targetId, content, {
+			signal: options.signal,
+			delivery: "steer"
+		});
+	}
+	/**
+	* Queue one human-authored prompt as a distinct direct-child turn.
+	* @param parent - exact live direct parent authorizing delivery.
+	* @param childId - durable direct-child session id.
+	* @param content - human-authored content to deliver.
+	* @param source - durable host-protocol provenance.
+	* @param signal - caller cancellation before inbox acceptance.
+	* @returns the accepted message's inbox id.
+	*/
+	async queuePrompt(parent, childId, content, source, signal) {
+		return this.deliverToChild(parent, childId, content, {
+			source,
+			signal,
+			delivery: "queue"
+		});
+	}
+	/**
+	* Steer one host-authored prompt to a direct continuable child.
+	* @param parent - exact live direct parent authorizing delivery.
+	* @param childId - durable direct-child session id.
+	* @param content - host-authored content to deliver.
+	* @param source - durable host-protocol provenance.
+	* @param signal - caller cancellation before inbox acceptance.
+	* @returns the accepted message's inbox id.
+	*/
+	async steerPrompt(parent, childId, content, source, signal) {
+		return this.deliverToChild(parent, childId, content, {
+			source,
+			signal,
+			delivery: "steer"
+		});
+	}
+	/** Route one parent-originated delivery through residency and cold resume. */
+	async deliverToChild(parent, childId, content, options) {
 		this.assertAdmitting(parent);
+		const releaseHold = this.holdOwnership(parent, childId);
+		try {
+			return await this.deliverFollowup(parent, childId, content, options);
+		} catch (error) {
+			releaseHold();
+			throw error;
+		}
+	}
+	/** The delivery loop behind {@link deliverToChild}, run under the parent hold. */
+	async deliverFollowup(parent, childId, content, options) {
 		while (true) {
 			const live = await this.locks.run(childId, async () => {
 				const activation = this.activations.get(childId);
 				if (activation === void 0) return this.coldResume(parent, childId, content, options);
+				const disposal = activation.disposal;
 				/* v8 ignore next 3 -- the send-versus-dispose cutoff: reaching this arm needs a
 				* delivery to observe the transaction inside the same critical section that opened it,
 				* which no test can schedule deterministically. The behavior is covered end-to-end by
 				* "cold-resumes a delivery that lost the race with final disposal". */
-				if (activation.disposal !== void 0) return activation.disposal.then(() => void 0, () => void 0);
-				return this.submitAdmitted(activation, content, options.source, parent, options.signal);
+				if (disposal !== void 0) return disposal.then(() => void 0, () => void 0);
+				if (contentHasImage(content)) {
+					await this.assertImageCapable(activation.handle.agent, options.signal);
+					if (activation.disposal !== void 0) {
+						await Promise.allSettled([activation.disposal]);
+						return;
+					}
+				}
+				return this.submitAdmitted(activation, content, options, parent);
 			});
 			/* v8 ignore start -- only the lost-cutoff arm above returns undefined, so only that
 			* race reaches the retry below, which then cold-resumes a new Activation. */
@@ -892,66 +1245,24 @@ var SubagentContinuationManager = class {
 		if (activation.disposal !== void 0) return;
 		activation.handle.agent.cancel(authority.kind === "user" ? { kind: "user" } : { kind: "parent" }, { keepInbox: true });
 	}
-	/**
-	* Deliver explicitly selected content from one resident continuable child to
-	* its durable direct parent. Sender authorization, parent resolution, and
-	* send acceptance share one no-await span. Reporting neither concludes the
-	* child's turn nor changes its Activation lifetime.
-	* @param child - exact live reporting child; this is the authority credential.
-	* @param content - selected model-facing content.
-	* @param options - scheduling policy and pre-acceptance cancellation.
-	* @returns the stable identity of the message accepted by the parent.
-	* @throws {SubagentError} when the sender is unauthorized, the parent is not
-	*   live, or continuation admission is closing.
-	*/
-	async reportFrom(child, content, options) {
-		options.signal.throwIfAborted();
-		this.assertAdmitting(child);
-		const activation = this.authorizeReporter(child);
-		const parent = this.resolveReportParent(child);
-		return this.deliverReport(activation, parent, content, options.delivery);
-	}
-	/** Authorize only the exact Agent of one resident Activation. */
-	authorizeReporter(child) {
-		const activation = this.activations.get(child.id);
-		if (activation === void 0 || activation.handle.agent !== child) throw new SubagentError(`agent "${child.id}" is not a live continuable subagent and cannot report`, "UNAUTHORIZED");
-		/* v8 ignore next 6 -- only a synchronous re-entrant disposer can open this
-		* transaction between exact-agent authorization and this no-await cutoff. */
-		if (activation.disposal !== void 0) throw new SubagentError(`subagent "${child.id}" activation is being disposed; the report was not delivered`, "ACTIVATION_CLOSING");
-		return activation;
-	}
-	/** Resolve the reporting child's live direct parent from durable lineage. */
-	resolveReportParent(child) {
-		const parentId = child.session.header.parentSession;
-		/* v8 ignore next -- every continuation-managed child has direct-parent metadata. */
-		const parent = parentId === void 0 ? void 0 : this.ctx.agents.get(parentId);
-		if (parent === void 0) throw new SubagentError("direct parent is not live; report was not delivered", "PARENT_UNAVAILABLE");
-		return parent;
-	}
-	/** Deliver one framed report through the selected parent scheduling preset. */
-	deliverReport(activation, parent, content, delivery) {
-		const message = createUserMessage({
-			content: [{
-				type: "text",
-				text: `Background subagent ${activation.childId} reported:`
-			}, ...content],
-			source: {
-				kind: "subagent-report",
-				form: "relay",
-				senderSessionId: activation.childId
-			}
-		});
-		if (delivery === "wakeup") this.sendWaking(parent, message, () => {
-			this.sendReport(parent, message, delivery);
+	/** Deliver one resident continuable child's message to its live direct parent. */
+	sendToParent(activation, sender, content) {
+		/* v8 ignore next 6 -- only synchronous re-entrant teardown can open this
+		* transaction between exact-agent authorization and this no-await span. */
+		if (activation.disposal !== void 0) throw new SubagentError(`subagent "${sender.id}" activation is being disposed; the message was not delivered`, "ACTIVATION_CLOSING");
+		const parent = this.ctx.agents.get(activation.parentSession);
+		if (parent === void 0) throw new SubagentError("direct parent is not live; the message was not delivered", "PARENT_UNAVAILABLE");
+		const message = agentMessage(sender, content);
+		this.sendWaking(parent, message, () => {
+			this.sendAgentMessage(parent, message);
 		});
-		else this.sendReport(parent, message, delivery);
 		return message.id;
 	}
 	/**
 	* Perform one waking send to a parent, accounted against that parent's own
 	* Activation when it has one. Registering the id before the send is what
 	* keeps a continuation-managed parent from being judged quiescent in the
-	* window between `followup()` and the microtask that admits it.
+	* window between a waking send and the microtask that admits it.
 	* @param parent - the exact live parent receiving the waking message.
 	* @param message - the message whose id is accounted.
 	* @param send - the synchronous waking send to perform.
@@ -961,13 +1272,12 @@ var SubagentContinuationManager = class {
 		if (parentActivation !== void 0 && parentActivation.handle.agent === parent) this.admitWaking(parentActivation, message.id, send);
 		else send();
 	}
-	/** Send one report while translating only the parent's own rejection. */
-	sendReport(parent, message, delivery) {
+	/** Send one Agent message while translating only the target's own rejection. */
+	sendAgentMessage(parent, message) {
 		try {
-			if (delivery === "wakeup") parent.followup(message);
-			else parent.inject(message);
+			parent.steer(message);
 		} catch (error) {
-			throw new SubagentError("direct parent is not live; report was not delivered", "PARENT_UNAVAILABLE", { cause: error });
+			throw new SubagentError("direct parent is not live; the message was not delivered", "PARENT_UNAVAILABLE", { cause: error });
 		}
 	}
 	/**
@@ -1027,6 +1337,28 @@ var SubagentContinuationManager = class {
 		await Promise.all(materializations.map((materialization) => materialization.settled));
 		await this.disposeRoots(targetRoots, "scoped activation(s)");
 	}
+	/**
+	* Release selected resident direct children of one exact live parent without
+	* closing admission for the parent's other continuable children. Owned
+	* descendants are released recursively through the same lifecycle.
+	* @param parent - exact live direct parent authorizing the selected release.
+	* @param childIds - durable direct-child ids to release when resident.
+	* @returns once every selected Activation released its handle.
+	* @throws {SubagentError} `UNAUTHORIZED` when a resident target is not the
+	*   parent's direct continuable child or the parent identity is stale.
+	*/
+	async drainChildren(parent, childIds) {
+		if (this.ctx.agents.get(parent.id) !== parent) throw new SubagentError("selected child teardown requires the exact live parent agent", "UNAUTHORIZED");
+		const targets = [];
+		for (const childId of new Set(childIds)) {
+			const activation = this.activations.get(childId);
+			if (activation === void 0) continue;
+			if (activation.parentSession !== parent.id || !activation.ancestry.has(parent)) throw new SubagentError(`subagent "${childId}" is not a direct child of agent "${parent.id}"`, "UNAUTHORIZED");
+			targets.push(activation);
+		}
+		for (const activation of targets) this.dispose(activation).catch(() => void 0);
+		await this.disposeRoots(targets, "selected activation(s)");
+	}
 	/** Dispose independent roots and report every branch failure after all settle. */
 	async disposeRoots(roots, failureSubject) {
 		const reasons = (await Promise.all(roots.map(async (activation) => {
@@ -1098,61 +1430,77 @@ var SubagentContinuationManager = class {
 		return "settled";
 	}
 	/**
-	* Cold-resume a persisted child: inspect and authorize its Session, fold the
+	* Cold-resume a persisted child: retain and authorize its prepared Session, fold the
 	* generic descriptor, create the Activation through `ctx.agents.resume()`,
 	* and submit the waiting turn. This never dispatches through a subagent
 	* provider — the persisted Session already holds the initial prefix and the
 	* descriptor is the whole reconstruction input.
 	*/
 	async coldResume(parent, childId, content, options) {
-		const persistence = this.requirePersistence();
-		let loaded;
-		try {
-			loaded = await persistence.inspect(childId, options.signal);
-		} catch (error) {
-			options.signal.throwIfAborted();
-			throw new SubagentError(`subagent "${childId}" is unavailable`, "NOT_RESUMABLE", { cause: error });
-		}
-		options.signal.throwIfAborted();
-		this.assertAdmitting(parent);
-		this.authorizeLineage(parent, childId, loaded.meta.parentSession);
-		const descriptor = foldSubagentDescriptor(loaded.events.slice(loaded.meta.seedLength ?? 0));
-		if (descriptor === void 0 || descriptor.mode !== "continuable") throw new SubagentError(`subagent "${childId}" has no supported continuation state and cannot be resumed; do not retry send_message with this id`, "NOT_RESUMABLE");
-		let activation;
+		const env_1 = {
+			stack: [],
+			error: void 0,
+			hasError: false
+		};
 		try {
-			activation = await this.materialize({
-				childId,
-				provider: descriptor.provider,
-				parent,
-				agentOptions: {
-					...descriptor.agentProvider !== void 0 ? { provider: descriptor.agentProvider } : {},
-					...descriptor.agentModel !== void 0 ? { model: descriptor.agentModel } : {}
-				},
-				composition: {
-					persona: descriptor.persona,
-					toolFilter: descriptor.toolFilter
-				},
-				signal: options.signal
-			});
-		} catch (error) {
-			options.signal.throwIfAborted();
-			if (error instanceof SubagentError) throw error;
-			throw new SubagentError(`subagent "${childId}" is unavailable`, "NOT_RESUMABLE", { cause: error });
+			const query = this.requireSessionQuery();
+			let observation;
+			try {
+				observation = await query.observeSession(childId, { signal: options.signal });
+			} catch (error) {
+				options.signal.throwIfAborted();
+				throw new SubagentError(`subagent "${childId}" is unavailable`, "NOT_RESUMABLE", { cause: error });
+			}
+			const source = __addDisposableResource$1(env_1, observation, false);
+			this.assertAdmitting(parent);
+			this.authorizeLineage(parent, childId, source.header.parentSession);
+			const descriptor = foldSubagentDescriptor(source.events.slice(source.inheritedEventCount));
+			if (descriptor === void 0 || descriptor.mode !== "continuable") throw new SubagentError(`subagent "${childId}" has no supported continuation state and cannot be resumed; choose a different target`, "NOT_RESUMABLE");
+			let activation;
+			try {
+				activation = await this.materialize({
+					childId,
+					provider: descriptor.provider,
+					parent,
+					agentOptions: {
+						...descriptor.agentProvider !== void 0 ? { provider: descriptor.agentProvider } : {},
+						...descriptor.agentModel !== void 0 ? { model: descriptor.agentModel } : {},
+						...descriptor.agentReasoningEffort !== void 0 ? { reasoningEffort: ReasoningEffortId(descriptor.agentReasoningEffort) } : {}
+					},
+					composition: {
+						persona: descriptor.persona,
+						toolFilter: descriptor.toolFilter
+					},
+					signal: options.signal
+				});
+			} catch (error) {
+				options.signal.throwIfAborted();
+				if (error instanceof SubagentError) throw error;
+				throw new SubagentError(`subagent "${childId}" is unavailable`, "NOT_RESUMABLE", { cause: error });
+			}
+			return await this.submitMaterialized(activation, content, options, parent);
+		} catch (e_1) {
+			env_1.error = e_1;
+			env_1.hasError = true;
+		} finally {
+			__disposeResources$1(env_1);
 		}
-		return this.submitMaterialized(activation, content, options.source, parent, options.signal);
 	}
 	/**
 	* Submit to a freshly materialized Activation or roll it back completely.
 	* @param activation - the just-published Activation to admit or release.
 	* @param content - the initial or resumed message content.
-	* @param source - durable fields naming who supplied the accepted message.
+	* @param options - durable source, scheduling, and pre-acceptance cancellation.
 	* @param parent - the live direct parent authorizing admission.
-	* @param signal - caller cancellation owning admission until acceptance.
 	* @returns the accepted inbox message id.
 	*/
-	async submitMaterialized(activation, content, source, parent, signal) {
+	async submitMaterialized(activation, content, options, parent) {
 		try {
-			return this.submitAdmitted(activation, content, source, parent, signal);
+			if (contentHasImage(content)) {
+				await this.assertImageCapable(activation.handle.agent, options.signal);
+				if (activation.disposal !== void 0) throw new SubagentError(`subagent "${activation.childId}" is closing`, "ACTIVATION_CLOSING");
+			}
+			return this.submitAdmitted(activation, content, options, parent);
 		} catch (error) {
 			/* v8 ignore next -- rollback disposal failures must not mask the
 			* pre-acceptance signal, drain, or lifecycle failure. */
@@ -1161,6 +1509,28 @@ var SubagentContinuationManager = class {
 		}
 	}
 	/**
+	* Refuse image content addressed to a child whose model accepts text only.
+	* Callers guard with `contentHasImage`, so text-only delivery never awaits.
+	* The check runs inside the per-child delivery lock, before the message
+	* exists, so a rejection leaves no partial user message. When the child's
+	* route is not fixed by its options (a request-waterfall listener owns it)
+	* or no LLM registry is composed, delivery proceeds and the LLM layer's
+	* text-only projection replaces each image with its stable placeholder.
+	* @param agent - the live or freshly materialized child agent.
+	* @param signal - caller cancellation bounding the model-info read.
+	* @throws {SubagentError} `MODEL_DOES_NOT_SUPPORT_IMAGES` when the child's resolved model declines image input.
+	*/
+	async assertImageCapable(agent, signal) {
+		const { provider, model } = agent.options;
+		if (provider === void 0 || model === void 0) return;
+		const llm = this.ctx.get("llm");
+		/* v8 ignore next -- a deployment without the LLM registry serves no model
+		* to refuse against; delivery then defers to the text-only projection. */
+		if (llm === void 0) return;
+		const info = await llm.resolveModelInfo(provider, model, signal);
+		if (info.inputModalities !== void 0 && !info.inputModalities.includes("image")) throw new SubagentError(`Model "${model}" does not support image input.`, "MODEL_DOES_NOT_SUPPORT_IMAGES");
+	}
+	/**
 	* Create or resume the child Agent through the private activation-owner
 	* scope, install the handle in a fresh Activation, and register ownership on
 	* a continuation-managed parent. Rejection leaves no Activation, no handle,
@@ -1191,7 +1561,6 @@ var SubagentContinuationManager = class {
 		const setup = (childCtx) => {
 			if (create !== void 0) appendDelegatedPolicyOverrides(childCtx.agent.session, create.delegatedPolicies);
 			applyChildComposition(childCtx, parent, inputs.composition);
-			return this.setupRegistry.apply(childCtx);
 		};
 		const observer = this.host.observeActivation(provider, childId, parent);
 		const handle = create === void 0 ? await this.ownerCtx.agents.resume({
@@ -1203,6 +1572,7 @@ var SubagentContinuationManager = class {
 			sessionId: childId,
 			meta: create.meta,
 			seed: create.seed,
+			inheritedEventCount: create.inheritedEventCount,
 			agentOptions: inputs.agentOptions,
 			signal: inputs.signal,
 			setup
@@ -1284,14 +1654,15 @@ var SubagentContinuationManager = class {
 	* inbox id. Acceptance is the operation's success boundary; the manager owns
 	* the Activation independently afterwards.
 	*/
-	submit(activation, content, source, parent) {
+	submit(activation, content, options, parent) {
 		this.acquireOwnership(parent, activation.childId);
-		const message = createUserMessage({
+		const message = options.source === void 0 ? agentMessage(parent, content) : createUserMessage({
 			content,
-			source
+			source: options.source
 		});
 		const accepted = this.admitWaking(activation, message.id, () => {
-			activation.handle.agent.followup(message);
+			if (options.delivery === "steer") activation.handle.agent.steer(message);
+			else activation.handle.agent.followup(message);
 		});
 		activation.announced = true;
 		return accepted;
@@ -1319,14 +1690,14 @@ var SubagentContinuationManager = class {
 	* manager drain, or Activation disposal that wins before this synchronous
 	* span rejects without inbox acceptance.
 	*/
-	submitAdmitted(activation, content, source, parent, signal) {
-		signal.throwIfAborted();
+	submitAdmitted(activation, content, options, parent) {
+		options.signal.throwIfAborted();
 		this.assertAdmitting(parent);
 		/* v8 ignore next 6 -- only a synchronous re-entrant disposer can change
 		* this field between the caller's live check and this no-await boundary. */
 		if (disposalOf(activation) !== void 0) throw new SubagentError(`subagent "${activation.childId}" activation is being disposed; the message was not accepted`, "ACTIVATION_CLOSING");
 		this.authorizeLineage(parent, activation.childId, activation.handle.agent.session.header.parentSession);
-		return this.submit(activation, content, source, parent);
+		return this.submit(activation, content, options, parent);
 	}
 	/**
 	* Authorize one operation against the durable direct-parent lineage. Other
@@ -1504,147 +1875,26 @@ var SubagentContinuationManager = class {
 		if (persistence === void 0) throw new SubagentError("continuable subagents require session persistence (load a dsh-session-persistence backend)", "PERSISTENCE_UNAVAILABLE");
 		return persistence;
 	}
-};
-//#endregion
-//#region lib/types/activation-setup-registry.js
-/**
-* Internal registry of deployment capabilities composed into every continuable
-* child's unpublished creation context.
-*
-* A contribution grants a child-scoped capability without teaching the
-* continuation manager which capabilities exist. The manager owns residency;
-* this registry owns the join between plugin lifetime, unpublished setup, and
-* Activation disposal, so no installation outlives either owner and no removed
-* contribution can be installed after revocation reports completion.
-*
-* @module @xneog/dsh-subagent/activation-setup-registry
-*/
-/** Re-read mutable removal state after a contribution may have revoked itself. */
-function isRemoved(registration) {
-	return registration.removed;
-}
-/**
-* Owns continuable-child setup registrations, installations, rollback, child
-* cleanup, and immediate live revocation.
-*/
-var SubagentActivationSetupRegistry = class {
-	/** Live contributions in installation order. */
-	registrations = /* @__PURE__ */ new Set();
-	/** Child context to its live installations. */
-	byChild = /* @__PURE__ */ new Map();
-	/**
-	* Register one contribution.
-	* @param contribution - synchronous child-scope installer.
-	* @returns an idempotent registration undo.
-	* @throws after attempting every installation when any disposer fails.
-	*/
-	register(contribution) {
-		const registration = {
-			contribution,
-			removed: false,
-			installations: /* @__PURE__ */ new Set()
-		};
-		this.registrations.add(registration);
-		return () => {
-			if (registration.removed) return;
-			registration.removed = true;
-			this.registrations.delete(registration);
-			this.releaseAll([...registration.installations], "contribution removal");
-		};
-	}
-	/**
-	* Install every live contribution into one unpublished child context.
-	* @param childCtx - the child's unpublished scoped context.
-	* @returns the provisioning commit consumed at Agent publication.
-	*/
-	apply(childCtx) {
-		const state = {
-			installations: [],
-			invalidated: false
-		};
-		try {
-			for (const registration of [...this.registrations]) {
-				/* v8 ignore next -- only a synchronous re-entrant revocation of an
-				* already-snapshotted registration reaches this guard. */
-				if (registration.removed) continue;
-				const installation = {
-					registration,
-					childCtx,
-					dispose: registration.contribution(childCtx),
-					released: false,
-					transaction: state
-				};
-				registration.installations.add(installation);
-				state.installations.push(installation);
-				let indexed = this.byChild.get(childCtx);
-				if (indexed === void 0) {
-					indexed = /* @__PURE__ */ new Set();
-					this.byChild.set(childCtx, indexed);
-				}
-				indexed.add(installation);
-				if (isRemoved(registration)) this.release(installation);
-			}
-		} catch (error) {
-			try {
-				this.releaseAll([...state.installations], "setup rollback");
-			} catch (releaseFailure) {}
-			throw error;
-		}
-		childCtx.effect(() => () => {
-			this.releaseChild(childCtx);
-		}, "subagents.activationSetup()");
-		return { commit: () => {
-			if (state.invalidated) throw new SubagentError("a continuable-subagent setup contribution was revoked while this child was being built; the child was not established", "ACTIVATION_SETUP_REVOKED");
-			for (const installation of state.installations) installation.transaction = void 0;
-		} };
-	}
-	/** Release every remaining installation owned by one disposed child scope. */
-	releaseChild(childCtx) {
-		const indexed = this.byChild.get(childCtx) ?? [];
-		this.releaseAll([...indexed], "child scope disposal");
-	}
-	/**
-	* Release a batch completely before reporting disposer failures.
-	* @param installations - records to release.
-	* @param during - operation name for diagnostics.
-	*/
-	releaseAll(installations, during) {
-		const failures = [];
-		for (const installation of installations) try {
-			this.release(installation);
-		} catch (error) {
-			failures.push(error);
-		}
-		if (failures.length === 0) return;
-		throw new SubagentError(`continuable-subagent setup ${during} failed to release ${failures.length} installation(s): ` + failures.map((failure) => errorChain(failure)).join("; "), "ACTIVATION_SETUP_RELEASE_FAILED");
-	}
-	/** Drop one installation from both indices and dispose it exactly once. */
-	release(installation) {
-		if (installation.released) return;
-		installation.released = true;
-		installation.registration.installations.delete(installation);
-		const indexed = this.byChild.get(installation.childCtx);
-		/* v8 ignore next 4 -- every live installation is indexed until this method removes it. */
-		if (indexed !== void 0) {
-			indexed.delete(installation);
-			if (indexed.size === 0) this.byChild.delete(installation.childCtx);
-		}
-		if (installation.transaction !== void 0) installation.transaction.invalidated = true;
-		installation.dispose();
+	/** Resolve the Session query service used for cold child observations. */
+	requireSessionQuery() {
+		const query = this.ctx.get("sessionQuery");
+		if (query === void 0) throw new SubagentError("continuable subagents require session query (load @xneog/dsh-session-query)", "CONTINUATION_UNAVAILABLE");
+		return query;
 	}
 };
 //#endregion
 //#region lib/types/list-children.js
 /**
 * Read-only enumeration of durable subagent children and descendant trees
-* straight from the live session store and optional session persistence — no
-* query service. Candidates come from one live-preferred corpus; each child's
-* mode/label is the registered `subagent` projection unit's value, resolved
+* through the Session query service. Candidates come from one live-preferred
+* corpus; each child's mode/label is the registered `subagent` projection
+* unit's value, resolved
 * down a three-rung ladder: the registry's watermark cache for a live child,
-* a durable projection-cache row when it serves an own-suffix identity (the
-* seq gate), and one persistence inspection folded through the registry
-* otherwise, validated against the enumerated lifecycle. The projection fold
-* is the single classification authority — this module parses no descriptor
+* an unseeded durable projection-cache row, and one shared Session observation
+* otherwise. A seeded header deliberately lacks its exact inherited cut, so
+* it takes the body-bearing observation path before classifying an identity.
+* The projection fold is the single classification
+* authority — this module parses no descriptor
 * itself. Absent persistence, enumeration is live-only: a cold child is
 * unreachable for resume anyway, so its absence is capability absence, not an
 * error. The module owns no catalog state and does not consult Activation,
@@ -1652,10 +1902,68 @@ var SubagentActivationSetupRegistry = class {
 *
 * @module @xneog/dsh-subagent
 */
+var __addDisposableResource = function(env, value, async) {
+	if (value !== null && value !== void 0) {
+		if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+		var dispose, inner;
+		if (async) {
+			if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+			dispose = value[Symbol.asyncDispose];
+		}
+		if (dispose === void 0) {
+			if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+			dispose = value[Symbol.dispose];
+			if (async) inner = dispose;
+		}
+		if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+		if (inner) dispose = function() {
+			try {
+				inner.call(this);
+			} catch (e) {
+				return Promise.reject(e);
+			}
+		};
+		env.stack.push({
+			value,
+			dispose,
+			async
+		});
+	} else if (async) env.stack.push({ async: true });
+	return value;
+};
+var __disposeResources = (function(SuppressedError) {
+	return function(env) {
+		function fail(e) {
+			env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+			env.hasError = true;
+		}
+		var r, s = 0;
+		function next() {
+			while (r = env.stack.pop()) try {
+				if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+				if (r.dispose) {
+					var result = r.dispose.call(r.value);
+					if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) {
+						fail(e);
+						return next();
+					});
+				} else s |= 1;
+			} catch (e) {
+				fail(e);
+			}
+			if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+			if (env.hasError) throw env.error;
+		}
+		return next();
+	};
+})(typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed, message) {
+	var e = new Error(message);
+	return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
 /**
-* Concurrent cold inspections per listing; a constant because it bounds one
-* read-only scan of local media, not deployment behavior. Should a networked
-* persistence backend appear, promote it to a validated `Config` field.
+* Concurrent cold observations per explicit catalog listing. Current Session
+* persistence providers are local; a networked provider must promote this to
+* a validated deployment setting.
 */
 const COLD_READ_CONCURRENCY = 4;
 /**
@@ -1663,9 +1971,8 @@ const COLD_READ_CONCURRENCY = 4;
 * live-preferred merge of `ctx.sessions` and optional session persistence,
 * serving each identity from the `subagent` projection unit: the registry's
 * watermark snapshot for a live child; for a cold one, a durable
-* projection-cache row when it serves an own-suffix identity (the seq gate),
-* else one bounded-concurrency persistence inspection folded through the
-* registry.
+* projection-cache read for an unseeded lifecycle, else one bounded-concurrency
+* shared Session observation carrying the exact inherited cut.
 * @see SubagentRuntime.listChildren for the public cancellation and failure contract.
 * @param ctx - context carrying the session store, the projection registry,
 *   optional persistence, and the optional projection cache.
@@ -1714,32 +2021,30 @@ async function prepareListing(ctx, signal) {
 	const sessions = ctx.get("sessions");
 	if (sessions === void 0) throw new SubagentError("listing subagents requires the session store (load @xneog/dsh-session)", "SUBAGENT_CONTROL_SESSION_STORE_UNAVAILABLE");
 	assertListingNotCancelled(signal);
-	const persistence = ctx.get("sessionPersistence");
+	const query = ctx.get("sessionQuery");
+	if (query === void 0) throw new SubagentError("listing subagents requires the sessionQuery service (load @xneog/dsh-session-query)", "SUBAGENT_CONTROL_QUERY_UNAVAILABLE");
 	const cache = ctx.get("sessionProjectionCache");
-	let persistedHeaders = [];
-	if (persistence !== void 0) {
-		try {
-			persistedHeaders = await persistence.list(signal);
-		} catch (error) {
-			assertListingNotCancelled(signal);
-			throw error;
-		}
+	let records;
+	try {
+		records = await query.listSessions(signal);
+	} catch (error) {
 		assertListingNotCancelled(signal);
+		throw error;
 	}
+	assertListingNotCancelled(signal);
 	const corpus = /* @__PURE__ */ new Map();
-	for (const header of persistedHeaders) corpus.set(header.id, {
-		header,
-		live: void 0
-	});
-	for (const session of sessions.list()) corpus.set(session.header.id, {
-		header: session.header,
-		live: session
-	});
+	for (const record of records) {
+		const live = sessions.get(record.header.id);
+		corpus.set(record.header.id, {
+			header: live?.header ?? record.header,
+			live
+		});
+	}
 	const subagentParents = /* @__PURE__ */ new Set();
 	for (const record of corpus.values()) if (record.header.origin === "subagent" && record.header.parentSession !== void 0) subagentParents.add(record.header.parentSession);
 	return {
 		projections,
-		persistence,
+		query,
 		cache,
 		corpus,
 		subagentParents
@@ -1747,7 +2052,7 @@ async function prepareListing(ctx, signal) {
 }
 /** Resolve projection-backed rows for aligned candidates with bounded cold reads. */
 async function resolveCandidateRows(candidates, listing, signal) {
-	const { projections, persistence, cache, subagentParents } = listing;
+	const { projections, query, cache, subagentParents } = listing;
 	const rows = Array.from({ length: candidates.length });
 	const coldReads = [];
 	candidates.forEach((candidate, index) => {
@@ -1761,7 +2066,7 @@ async function resolveCandidateRows(candidates, listing, signal) {
 		}
 		let identity;
 		try {
-			identity = projections.snapshot(candidate.live).values.subagent;
+			identity = projections.snapshot(candidate.live, ["subagent"]).values.subagent;
 		} catch {
 			rows[index] = {
 				kind: "diagnostic",
@@ -1770,13 +2075,13 @@ async function resolveCandidateRows(candidates, listing, signal) {
 			};
 			return;
 		}
-		if (identity === void 0 || identity === null) return;
+		if (identity === void 0 || identity === null || !candidate.live.isOwnSeq(identity.seq)) return;
 		rows[index] = childRow(childId, identity, "running", subagentParents.has(childId));
 	});
-	if (persistence !== void 0 && coldReads.length > 0) {
+	if (coldReads.length > 0) {
 		const queue = [...coldReads];
 		await Promise.all(Array.from({ length: Math.min(COLD_READ_CONCURRENCY, queue.length) }, async () => {
-			for (let job = queue.shift(); job !== void 0; job = queue.shift()) rows[job.index] = await resolveColdIdentity(persistence, projections, cache, job.header, subagentParents.has(job.header.id), signal);
+			for (let job = queue.shift(); job !== void 0; job = queue.shift()) rows[job.index] = await resolveColdIdentity(query, cache, job.header, subagentParents.has(job.header.id), signal);
 		}));
 	}
 	assertListingNotCancelled(signal);
@@ -1820,60 +2125,62 @@ function compareCorpusRecords(a, b) {
 	return a.header.createdAt - b.header.createdAt || a.header.id.localeCompare(b.header.id);
 }
 /**
-* Resolve one cold candidate down the remaining ladder: a durable
-* projection-cache row when it serves an own-suffix identity (the seq gate),
-* otherwise one persistence inspection folded through the projection
-* registry (the same detached recipe the API proxy uses for detached session
-* projections). A failed inspection is one transient `unavailable` row
-* retried on the next listing; an inspection naming another lifecycle, and a
+* Resolve one cold candidate down the remaining ladder: an unseeded durable
+* projection-cache row, otherwise one shared Session observation. An absent or transiently failed
+* observation is one `unavailable` row retried on the next listing; an observation
+* source naming another lifecycle, and a
 * settled log the fold cannot identify — or that makes any registered unit
 * throw — are final, so they report `corrupt`.
 */
-async function resolveColdIdentity(persistence, projections, cache, header, hasChildren, signal) {
-	const childId = header.id;
-	if (cache !== void 0) {
-		let cached;
+async function resolveColdIdentity(query, cache, header, hasChildren, signal) {
+	const env_1 = {
+		stack: [],
+		error: void 0,
+		hasError: false
+	};
+	try {
+		const childId = header.id;
+		if (cache !== void 0 && !header.isSeeded) {
+			let cached;
+			try {
+				cached = cache.cachedSnapshot(header, SessionLogOffset(0), ["subagent"])?.values.subagent;
+			} catch {
+				cached = void 0;
+			}
+			if (cached !== void 0 && cached !== null) return childRow(childId, cached, "inactive", hasChildren);
+		}
+		assertListingNotCancelled(signal);
+		let observation;
 		try {
-			cached = cache.cachedSnapshot(header)?.values.subagent;
-		} catch {
-			cached = void 0;
+			observation = await query.observeSession(childId, { ...signal === void 0 ? {} : { signal } });
+		} catch (error) {
+			assertListingNotCancelled(signal);
+			return {
+				kind: "diagnostic",
+				id: childId,
+				reason: sessionQueryCode(error) === "SESSION_QUERY_CORRUPT_SESSION" || sessionQueryCode(error) === "SESSION_QUERY_SOURCE_CONFLICT" ? "corrupt" : "unavailable"
+			};
 		}
-		if (cached !== void 0 && cached !== null && cached.seq >= (header.seedLength ?? 0)) return childRow(childId, cached, "inactive", hasChildren);
-	}
-	assertListingNotCancelled(signal);
-	let inspected;
-	try {
-		inspected = await persistence.inspect(childId, signal);
-	} catch {
+		const ownedObservation = __addDisposableResource(env_1, observation, false);
 		assertListingNotCancelled(signal);
-		return {
+		if (!sameLifecycle(ownedObservation.header, header)) return {
 			kind: "diagnostic",
 			id: childId,
-			reason: "unavailable"
+			reason: "corrupt"
 		};
-	}
-	assertListingNotCancelled(signal);
-	if (!sameLifecycle(inspected.meta, header)) return {
-		kind: "diagnostic",
-		id: childId,
-		reason: "corrupt"
-	};
-	let identity;
-	try {
-		identity = projections.restore({}, inspected.events, 0).snapshot.values.subagent;
-	} catch {
-		return {
+		const identity = ownedObservation.projections?.values.subagent;
+		if (identity === void 0 || identity === null || identity.seq < ownedObservation.inheritedEventCount) return {
 			kind: "diagnostic",
 			id: childId,
 			reason: "corrupt"
 		};
+		return childRow(childId, identity, "inactive", hasChildren);
+	} catch (e_1) {
+		env_1.error = e_1;
+		env_1.hasError = true;
+	} finally {
+		__disposeResources(env_1);
 	}
-	if (identity === void 0 || identity === null) return {
-		kind: "diagnostic",
-		id: childId,
-		reason: "corrupt"
-	};
-	return childRow(childId, identity, "inactive", hasChildren);
 }
 /** Materialize one served identity as its child row. */
 function childRow(id, identity, activity, hasChildren) {
@@ -1900,8 +2207,10 @@ const LIFECYCLE_WITNESS_KEYS = [
 	"createdAt",
 	"cwd",
 	"parentSession",
-	"seedLength",
-	"delegationDepth"
+	"isSeeded",
+	"delegationDepth",
+	"origin",
+	"agentPreset"
 ];
 /** Whether an inspected log still belongs to the enumerated lifecycle. */
 function sameLifecycle(meta, expected) {
@@ -1911,6 +2220,28 @@ function sameLifecycle(meta, expected) {
 function assertListingNotCancelled(signal) {
 	if (signal?.aborted) throw new SubagentError("subagent listing was cancelled", "CANCELLED");
 }
+function sessionQueryCode(error) {
+	return error instanceof Error && "code" in error ? error.code : void 0;
+}
+//#endregion
+//#region lib/types/projection.js
+/**
+* Pure session projections for subagent identity (mode/label) and active-turn
+* duration.
+*
+* @module @xneog/dsh-subagent/projection
+*/
+const activeIntervalSchema = z.object({
+	since: z.number().int().nonnegative(),
+	through: z.number().int().nonnegative()
+}).strict();
+const projectionSchema = z.object({
+	settledMs: z.number().int().nonnegative(),
+	active: activeIntervalSchema.optional()
+}).strict().transform(({ settledMs, active }) => ({
+	settledMs,
+	...active === void 0 ? {} : { active }
+}));
 /**
 * Fold turn boundaries around the child's own durable descriptor.
 *
@@ -1921,12 +2252,11 @@ function assertListingNotCancelled(signal) {
 */
 const subagentTimingProjectionDefinition = {
 	key: "subagentTiming",
-	schema: z.object({
+	stateSchema: z.object({
 		settledMs: z.number().int().nonnegative(),
-		active: z.object({
-			since: z.number().int().nonnegative(),
-			through: z.number().int().nonnegative()
-		}).strict().optional()
+		active: activeIntervalSchema.optional(),
+		pendingTurnStart: z.number().int().nonnegative().optional(),
+		descriptorSeen: z.boolean()
 	}).strict(),
 	init: () => ({
 		descriptorSeen: false,
@@ -1976,21 +2306,26 @@ const subagentTimingProjectionDefinition = {
 			}
 		};
 	},
-	view: (state) => ({
-		settledMs: state.settledMs,
-		...state.active === void 0 ? {} : { active: state.active }
-	}),
+	wire: {
+		viewSchema: projectionSchema,
+		view: (state) => ({
+			settledMs: state.settledMs,
+			...state.active === void 0 ? {} : { active: state.active }
+		})
+	},
 	stateVersion: 2
 };
-const identitySchema = z.discriminatedUnion("mode", [z.object({
+const identityValueSchema = z.discriminatedUnion("mode", [z.object({
 	mode: z.literal("one-shot"),
 	label: z.string().optional(),
-	seq: z.number().int().nonnegative()
+	seq: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).transform(SessionSeq)
 }).strict(), z.object({
 	mode: z.literal("continuable"),
 	label: z.string(),
-	seq: z.number().int().nonnegative()
-}).strict()]).nullable();
+	seq: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).transform(SessionSeq)
+}).strict()]);
+const identitySchema = identityValueSchema.nullable();
+const identityStateSchema = z.object({ identity: identityValueSchema.optional() }).strict();
 /** Interpret one `subagent/descriptor` event's identity; no value when the payload cannot be trusted. */
 function descriptorIdentity(event) {
 	let descriptor;
@@ -2023,14 +2358,17 @@ function descriptorIdentity(event) {
 */
 const subagentIdentityProjectionDefinition = {
 	key: "subagent",
-	schema: identitySchema,
+	stateSchema: identityStateSchema,
 	init: () => ({}),
 	apply: (state, event) => {
 		if (event.type !== "subagent/descriptor") return state;
 		const identity = descriptorIdentity(event);
 		return identity === void 0 ? {} : { identity };
 	},
-	view: (state) => state.identity ?? null,
+	wire: {
+		viewSchema: identitySchema,
+		view: (state) => state.identity ?? null
+	},
 	stateVersion: 2
 };
 //#endregion
@@ -2047,13 +2385,38 @@ const subagentIdentityProjectionDefinition = {
 *
 * @module @xneog/dsh-subagent/out-of-process
 */
+/** Maximum UTF-8 size of {@link SubagentResult.diagnostic}. */
+const MAX_SUBAGENT_DIAGNOSTIC_BYTES = 4096;
+const DIAGNOSTIC_TRUNCATION_SUFFIX = "\n[diagnostic truncated]";
+const utf8Encoder = new TextEncoder();
+const utf8Decoder = new TextDecoder();
+/**
+* Limit provider-authored failure detail without splitting a UTF-8 sequence.
+* @param diagnostic - safe diagnostic text produced by the provider.
+* @returns the original text, or a visibly truncated value within the limit.
+*/
+function limitSubagentDiagnostic(diagnostic) {
+	const bytes = utf8Encoder.encode(diagnostic);
+	if (bytes.byteLength <= MAX_SUBAGENT_DIAGNOSTIC_BYTES) return diagnostic;
+	let prefixBytes = MAX_SUBAGENT_DIAGNOSTIC_BYTES - utf8Encoder.encode(DIAGNOSTIC_TRUNCATION_SUFFIX).byteLength;
+	while ((bytes[prefixBytes] & 192) === 128) prefixBytes -= 1;
+	return utf8Decoder.decode(bytes.subarray(0, prefixBytes)) + DIAGNOSTIC_TRUNCATION_SUFFIX;
+}
+/** Enforce the byte limit on a provider-returned diagnostic. */
+function normalizeSubagentDiagnostic(result) {
+	return result.diagnostic === void 0 ? result : {
+		...result,
+		diagnostic: limitSubagentDiagnostic(result.diagnostic)
+	};
+}
 /**
 * The capability advertisement of an out-of-process backend: NONE. A child in
 * another process cannot honor parent-enforced start features
-* (`outputSchema`/`maxDepth`/`toolFilter`/`persona`), so the service rejects a
+* (`agentOptions`/`outputSchema`/`maxDepth`/`toolFilter`/`persona`), so the service rejects a
 * request needing any of them before `start` runs — never accepted-then-ignored.
 */
 const NO_START_CAPABILITIES = Object.freeze({
+	agentOptions: false,
 	outputSchema: false,
 	depthLimit: false,
 	toolFilter: false,
@@ -2141,7 +2504,8 @@ function toError(value) {
 * rejects after publication. A normally completed or rejected attempt resolves
 * as `aborted` when cancellation already settled locally; another rejection is
 * flattened to `stopReason: 'error'` through the contained diagnostic sink.
-* The abort listener is removed on every path.
+* Provider-returned diagnostics use the same byte limit. The abort listener is
+* removed on every path.
 * @param parts - the attempt, output snapshot, cancellation state, sink, and signal wiring.
 * @returns the terminal result (never a rejection).
 */
@@ -2151,7 +2515,7 @@ async function settleRunResult(parts) {
 		return parts.cancelled() ? {
 			output: parts.collectOutput(),
 			stopReason: "aborted"
-		} : result;
+		} : normalizeSubagentDiagnostic(result);
 	} catch (error) {
 		if (parts.cancelled()) return {
 			output: parts.collectOutput(),
@@ -2160,8 +2524,11 @@ async function settleRunResult(parts) {
 		try {
 			parts.onError?.(toError(error), "error");
 		} catch {}
+		const collected = parts.collectDiagnostic?.();
+		const diagnostic = collected === void 0 ? void 0 : limitSubagentDiagnostic(collected);
 		return {
 			output: parts.collectOutput(),
+			...diagnostic === void 0 ? {} : { diagnostic },
 			stopReason: "error"
 		};
 	} finally {
@@ -2204,9 +2571,16 @@ function subprocessRunHandle(parts) {
 function finalText(blocks) {
 	return blocks.filter((block) => block.type === "text").map((block) => block.text).join("");
 }
+/** Render a failed stop reason with optional provider-authored detail. */
+function failureDetail(result) {
+	const stopReason = result.stopReason;
+	return result.diagnostic === void 0 ? stopReason : `${stopReason}; diagnostic: ${result.diagnostic}`;
+}
 /**
-* Map a child result to the task outcome: completed carries final text,
-* aborted is killed, and every other reason is failed without partial output.
+* Map a child result to the task outcome: completed carries final text, local
+* cancellation (`aborted` without a diagnostic) is killed, and provider-
+* diagnosed remote aborts plus every other reason are failed without partial
+* output.
 * @param result - child terminal result.
 * @returns outcome for the `ctx.jobs` registration.
 */
@@ -2216,16 +2590,19 @@ function runOutcome(result) {
 			status: "completed",
 			output: finalText(result.output)
 		};
-		case "aborted": return { status: "killed" };
+		case "aborted": return result.diagnostic === void 0 ? { status: "killed" } : {
+			status: "failed",
+			detail: failureDetail(result)
+		};
 		case "error":
 		case "max-tokens":
 		case "refusal": return {
 			status: "failed",
-			detail: result.stopReason
+			detail: failureDetail(result)
 		};
 		default: return {
 			status: "failed",
-			detail: String(result.stopReason)
+			detail: failureDetail(result)
 		};
 	}
 }
@@ -2263,10 +2640,8 @@ async function settleRun(run) {
 * child before returning its run, so fulfillment is the single publication and
 * ownership-transfer boundary.
 *
-* Unlike the bash seam (one executor per context, second load throws), MULTIPLE
-* providers coexist here: each registers under a unique name and a caller picks
-* one by name. The shape mirrors the LLM adapter registry
-* (`LlmRuntime.registerAdapter`), not the single-service bash executor.
+* Multiple providers coexist: each registers under a unique name and callers
+* select one by name.
 *
 * This package owns the Service Definition role of the capability seam. Service Providers
 * (`@xneog/dsh-subagent-spawn-in-process`, `-fork`, `-acp`) and the model-facing
@@ -2274,8 +2649,8 @@ async function settleRun(run) {
 *
 * Public operations express caller intent: `start` returns one published owned
 * one-shot run, `startContinuable` establishes a durable continuable child, and
-* `followup` delivers later content without exposing whether the child is
-* resident. Continuable children never become a {@link SubagentRun}: the
+* `sendMessage` steers between adjacent Agents without exposing whether a child
+* is resident. Continuable children never become a {@link SubagentRun}: the
 * continuation manager holds their `AgentHandle` directly and orders every turn
 * through the child's own inbox, so providers contribute only the detached
 * creation spec and see no handle, turn, or teardown. Child and descendant
@@ -2289,284 +2664,465 @@ async function settleRun(run) {
 *
 * @module @xneog/dsh-subagent
 */
+var __runInitializers = function(thisArg, initializers, value) {
+	var useValue = arguments.length > 2;
+	for (var i = 0; i < initializers.length; i++) value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+	return useValue ? value : void 0;
+};
+var __esDecorate = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+	function accept(f) {
+		if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected");
+		return f;
+	}
+	var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+	var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+	var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+	var _, done = false;
+	for (var i = decorators.length - 1; i >= 0; i--) {
+		var context = {};
+		for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+		for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+		context.addInitializer = function(f) {
+			if (done) throw new TypeError("Cannot add initializers after decoration has completed");
+			extraInitializers.push(accept(f || null));
+		};
+		var result = (0, decorators[i])(kind === "accessor" ? {
+			get: descriptor.get,
+			set: descriptor.set
+		} : descriptor[key], context);
+		if (kind === "accessor") {
+			if (result === void 0) continue;
+			if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+			if (_ = accept(result.get)) descriptor.get = _;
+			if (_ = accept(result.set)) descriptor.set = _;
+			if (_ = accept(result.init)) initializers.unshift(_);
+		} else if (_ = accept(result)) if (kind === "field") initializers.unshift(_);
+		else descriptor[key] = _;
+	}
+	if (target) Object.defineProperty(target, contextIn.name, descriptor);
+	done = true;
+};
 /** Named provider registry with one-shot runs, durable discovery, and continuable-child operations. */
-var SubagentRuntime = class extends Service {
-	providers = /* @__PURE__ */ new Map();
-	continuations;
-	/** Deployment contributions composed into unpublished continuable children. */
-	setupRegistry = new SubagentActivationSetupRegistry();
-	/**
-	* The contained lifecycle-edge publisher. Built here because scoped dispatch
-	* keys its carrier by this exact service instance, whose own context filter
-	* composes into the carrier.
-	*/
-	emitLifecycle;
-	constructor(ctx) {
-		super(ctx, "subagents");
-		this.emitLifecycle = createLifecycleEmitter(this.ctx, (parent) => scopeTarget(this, parent));
-		ctx.inject(["agents"], (childCtx) => {
-			const manager = new SubagentContinuationManager(childCtx, {
-				prepareContinuable: (name, request) => this.prepareContinuable(name, request),
-				observeActivation: (provider, childId, parent) => this.observeActivation(provider, childId, parent)
-			}, this.setupRegistry);
-			this.continuations = manager;
-			childCtx.effect(() => () => {
-				/* v8 ignore else -- one injected binding owns the slot until its fiber disposes. */
-				if (this.continuations === manager) this.continuations = void 0;
-			}, "subagents.continuationBinding()");
-		});
-		ctx.inject(["sessionProjections"], (projectionCtx) => {
-			projectionCtx.sessionProjections.register(subagentTimingProjectionDefinition);
-			projectionCtx.sessionProjections.register(subagentIdentityProjectionDefinition);
-		});
-	}
-	/**
-	* Establish one durable continuable child and deliver its initial prompt.
-	* Resolves when the child's inbox accepts that prompt, without waiting for the
-	* turn to start or for the message to reach the Session log; any earlier
-	* failure rejects with no ids and rolls back the child entirely.
-	* @param spec - provider, delegation request, and caller cancellation.
-	* @returns the durable child id and the accepted prompt's message id.
-	* @throws when continuation services are unavailable or materialization fails.
-	*/
-	async startContinuable(spec) {
-		return this.requireContinuations().startContinuable(spec);
-	}
-	/**
-	* Deliver one later message to a continuable child as its next FIFO turn. A
-	* resident child's Agent inbox accepts it directly (waking a `waiting`
-	* Activation), while an absent one is cold-resumed from its persisted
-	* Session. The Agent inbox is the only queue, so every accepted message has
-	* one observable order.
-	* @param parent - the exact live direct parent authorizing this delivery.
-	* @param childId - durable child session id.
-	* @param content - user-role content to deliver.
-	* @param options - the message source fields and caller cancellation, which stops the
-	*   operation only before inbox acceptance.
-	* @returns the accepted message's inbox id.
-	* @throws when continuation services are unavailable, parent authority is
-	*   rejected, or the message was not admitted.
-	*/
-	async followup(parent, childId, content, options) {
-		return this.requireContinuations().followup(parent, childId, content, options);
-	}
-	/**
-	* Interrupt one live continuable child's current turn under a human parent
-	* address or an exact live ancestor Agent. Fire-and-return: the cancel
-	* signal is issued before this returns, but the target may keep running
-	* until it observes the signal. Unclaimed pending inbox work, the Activation,
-	* and published descendants are preserved; claimed work is not requeued.
-	* Once the interrupted driver is idle, a waking send resumes the parked FIFO
-	* queue. An absent target — including a one-shot or unknown id —
-	* is an accepted no-op, as is a manager-less composition, which cannot own a
-	* live Activation.
-	* @param targetSessionId - the durable child session id to interrupt.
-	* @param authority - the human parent address or exact live ancestor Agent.
-	* @throws {SubagentError} `UNAUTHORIZED` when the authority does not own the
-	*   live target.
-	*/
-	interrupt(targetSessionId, authority) {
-		this.continuations?.interrupt(targetSessionId, authority);
-	}
-	/**
-	* Deliver selected content from one live continuable child to its durable
-	* direct parent. The child is the authority credential; callers cannot name a
-	* recipient. Reporting does not conclude the child's turn or Activation.
-	* @param child - exact live reporting child.
-	* @param content - selected model-facing content.
-	* @param options - parent scheduling and pre-acceptance cancellation.
-	* @returns the stable identity of the parent-accepted message.
-	* @throws when continuation services are unavailable, sender authorization
-	*   fails, or the direct parent is not live.
-	*/
-	async reportFrom(child, content, options) {
-		return this.requireContinuations().reportFrom(child, content, options);
-	}
-	/**
-	* Compose one deployment capability into every continuable child's
-	* unpublished creation context on fresh creation and cold resume. Grants wait
-	* for the next Activation; removing the contribution revokes every resident
-	* installation immediately.
-	* @param contribution - synchronous child-scope installer.
-	* @returns the exact Cordis effect disposer.
-	*/
-	registerContinuableSetup(contribution) {
-		return this.ctx.effect(() => this.setupRegistry.register(contribution), "subagents.registerContinuableSetup()");
-	}
-	/**
-	* Close continuable admission below exact live parent Agents, stop only their
-	* visible descendant Activations synchronously, then await admitted scoped
-	* materializations and release those forests child-first. The scoped cutoff
-	* lasts until each exact parent leaves the registry; unrelated parent trees
-	* remain live.
-	* @param parents - exact host-owned parent Agents entering teardown.
-	* @returns once every retained descendant Activation released its `AgentHandle`.
-	* @throws an aggregate error after all branches settle when any failed.
-	*/
-	async drainContinuableDescendants(parents) {
-		const manager = this.continuations;
-		if (manager === void 0) return;
-		await manager.drainDescendants(parents);
-	}
-	/**
-	* Enumerate the parent's direct session-backed subagents without loading or
-	* resuming an Agent and without any query service: the listing merges the live
-	* session store with optional session persistence (live-preferred) and
-	* serves each child's durable mode/label from the registered `subagent`
-	* projection unit down a three-rung ladder — the registry's watermark
-	* snapshot for a live child; for a cold one, a durable projection-cache
-	* row when the optional cache serves an own-suffix identity (its `seq`
-	* gate proves the value postdates the fork seed, where a child's own
-	* descriptor is immutable once appended), else one persistence inspection
-	* folded through the registry. The
-	* projection fold is the single classification authority; per-child
-	* diagnostics relay a fold that served no identity or a failed inspection,
-	* never a list-time descriptor parse. Absent persistence, enumeration is
-	* live-only (a cold child cannot be resumed then either, so its absence is
-	* capability absence, not an error). This service consults no Agent
-	* registrations, Activations, or providers.
-	*
-	* Every persistence read receives `signal`, and the listing rechecks
-	* cancellation around each of those awaits. Read rejections that settle
-	* after an abort become a stable `SubagentError` with code `CANCELLED`.
-	* @param parentSessionId - parent session whose direct children are listed.
-	* @param signal - caller-owned cancellation forwarded to persistence reads
-	*   and observed around every read await.
-	* @returns children and per-child diagnostics ordered by `createdAt`, then id.
-	* @throws {@link SubagentError} when the projection registry or the session
-	*   store is not mounted, or the caller cancels the listing.
-	*/
-	listChildren(parentSessionId, signal) {
-		return listChildren(this.ctx, parentSessionId, signal);
-	}
-	/**
-	* Enumerate the root's complete session-backed subagent tree in stable
-	* pre-order from one live-preferred corpus, without loading or resuming an
-	* Agent. Ordinary sessions and one-shot children remain traversal nodes so
-	* continuable descendants below them are discovered; each returned entry
-	* adds its durable `parentId` and root-relative `depth`. Identity resolution,
-	* diagnostics, optional persistence, and cancellation follow the same
-	* projection-backed contract as {@link listChildren}.
-	* @param rootSessionId - session whose complete descendant tree is listed.
-	* @param signal - caller-owned cancellation forwarded to persistence reads
-	*   and observed around every read await.
-	* @returns children and per-candidate diagnostics with tree position, in
-	*   stable pre-order.
-	* @throws {@link SubagentError} under the same conditions as {@link listChildren}.
-	*/
-	listDescendants(rootSessionId, signal) {
-		return listDescendants(this.ctx, rootSessionId, signal);
-	}
-	/**
-	* Register a provider under its name. Registration is effect-scoped and HMR
-	* safe; removing a provider blocks new starts but does not revoke runs that
-	* were already returned to their holders.
-	* @param provider - the trusted provider implementation.
-	* @returns the exact Cordis effect disposer.
-	*/
-	registerProvider(provider) {
-		const name = provider.name;
-		return this.ctx.effect(function* () {
-			if (this.providers.has(name)) throw new SubagentError(`a subagent provider named "${name}" is already registered`, "DUPLICATE_PROVIDER");
-			this.providers.set(name, provider);
-			yield () => {
-				this.providers.delete(name);
-				this.emitLifecycle("subagent/provider-removed", name);
+let SubagentRuntime = (() => {
+	let _classSuper = TypertRemoteService;
+	let _instanceExtraInitializers = [];
+	let _remoteExportList_decorators;
+	let _prompt_decorators;
+	let _interruptByParent_decorators;
+	return class SubagentRuntime extends _classSuper {
+		static {
+			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+			_remoteExportList_decorators = [Remote("list")];
+			_prompt_decorators = [Remote("prompt")];
+			_interruptByParent_decorators = [Remote("interruptByParent")];
+			__esDecorate(this, null, _remoteExportList_decorators, {
+				kind: "method",
+				name: "remoteExportList",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "remoteExportList" in obj,
+					get: (obj) => obj.remoteExportList
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _prompt_decorators, {
+				kind: "method",
+				name: "prompt",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "prompt" in obj,
+					get: (obj) => obj.prompt
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _interruptByParent_decorators, {
+				kind: "method",
+				name: "interruptByParent",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "interruptByParent" in obj,
+					get: (obj) => obj.interruptByParent
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			if (_metadata) Object.defineProperty(this, Symbol.metadata, {
+				enumerable: true,
+				configurable: true,
+				writable: true,
+				value: _metadata
+			});
+		}
+		providers = (__runInitializers(this, _instanceExtraInitializers), /* @__PURE__ */ new Map());
+		continuations;
+		/**
+		* The contained lifecycle-edge publisher. Built here because scoped dispatch
+		* keys its carrier by this exact service instance, whose own context filter
+		* composes into the carrier.
+		*/
+		emitLifecycle;
+		constructor(ctx) {
+			super(ctx, "subagents");
+			this.emitLifecycle = createLifecycleEmitter(this.ctx, (parent) => scopeTarget(this, parent));
+			ctx.inject(["agents"], (childCtx) => {
+				const manager = new SubagentContinuationManager(childCtx, {
+					prepareContinuable: (name, request) => this.prepareContinuable(name, request),
+					observeActivation: (provider, childId, parent) => this.observeActivation(provider, childId, parent)
+				});
+				this.continuations = manager;
+				childCtx.effect(() => () => {
+					/* v8 ignore else -- one injected binding owns the slot until its fiber disposes. */
+					if (this.continuations === manager) this.continuations = void 0;
+				}, "subagents.continuationBinding()");
+			});
+			ctx.inject(["sessionProjections"], (projectionCtx) => {
+				projectionCtx.sessionProjections.register(subagentTimingProjectionDefinition);
+				projectionCtx.sessionProjections.register(subagentIdentityProjectionDefinition);
+			});
+		}
+		/**
+		* Establish one durable continuable child and deliver its initial prompt.
+		* Resolves when the child's inbox accepts that prompt, without waiting for the
+		* turn to start or for the message to reach the Session log; any earlier
+		* failure rejects with no ids and rolls back the child entirely.
+		* @param spec - provider, delegation request, and caller cancellation.
+		* @returns the durable child id and the accepted prompt's message id.
+		* @throws when continuation services are unavailable or materialization fails.
+		*/
+		async startContinuable(spec) {
+			return this.requireContinuations().startContinuable(spec);
+		}
+		/**
+		* Steer one model-authored message to the sender's direct parent or direct
+		* continuable child. A running target admits it at the nearest step boundary;
+		* an idle target starts a turn, and an absent direct child cold-resumes from
+		* persistence. The service derives durable sender attribution from the exact
+		* live sender. Caller cancellation stops only pre-acceptance work.
+		* @param sender - exact live Agent authorizing and originating the message.
+		* @param targetId - durable direct-parent or direct-child session id.
+		* @param content - model-authored content to deliver.
+		* @param options - caller cancellation before inbox acceptance.
+		* @returns the accepted message's inbox id.
+		* @throws when continuation services are unavailable, adjacency is rejected,
+		*   or the message was not admitted.
+		*/
+		async sendMessage(sender, targetId, content, options) {
+			return this.requireContinuations().sendMessage(sender, targetId, content, options);
+		}
+		/**
+		* Deliver one host-protocol message to a direct continuable child.
+		* Symbol-keyed so host adapters can preserve their own provenance without
+		* widening the public Service Definition or impersonating an Agent sender.
+		* @param parent - exact live direct parent authorizing delivery.
+		* @param childId - durable direct-child session id.
+		* @param content - host-authored content to deliver.
+		* @param source - durable host-protocol provenance.
+		* @param signal - caller cancellation before inbox acceptance.
+		* @param delivery - Queue as a distinct turn or Steer at the nearest step.
+		* @returns the accepted message's inbox id.
+		*/
+		[deliverSubagentPrompt](parent, childId, content, source, signal, delivery) {
+			return delivery === "steer" ? this.requireContinuations().steerPrompt(parent, childId, content, source, signal) : this.requireContinuations().queuePrompt(parent, childId, content, source, signal);
+		}
+		/**
+		* Interrupt one live continuable child's current turn under a human parent
+		* address or an exact live ancestor Agent. Fire-and-return: the cancel
+		* signal is issued before this returns, but the target may keep running
+		* until it observes the signal. Unclaimed pending inbox work, the Activation,
+		* and published descendants are preserved; claimed work is not requeued.
+		* Once the interrupted driver is idle, a waking send resumes the parked FIFO
+		* queue. An absent target — including a one-shot or unknown id —
+		* is an accepted no-op, as is a manager-less composition, which cannot own a
+		* live Activation.
+		* @param targetSessionId - the durable child session id to interrupt.
+		* @param authority - the human parent address or exact live ancestor Agent.
+		* @throws {SubagentError} `UNAUTHORIZED` when the authority does not own the
+		*   live target.
+		*/
+		interrupt(targetSessionId, authority) {
+			this.continuations?.interrupt(targetSessionId, authority);
+		}
+		/**
+		* Close continuable admission below exact live parent Agents, stop only their
+		* visible descendant Activations synchronously, then await admitted scoped
+		* materializations and release those forests child-first. The scoped cutoff
+		* lasts until each exact parent leaves the registry; unrelated parent trees
+		* remain live.
+		* @param parents - exact host-owned parent Agents entering teardown.
+		* @returns once every retained descendant Activation released its `AgentHandle`.
+		* @throws an aggregate error after all branches settle when any failed.
+		*/
+		async drainContinuableDescendants(parents) {
+			const manager = this.continuations;
+			if (manager === void 0) return;
+			await manager.drainDescendants(parents);
+		}
+		/**
+		* Release selected resident continuable direct children of one exact live
+		* parent. Other children of the same parent remain admitted and resident.
+		* Absent targets and a manager-less composition are accepted no-ops.
+		* @param parent - exact live direct parent authorizing the selected release.
+		* @param childIds - durable direct-child ids to release when resident.
+		* @returns once every selected Activation released its `AgentHandle`.
+		* @throws {SubagentError} `UNAUTHORIZED` when a resident target belongs to a
+		*   different parent or the supplied parent identity is stale.
+		*/
+		async drainContinuableChildren(parent, childIds) {
+			const manager = this.continuations;
+			if (manager === void 0) return;
+			await manager.drainChildren(parent, childIds);
+		}
+		/**
+		* Enumerate the parent's direct session-backed subagents without loading or
+		* resuming an Agent. The Session query service supplies one live-preferred
+		* corpus and shared point observations; the projection cache supplies
+		* immutable descriptor hits without opening cold logs. The registered
+		* `subagent` projection remains the sole mode/label classifier.
+		*
+		* Every query receives `signal`, and the listing rechecks cancellation
+		* around each await. Read rejections that settle
+		* after an abort become a stable `SubagentError` with code `CANCELLED`.
+		* @param parentSessionId - parent session whose direct children are listed.
+		* @param signal - caller-owned cancellation forwarded to Session queries
+		*   and observed around every read await.
+		* @returns children and per-child diagnostics ordered by `createdAt`, then id.
+		* @throws {@link SubagentError} when the projection registry or the session
+		*   store is not mounted, or the caller cancels the listing.
+		*/
+		listChildren(parentSessionId, signal) {
+			return listChildren(this.ctx, parentSessionId, signal);
+		}
+		/**
+		* Enumerate the root's complete session-backed subagent tree in stable
+		* pre-order from one live-preferred corpus, without loading or resuming an
+		* Agent. Ordinary sessions and one-shot children remain traversal nodes so
+		* continuable descendants below them are discovered; each returned entry
+		* adds its durable `parentId` and root-relative `depth`. Identity resolution,
+		* diagnostics, optional persistence, and cancellation follow the same
+		* projection-backed contract as {@link listChildren}.
+		* @param rootSessionId - session whose complete descendant tree is listed.
+		* @param signal - caller-owned cancellation forwarded to persistence reads
+		*   and observed around every read await.
+		* @returns children and per-candidate diagnostics with tree position, in
+		*   stable pre-order.
+		* @throws {@link SubagentError} under the same conditions as {@link listChildren}.
+		*/
+		listDescendants(rootSessionId, signal) {
+			return listDescendants(this.ctx, rootSessionId, signal);
+		}
+		/**
+		* Remote face of {@link listChildren} for one browser: the durable listing
+		* plus live Agent activity and the delivery-time parent availability hint.
+		* Parent availability is a hint; {@link prompt} performs the authoritative
+		* check. Named apart from the provider-name {@link list}, which owns the
+		* member.
+		* @param parentSessionId - parent session whose direct children are listed.
+		* @param signal - carrier cancellation forwarded to Session queries.
+		* @returns the catalog view for that parent.
+		* @throws {RemoteError} `gateway/bad-request` for an empty parent id,
+		*   `gateway/cancelled` for an aborted read, `subagent/projections-unavailable` when
+		*   the deployment has no projection registry, otherwise `gateway/internal`.
+		*/
+		async remoteExportList(parentSessionId, signal) {
+			validateControlRequest("subagent.list", { parentSessionId });
+			try {
+				return catalogView(this.ctx, parentSessionId, await this.listChildren(parentSessionId, signal));
+			} catch (error) {
+				return rejectCatalogRead(error, signal);
+			}
+		}
+		/**
+		* Deliver one browser-authored message to a continuable child through the
+		* exact live direct parent, retaining the caller-minted request identity and
+		* validated browser zone on the accepted message. Success identifies the
+		* message the child's FIFO inbox accepted; later execution is independent of
+		* this call.
+		* Image parts are admitted and persisted through the attachment store
+		* before delivery, and the child's model must accept image input.
+		* @param request - durable address, minted identity, content, and optional browser zone.
+		* @param signal - carrier cancellation, owning the call until inbox acceptance.
+		* @returns the accepted message's inbox identity.
+		* @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-invalid`,
+		*   `subagent/invalid-time-zone`, `subagent/parent-unavailable`,
+		*   `subagent/not-resumable`, `subagent/unauthorized`,
+		*   `subagent/delivery-unavailable`, `gateway/cancelled`, or `gateway/internal`.
+		*/
+		async prompt(request, signal) {
+			const { parentSessionId, childSessionId, clientTimeZone } = request;
+			validateControlRequest("subagent.prompt", request);
+			const canonicalTimeZone = clientTimeZone === void 0 ? void 0 : canonicalClientTimeZone(clientTimeZone);
+			if (clientTimeZone !== void 0 && canonicalTimeZone === void 0) throw new RemoteError("subagent/invalid-time-zone", "clientTimeZone must be UTC or a valid IANA Area/Location name", { value: clientTimeZone });
+			const parent = this.ctx.get("agents")?.get(parentSessionId);
+			if (parent === void 0) throw new RemoteError("subagent/parent-unavailable", `parent session "${parentSessionId}" is not live`, { parentSessionId });
+			const source = {
+				kind: "user",
+				rpcId: request.requestId,
+				...canonicalTimeZone === void 0 ? {} : { clientTimeZone: canonicalTimeZone }
 			};
-			this.ctx.emit("subagent/provider-added", provider);
-		}.bind(this), "subagents.registerProvider()");
-	}
-	/**
-	* Look up a provider by name.
-	* @param name - the provider name.
-	* @returns the provider, or undefined when absent.
-	*/
-	getProvider(name) {
-		return this.providers.get(name);
-	}
-	/**
-	* List registered provider names in insertion order.
-	* @returns the registered names.
-	*/
-	list() {
-		return [...this.providers.keys()];
-	}
-	/**
-	* Establish a published child on the named provider. Capability and semantic
-	* checks run before delegation. Provider ownership lasts until its promise
-	* fulfills; a rejection therefore has no run for the caller to dispose and
-	* emits no run lifecycle events. Post-publication turn and infrastructure
-	* failures settle through the returned run.
-	* @param name - the provider to use.
-	* @param request - child label, prompt, parent, signal, and optional capabilities.
-	* @returns the published holder-owned run.
-	*/
-	async start(name, request) {
-		const provider = this.expectProvider(name);
-		this.assertCapabilities(provider, request);
-		assertSubagentMaxDepth(request.maxDepth);
-		if (request.outputSchema !== void 0) assertObjectJsonSchema(request.outputSchema);
-		const descriptor = snapshotSubagentDescriptor({
-			mode: "one-shot",
-			provider: name,
-			...request.label !== void 0 ? { label: request.label } : {}
-		});
-		const resolved = {
-			...request,
-			descriptor
-		};
-		return observeRun(this.emitLifecycle, name, request.parent, await provider.start(resolved));
-	}
-	/**
-	* Resolve one provider's detached continuable-creation contribution. Method
-	* presence on the provider IS the capability, so a provider without it is
-	* rejected before the manager reserves any child resources.
-	*/
-	async prepareContinuable(name, request) {
-		const provider = this.expectProvider(name);
-		if (provider.prepareContinuable === void 0) throw new SubagentError(`subagent provider "${provider.name}" does not support continuable children (no prepareContinuable capability)`, "UNSUPPORTED_CAPABILITY");
-		return provider.prepareContinuable(request);
-	}
-	/** Look up a provider for dispatch or fail loud. */
-	expectProvider(name) {
-		const provider = this.providers.get(name);
-		if (provider === void 0) throw new SubagentError(`no subagent provider registered for "${name}"`, "NO_PROVIDER");
-		return provider;
-	}
-	/** Resolve the optional continuable-subagent manager or fail loud. */
-	requireContinuations() {
-		if (this.continuations === void 0) throw new SubagentError("continuable subagents require the agents service", "CONTINUATION_UNAVAILABLE");
-		return this.continuations;
-	}
-	/**
-	* Build the lifecycle observer for one continuable Activation's residency
-	* epoch, so the manager publishes its edges without owning event dispatch.
-	*/
-	observeActivation(provider, childId, parent) {
-		return createActivationObserver(this.emitLifecycle, provider, childId, parent);
-	}
-	/** Reject the first requested capability that the provider lacks. */
-	assertCapabilities(provider, request) {
-		const needs = [
-			{
-				when: request.outputSchema !== void 0,
-				cap: "outputSchema"
-			},
-			{
-				when: request.maxDepth !== void 0,
-				cap: "depthLimit"
-			},
-			{
-				when: request.toolFilter !== void 0,
-				cap: "toolFilter"
-			},
-			{
-				when: request.persona !== void 0,
-				cap: "persona"
+			try {
+				let content;
+				if (request.content.every((part) => part.type === "text")) content = request.content.map((part) => ({
+					type: "text",
+					text: part.text
+				}));
+				else {
+					const attachments = this.ctx.get("attachments");
+					if (attachments === void 0) throw new Error("subagent image prompt requires an attachment store");
+					content = await admitPromptContent(attachments, request.content);
+				}
+				return { messageId: await this[deliverSubagentPrompt](parent, childSessionId, content, source, signal, "queue") };
+			} catch (error) {
+				return rejectPrompt(error, childSessionId, signal);
 			}
-		];
-		for (const { when, cap } of needs) if (when && !provider.capabilities[cap]) throw new SubagentError(`subagent provider "${provider.name}" does not support the "${cap}" capability`, "UNSUPPORTED_CAPABILITY");
-	}
-};
+		}
+		/**
+		* Remote face of {@link interrupt} under one durable parent address. No
+		* catalog, history, persistence, or parent Agent lookup runs: the core
+		* primitive alone authorizes the address against the live Activation, which
+		* is what keeps a live child interruptible while its parent Agent is offline.
+		* Absent, idle, and already-completed targets are accepted no-ops there.
+		* @param childSessionId - durable child session id to interrupt.
+		* @param parentSessionId - durable direct parent whose authority is claimed.
+		* @param mode - required continuable-address discriminator.
+		* @returns acknowledgement that the cancel signal was admitted, not that the target is quiescent.
+		* @throws {RemoteError} `gateway/bad-request` for an empty id,
+		*   `subagent/unauthorized` when the address does not own the live target,
+		*   otherwise `gateway/internal`.
+		*/
+		interruptByParent(childSessionId, parentSessionId, mode) {
+			validateControlRequest("subagent.interrupt", {
+				childSessionId,
+				parentSessionId,
+				mode
+			});
+			try {
+				this.interrupt(childSessionId, {
+					kind: "user",
+					parentSessionId
+				});
+			} catch (error) {
+				if (error instanceof SubagentError && error.code === "UNAUTHORIZED") throw new RemoteError("subagent/unauthorized", "subagent does not belong to this parent", { childSessionId }, { cause: error });
+				throw new RemoteError("gateway/internal", "subagent interrupt failed", {}, { cause: error });
+			}
+			return { accepted: true };
+		}
+		/**
+		* Register a provider under its name. Registration is effect-scoped and HMR
+		* safe; removing a provider blocks new starts but does not revoke runs that
+		* were already returned to their holders.
+		* @param provider - the trusted provider implementation.
+		* @returns the exact Cordis effect disposer.
+		*/
+		registerProvider(provider) {
+			const name = provider.name;
+			return this.ctx.effect(function* () {
+				if (this.providers.has(name)) throw new SubagentError(`a subagent provider named "${name}" is already registered`, "DUPLICATE_PROVIDER");
+				this.providers.set(name, provider);
+				yield () => {
+					this.providers.delete(name);
+					this.emitLifecycle("subagent/provider-removed", name);
+				};
+				this.ctx.emit("subagent/provider-added", provider);
+			}.bind(this), "subagents.registerProvider()");
+		}
+		/**
+		* Look up a provider by name.
+		* @param name - the provider name.
+		* @returns the provider, or undefined when absent.
+		*/
+		getProvider(name) {
+			return this.providers.get(name);
+		}
+		/**
+		* List registered provider names in insertion order.
+		* @returns the registered names.
+		*/
+		list() {
+			return [...this.providers.keys()];
+		}
+		/**
+		* Establish a published child on the named provider. Capability and semantic
+		* checks run before delegation. Provider ownership lasts until its promise
+		* fulfills; a rejection therefore has no run for the caller to dispose and
+		* emits no run lifecycle events. Post-publication turn and infrastructure
+		* failures settle through the returned run.
+		* @param name - the provider to use.
+		* @param request - child label, prompt, parent, signal, and optional capabilities.
+		* @returns the published holder-owned run.
+		*/
+		async start(name, request) {
+			const provider = this.expectProvider(name);
+			this.assertCapabilities(provider, request);
+			assertSubagentMaxDepth(request.maxDepth);
+			if (request.outputSchema !== void 0) assertObjectJsonSchema(request.outputSchema);
+			const descriptor = snapshotSubagentDescriptor({
+				mode: "one-shot",
+				provider: name,
+				...request.label !== void 0 ? { label: request.label } : {}
+			});
+			const resolved = {
+				...request,
+				descriptor
+			};
+			return observeRun(this.emitLifecycle, name, request.parent, await provider.start(resolved));
+		}
+		/**
+		* Resolve one provider's detached continuable-creation contribution. Method
+		* presence on the provider IS the capability, so a provider without it is
+		* rejected before the manager reserves any child resources.
+		*/
+		async prepareContinuable(name, request) {
+			const provider = this.expectProvider(name);
+			if (provider.prepareContinuable === void 0) throw new SubagentError(`subagent provider "${provider.name}" does not support continuable children (no prepareContinuable capability)`, "UNSUPPORTED_CAPABILITY");
+			return provider.prepareContinuable(request);
+		}
+		/** Look up a provider for dispatch or fail loud. */
+		expectProvider(name) {
+			const provider = this.providers.get(name);
+			if (provider === void 0) throw new SubagentError(`no subagent provider registered for "${name}"`, "NO_PROVIDER");
+			return provider;
+		}
+		/** Resolve the optional continuable-subagent manager or fail loud. */
+		requireContinuations() {
+			if (this.continuations === void 0) throw new SubagentError("continuable subagents require the agents service", "CONTINUATION_UNAVAILABLE");
+			return this.continuations;
+		}
+		/**
+		* Build the lifecycle observer for one continuable Activation's residency
+		* epoch, so the manager publishes its edges without owning event dispatch.
+		*/
+		observeActivation(provider, childId, parent) {
+			return createActivationObserver(this.emitLifecycle, provider, childId, parent);
+		}
+		/** Reject the first requested capability that the provider lacks. */
+		assertCapabilities(provider, request) {
+			const needs = [
+				{
+					when: request.agentOptions !== void 0,
+					cap: "agentOptions"
+				},
+				{
+					when: request.outputSchema !== void 0,
+					cap: "outputSchema"
+				},
+				{
+					when: request.maxDepth !== void 0,
+					cap: "depthLimit"
+				},
+				{
+					when: request.toolFilter !== void 0,
+					cap: "toolFilter"
+				},
+				{
+					when: request.persona !== void 0,
+					cap: "persona"
+				}
+			];
+			for (const { when, cap } of needs) if (when && !provider.capabilities[cap]) throw new SubagentError(`subagent provider "${provider.name}" does not support the "${cap}" capability`, "UNSUPPORTED_CAPABILITY");
+		}
+	};
+})();
 //#endregion
-export { AssistantOutputFold, NO_START_CAPABILITIES, SUBAGENT_DESCRIPTOR_VERSION, SubagentDepthError, SubagentError, SubagentRunId, SubagentRuntime, SubagentRuntime as default, appendDelegatedPolicyOverrides, applyChildComposition, assertPositiveFinite, assertSubagentMaxDepth, assertUsableCwd, captureDelegatedPolicyOverrides, childSessionMeta, delegationDepthOf, finalAssistantOutput, foldSubagentDescriptor, resolveChildAgentOptions, resolveChildCwd, resolveChildDepth, seedDescriptorTurn, settleRun, settleRunResult, snapshotSubagentDescriptor, subprocessRunHandle, validateConfiguredCwd };
+export { AssistantOutputFold, NO_START_CAPABILITIES, SUBAGENT_DESCRIPTOR_VERSION, SubagentDepthError, SubagentError, SubagentRunId, SubagentRuntime, SubagentRuntime as default, appendDelegatedPolicyOverrides, applyChildComposition, assertPositiveFinite, assertSubagentMaxDepth, assertUsableCwd, captureDelegatedPolicyOverrides, childSessionMeta, delegationDepthOf, finalAssistantOutput, foldSubagentDescriptor, parentAgentOptionsForDelegation, resolveChildAgentOptions, resolveChildCwd, resolveChildDepth, seedDescriptorTurn, settleRun, settleRunResult, snapshotSubagentDescriptor, subprocessRunHandle, validateConfiguredCwd };