flowviant 0.125.6 → 0.125.9

package/bin/lib/runTurn.mjs

@@ -11,6 +11,8 @@
  */
 
 import { promptTransport } from './promptTransport.mjs';
+import { prepareResearchLaunch } from './researchHandoff.mjs';
+import { runResearchWithReceipt } from './researchRestoration.mjs';
 import { runIsolatedResearch } from './codexResearch.mjs';
 import { spawn } from 'node:child_process';
 import { runtimeById } from './runtimes.mjs';
@@ -21,7 +23,8 @@ import { never, workLanesStopped } from './standDownGate.mjs';
 import { learnCodexLimits, recordClaudeRateLimit } from './runtimeLimits.mjs';
 import { initHarvestFor, recordMcpServers, recordSkills } from './runtimeCapabilities.mjs';
 import { codexTurnModel } from './turnModel.mjs';
-import { printableText } from './printable.mjs';
+import { createTurnOutput } from './turnOutput.mjs';
+import { createObservedLines } from './observedLines.mjs';
 import { startTurnDiagnostics } from './turnDiagnostics.mjs';
 import { createClaudeInput } from './claudeInput.mjs';
 import { measuredRuntimeVersion } from './runtimeDetection.mjs';
@@ -29,6 +32,8 @@ import { createTurnSubagents } from './turnSubagents.mjs';
 
 /** How long a Codex turn's answer may wait on its rollout's model line. */
 const CODEX_MODEL_READ_MS = 1_500;
+/** How long an exited CLI's turn waits for its streams to close (see the `exit` handler). */
+export const EXIT_CLOSE_GRACE_MS = 2_000;
 
 /**
  * THE ENVIRONMENT A CLI TURN IS SPAWNED WITH — the daemon's own, plus the
@@ -61,23 +66,29 @@ export function cliEnv(mcpEnv, { display = false, browserHome = null } = {}) {
 }
 
 // One CLI turn. Output is captured (for sentinel detection) and streamed
-// through, line-prefixed with the worker label so a fleet stays legible.
+// through as complete timestamped records carrying work and turn identity.
 //
 // The event stream is parsed, always: only the humanized tool activity reaches
 // the console (a legible stream of `read …`, `grep …`, `+ node …`), assistant
 // text is folded into the returned string for sentinel detection, and each
 // activity is handed to `onActivity` so the caller can forward progress.
+/** Linux's per-argument ceiling (`MAX_ARG_STRLEN`, 32 pages): one argv
+ *  string past it is refused at launch with E2BIG. */
+const MAX_ARG_BYTES = 128 * 1024;
+
 export function runTurn(opts) {
   // A Codex write-up runs over an isolated copy of its worktree
   // (codexResearch.mjs). After the teardown it copies nothing either: the
   // stand-down gate below is asked before the copy, not only before the spawn.
   if (opts.runtime === 'codex' && opts.profile === 'research')
-    return workLanesStopped() ? never() : runIsolatedResearch(opts, runPlainTurn);
+    return workLanesStopped() ? never() : runIsolatedResearch(opts, prepared => runResearchWithReceipt(prepared, runPlainTurn));
+  if (opts.profile === 'research' && opts.researchHandoff)
+    return prepareResearchLaunch(opts).then(prepared => runResearchWithReceipt(prepared, runPlainTurn));
   return runPlainTurn(opts);
 }
 
 function runPlainTurn(opts) {
-  const { prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, agentTools, runtime = 'claude', label, onSpawn, answerFromResult, onActivity, onToolEvent, onInit, onUsage, onRateLimit, onModel, onThreadId, onAnswer, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId, display, browserHome } = opts;
+  const { prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, agentTools, runtime = 'claude', onSpawn, answerFromResult, onActivity, onToolEvent: callerOnToolEvent, onInit, onUsage, onRateLimit, onModel, onThreadId, onAnswer, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId, display, browserHome } = opts;
   /**
    * AFTER THE TEARDOWN, NO TURN STARTS AND NO TURN ENDS (standDownGate.mjs).
    * A stand-down that drains a deploy keeps this process alive; without this
@@ -86,11 +97,19 @@ function runPlainTurn(opts) {
    * Both answers stay pending instead, as `process.exit` left them.
    */
   if (workLanesStopped()) return never();
+  const output = createTurnOutput(opts);
+  const emit = output.emit;
+  const onToolEvent = (name, input, meta, observedAt) => {
+    output.tool(name, input, meta, observedAt);
+    callerOnToolEvent?.(name, input, meta);
+  };
   return new Promise((resolveTurn, rejectTurn) => {
     const resolve = (v) => {
+      output.close();
       if (!workLanesStopped()) resolveTurn(v);
     };
     const reject = (error) => {
+      output.close();
       if (!workLanesStopped()) rejectTurn(error);
     };
     const rt = runtimeById(runtime);
@@ -101,7 +120,7 @@ function runPlainTurn(opts) {
     // lane's `unsupported` check). Here the daemon log names the id and the
     // turn answers nothing — never Claude wearing the other runtime's name.
     if (!rt) {
-      console.error(`\nerror: cannot run '${runtime}' — this daemon does not know that runtime; update flowviant`);
+      output.error(`error: cannot run '${runtime}' — this daemon does not know that runtime; update flowviant`);
       resolve('');
       return;
     }
@@ -112,7 +131,7 @@ function runPlainTurn(opts) {
      */
     const turnProfile = resolveTurnProfile(opts);
     if (turnProfile.error) {
-      console.error(`\nerror: ${turnProfile.error}`);
+      output.error(`error: ${turnProfile.error}`);
       resolve('');
       return;
     }
@@ -127,7 +146,7 @@ function runPlainTurn(opts) {
     // adapter learns to express one this opens by itself.
     const offRuntime = turnProfile.onlyOn?.(rt);
     if (offRuntime) {
-      console.error(`\nerror: ${offRuntime}`);
+      output.error(`error: ${offRuntime}`);
       resolve('');
       return;
     }
@@ -136,7 +155,7 @@ function runPlainTurn(opts) {
       // drive. Fail as a turn with no sentinel — the loop already treats that as
       // "the protocol did not complete" and retries, rather than inventing a
       // completion for work that never started.
-      console.error(`\nerror: cannot run '${rt.label}' — ${rt.blocked}`);
+      output.error(`error: cannot run '${rt.label}' — ${rt.blocked}`);
       resolve('');
       return;
     }
@@ -181,6 +200,7 @@ function runPlainTurn(opts) {
       // The lane's own measurement when it decided to orchestrate, so the
       // hooks and the controller cannot disagree (workAgentTurnExecution.mjs).
       codexVersion: opts.codexVersion ?? measuredRuntimeVersion('codex')?.version,
+      claudeVersion: opts.claudeVersion ?? measuredRuntimeVersion('claude')?.version ?? null,
 
       streamInput: stdinText !== null || (rt.liveInput === true && Boolean(opts.liveMessages)),
       writableDirs: opts.writableDirs,
@@ -346,34 +366,33 @@ function runPlainTurn(opts) {
       // own browser home.
       releaseArgs();
       browser?.cleanup();
+      // THE COMMAND LINE'S OWN LIMIT, IN WORDS (2026-10-19). A runtime whose
+      // prompt still rides argv (Antigravity's `-p`) hits the OS's per-argument
+      // ceiling on a long message, and the turn failed as "spawn E2BIG". The
+      // refusal is the system's and stays; only its words are new.
+      // Said only when the message IS the oversized argument: E2BIG also
+      // answers an environment too large for the launch, which is not the
+      // person's message and keeps the system's own words.
+      const carrying = error?.code === 'E2BIG' && typeof prompt === 'string' && prompt
+        ? args.find((a) => typeof a === 'string' && a.includes(prompt))
+        : undefined;
+      const bytes = carrying ? Buffer.byteLength(carrying) : 0;
+      if (bytes > MAX_ARG_BYTES) {
+        throw Object.assign(new Error(`${rt.label} takes its message on the command line, and this one is too long for it (${Math.ceil(bytes / 1024)} KB; the system allows ${MAX_ARG_BYTES / 1024} KB per argument, E2BIG). Send it in shorter parts, or attach the long text as a file.`), { code: 'E2BIG' });
+      }
       throw error;
     }
     if (browser) {
       child.once('close', browser.cleanup);
       child.once('error', browser.cleanup);
     }
-    if (child.pid) onSpawn?.(child);
+    if (child.pid) { output.event(`${rt.label} started`, 'start'); onSpawn?.(child); }
     // When this turn began, for the Codex rollout read: a `turn_context` older
     // than this is a previous turn's (turnModel.mjs).
     const spawnedAt = Date.now();
     let out = '';
     let stdinError = null;
-    const input = rt.liveInput === true && opts.liveMessages ? createClaudeInput(child, { onTaken: opts.liveMessages.onTaken }) : null;
-    const pfx = label ? `${label} ` : '';
-    /**
-     * THE ONE SINK FOR WHAT A CLI OR A MODEL WROTE (2026-10-10, the audit's
-     * F133): activity labels — a Bash command, a Codex `say`, a file path —
-     * and the CLI's raw stderr. A prompt-injected agent can put an OSC 52 in
-     * a tool command as easily as in prose, and this wrote it to the
-     * operator's terminal as-is. Scrubbed HERE, before the daemon's own
-     * coloured `label` is added, so the prefix keeps its colour and nothing
-     * the model wrote keeps an escape sequence (printable.mjs, `printableText`).
-     */
-    const emit = (s) => {
-      const text = printableText(String(s));
-      process.stdout.write(pfx ? text.replace(/\n/g, `\n${pfx}`) : text);
-    };
-
+    const input = rt.liveInput === true && opts.liveMessages ? createClaudeInput(child, { onTaken: opts.liveMessages.onTaken, onContext: opts.onContext ?? null }) : null;
     // EVERY TURN IS LINE-PARSED (2026-10-10, the audit). Claude's adapter
     // always asks for `--output-format stream-json` and every other runtime
     // brings its own `parse` — for Codex the JSONL stream is the only output
@@ -382,7 +401,6 @@ function runPlainTurn(opts) {
     // already drifted once (it called process.exit(1)); both are gone. A line
     // that is not JSON is still kept as text (claudeStream.mjs), and stderr
     // still lands in the haystack the sentinels read.
-    let buf = '';
     const appendText = (t) => {
       out += t;
     };
@@ -400,13 +418,15 @@ function runPlainTurn(opts) {
      * waits on a file read. See runtimeLimits.mjs.
      */
     const onRate = (info) => {
+      if (info?.status === 'rejected' || info?.status === 'allowed_warning')
+        output.event(`${rt.label} plan limit: ${info.status}${typeof info.rateLimitType === 'string' ? ` (${info.rateLimitType})` : ''}`, 'limit');
       recordClaudeRateLimit(info);
       onRateLimit?.(info);
     };
     // The native children this CLI starts, observed (turnSubagents.mjs).
     const natives = createTurnSubagents({ runtime: rt.id, cwd, since: spawnedAt, env: { ...process.env, ...(mcpEnv ?? {}) },
       owned: opts.orchestration === true, onSubagent: opts.onSubagent, onSpawnResult: opts.onSpawnResult, resumeThreadId,
-      sinks: { emit, onActivity, onToolEvent, appendText } });
+      sinks: { emit, onActivity, onToolEvent, appendText, onDetail: output.detail } });
     let codexThread = rt.id === 'codex' && typeof resumeThreadId === 'string' ? resumeThreadId : null;
     /**
      * THE MODEL THIS SPAWN RAN ON, ONCE (2026-09-29, turnModel.mjs). Claude
@@ -436,12 +456,17 @@ function runPlainTurn(opts) {
       if (harvest.mcp) recordMcpServers(i?.mcpServers, i?.tools);
       onInit?.(i);
     };
+    /** This turn's Claude task list, as the plan card reads it (claudeStream.mjs). */
+    const taskPlan = new Map();
     /** One line of the child's stdout, in whichever dialect it speaks. */
     let cliFailed = false;
-    const onLine = (line) => {
+    const onLine = (line, observedAt) => {
+      const emitObserved = (text, meta) => emit(text, { ...meta, observedAt });
+      const toolObserved = (name, input, meta) => onToolEvent(name, input, meta, observedAt);
       try {
         const event = JSON.parse(line);
         const parentEvent = event.parent_tool_use_id == null && !event.isSidechain;
+        opts.researchReceipt?.event(event);
         if (input && parentEvent) {
           input.event(event);
           if (event.type === 'system' && event.subtype === 'init' && event.session_id) opts.liveMessages.onInit(event.session_id);
@@ -457,7 +482,7 @@ function runPlainTurn(opts) {
         }
       } catch { /* ordinary non-JSON CLI output */ }
       if (!rt.parse)
-        return handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, appendText, answerFromResult, onInit: onInitAll, onUsage, onRateLimit: onRate, onModel: onRanOn, subagents: natives.collector });
+        return handleStreamLine(line, { cwd, emit: emitObserved, onActivity, onToolEvent: toolObserved, appendText, answerFromResult, onInit: onInitAll, onUsage, onRateLimit: onRate, onModel: onRanOn, subagents: natives.collector, tasks: taskPlan, onDetail: (text, meta) => output.detail(text, { ...meta, observedAt }) });
       const ev = rt.parse(line, cwd);
       if (!ev) return;
       // The conversation id, when the runtime announces one (codex's
@@ -474,14 +499,17 @@ function runPlainTurn(opts) {
       // A receipt the controller cannot take never ends this line's handling,
       // as when the lane parsed the line again itself (2026-10-18).
       if (ev.spawnResult) try { opts.onSpawnResult?.(ev.spawnResult); } catch { /* the controller's own failure */ }
-      if (ev.toolEvent) onToolEvent?.(...ev.toolEvent);
+      if (ev.toolEvent) toolObserved(...ev.toolEvent);
+      for (const tool of ev.toolEvents ?? []) toolObserved(...tool);
       if (ev.usage) onUsage?.(ev.usage);
       // One agent MESSAGE, alone — see parseCodexLine's `answer`. Last call
       // wins at the caller, which is what "the final answer" means.
       if (typeof ev.answer === 'string') onAnswer?.(ev.answer);
+      if (ev.detail) output.detail(ev.detail.text, { source: ev.detail.source, observedAt });
       if (ev.text) appendText(ev.text);
       if (ev.activity) {
-        emit(`${ev.activity.label}\n`);
+        emitObserved(ev.activity.kind === 'error' ? ev.activity.full ?? ev.activity.label : ev.activity.label + '\n', ev.activity);
+        if (ev.activity.error) emitObserved(ev.activity.error, { ...ev.activity, kind: 'error', full: ev.activity.error });
         onActivity?.(ev.activity);
       }
     };
@@ -492,19 +520,18 @@ function runPlainTurn(opts) {
     // `setEncoding` holds the partial bytes over to the next chunk.
     child.stdout.setEncoding('utf8');
     child.stderr.setEncoding('utf8');
+    let ended = false;
+    const stdoutLines = createObservedLines((line, at) => { if (line.trim()) onLine(line, at); });
+    const stderrLines = createObservedLines((line, observedAt) => emit(line + '\n', { observedAt, source: 'stderr' }));
     child.stdout.on('data', (d) => {
-      buf += d;
-      let nl;
-      while ((nl = buf.indexOf('\n')) >= 0) {
-        const line = buf.slice(0, nl);
-        buf = buf.slice(nl + 1);
-        if (line.trim()) onLine(line);
-      }
+      if (ended) return;
+      stdoutLines.push(d);
     });
     // stderr is not JSON (warnings/errors) — pass through and keep for sentinels.
     child.stderr.on('data', (s) => {
+      if (ended) return;
       out += s;
-      emit(s);
+      stderrLines.push(s);
     });
     /**
      * A SPAWN THAT FAILS FAILS THE TURN, NOT THE DAEMON — the one copy of the
@@ -520,32 +547,42 @@ function runPlainTurn(opts) {
      * this turn with the native reason; the lane records a failed report.
      */
     const onSpawnError = (e) => {
+      opts.researchReceipt?.fail();
       input?.close();
+      stdoutLines.end();
+      stderrLines.end();
       natives.abandon();
       if (opts.liveMessages) void opts.liveMessages.stop();
       finishDiagnostics({ pid: child.pid, spawnError: typeof e.code === 'string' ? e.code : 'SPAWN_ERROR' });
       releaseArgs();
       if (e.code === 'ENOENT') {
-        console.error(`\nerror: '${rt.bin}' CLI not found on PATH. Install ${rt.label} first: ${rt.install}`);
+        output.error(`error: '${rt.bin}' CLI not found on PATH. Install ${rt.label} first: ${rt.install}`);
         resolve('');
         return;
       }
-      console.error(e);
+      output.error(e);
       reject(e);
     };
     child.on('error', onSpawnError);
-    child.on('close', (code, signal) => {
+    const onClose = (code, signal) => {
+      if (ended) return;
+      ended = true;
       input?.close();
       releaseArgs();
       opts.onExit?.(code, signal);
-      if (buf.trim()) onLine(buf);
+      stdoutLines.end();
+      stderrLines.end();
+      if (code !== 0 || signal) opts.researchReceipt?.fail();
       finishDiagnostics({ code, signal, pid: child.pid, output: out, cliFailed, inputError: stdinError?.code });
       const handBack = async () => {
         if (opts.liveMessages) await opts.liveMessages.stop();
         await natives.drain(CODEX_MODEL_READ_MS);
         natives.sweep();
+        if (signal) output.event(`${rt.label} interrupted (${signal})`, 'interrupted');
+        else if (code !== 0) output.event(`${rt.label} exited with code ${code}`, 'error');
         if (stdinError) {
-          if (!workLanesStopped()) rejectTurn(stdinError);
+          output.error(stdinError);
+          reject(stdinError);
           return;
         }
         resolve(out);
@@ -577,12 +614,29 @@ function runPlainTurn(opts) {
         return;
       }
       handBack();
+    };
+    child.on('close', onClose);
+    /**
+     * THE CLI'S EXIT ENDS ITS TURN (2026-10-19). `close` waits for every
+     * stdio stream, and anything the CLI started that inherited them holds
+     * them open after the CLI is gone. A New task chat's Codex aborted its
+     * turn and exited; its turn stayed pending under a renewed lease for six
+     * and a half hours, until the machine restarted. An exited CLI says
+     * nothing more, so a turn its streams still hold settles with what it
+     * said. The streams keep draining, since the holder is not this turn's
+     * to break (`interruptThenKill`): a later line is dropped, never parsed
+     * into a settled turn.
+     */
+    child.once('exit', (code, signal) => {
+      const timer = setTimeout(() => onClose(code, signal), EXIT_CLOSE_GRACE_MS);
+      child.once('close', () => clearTimeout(timer));
     });
     if (transport.text !== null) {
       // end() buffers with backpressure and closes at EOF; Codex reads the
       // entire prompt before starting. An early close must not accept output
       // from a turn whose complete authorized input never reached the CLI.
       child.stdin.on('error', (error) => {
+        opts.researchReceipt?.fail('input_error');
         stdinError = Object.assign(new Error(`${rt.label} could not receive the complete turn input (${error.code || 'PIPE_ERROR'}).`), { code: error.code || 'PIPE_ERROR' });
         opts.onCliFailure?.();
         child.kill('SIGTERM');

package/bin/lib/runtimeCapabilities.mjs

@@ -168,9 +168,14 @@ export function claudeMcpInventoryOf(list, tools) {
   for (const e of list) {
     if (!e || typeof e !== 'object' || typeof e.name !== 'string') continue;
     const name = e.name.trim().slice(0, MCP_NAME_MAX).trim();
-    if (!name || name === 'flowviant' || seen.has(name)) continue;
+    const scope = typeof e.scope === 'string' ? e.scope : typeof e.source === 'string' ? e.source : null;
+    // The daemon's own `flowviant` rides `--mcp-config`, reported `dynamic`.
+    // One in the person's own config is theirs (2026-10-17, the owner) and is
+    // listed, so a revoked token there reads failed (2026-10-19). An
+    // unscoped report cannot say which, and stays hidden.
+    if (!name || name === 'flowviant' && (scope === 'dynamic' || scope == null) || seen.has(name)) continue;
     const status = MCP_STATUSES.has(e.status) ? e.status : 'other';
-    seen.set(name, { name, status, scope: typeof e.scope === 'string' ? e.scope : typeof e.source === 'string' ? e.source : null, prefix: mcpToolPrefix(e.name.trim()), tools: status === 'connected' ? [] : null });
+    seen.set(name, { name, status, scope, prefix: mcpToolPrefix(e.name.trim()), tools: status === 'connected' ? [] : null });
   }
   // The longest prefix wins, so `a_b` never claims `a`'s tools or the reverse.
   const byPrefix = [...seen.values()].sort((a, b) => b.prefix.length - a.prefix.length);

package/bin/lib/runtimeClaude.mjs

@@ -16,9 +16,19 @@ import { join } from 'node:path';
 import { MODEL, USER_AGENT } from './config.mjs';
 import { NO_SETTING_SOURCES, personalClaudeSettings, releaseTurnSettings, withPersonalSettings, writeTurnSettings } from './claudePersonal.mjs';
 import { machineMcpServers } from './claudeMachineMcp.mjs';
-import { claudePermFor, withMachineMcp } from './claudePosture.mjs';
+import { claudePermFor, withMachineMcp, withNativeChildren } from './claudePosture.mjs';
 import { withSettings } from './claudeSettingsArg.mjs';
 import { orchestratorHooks } from './orchestratorHooks.mjs';
+import { orchestratesPosture } from './orchestratorPrompt.mjs';
+import { versionAtLeast } from './versionOrder.mjs';
+
+/** The release the agent lane first measured `--system-prompt-snapshot` on
+ *  (decisions.md, 2026-09-24). */
+export const SYSTEM_PROMPT_SNAPSHOT_MIN = '2.1.281';
+/** `--version` prints "2.1.303 (Claude Code)"; the first word is the version. */
+export function claudeSnapshotFlagKnown(version) {
+  return versionAtLeast(String(version ?? '').trim().split(/\s+/)[0], SYSTEM_PROMPT_SNAPSHOT_MIN);
+}
 
 function claudeMcp(token, mcpUrl) {
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-mcp-'));
@@ -113,7 +123,7 @@ export const CLAUDE_RUNTIME = {
    * strongest form of it available anywhere: `--append-system-prompt` sits
    * above the conversation rather than inside it.
    */
-  args({ writableDirs = [], prompt, system, model, effort, resume, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings, machineMcp, baseMcp = [], mcpCheckout = null, streamInput = false, orchestration = false }) {
+  args({ writableDirs = [], prompt, system, model, effort, resume, perm: postureList, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings, machineMcp, baseMcp = [], mcpCheckout = null, streamInput = false, orchestration = false, claudeVersion = null }) {
     // THE CARTOGRAPHER'S FENCE NAMES ITS VAULT (2026-10-10): its one write rule
     // is the vault's absolute path (claudePosture.mjs `wikiPermFor`), so a turn
     // with no vault, or one no rule can name, has no list — refused here in
@@ -122,7 +132,7 @@ export const CLAUDE_RUNTIME = {
     if (profile === 'wiki' && !vaultDir) {
       throw new Error("a wiki turn needs its vault to fence — none reached claude's builder");
     }
-    if (profile === 'wiki' && !Array.isArray(perm)) {
+    if (profile === 'wiki' && !Array.isArray(postureList)) {
       throw new Error(`a wiki turn's vault must be a path a Claude Code permission rule can name — ${JSON.stringify(vaultDir)} is not`);
     }
     const a = [];
@@ -181,6 +191,10 @@ export const CLAUDE_RUNTIME = {
      * agent renders the CURRENT base snapshot, not the first turn's cache.
      */
     const fenced = profile !== 'build';
+    // THE GATE RIDES A CODE OR RESEARCH CARD (2026-10-19, orchestratorPrompt.mjs);
+    // a research card's list then admits the children its fence denied.
+    const gated = orchestration && orchestratesPosture(profile);
+    const perm = gated && fenced ? withNativeChildren(postureList) : postureList;
     if (fenced) a.push(...NO_SETTING_SOURCES);
     // A FENCED POSTURE NAMES ITS OWN MODE (2026-10-10). Its lists fence only
     // under the CLI's `default` mode, where a tool the list does not name is
@@ -191,10 +205,18 @@ export const CLAUDE_RUNTIME = {
     // states `default` itself, unless its own list names a mode (plan-mode).
     if (fenced && !perm.includes('--permission-mode')) a.push('--permission-mode', 'default');
     else if (agentTools) a.push('--setting-sources', 'user');
-    if (agentTools) {
-      a.push('--system-prompt-snapshot', 'off');
-      if (agentTools.pluginDir) a.push('--plugin-dir', agentTools.pluginDir);
-    }
+    // EVERY TURN RENDERS ITS OWN SYSTEM PROMPT (2026-10-19). By default the
+    // CLI records a conversation's first system prompt and resends that record
+    // on every resume "even when a later launch passes different text" —
+    // measured offline on 2.1.303: a resumed turn appended BETA and the model
+    // was sent the first turn's ALPHA. A tab's appended prompt moves between
+    // turns (plan mode on and off, the knowledge and artifact paragraphs), so
+    // a tab switched out of plan mode kept being told to change nothing. An
+    // agent turn always passed this (its current base instructions). A CLI too
+    // old to name the flag refuses it, so an unmeasured version keeps the old
+    // argv.
+    if (agentTools || claudeSnapshotFlagKnown(claudeVersion)) a.push('--system-prompt-snapshot', 'off');
+    if (agentTools?.pluginDir) a.push('--plugin-dir', agentTools.pluginDir);
     // WHICH MCP SERVERS A TURN MOUNTS. An agent's code, write-up and
     // mockup/3D-model/deck turns (2026-10-11, the owner) mount this machine's
     // own — its user and local servers and the account's claude.ai connectors —
@@ -257,7 +279,7 @@ export const CLAUDE_RUNTIME = {
     const mounted = machine ? withMachineMcp(perm, machineMcp) : perm;
     // The orchestrator's hooks join that same `--settings`: the CLI applies
     // only the last one it is handed (claudeSettingsArg.mjs `withSettings`).
-    const postured = orchestration && !fenced ? withSettings(mounted, { hooks: orchestratorHooks(), disableAllHooks: false }) : mounted;
+    const postured = gated ? withSettings(mounted, { hooks: orchestratorHooks(), disableAllHooks: false }) : mounted;
     let tail;
     try {
       tail = fenced ? withPersonalSettings(postured, personalSettings ?? personalClaudeSettings()) : postured;

package/bin/lib/runtimeCodex.mjs

@@ -18,6 +18,7 @@ import { researchFence } from './codexResearch.mjs';
 import { projectReadBoundary, projectReadFence } from './codexProjectRead.mjs';
 import { versionAtLeast } from './versionOrder.mjs';
 import { codexOrchestratorArgs } from './orchestratorHooks.mjs';
+import { orchestratesPosture } from './orchestratorPrompt.mjs';
 
 /**
  * FLOWVIANT'S OWN TOOLS NEED NO APPROVAL FROM A CHAT NOBODY CAN ANSWER
@@ -84,8 +85,31 @@ export const NO_REACH_OUT = Object.freeze([
  */
 export const NO_WEB = Object.freeze(['-c', 'tools.web_search=false', '-c', 'web_search="disabled"']);
 
-/** Fenced lanes and non-card turns never delegate. */
-export const NO_SUBAGENTS = Object.freeze(['-c', 'features.multi_agent=false', '-c', 'features.goals=false']);
+/** Fenced lanes and non-card turns never delegate — but an orchestrated
+ *  research card, whose children read under the gate (2026-10-19).
+ *  `features.multi_agent_v2=false` closes a person's own V2 switch, which
+ *  beats every other key (measured on 0.163; harmless on 0.144). */
+export const NO_SUBAGENTS = Object.freeze(['-c', 'features.multi_agent=false', '-c', 'features.goals=false', '-c', 'features.multi_agent_v2=false']);
+
+/**
+ * …AND ON A CATALOG V2 MODEL, `agents.enabled=false` (2026-10-19). Measured on
+ * codex-cli 0.163.0, offline: `features.multi_agent=false` did not remove
+ * native subagents on gpt-6.1-sol, gpt-6-luna or gpt-5.6-sol, whose catalog
+ * entry names multi-agent V2 — a stock research turn listed `collaboration`
+ * and a spawn really started a child no gate saw (core/src/config/mod.rs:
+ * V2 if `features.multi_agent_v2`, else disabled only by `agents.enabled =
+ * false`, else the model's catalog version, and only then the feature).
+ * With the pair the namespace is gone and the call fails "unsupported call".
+ * `agents.enabled` first exists in 0.145.0: 0.144.x reads `[agents]` as a role
+ * map and refuses to start ("invalid type: boolean `false`, expected struct
+ * AgentRoleToml"), and there the catalog does not outrank the feature yet.
+ * So it rides only a CLI measured at 0.145.0 or later.
+ */
+export const AGENTS_ENABLED_MIN = '0.145.0';
+export const noSubagents = (codexVersion) => [...NO_SUBAGENTS,
+  ...(versionAtLeast(String(codexVersion ?? '').replace(/^codex-cli\s+/, ''), AGENTS_ENABLED_MIN) ? ['-c', 'agents.enabled=false'] : [])];
+/** A card turn whose children the gate admits: native multi-agent on, goals off. */
+export const CARD_SUBAGENTS = Object.freeze(['-c', 'features.multi_agent=true', '-c', 'features.goals=false']);
 
 /** rust-v0.160.0 core/src/agent/child_config.rs applies the invoking turn's
  * approval policy, permission profile and cwd AFTER role overrides, for V1
@@ -111,10 +135,11 @@ export const HERMETIC = Object.freeze(['--ignore-user-config', '--ignore-rules']
  * needs the isolated research read fence because broad-read tools can read
  * host credentials. Feature flags do not prove account/model entitlement.
  */
-export const fencedTail = ({ imageGeneration = false, web = false } = {}) => [
+export const fencedTail = ({ imageGeneration = false, web = false, subagents = false, codexVersion } = {}) => [
   // Native web is paired with the copied, root-denied read fence.
   ...(web ? [] : NO_WEB),
-  ...NO_SUBAGENTS,
+  // Only an orchestrated research card's fence admits children (CODEX_FENCES).
+  ...(subagents ? CARD_SUBAGENTS : noSubagents(codexVersion)),
   ...NO_REACH_OUT,
   imageGeneration ? '--enable' : '--disable',
   'image_generation',
@@ -165,14 +190,17 @@ export const codexIgnoresUserConfig = ({ profile = 'build', vaultDir } = {}) =>
  * config: `codex exec` (0.156.1) has no `-P`, so every Codex wiki turn was
  * refused before it started (0.114.0).
  */
-const codexWikiFence = (vaultDir) => [
+const codexWikiFence = (vaultDir, codexVersion) => [
   '-c', 'permissions.flowviantwiki.extends=":read-only"',
   '-c', `permissions.flowviantwiki.filesystem={${JSON.stringify(vaultDir)}="write"}`,
   '-c', 'default_permissions="flowviantwiki"',
-  ...fencedTail(),
+  ...fencedTail({ codexVersion }),
 ];
 
 function codexPrompt({ system, prompt, profile = 'build' }) {
+  // A resumed tab whose thread already holds the contract sends none
+  // (codexContract.mjs): the message alone.
+  if (!system) return prompt;
   const readers = profile === 'consult' || profile === 'plan'
     ? '\nUse exec_command with shell="/bin/bash" and login=false for project discovery. Project files, local Git history and the project knowledge directory are readable; host files are outside this turn’s read boundary.'
     : '';
@@ -284,8 +312,11 @@ export const CODEX_RUNTIME = {
     // THE FENCE, picked by the same keys as `codexIgnoresUserConfig`: a fenced
     // posture builds its own (CODEX_FENCES below); anything else is a build.
     const fenced = codexIgnoresUserConfig({ profile, vaultDir });
+    // THE GATE RIDES A CODE OR RESEARCH CARD on a CLI whose children inherit
+    // the parent's sandbox (2026-10-19, orchestratorPrompt.mjs).
+    const gated = orchestration && orchestratesPosture(fenced ? profile : 'build') && codexSubagentsSafe(codexVersion);
     if (fenced) {
-      a.push(...CODEX_FENCES[profile]({ cwd, vaultDir, researchIsolation, knowledgeDir, projectReads }));
+      a.push(...CODEX_FENCES[profile]({ cwd, vaultDir, researchIsolation, knowledgeDir, projectReads, subagents: gated, codexVersion }));
     } else {
       // The daemon's build posture, mapped: SAFE keeps writes inside the
       // workspace, the default lets the agent run its own tests and git
@@ -300,9 +331,7 @@ export const CODEX_RUNTIME = {
       if (writableDirs.length) a.push('-c', `sandbox_workspace_write.writable_roots=${JSON.stringify(writableDirs)}`);
       a.push('-c', `sandbox_mode="${SAFE ? 'workspace-write' : 'danger-full-access'}"`);
       if (cardTurn) a.push('-c', 'approval_policy="never"', ...(agentTools?.codexApprovals ?? []));
-      a.push(...(cardTurn && profile === 'build' && codexSubagentsSafe(codexVersion)
-        ? ['-c', 'features.multi_agent=true', '-c', 'features.goals=false']
-        : NO_SUBAGENTS));
+      a.push(...(cardTurn && profile === 'build' && codexSubagentsSafe(codexVersion) ? CARD_SUBAGENTS : noSubagents(codexVersion)));
     }
 
     /**
@@ -318,7 +347,7 @@ export const CODEX_RUNTIME = {
     if (a.includes('--ignore-user-config')) a.push(...(personal?.args ?? []));
 
     a.push(...mcp, ...resultSchemaArgs);
-    if (orchestration && !fenced && codexSubagentsSafe(codexVersion)) a.push(...codexOrchestratorArgs());
+    if (gated) a.push(...codexOrchestratorArgs());
     a.push(streamInput ? '-' : codexPrompt({ system, prompt, profile }));
     return a;
   },
@@ -398,7 +427,7 @@ export const CODEX_RUNTIME = {
  * Claude's research list was fenced to prevent. Codex research (0.117.0) runs
  * under its own fence instead, over a copied view (CODEX_FENCES `research`).
  */
-export function codexArtifactFence(cwd, { name, imageGeneration = false, what }) {
+export function codexArtifactFence(cwd, { name, imageGeneration = false, what, codexVersion }) {
   if (!cwd || !isAbsolute(cwd)) {
     throw new Error(`${what} needs its worktree to fence — none reached codex's builder`);
   }
@@ -420,14 +449,14 @@ export function codexArtifactFence(cwd, { name, imageGeneration = false, what })
     '-c', `default_permissions="${name}"`,
     // Nobody is on this end of the pipe to approve an escalation.
     '-c', 'approval_policy="never"',
-    ...fencedTail({ imageGeneration }),
+    ...fencedTail({ imageGeneration, codexVersion }),
   ];
 }
 
 /** The design card's fence — `codexArtifactFence` under its own profile name,
  *  with native image generation available for supporting assets. */
-export const codexDesignFence = (cwd) =>
-  codexArtifactFence(cwd, { name: 'flowviantdesign', imageGeneration: true, what: 'a design turn' });
+export const codexDesignFence = (cwd, codexVersion) =>
+  codexArtifactFence(cwd, { name: 'flowviantdesign', imageGeneration: true, what: 'a design turn', codexVersion });
 
 /**
  * EVERY FENCED POSTURE'S ARGV, by the keys of CODEX_FENCED (a test holds the
@@ -437,7 +466,7 @@ const CODEX_FENCES = {
   // A CONSULT, EXPRESSED THE ONLY WAY CODEX CAN EXPRESS IT — a different
   // shape from Claude's verb allowlist, which is the whole reason `profile` is
   // a promise rather than a flag list. See codexProjectRead.mjs.
-  consult: (opts) => [...projectReadFence(opts.projectReads ?? projectReadBoundary(opts)), ...fencedTail()],
+  consult: (opts) => [...projectReadFence(opts.projectReads ?? projectReadBoundary(opts)), ...fencedTail({ codexVersion: opts.codexVersion })],
   // A PLANNING SESSION. Read-only on the filesystem, exactly like a consult —
   // the writes it makes go through the control plane, not through this box —
   // and for the same reason: its prompt is steered by anything a project
@@ -446,8 +475,8 @@ const CODEX_FENCES = {
   // turn's scoped token. The plan token has the planning tools; a capture
   // token has only staging and transcript tools. The server refuses
   // everything outside that scope.
-  plan: (opts) => [...projectReadFence(opts.projectReads ?? projectReadBoundary(opts)), ...fencedTail()],
-  wiki: ({ vaultDir }) => codexWikiFence(vaultDir),
+  plan: (opts) => [...projectReadFence(opts.projectReads ?? projectReadBoundary(opts)), ...fencedTail({ codexVersion: opts.codexVersion })],
+  wiki: ({ vaultDir, codexVersion }) => codexWikiFence(vaultDir, codexVersion),
   // AN IMAGE CARD (0.114.0): read the repo, write ONLY the worktree's
   // `.flowviant/artifacts/`, generate pictures, and nothing else. MEASURED on
   // codex-cli 0.156.1 (Linux, bubblewrap), with no model turn spent: under
@@ -474,18 +503,21 @@ const CODEX_FENCES = {
   //
   // Native images support every artifact kind; this profile still delivers
   // PNG/WebP, while design/model/deck still deliver their self-contained page.
-  image: ({ cwd }) => codexArtifactFence(cwd, { name: 'flowviantimage', imageGeneration: true, what: 'an image turn' }),
+  image: ({ cwd, codexVersion }) => codexArtifactFence(cwd, { name: 'flowviantimage', imageGeneration: true, what: 'an image turn', codexVersion }),
   // A MOCKUP, 3D-MODEL OR DECK CARD (0.115.0): the fence is
   // `codexDesignFence`'s, argued and measured at `codexArtifactFence` above.
-  design: ({ cwd }) => codexDesignFence(cwd),
+  design: ({ cwd, codexVersion }) => codexDesignFence(cwd, codexVersion),
   // A WRITE-UP CARD (0.117.0): live web over a COPIED view of the worktree,
   // never the checkout or the login store, under a root-denied tool fence
   // (codexResearch.mjs `researchFence`, built by runTurn's
   // `runIsolatedResearch`). It is the one fence that keeps the web, so its
   // tail leaves NO_WEB out and closes everything else.
-  research: ({ researchIsolation }) => {
+  // An orchestrated research card's children (2026-10-19) inherit this same
+  // permission profile, approval policy and cwd (0.160.0 child_config.rs);
+  // the gate refuses their writes.
+  research: ({ researchIsolation, subagents = false, codexVersion }) => {
     if (!researchIsolation) throw new Error('Codex research requires its isolated input copy.');
-    return [...researchFence(researchIsolation), ...fencedTail({ web: true, imageGeneration: true })];
+    return [...researchFence(researchIsolation), ...fencedTail({ web: true, imageGeneration: true, subagents, codexVersion })];
   },
 };
 /** The fenced profile names — for the test that holds both tables to one set. */