fix: address codex review round 2

- listChildren() checks its cancellation signal before starting the corpus
  trace and immediately after it resolves, so a pre-aborted or trace-time
  abort fails CANCELLED instead of returning a successful empty result.
- Corrected the persistence-repair claims: session query resolves persisted
  candidates through the non-mutating inspect() read, so listing is
  storage-read-only and a torn child tail is surfaced (shorter valid prefix)
  rather than repaired; the Agent Note, README, and JSDoc now state that,
  and the zh pair is re-recorded.

packages/cordis/tool-cordis/src/api-catalog.ts

@@ -898,7 +898,7 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
       },
       {
         signature: 'async listChildren(parentSessionId: SessionId, signal?: AbortSignal): Promise<SubagentListEntry[]>',
-        jsDoc: '/**\n * Enumerate one session\'s direct continuable children from the durable,\n * live-preferred corpus without loading or resuming an Agent. The lineage\n * trace supplies stable candidate order and live status; each candidate is\n * then inspected independently for exactly one supported descriptor in its\n * own suffix. Session-query reads take no signal, so cancellation is\n * cooperative: the scan rechecks `signal` after every un-signalled await and\n * stops between candidates instead of draining a slow or large catalog after\n * the caller has gone.\n * @param parentSessionId - parent whose direct children are listed.\n * @param signal - caller-owned cancellation observed between query awaits.\n * @returns child and diagnostic entries in lineage-trace order.\n */',
+        jsDoc: '/**\n * Enumerate one session\'s direct continuable children from the durable,\n * live-preferred corpus without loading or resuming an Agent. The lineage\n * trace supplies stable candidate order and live status; each candidate is\n * then inspected independently for exactly one supported descriptor in its\n * own suffix. Listing is storage-read-only: session query resolves persisted\n * candidates through the non-mutating `inspect()` read, so no catalog,\n * descriptor, or repair event is written. Session-query reads take no signal,\n * so cancellation is cooperative: the scan rechecks `signal` before and\n * after the initial trace and after every other un-signalled await instead of\n * draining a slow or large catalog after the caller has gone.\n * @param parentSessionId - parent whose direct children are listed.\n * @param signal - caller-owned cancellation observed between query awaits.\n * @returns child and diagnostic entries in lineage-trace order.\n */',
       },
       {
         signature: 'registerProvider(provider: SubagentProvider): () => void',

packages/subagent/subagent/src/index.ts

@@ -251,10 +251,12 @@ export class SubagentService extends Service {
    * live-preferred corpus without loading or resuming an Agent. The lineage
    * trace supplies stable candidate order and live status; each candidate is
    * then inspected independently for exactly one supported descriptor in its
-   * own suffix. Session-query reads take no signal, so cancellation is
-   * cooperative: the scan rechecks `signal` after every un-signalled await and
-   * stops between candidates instead of draining a slow or large catalog after
-   * the caller has gone.
+   * own suffix. Listing is storage-read-only: session query resolves persisted
+   * candidates through the non-mutating `inspect()` read, so no catalog,
+   * descriptor, or repair event is written. Session-query reads take no signal,
+   * so cancellation is cooperative: the scan rechecks `signal` before and
+   * after the initial trace and after every other un-signalled await instead of
+   * draining a slow or large catalog after the caller has gone.
    * @param parentSessionId - parent whose direct children are listed.
    * @param signal - caller-owned cancellation observed between query awaits.
    * @returns child and diagnostic entries in lineage-trace order.
@@ -267,10 +269,11 @@ export class SubagentService extends Service {
         'SUBAGENT_CONTROL_SESSION_QUERY_UNAVAILABLE',
       )
     }
+    assertListingNotCancelled(signal)
     const trace = await query.traceSession(parentSessionId)
+    assertListingNotCancelled(signal)
     const entries: SubagentListEntry[] = []
     for (const node of trace.descendants) {
-      assertListingNotCancelled(signal)
       const entry = await this.inspectChild(query, parentSessionId, node.session, signal)
       if (entry !== undefined) entries.push(entry)
     }