fix(schedule): close absolute-time review gaps

packages/host/apiproxy/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/host/apiproxy/README.md
-README.md: 592e831a2e06e144844607cc7d7b71998f7fb11c
-README.zh.md: f26cc471b4402c9a1d5fc5029aef4995ee1d1441
+README.md: 1d1d685e714db11691b834d51019fae3f50a0010
+README.zh.md: aa846010560a62d0330700fa74f249b451e9d31f

packages/host/apiproxy/README.md

@@ -34,7 +34,7 @@ Session titles ride the generic projection pair like every other domain — the
 
 Session model selection is a session-domain contract. `session.models` returns the current `ModelSelection` separately from provider-grouped advisory models, exact-model reasoning metadata, and provider-local lookup failures. The selection may be absent from the groups and is never injected as a synthetic row; clients can prompt for another selection without turning the directory into a routing whitelist. `session.selectModel` validates the optional adapter-owned reasoning effort and assigns the complete selection for the next prompt-assembly boundary. Catalog membership is not validation: an adapter may resolve an unlisted model, while an unavailable provider or unsupported effort returns `model-unavailable`. `session.models` additionally reports `routable`: whether an adapter currently serves the selected provider. This is deliberately not derivable from the groups because an adapter may serve an unadvertised model. `session.prompt` refuses on the same fact with `model-unavailable` before opening a turn; a disabled composer is a client affordance, and the method remains callable.
 
-`session.prompt` also accepts optional request-local `clientTimeZone` provenance. When present, the Host validates and canonicalizes `UTC` or an IANA Area/Location before Agent entry, rejects invalid input with `invalid-time-zone`, and records the canonical value on that exact `user-rpc` message beside its `rpcId`. The value is not Session, connection, create, resume, or fork state; non-browser callers may omit it.
+`session.prompt` and `subagent.prompt` accept optional request-local `clientTimeZone` provenance. When present, the Host validates and canonicalizes `UTC` or an IANA Area/Location before Agent entry, rejects invalid input with `invalid-time-zone`, and records the canonical value on that exact `user-rpc` message beside its `rpcId`. The value is not Session, connection, create, resume, or fork state; non-browser callers may omit it.
 
 Pending queued input is a live control-plane contract, not conversation history. The gateway derives the complete `next-turn` queue from durable `agent/inbox/spliced` mutations and broadcasts authoritative `session/queue` snapshots after each change and on reconnect; pending `next-step` steering stays outside this Web projection. Within `next-step`, user-origin messages carry the `steering` placement while injected context (approval notices, task completion, attached snapshots) carries `context` and is not surfaced until claimed. The message-local `agent/inbox/inserted`, `claimed`, and `discarded` notifications remain available to lifecycle observers but do not build the queue view. `session.updateQueue` addresses one `MessageId`; edit and remove mutate the attached Agent through `Inbox.splice()`. A claim's pure deletion splice wins races before pre-step admission, so a later operation returns `queue-item-not-found`. `session.cancel` aborts only the active turn and preserves pending inbox work; after cancellation reaches quiescence and the closing turn flushes, AgentLoop claims the next waking message in FIFO order, and the browser never resends or promotes it. Queue operations never resume a cold session, and the client never infers retirement from turn or status events.
 

packages/host/apiproxy/README.zh.md

@@ -34,7 +34,7 @@ Settings 分节中的 `reasoningEffort` 在 agent-default-model 插件配置中
 
 会话模型选择属于会话领域约定。`session.models` 将当前 `ModelSelection` 与按提供方分组的建议性模型、精确模型的推理（reasoning）元数据和逐提供方查询失败记录分开返回。该选择可能不在这些分组中，也绝不会作为合成行注入；客户端可以提示用户作出另一项选择，而无需把目录变成路由白名单。`session.selectModel` 校验由适配器持有的可选推理强度，并指定将在下一提示词组装边界使用的完整选择。目录成员关系不构成校验：适配器可以解析未列出的模型，而不可用的提供方或不受支持的推理强度会返回 `model-unavailable`。`session.models` 还会报告 `routable`，即当前是否有适配器为所选提供方提供服务。该值刻意不从分组推导，因为适配器可以服务未公布的模型。`session.prompt` 会依据同一事实，在开启轮次之前以 `model-unavailable` 拒绝；客户端禁用 composer 只是提示性设计，这个方法始终可被调用。
 
-`session.prompt` 还接受可选的请求本地 `clientTimeZone` 来源信息。若提供该值，Host 会在进入 Agent 前校验 `UTC` 或 IANA Area/Location 并将其规范化；无效输入以 `invalid-time-zone` 拒绝，规范值则与 `rpcId` 一起记录在这条确切的 `user-rpc` 消息上。该值不属于 Session、连接、create、resume 或 fork 状态；非浏览器调用方可以省略它。
+`session.prompt` 和 `subagent.prompt` 接受可选的请求本地 `clientTimeZone` 来源信息。若提供该值，Host 会在进入 Agent 前校验 `UTC` 或 IANA Area/Location 并将其规范化；无效输入以 `invalid-time-zone` 拒绝，规范值则与 `rpcId` 一起记录在这条确切的 `user-rpc` 消息上。该值不属于 Session、连接、create、resume 或 fork 状态；非浏览器调用方可以省略它。
 
 待处理的 queued 输入属于实时控制平面约定，而非对话历史。网关根据持久 `agent/inbox/spliced` 变更派生完整的 `next-turn` 队列，并在每次变更后及重连时广播权威 `session/queue` 快照；待处理的 `next-step` steering（中途引导）不进入此 Web 投影。在 `next-step` 内，用户来源的消息携带 `steering` placement，而注入上下文（审批通知、任务完成、附加快照）携带 `context`，领取前不对外呈现。面向单条消息的 `agent/inbox/inserted`、`claimed` 与 `discarded` 通知仍供生命周期观察方使用，但不用于构建队列视图。`session.updateQueue` 通过 `MessageId` 寻址单个项；编辑和移除经已挂载 Agent 的 `Inbox.splice()` 修改队列。claim 的纯删除 splice 会在 pre-step 准入前赢得竞态，因此之后的操作返回 `queue-item-not-found`。`session.cancel` 仅中止活动轮次并保留待处理 inbox 工作；取消达到完全停稳且结束中的轮次完成 flush 后，AgentLoop 按 FIFO 顺序认领下一条可唤醒消息，浏览器绝不重发或提升它。队列操作绝不恢复冷会话，客户端也绝不根据轮次或状态事件推断某项已退出队列。
 

packages/host/apiproxy/src/api-proxy.ts

@@ -2016,7 +2016,17 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
       },
 
       async prompt(request, signal) {
-        const { parentSessionId, childSessionId, content } = request.payload
+        const { parentSessionId, childSessionId, content, clientTimeZone } = request.payload
+        const canonicalTimeZone = clientTimeZone === undefined
+          ? undefined
+          : canonicalClientTimeZone(clientTimeZone)
+        if (clientTimeZone !== undefined && canonicalTimeZone === undefined) {
+          return err(request, {
+            code: 'invalid-time-zone',
+            message: 'clientTimeZone must be UTC or a valid IANA Area/Location name',
+            details: { value: clientTimeZone },
+          })
+        }
         const parent = ctx.agents.get(parentSessionId)
         if (parent === undefined) {
           return err(request, {
@@ -2031,7 +2041,11 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
         if (verified.error !== undefined) return err(request, verified.error)
         try {
           const messageId = await ctx.subagents.followup(parent, childSessionId, content, {
-            source: { kind: 'user', rpcId: request.rpcId },
+            source: {
+              kind: 'user',
+              rpcId: request.rpcId,
+              ...(canonicalTimeZone === undefined ? {} : { clientTimeZone: canonicalTimeZone }),
+            },
             signal,
           })
           return ok(request, { messageId })

packages/host/apiproxy/src/api/subagents.schema.ts

@@ -67,6 +67,7 @@ export const subagentPromptRequestSchema = z.object({
   childSessionId: sessionIdSchema,
   mode: z.literal('continuable'),
   content: z.array(contentBlockSchema),
+  clientTimeZone: z.string().optional(),
 }) as unknown as z.ZodType<RequestPayload<'subagent.prompt'>>
 
 /** subagent.interrupt request payload. */

packages/host/apiproxy/src/api/subagents.ts

@@ -92,10 +92,15 @@ export interface SubagentsApi {
    * Delivers human content to a continuable child through the exact live
    * parent's continuation owner. Success identifies the message accepted by
    * the child's FIFO inbox; later execution is independent of this request.
+   * Optional browser-zone provenance is validated and logged on that message.
    */
   prompt(
     request: RpcRequest<
-      Extract<SubagentAddress, { mode: 'continuable' }> & { content: ContentBlock[] }
+      Extract<SubagentAddress, { mode: 'continuable' }> & {
+        content: ContentBlock[]
+        /** Optional browser zone sampled for this exact human prompt. */
+        clientTimeZone?: string
+      }
     >,
     signal: AbortSignal,
   ): Promise<RpcResponse<SubagentPromptReceipt>>

packages/host/apiproxy/tests/api-proxy-subagents.spec.ts

@@ -50,7 +50,10 @@ function bench(options: {
     _parent: unknown,
     _childId: SessionId,
     _content: unknown,
-    _delivery: { source: { kind: string; rpcId: RpcId }; signal: AbortSignal },
+    _delivery: {
+      source: { kind: string; rpcId: RpcId; clientTimeZone?: string }
+      signal: AbortSignal
+    },
   ) => options.followupError === undefined
     ? Promise.resolve('message-1')
     : Promise.reject(options.followupError))
@@ -270,6 +273,43 @@ describe('subagent gateway', () => {
     )
   })
 
+  it('canonicalizes browser-zone provenance before delivering a child prompt', async () => {
+    const { api, parent, followup } = bench()
+    const alias = 'US/Pacific'
+    const canonical = new Intl.DateTimeFormat('en-US', { timeZone: alias })
+      .resolvedOptions().timeZone
+    const content = [{ type: 'text' as const, text: 'continue locally' }]
+    const signal = new AbortController().signal
+    await expect(api.subagents.prompt(request({
+      parentSessionId: PARENT,
+      childSessionId: CHILD,
+      mode: 'continuable',
+      content,
+      clientTimeZone: alias,
+    }), signal)).resolves.toMatchObject({ result: { ok: true } })
+    expect(followup).toHaveBeenCalledWith(parent, CHILD, content, {
+      source: { kind: 'user', rpcId: RpcId('subagent-rpc'), clientTimeZone: canonical },
+      signal,
+    })
+
+    const invalid = await api.subagents.prompt(request({
+      parentSessionId: PARENT,
+      childSessionId: CHILD,
+      mode: 'continuable',
+      content,
+      clientTimeZone: 'Not/A_Real_Zone',
+    }), signal)
+    expect(invalid.result).toEqual({
+      ok: false,
+      error: {
+        code: 'invalid-time-zone',
+        message: 'clientTimeZone must be UTC or a valid IANA Area/Location name',
+        details: { value: 'Not/A_Real_Zone' },
+      },
+    })
+    expect(followup).toHaveBeenCalledOnce()
+  })
+
   it('fails before delivery when the parent is absent and maps continuation failures', async () => {
     const absent = bench({ parentLive: false })
     expect((await absent.api.subagents.prompt(request({

packages/host/apiproxy/tests/rpc-schemas.spec.ts

@@ -36,6 +36,7 @@ import { hostFrameSchema, muxFrameSchema, askUserQuestionItemSchema } from '../s
 import { approvalRequestIdSchema, approvalResponsePayloadSchema } from '../src/api/approvals.schema.ts'
 import { askUserQuestionAnswerSchema, questionResponsePayloadSchema } from '../src/api/questions.schema.ts'
 import { goalEditRequestSchema } from '../src/api/goals.schema.ts'
+import { subagentPromptRequestSchema } from '../src/api/subagents.schema.ts'
 
 describe('RpcId', () => {
   it('brands a raw string at zero runtime cost', () => {
@@ -282,6 +283,24 @@ describe('sessions domain schemas', () => {
   })
 })
 
+describe('subagent domain schemas', () => {
+  it('carries optional request-local browser-zone provenance on prompts', () => {
+    expect(subagentPromptRequestSchema.parse({
+      parentSessionId: 'parent',
+      childSessionId: 'child',
+      mode: 'continuable',
+      content: [{ type: 'text', text: 'continue' }],
+      clientTimeZone: 'Asia/Shanghai',
+    }).clientTimeZone).toBe('Asia/Shanghai')
+    expect(subagentPromptRequestSchema.parse({
+      parentSessionId: 'parent',
+      childSessionId: 'child',
+      mode: 'continuable',
+      content: [],
+    }).clientTimeZone).toBeUndefined()
+  })
+})
+
 describe('host domain schemas', () => {
   it('validates describe request/value', () => {
     expect(hostDescribeRequestSchema.parse({})).toEqual({})