fix(scope): close final ownership races

Drain idle injection flushes before agent teardown, snapshot approval and subagent provider inputs, and gate subagent lifecycle events on real child readiness. Align the RFCs and generated contracts with the hardened behavior.

packages/subagent/subagent-inprocess/README.md

@@ -9,11 +9,11 @@ The shared **in-process subagent run driver**. A library with no provider or imp
 Runs a child as a child [`Agent`](../../core/agent) on the same cordis context (`ctx.agents`):
 
 1. snapshots the accepted request before asynchronous owner setup: the parent and signal remain identity capabilities but are never reread from the caller-owned record; tool filter, seed, agent options, output schema, and prompt are detached. It computes child depth = `depthOf(parent) + 1` and rejects `request.maxDepth` overflow with `SubagentDepthError`; `outputSchema` is asserted before cloning so a hostile value fails as `OutputSchemaError`, while the prompt passes the session log's lossless-JSON check before and after cloning;
-2. first installs provider ownership, then attaches the request abort listener and creates one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves no child or orphaned listener. Async child creation goes through that fiber's `ctx.agents` service with fresh IDs, lineage/seed, inherited model, and an unpublished setup transaction for persona, tool restriction, and structured output. Parent teardown, provider teardown, and manual `run.dispose()` all dispose this exact node, preventing publication after it becomes inactive and awaiting the same quiescence boundary. `startInProcessRun` still returns its `SubagentRun` immediately, and cancellation during creation is recorded and applied when a child exists;
+2. first installs provider ownership, then attaches the request abort listener and creates one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves no child or orphaned listener. Async child creation goes through that fiber's `ctx.agents` service with fresh IDs, lineage/seed, inherited model, and an unpublished setup transaction for persona, tool restriction, and structured output. Parent teardown, provider teardown, and manual `run.dispose()` all dispose this exact node, preventing publication after it becomes inactive and awaiting the same quiescence boundary. `startInProcessRun` still returns its `SubagentRun` immediately: `run.started` resolves only after `ctx.agents.create()` has published the child (and rejects if publication never happens), while cancellation during creation is recorded and applied when a child exists;
 3. drives the one-shot: `child.send(prompt)` then `await child.whenIdle()` (ordering matters — `send` enqueues synchronously, so `whenIdle` observes the queued work and resolves on the child's `running → idle` transition, never before the turn starts); there is deliberately NO re-prompt for a structured child that finished cleanly without calling `structured_output` — the shortfall maps to an `error` result for the parent;
 4. reads the result, scoped to the child's OWN events (everything at or after `seedLength`, so a seeded child that produced no message of its own never returns the seeded parent's last message): the last `assistant/message` content (deep-cloned — the log is frozen) and the last `turn/end.reason` mapped to a `SubagentStopReason`. A structured run surfaces the captured value as `result.structured`; a structured child that finished cleanly WITHOUT ever capturing settles `error` (a clean finish without the demanded result is a failure, not a success with a missing field).
 
-`dispose()` awaits creation or rollback and then delegates to `AgentHandle.dispose()` (stop and drain → remove agent → detach session → unwind scope); `cancel()` records its request even before publication and cancels the child immediately once available. A cancel landing before any `turn/end` still settles `aborted`, honoring the cancel contract rather than the generic no-turn `error`.
+`SubagentService` waits for `run.started` before emitting `subagent/start`, so a synchronous start observer can resolve the published child with `ctx.agents.get(run.id)`; the result driver awaits the same boundary before sending the prompt. An attempt that never publishes rejects readiness and emits no false start/end pair; its result reports a deliberate cancel/dispose as `aborted` and propagates an infrastructure fault. `dispose()` awaits creation or rollback and then delegates to `AgentHandle.dispose()` (stop and drain → remove agent → detach session → unwind scope); `cancel()` records its request even before publication and cancels the child immediately once available. A cancel landing before any `turn/end` still settles `aborted`, honoring the cancel contract rather than the generic no-turn `error`.
 
 ### `InProcessRunOptions`
 

packages/subagent/subagent-inprocess/src/index.ts

@@ -289,11 +289,23 @@ export function startInProcessRun(
     return created.agent
   })()
 
+  // Provider readiness is a distinct lifecycle boundary from accepting the
+  // request. It resolves only after the factory has published the child and
+  // returned its handle, so SubagentService can emit `subagent/start` while
+  // `ctx.agents.get(childId)` is guaranteed to resolve. The result path awaits
+  // THIS SAME promise immediately, which also observes a readiness rejection
+  // when the driver is invoked directly rather than through SubagentService.
+  const started: Promise<void> = creation.then(() => undefined)
+
   const result: Promise<SubagentResult> = (async () => {
     try {
       let liveChild: Agent
       try {
-        liveChild = await creation
+        await started
+        // `creation` assigns `child` before it fulfills, and `started` is its
+        // direct fulfillment projection. The cast records that local invariant
+        // without manufacturing an unreachable runtime branch.
+        liveChild = child as Agent
       } catch (error: unknown) {
         if (isManualDisposeRequested()) return { output: [], stopReason: 'aborted' }
         throw error instanceof Error ? error : new Error('subagent child creation failed with a non-Error value', { cause: error })
@@ -313,6 +325,7 @@ export function startInProcessRun(
   let disposing: Promise<void> | undefined
   return {
     id: childId,
+    started,
     result,
     cancel(reason?: string): void {
       requestCancel(reason ?? 'subagent cancelled')