Merge master into subagent usage branch

# Conflicts:
#	.agents/notes/implemented/feature/2026-07-27-web-subagent-conversations.i18n.yaml
#	.agents/notes/implemented/feature/2026-07-27-web-subagent-conversations.md
#	.agents/notes/implemented/feature/2026-07-27-web-subagent-conversations.zh.md
#	apps/web/tests/snapshots/subagent-conversation/tree.expected.md
#	apps/web/tests/subagent-conversation.e2e.ts
#	packages/client/ui-subagent/src/client/SubagentCatalogAction.tsx

packages/subagent/subagent/src/activation-setup-registry.ts

@@ -12,6 +12,7 @@
  */
 
 import type { Context } from 'cordis'
+import type { AgentSetupCommit } from '@deepseek-ai/dsh-agent'
 import { errorChain } from '@deepseek-ai/dsh-llm'
 import { SubagentError } from './error.ts'
 
@@ -47,17 +48,6 @@ interface TransactionState {
   invalidated: boolean
 }
 
-/** Package-private setup transaction consumed by the continuation manager. */
-export interface ActivationSetupTransaction {
-  /**
-   * Reject a batch invalidated by revocation before publication.
-   * @throws {SubagentError} code `ACTIVATION_SETUP_REVOKED` after revocation.
-   */
-  assertIntact(): void
-  /** Promote this batch to resident installations. */
-  commit(): void
-}
-
 /** Re-read mutable removal state after a contribution may have revoked itself. */
 function isRemoved(registration: Registration): boolean {
   return registration.removed
@@ -95,9 +85,9 @@ export class SubagentActivationSetupRegistry {
   /**
    * Install every live contribution into one unpublished child context.
    * @param childCtx - the child's unpublished scoped context.
-   * @returns the provisioning transaction.
+   * @returns the provisioning commit consumed at Agent publication.
    */
-  apply(childCtx: Context): ActivationSetupTransaction {
+  apply(childCtx: Context): AgentSetupCommit {
     const state: TransactionState = { installations: [], invalidated: false }
     try {
       for (const registration of [...this.registrations]) {
@@ -135,15 +125,14 @@ export class SubagentActivationSetupRegistry {
     }
     childCtx.effect(() => () => { this.releaseChild(childCtx) }, 'subagents.activationSetup()')
     return {
-      assertIntact: () => {
-        if (!state.invalidated) return
-        throw new SubagentError(
-          'a continuable-subagent setup contribution was revoked while this child was being built; '
-          + 'the child was not established',
-          'ACTIVATION_SETUP_REVOKED',
-        )
-      },
       commit: () => {
+        if (state.invalidated) {
+          throw new SubagentError(
+            'a continuable-subagent setup contribution was revoked while this child was being built; '
+            + 'the child was not established',
+            'ACTIVATION_SETUP_REVOKED',
+          )
+        }
         for (const installation of state.installations) installation.transaction = undefined
       },
     }

packages/subagent/subagent/src/continuation.ts

@@ -20,6 +20,7 @@ import type {
   Agent,
   AgentHandle,
   AgentOptions,
+  AgentSetupCommit,
   CreateAgentOptions,
 } from '@deepseek-ai/dsh-agent'
 import { createUserMessage, errorChain } from '@deepseek-ai/dsh-llm'
@@ -42,7 +43,6 @@ import type { ContinuableCreateRequest, ContinuableCreateSpec, SubagentStartRequ
 import type { ActivationObserver } from './lifecycle.ts'
 import { SubagentError } from './error.ts'
 import type SubagentActivationSetupRegistry from './activation-setup-registry.ts'
-import type { ActivationSetupTransaction } from './activation-setup-registry.ts'
 
 /** Attribution for a model coordinator's follow-up to one of its children. */
 export interface CoordinatorMessageSource {
@@ -800,10 +800,9 @@ export class SubagentContinuationManager {
     // `AgentRegistry.enter()` is the authoritative collision boundary for an id
     // some other owner holds — a duplicate would reject there with rollback.
     inputs.signal.throwIfAborted()
-    let setupTransaction!: ActivationSetupTransaction
-    const setup = (childCtx: Context): void => {
+    const setup = (childCtx: Context): AgentSetupCommit => {
       applyChildComposition(childCtx, inputs.composition)
-      setupTransaction = this.setupRegistry.apply(childCtx)
+      return this.setupRegistry.apply(childCtx)
     }
     const observer = this.host.observeActivation(provider, childId, parent)
     const { create } = inputs
@@ -842,7 +841,6 @@ export class SubagentContinuationManager {
     try {
       inputs.signal.throwIfAborted()
       this.assertAdmitting(parent)
-      setupTransaction.assertIntact()
       this.acquireOwnership(parent, childId)
       // Every accepted id leaves the inbox exactly once, through dequeue or
       // discard. Clearing it there is what lets `stateOf()` distinguish a truly
@@ -860,8 +858,8 @@ export class SubagentContinuationManager {
         for (const item of items) activation.accepted.delete(item.message.id)
         this.wake(activation)
       })
-      // Resident setup revokes live from here instead of invalidating creation.
-      setupTransaction.commit()
+      // Agent creation committed setup at its publication boundary;
+      // revocations from here on are immediate live revocation.
       // Publish the start edge before any turn can run, so observers see this
       // epoch before its first request.
       observer.start(handle.agent)

packages/subagent/subagent/src/descriptor.ts

@@ -12,6 +12,11 @@
  * omits `subagentDepth` — cold resume trusts the persisted header's
  * `delegationDepth` as the monotone floor — and `outputSchema`, which belongs
  * to one activation's result contract rather than durable child composition.
+ * Per-activation knobs such as `maxTokens` are omitted for the same reason as
+ * `outputSchema`: they budget one activation. Cold resume requires the exact
+ * live parent for authorization but reconstructs child options only from the
+ * durable descriptor, so it neither restores the prior budget nor inherits
+ * the parent's current one; the resumed route's defaults apply instead.
  *
  * @module @deepseek-ai/dsh-subagent/descriptor
  */

packages/subagent/subagent/tests/activation-setup-registry.spec.ts

@@ -19,8 +19,7 @@ describe('SubagentActivationSetupRegistry', () => {
 
     const transaction = registry.apply(child.ctx)
     expect(order).toEqual(['first', 'second'])
-    expect(() => { transaction.assertIntact() }).not.toThrow()
-    transaction.commit()
+    expect(() => { transaction.commit() }).not.toThrow()
     expect(order).toEqual(['first', 'second'])
   })
 
@@ -68,7 +67,7 @@ describe('SubagentActivationSetupRegistry', () => {
 
     remove()
     expect(disposals).toBe(1)
-    expect(() => { transaction.assertIntact() }).toThrow(/revoked while this child was being built/)
+    expect(() => { transaction.commit() }).toThrow(/revoked while this child was being built/)
   })
 
   it('catches a contribution revoked inside its own installer', () => {
@@ -82,7 +81,7 @@ describe('SubagentActivationSetupRegistry', () => {
 
     const transaction = registry.apply(childContext().ctx)
     expect(disposals).toBe(1)
-    expect(() => { transaction.assertIntact() }).toThrow(/revoked/)
+    expect(() => { transaction.commit() }).toThrow(/revoked/)
   })
 
   it('attempts every contribution-removal disposer before reporting failures', () => {

packages/subagent/tool-subagent-report/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/subagent/tool-subagent-report/README.md
-README.md: e15b8b5d5881fd7b6868995fec22048a605f4c7e
-README.zh.md: 0c41bc9c1e5aa4d728789b064f2d00c8da8ca6c8
+README.md: cd73154dfb9c8b37f4a811c3beedbe6a63207f58
+README.zh.md: 4b31bed48ea0e50ec3a9d507548658defb94b8b8

packages/subagent/tool-subagent-report/README.md

@@ -4,7 +4,7 @@ English | [中文](README.zh.md)
 
 The optional child-scoped `report` tool is a thin adapter over `ctx.subagents.reportFrom()`. It gives every continuable in-process child a return channel to the Agent that started it. The package registers a continuable-child setup contribution instead of a global tool, so `report` exists only inside those children. Roots, one-shot subagents, remote subagent providers, sibling scopes, and agentless tool execution never present or execute it. Installing this package grants only that child-scoped capability; the parent-to-child direction remains the independent [`@deepseek-ai/dsh-tool-subagent-control`](../tool-subagent-control/README.md), and continuable mode depends on neither package.
 
-A child may call `report` zero or many times in one turn. A successful call neither concludes the turn, settles the Activation, nor prevents later parent follow-ups, and finishing a turn never reports automatically. The tool accepts no recipient: `exec.agent` is the sender's exact live Agent and the authority credential, and the service derives the sole recipient from that child's durable `parentSession`. Success returns the stable `MessageId` of the parent-accepted message, not a read receipt, an inbox-occurrence id, a parent-log acknowledgement, a turn-completion receipt, or a persistence flush. A missing, disposed, or closing parent fails the call with `direct parent is not live; report was not delivered`; the service performs no injection, parent cold resume, or offline mailbox write, so the durable child transcript remains the recovery source.
+A child may call `report` zero or many times in one turn. A successful call neither concludes the turn, settles the Activation, nor prevents later parent follow-ups, and finishing a turn never reports automatically. The tool accepts no recipient: `exec.agent` is the sender's exact live Agent and the authority credential, and the service derives the sole recipient from that child's durable `parentSession`. Success returns the stable `MessageId` of the parent-accepted message, not a read receipt, an inbox-occurrence id, a parent-log acknowledgement, a turn-completion receipt, or a persistence flush. A parent absent from the registry fails the call with `direct parent is not live; report was not delivered` — registry presence governs parent resolution, and a registered parent already in host-owned disposal still accepts while its log admits appends. The service performs no injection, parent cold resume, or offline mailbox write; the durable child transcript remains the recovery source, and a failed tool call does not prove non-delivery (a later `tools/post-execute` veto can fail a call whose report was already accepted).
 
 `reportDelivery` selects parent scheduling for every accepted report. `quiet` (the default) uses `parent.inject()`, adding model-facing context without starting a parent model request: an idle parent's append completes before the call returns, while a report reaching an admitting or running parent stages for the next safe log position. `wakeup` uses `parent.followup()`, creating exactly one ordinary later parent turn and waking a parked parent driver; it never steers an open turn. This is deployment scheduling policy, so the model-facing schema cannot select or override it per call.
 
@@ -58,7 +58,6 @@ Append-only; the report follows the parent's reusable request prefix. Waking del
 
 ## Known Limitations and Deferred Work
 
-- **Setup revocation can follow lower-level Session publication** — the final revocation check runs after `ctx.agents.create()` or `ctx.agents.resume()` returns, by which point that call has already published its Agent and Session. Revocation in this window rolls back the handle and prevents the subagent Activation start edge, but may leave a persisted Session. Closing this gap requires a future Agent-creation setup transaction seam before lower-level publication.
 - **A parent whose host-owned disposal already started can still accept** — `AgentHandle.dispose()` cancels, awaits quiescence, and only then unwinds the scope and leaves the registry; it exposes no signal for "disposal started." A report accepted in that window is appended to the parent's transcript, but that parent will not act on it in this process. A continuation-manager-owned parent rejects forest teardown through the manager's admission boundary.
 - **Acceptance is weaker than durable delivery** — there is no durable mailbox, idempotency key, delivery receipt, retry protocol, or exactly-once claim. A process failure after one side recorded acceptance leaves the outcome ambiguous, and an external retry may duplicate the report.
 - **A staged quiet report is not immediately reconstructable** — acceptance returns its stable `MessageId`, but the parent Session reconstructs the framed content only after pending context reaches its ordinary log boundary.

packages/subagent/tool-subagent-report/README.zh.md

@@ -4,7 +4,7 @@
 
 可选的子级作用域 `report` 工具是 `ctx.subagents.reportFrom()` 之上的轻量适配器。它为每个可继续的进程内子级提供一条返回通道，指向启动该子级的 Agent（智能体）。本包（package）注册的是可继续子级设置贡献，而不是全局工具，因此 `report` 只存在于这些子级内部。根 Agent、一次性 subagent、远程 subagent 提供方、同级作用域以及不关联 Agent 的工具执行都不会提供或执行它。安装本包只授予这项子级作用域功能；父到子方向仍由独立的 [`@deepseek-ai/dsh-tool-subagent-control`](../tool-subagent-control/README.md) 负责，可继续模式不依赖这两个包中的任一个。
 
-子级可以在一个轮次中调用 `report` 零次或多次。调用成功既不会结束轮次或结算 Activation，也不会阻止父级后续消息；轮次结束也绝不会自动上报。该工具不接受接收方参数：`exec.agent` 是发送方准确的实时 Agent，也是权限凭据；服务根据该子级持久化的 `parentSession` 推导唯一接收方。成功时返回父级已接受消息的稳定 `MessageId`，不表示已读回执、inbox 中该次出现的 id、父级日志确认、轮次完成回执或持久化刷盘。父级不存在、已 dispose（资源释放）或正在关闭时，本次调用会失败并返回 `direct parent is not live; report was not delivered`；服务不会执行注入、父级冷恢复或离线 mailbox 写入，因此持久化子级 transcript（文本记录）仍是恢复真源。
+子级可以在一个轮次中调用 `report` 零次或多次。调用成功既不会结束轮次或结算 Activation，也不会阻止父级后续消息；轮次结束也绝不会自动上报。该工具不接受接收方参数：`exec.agent` 是发送方准确的实时 Agent，也是权限凭据；服务根据该子级持久化的 `parentSession` 推导唯一接收方。成功时返回父级已接受消息的稳定 `MessageId`，不表示已读回执、inbox 中该次出现的 id、父级日志确认、轮次完成回执或持久化刷盘。父级解析由注册表中的存在性决定：父级不在注册表时，调用失败并返回 `direct parent is not live; report was not delivered`；已开始宿主 dispose 但仍在注册表中的父级在其日志仍接受追加时仍会接受。服务不会执行注入、父级冷恢复或离线 mailbox 写入；持久化子级 transcript（文本记录）仍是恢复真源，且工具调用失败不能证明未送达（后续 `tools/post-execute` 否决可能让报告已被接受的调用以失败结束）。
 
 `reportDelivery` 为每条已接受的报告选择父级调度方式。`quiet`（默认值）使用 `parent.inject()`，在不启动父级模型请求的情况下添加面向模型的上下文：父级空闲时，追加操作会在调用返回前完成；报告到达正在准入或运行的父级时，则会暂存到下一个安全日志位置。`wakeup` 使用 `parent.followup()`，准确创建一个普通的后续父级轮次，并唤醒停驻的父级驱动；它绝不会对正在运行的轮次进行 steering（中途引导）。这是部署调度策略，因此面向模型的 schema 不能在单次调用中选择或覆盖该策略。
 
@@ -58,7 +58,6 @@
 
 ## 已知限制与暂缓事项
 
-- **setup 撤销可能发生在底层 Session 发布之后**：最终撤销检查发生在 `ctx.agents.create()` 或 `ctx.agents.resume()` 返回之后，此时该调用已发布其 Agent 和 Session。在这个窗口内撤销会回滚 handle，并阻止 subagent Activation 的 start 边，但可能留下持久化 Session。要弥合这个缺口，需要未来在底层发布之前提供 Agent 创建 setup 事务 seam。
 - **父级可能在宿主启动 dispose 后继续接受报告**：`AgentHandle.dispose()` 会先取消并等待完全停稳，然后才撤销作用域并离开注册表；它不公开「dispose 已开始」信号。在该窗口内接受的报告会追加到父级 transcript，但该父级不会在本进程中处理它。对于由延续管理器拥有的父级，管理器的准入边界会在整棵子树拆卸期间拒绝该上报。
 - **接受弱于持久投递**：没有持久化 mailbox、幂等键、投递回执、重试协议，也不保证恰好一次。任一侧记录接受后若进程失败，结果都不明确；外部重试可能产生重复上报。
 - **暂存的静默报告无法立即重建**：接受时会返回其稳定 `MessageId`，但只有当待处理上下文到达普通日志边界后，父级 Session 才能重建带前缀的内容。

packages/subagent/tool-subagent-report/src/index.ts

@@ -88,7 +88,10 @@ export function installReportTool(
  * @param config - deployment scheduling policy.
  */
 export function apply(ctx: Context, config: Config = {}): void {
-  const { reportDelivery = 'quiet' } = Config(config)
+  // Config() applies the schema default ('quiet') at runtime; the schemastery
+  // return type keeps the input's optional shape, so assert the resolved
+  // shape here — no runtime fallback exists or is wanted.
+  const { reportDelivery } = Config(config) as { reportDelivery: SubagentReportDelivery }
   ctx.subagents.registerContinuableSetup(childCtx =>
     installReportTool(childCtx, ctx, reportDelivery))
 }

packages/subagent/tool-subagent-report/tests/tool-subagent-report.spec.ts

@@ -327,6 +327,15 @@ describe('dsh-tool-subagent-report', () => {
       return dispose
     })
 
+    // No session may be announced for the rejected child: the setup
+    // validation must reject inside the creation callback, before the factory
+    // publishes — a post-publication rejection would persist a resumable
+    // ghost that `list_agents` surfaces and `send_message` can resurrect.
+    // The parent was created inside setup(), so any later announcement is the
+    // rejected child's.
+    const announced: SessionId[] = []
+    const listener = (session: { id: SessionId }): void => { announced.push(session.id) }
+    const removeListener = ctx.on('session/created', listener)
     await expect(ctx.subagents.startContinuable({
       provider: 'spawn',
       label: 'racing child',
@@ -336,9 +345,56 @@ describe('dsh-tool-subagent-report', () => {
       },
       signal: testSignal,
     })).rejects.toMatchObject({ code: 'ACTIVATION_SETUP_REVOKED' })
+    removeListener()
+    expect(announced).toEqual([])
     expect(ctx.agents.list().map(agent => agent.id)).toEqual([parent.id])
   })
 
+  it('rolls back materialization when setup revocation lands before publication', async () => {
+    const { ctx, parent } = await setup({ load: false })
+    const self: { revoke?: () => void } = {}
+    let installed = false
+    self.revoke = ctx.subagents.registerContinuableSetup(() => {
+      installed = true
+      queueMicrotask(() => { self.revoke?.() })
+      return () => { installed = false }
+    })
+    const announced: SessionId[] = []
+    const removeListener = ctx.on('session/created', (session) => { announced.push(session.id) })
+
+    await expect(ctx.subagents.startContinuable({
+      provider: 'spawn',
+      label: 'revoked child',
+      request: {
+        prompt: [{ type: 'text', text: 'revoked child' }],
+        parent,
+      },
+      signal: testSignal,
+    })).rejects.toMatchObject({ code: 'ACTIVATION_SETUP_REVOKED' })
+    removeListener()
+    expect(installed).toBe(false)
+    expect(announced).toEqual([])
+    expect(ctx.agents.list().map(agent => agent.id)).toEqual([parent.id])
+    expect(ctx.sessions.list()).toEqual([parent.session])
+  })
+
+  it('accepts a report into a host-disposing but still-registered parent', async () => {
+    const { ctx } = await setup()
+    const parentHandle = await ctx.agents.create({
+      sessionId: SessionId('disposing-parent'),
+      agentOptions: { provider: 'mock', model: 'mock' },
+    })
+    const { child } = await startChild(ctx, parentHandle.agent)
+    // Host-owned disposal starts asynchronously; the parent stays registered
+    // until quiescence, and registry presence — not disposal state — is the
+    // acceptance gate (pins the README contract).
+    const disposing = parentHandle.dispose()
+    const accepted = await callReport(ctx, child, 'during-close')
+    expect(accepted.isError).toBe(false)
+    await disposing
+    expect((await callReport(ctx, child, 'after-close')).isError).toBe(true)
+  })
+
   it('keeps the namespace plugin shape and validates its default', () => {
     expect('default' in tool).toBe(false)
     expect(tool.name).toBe('tool-subagent-report')