Merge remote-tracking branch 'origin/master' into feat/profile-plugin-management

# Conflicts: # apps/cli/src/headless.ts # packages/host/apiproxy/README.i18n.yaml
2026-08-06 06:45:23 +08:00
parent 07d24b005f e88bace07e
commit af5f528903
783 changed files with 15211 additions and 14441 deletions
--- a/packages/acp/acp/README.i18n.yaml
+++ b/packages/acp/acp/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/acp/acp/README.md
-README.md: 7bcf3c2581b25cb3c5223d00c05d9df6a7f6d61e
-README.zh.md: 97a8e9c164bab71cb367ad54ce0bcc19ab4314a9
+README.md: 9cc4a5e271c7200f6ad8799a4b8fa9e64b2ca893
+README.zh.md: 82aa5df2c7d87312d4b619a09582cc0c2d884398
--- a/packages/acp/acp/README.md
+++ b/packages/acp/acp/README.md
@@ -24,7 +24,7 @@ Both fields are optional so another agent/request listener may supply the target
 | `initialize` | Negotiates the supported version and advertises baseline-only prompts (no image, audio, or embedded-context capability). No session, editor, terminal, filesystem, or MCP capability is advertised. |
 | `authenticate` | No-op because the server advertises no authentication methods. |
 | `session/new` | Creates a fresh agent with an absolute primary `cwd`; empty `additionalDirectories` and `mcpServers` are accepted, non-empty values reject. |
-| `session/prompt` | Concatenates text blocks, renders baseline resource links as bracketed textual references, rejects empty or beyond-baseline input, permits one in-flight request per session, and settles from that request's owning durable `turn/end`. |
+| `session/prompt` | Concatenates text blocks, renders baseline resource links as bracketed textual references, rejects empty or beyond-baseline input, permits one in-flight request per session, and waits for the whole agent to become idle. Normal quiescence reports `end_turn`; explicit ACP cancellation, disposal, or a prompt whose admission was discarded (a turnless slot) reports `cancelled`. |
 | `session/cancel` | Cancels only the addressed agent and settles its pending prompt as `cancelled`; unknown ids are no-ops. |
 | `session/update` | Emits one `agent_message_chunk` per non-empty text block in a committed `assistant/message`. Raw deltas and non-message events are omitted. |
 | `session/request_permission` | Offers one-shot allow/reject choices for bridge-owned approval requests carrying a tool call id. Clients may answer automatically. |
@@ -37,6 +37,8 @@ Committed-message output intentionally trades token-by-token latency for a clean

 Client disconnect and Cordis disposal share one memoized teardown. The bridge first rejects new sessions and prompts, settles pending prompts, then drains continuable descendants only below this connection's exact owned Agents before disposing those handles in parallel and awaiting every result before reporting any failure. Other frontends sharing the Context retain their continuable forests and admission. An ACP-only plugin reload therefore leaves no orphan agent.

+ACP requires each prompt response to carry a `stopReason`, but the bridge does not claim a prompt-specific turn outcome. Committed assistant messages stream across the owned activity, and steering or injected work may contribute before idle. Token-limit turn endings therefore do not become prompt-level ACP stop reasons (they settle as `end_turn`); a model error on the correlated turn rejects the prompt immediately.
+
 ## Running

 `pnpm --dir /path/to/deepseek-harness run demo:acp` boots the repository's automation server composition. A parent harness can spawn it through [`@deepseek-ai/dsh-subagent-acp`](../../subagent/subagent-acp/README.md); other ACP clients need only the core methods above.
--- a/packages/acp/acp/README.zh.md
+++ b/packages/acp/acp/README.zh.md
@@ -24,7 +24,7 @@
 | `initialize` | 协商受支持的版本，并仅公布基线提示词（无图像、音频或嵌入上下文能力）。不公布会话、编辑器、终端、文件系统或 MCP 能力。 |
 | `authenticate` | 空操作，因为服务器不公布身份验证方法。 |
 | `session/new` | 以绝对路径作为主 `cwd` 创建新 agent；接受空的 `additionalDirectories` 和 `mcpServers`，拒绝非空值。 |
-| `session/prompt` | 拼接文本块，将基线资源链接渲染为带方括号的文本引用，拒绝空输入或超出基线的输入，每个会话只允许一个正在处理的请求，并根据该请求所属的持久 `turn/end` 结算。 |
+| `session/prompt` | 拼接文本块，将基线资源链接渲染为带方括号的文本引用，拒绝空输入或超出基线的输入，每个会话只允许一个正在处理的请求，并等待整个 agent 进入 idle。正常完全停稳时报告 `end_turn`；显式 ACP 取消、资源释放，或准入被丢弃的提示词（turnless 槽位）时报告 `cancelled`。 |
 | `session/cancel` | 仅取消指定的 agent，并将其待处理提示词结算为 `cancelled`；未知 id 为空操作。 |
 | `session/update` | 为每个非空文本块发出一个 `agent_message_chunk`；这些文本块来自已提交的 `assistant/message`。省略原始增量和非消息事件。 |
 | `session/request_permission` | 为携带工具调用 id、由桥接层拥有的批准请求提供一次性允许／拒绝选项。客户端可以自动回答。 |
@@ -37,6 +37,8 @@

 客户端断开与 Cordis 释放共用同一个记忆化清理流程。桥接层先拒绝新会话和提示词，结算待处理提示词，然后只 drain 此连接确切拥有的 Agent 之下的可继续后代，再并行释放这些 handle，并等待全部结果结算后才报告失败。其他共享该上下文的前端会保留其可继续森林和准入。因此，仅 ACP 的插件重载不会遗留 agent。

+ACP 要求每个提示词响应都携带 `stopReason`，但桥接层不声称它表示提示词专属的轮次结果。已提交的 assistant 消息会在整个自有活动期间流式输出，agent 进入 idle 前发生的 steering（中途引导）或注入工作也可能参与其中。因此，因 token 上限而结束的轮次不会成为提示词级 ACP 停止原因（它们以 `end_turn` 结算）；关联轮次上的模型错误会立即 reject 提示词。
+
 ## 运行

 `pnpm --dir /path/to/deepseek-harness run demo:acp` 启动仓库的自动化服务器组合。父 harness 可以通过 [`@deepseek-ai/dsh-subagent-acp`](../../subagent/subagent-acp/README.md) spawn 它；其他 ACP 客户端只需上述核心方法。
--- a/packages/acp/acp/src/codec.ts
+++ b/packages/acp/acp/src/codec.ts
@@ -17,13 +17,17 @@ export function turnEndToStopReason(reason: TurnEndReason): StopReason {
      return 'end_turn'
    case 'max-tokens':
      return 'max_tokens'
+    // `cancelled` is reserved for explicit client cancellation (`session/cancel`)
+    // and disposal, both settled out of band; a turn aborted by a hook or
+    // another owner is ordinary quiescence and reports `end_turn`.
    case 'aborted':
-    case 'disposed':
+      return 'end_turn'
    case 'interrupted':
      return 'cancelled'
+    case 'blocked':
    case 'error':
      return 'end_turn'
-    // TurnEndReason is merge-extensible; future variants still need a legal wire value.
+    /* v8 ignore next 2 -- TurnEndReason is closed and every member is handled above */
    default:
      return 'end_turn'
  }
--- a/packages/acp/acp/src/index.ts
+++ b/packages/acp/acp/src/index.ts
@@ -90,13 +90,10 @@ interface SessionRecord {
  inflight: {
    resolve: (reason: StopReason) => void
    reject: (error: Error) => void
+    messageId: string
    turn: number | undefined
-    /**
-     * A failed turn's terminal reason, held until quiescence: a retry action
-     * closes the failed turn and opens a successor that adopts the prompt, so
-     * rejecting at `turn/end` would race the recovery.
-     */
-    pendingError: Extract<TurnEndReason, { kind: 'error' }> | undefined
+    /** The correlated turn's ending, set at turn/end and settled at whole-agent idle. */
+    endReason: TurnEndReason | undefined
  } | undefined
 }

@@ -149,7 +146,7 @@ export function apply(ctx: Context, config: AcpConfig): void {
    inflight: NonNullable<SessionRecord['inflight']>,
    reason: Extract<TurnEndReason, { kind: 'error' }>,
  ): void => {
-    inflight.reject(internalError(`turn failed: ${'failure' in reason ? reason.failure.message : reason.message}`))
+    inflight.reject(internalError(`turn failed: ${reason.error.message}`))
  }

  // Emit only committed assistant text. Raw chunks, reasoning, tools, plans,
@@ -174,30 +171,33 @@ export function apply(ctx: Context, config: AcpConfig): void {
      }
    } finally {
      const inflight = record.inflight
-      if (inflight !== undefined && event.type === 'turn/start') {
-        if (inflight.turn === undefined && event.data.trigger.kind === 'message'
-          && event.data.trigger.source.kind === 'user') {
-          inflight.turn = event.data.turn
-        } else if (inflight.pendingError !== undefined && event.data.trigger.kind === 'retry') {
-          // A recovery policy opened a retry turn on the failed history: the
-          // prompt rides it instead of rejecting on the failed turn's end.
-          inflight.turn = event.data.turn
-          inflight.pendingError = undefined
-        }
-      } else if (inflight !== undefined && event.type === 'turn/end' && inflight.turn === event.data.turn) {
+      if (inflight !== undefined && event.type === 'turn/end' && inflight.turn === event.data.turn) {
        if (event.data.reason.kind === 'error') {
-          // Hold the rejection: request recovery may adopt the prompt with a
-          // successor turn; quiescence without one delivers this error.
-          inflight.turn = undefined
-          inflight.pendingError = event.data.reason
-        } else {
+          // Model failures surface immediately as prompt errors; ordinary
+          // endings wait for whole-agent idle below.
          record.inflight = undefined
-          inflight.resolve(turnEndToStopReason(event.data.reason))
+          rejectFromError(inflight, event.data.reason)
+        } else {
+          inflight.endReason = event.data.reason
        }
      }
    }
  })

+  ctx.on('agent/inbox/claimed', (agent, { message, turn }) => {
+    const record = ownedRecord(agent)
+    const inflight = record?.inflight
+    if (inflight !== undefined && inflight.messageId === message.id) inflight.turn = turn
+  })
+
+  ctx.on('agent/error', (agent, turn, _step, error) => {
+    const record = ownedRecord(agent)
+    const inflight = record?.inflight
+    if (record === undefined || inflight === undefined || inflight.turn === turn) return
+    record.inflight = undefined
+    inflight.reject(internalError(`turn failed: ${errorChain(error)}`))
+  })
+
  // Permission requests are a machine policy channel for ACP clients such as
  // dsh-subagent-acp. The bridge offers one-shot choices only and never infers a
  // durable grant from an unknown client response.
@@ -278,17 +278,18 @@ export function apply(ctx: Context, config: AcpConfig): void {
        if (ctx.agents.get(record.agent.id) !== record.agent) {
          throw internalError('prompt was not queued: the agent was disposed outside the bridge')
        }
+        const message = createUserMessage({ content: [{ type: 'text', text }], source: { kind: 'user' } })
        const stopReason = await new Promise<StopReason>((resolve, reject) => {
          // Arm the slot before followup() so a listener-driven synchronous
          // turn cannot slip past correlation; a synchronous followup()
          // failure (invalid input) must free the slot again or the session
          // would reject every later prompt as already in flight.
          const inflight: NonNullable<SessionRecord['inflight']> = {
-            resolve, reject, turn: undefined, pendingError: undefined,
+            resolve, reject, messageId: message.id, turn: undefined, endReason: undefined,
          }
          record.inflight = inflight
          try {
-            record.agent.followup(createUserMessage({ content: [{ type: 'text', text }], source: { kind: 'user' } }))
+            record.agent.followup(message)
            // The machine's send() contains listener failures and accepts
            // any typed input; this guards a future synchronous throw so the
            // slot cannot wedge.
@@ -299,18 +300,21 @@ export function apply(ctx: Context, config: AcpConfig): void {
            throw internalError(`prompt was not queued: ${detail}`)
          }
          /* v8 ignore stop */
-          // Admission is pre-turn and retries outlive their failed turn, so a
-          // turnless slot settles only at quiescence: a held failure rejects
-          // (no retry adopted the prompt); no turn at all means admission
-          // discarded the prompt — report cancelled.
+          // Settlement waits for whole-agent idle: a correlated turn/end arms
+          // `endReason`, while a turnless slot (admission discarded the
+          // prompt) stays cancelled. Other producers may run further turns
+          // before quiescence; the prompt settles only when the agent stops.
          void record.agent.whenIdle().then(() => {
-            if (record.inflight !== inflight || inflight.turn !== undefined) return
+            if (record.inflight !== inflight) return
            record.inflight = undefined
-            if (inflight.pendingError !== undefined) {
-              rejectFromError(inflight, inflight.pendingError)
-              return
+            const end = inflight.endReason
+            if (end === undefined) {
+              inflight.resolve('cancelled')
+            } else {
+              // Token-limit and other non-terminal endings are not prompt-level
+              // stop reasons (see README); only normal quiescence reports end_turn.
+              inflight.resolve(end.kind === 'max-tokens' ? 'end_turn' : turnEndToStopReason(end))
            }
-            inflight.resolve('cancelled')
          })
        })
        return { stopReason }
--- a/packages/acp/acp/tests/approval.spec.ts
+++ b/packages/acp/acp/tests/approval.spec.ts
@@ -20,7 +20,7 @@ describe('ACP machine permission policy', () => {
    await harness.client.initialize({ protocolVersion: PROTOCOL_VERSION, clientCapabilities: {} })
    const { sessionId } = await harness.client.newSession({ cwd: process.cwd(), mcpServers: [] })
    const agent = harness.ctx.agents.get(SessionId(sessionId))!
-    agent.session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    agent.session.append('turn/start', { turn: 1 })
    return { agent, toolName: 'bash', callId: CallId('call-9'), ...overrides }
  }

--- a/packages/acp/acp/tests/codec.spec.ts
+++ b/packages/acp/acp/tests/codec.spec.ts
@@ -1,37 +1,24 @@
 import { describe, expect, it } from 'vitest'
 import type { TurnEndReason } from '@deepseek-ai/dsh-session'
-import { acpPromptToText, promptHasUnsupportedContent, turnEndToStopReason } from '../src/codec.ts'
+import { acpPromptToText, turnEndToStopReason } from '../src/codec.ts'

-describe('ACP automation codec', () => {
-  it('maps every known turn outcome to a legal stop reason', () => {
-    const cases: [TurnEndReason, string][] = [
-      [{ kind: 'completed' }, 'end_turn'],
-      [{ kind: 'max-tokens' }, 'max_tokens'],
-      [{ kind: 'aborted' }, 'cancelled'],
-      [{ kind: 'disposed' }, 'cancelled'],
-      [{ kind: 'interrupted' }, 'cancelled'],
-      [{ kind: 'error', step: 1, message: 'boom' }, 'end_turn'],
-    ]
-    for (const [reason, expected] of cases) expect(turnEndToStopReason(reason)).toBe(expected)
+describe('ACP codec', () => {
+  it.each([
+    [{ kind: 'completed' }, 'end_turn'],
+    [{ kind: 'max-tokens' }, 'max_tokens'],
+    [{ kind: 'aborted', reason: { kind: 'user' } }, 'end_turn'],
+    [{ kind: 'interrupted' }, 'cancelled'],
+    [{ kind: 'blocked' }, 'end_turn'],
+    [{ kind: 'error', error: { message: 'failed', code: 'UNKNOWN' } }, 'end_turn'],
+  ] satisfies Array<[TurnEndReason, string]>)('maps %o to %s', (reason, expected) => {
+    expect(turnEndToStopReason(reason)).toBe(expected)
  })

-  it('uses a legal fallback for merge-extensible future outcomes', () => {
-    expect(turnEndToStopReason({ kind: 'future' } as unknown as TurnEndReason)).toBe('end_turn')
-  })
-
-  it('flattens baseline blocks and rejects everything richer', () => {
-    expect(acpPromptToText([{ type: 'text', text: 'a' }, { type: 'text', text: 'b' }])).toBe('ab')
-    expect(acpPromptToText([
-      { type: 'text', text: 'see' },
-      { type: 'resource_link', name: 'x', uri: 'file:///x' },
-    ])).toBe('see\n[resource_link name="x" uri="file:///x"]\n')
-    expect(acpPromptToText([{ type: 'image', data: '', mimeType: 'image/png' }])).toBe('')
-    expect(promptHasUnsupportedContent([
-      { type: 'text', text: 'ok' },
-      { type: 'resource_link', name: 'x', uri: 'file:///x' },
-    ])).toBe(false)
-    expect(promptHasUnsupportedContent([
-      { type: 'image', data: '', mimeType: 'image/png' },
-    ])).toBe(true)
+  it('drops unsupported blocks from baseline text conversion', () => {
+    expect(acpPromptToText([{
+      type: 'image',
+      data: '',
+      mimeType: 'image/png',
+    }])).toBe('')
  })
 })
--- a/packages/acp/acp/tests/dispose.spec.ts
+++ b/packages/acp/acp/tests/dispose.spec.ts
@@ -67,7 +67,15 @@ describe('ACP connection ownership', () => {
    const agent = harness.ctx.agents.get(SessionId(sessionId))!
    void harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] }).catch(() => {})
    await vi.waitFor(() => { expect(agent.status).toBe('running') })
-    harness.ctx.on('agent/cancel-requested', () => { order.push('parent cancelled') })
+    const cancel = agent.cancel.bind(agent)
+    let cancelObserved = false
+    vi.spyOn(agent, 'cancel').mockImplementation((...args) => {
+      if (!cancelObserved) {
+        cancelObserved = true
+        order.push('parent cancelled')
+      }
+      cancel(...args)
+    })

    const disposal = harness.acpFiber.dispose()
    // A drain can block on persistence, so the bridge's own turn must already be
--- a/packages/acp/acp/tests/turns.spec.ts
+++ b/packages/acp/acp/tests/turns.spec.ts
@@ -31,11 +31,13 @@ describe('ACP prompt lifecycle', () => {
    harness = undefined
  })

-  it('maps a max-token turn without losing its committed text', async () => {
+  it('maps a max-token turn to end_turn without losing its committed text', async () => {
    harness = await makeBridgeHarness({ script: [maxTokensResponse('cut off')] })
    const sessionId = await newSession(harness)
    const result = await harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] })
-    expect(result.stopReason).toBe('max_tokens')
+    // A token-limit turn ending is not a prompt-level stop reason (README):
+    // the prompt settles at whole-agent idle with end_turn.
+    expect(result.stopReason).toBe('end_turn')
    await vi.waitFor(() => { expect(messageText(harness!)).toBe('cut off') })
  })

@@ -49,12 +51,27 @@ describe('ACP prompt lifecycle', () => {

  it('rejects an ordinary plugin failure through the same prompt boundary', async () => {
    harness = await makeBridgeHarness({ script: [textResponse('must not run')] })
-    harness.ctx.on('agent/step', () => { throw new Error('plugin pre-step failed') })
+    harness.ctx.on('agent/pre-step', () => { throw new Error('plugin pre-step failed') })
    const sessionId = await newSession(harness)
    await expect(harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] }))
      .rejects.toThrow(/turn failed: plugin pre-step failed/)
  })

+  it('rejects a turn-start failure before the prompt is claimed', async () => {
+    harness = await makeBridgeHarness({ script: [textResponse('must not run')] })
+    const sessionId = await newSession(harness)
+    const agent = harness.ctx.agents.get(SessionId(sessionId))!
+    const append = agent.session.append.bind(agent.session)
+    vi.spyOn(agent.session, 'append').mockImplementation(((type: string, ...rest: never[]) => {
+      if (type === 'turn/start') throw new Error('turn start unavailable')
+      return (append as (...args: never[]) => unknown)(type as never, ...rest)
+    }) as never)
+
+    await expect(harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] }))
+      .rejects.toThrow(/turn failed: turn start unavailable/)
+    vi.restoreAllMocks()
+  })
+
  it('settles even when an earlier turn observer throws', async () => {
    harness = await makeBridgeHarness({ script: [textResponse('answer')] })
    harness.ctx.on('session/event', (_session, event) => {
@@ -65,13 +82,13 @@ describe('ACP prompt lifecycle', () => {
      .resolves.toEqual({ stopReason: 'end_turn' })
  })

-  it('ignores an injection turn while correlating the owning message turn', async () => {
+  it('correlates the owning prompt when a synchronous injection joins its first step', async () => {
    harness = await makeBridgeHarness({ script: [textResponse('real answer')] })
    const sessionId = await newSession(harness)
    const agent = harness.ctx.agents.get(SessionId(sessionId))!
    let injected = false
-    harness.ctx.on('agent/inbox/enqueue', (subject) => {
-      if (subject === agent && !injected) {
+    harness.ctx.on('agent/inbox/inserted', (subject, { message }) => {
+      if (subject === agent && message.source.kind === 'user' && !injected) {
        injected = true
        agent.inject(createUserMessage({ content: [{ type: 'text', text: 'context' }], source: { kind: 'plugin', plugin: 'test' } }))
      }
@@ -86,30 +103,44 @@ describe('ACP prompt lifecycle', () => {
    harness = await makeBridgeHarness({ script: ['hang'] })
    const sessionId = await newSession(harness)
    const agent = harness.ctx.agents.get(SessionId(sessionId))!
-    let inserted = false
-    harness.ctx.on('agent/inbox/enqueue', (subject, item) => {
-      if (subject !== agent || item.message.source.kind !== 'user' || inserted) return
-      inserted = true
-      const source = { kind: 'plugin', plugin: 'test' } as const
-      agent.session.append('turn/start', { turn: 1, trigger: { kind: 'message', source } })
-      agent.session.append('user/message', createUserMessage({
-        content: [{ type: 'text', text: 'autonomous work' }],
-        source,
-      }), { surfaceOp: 'append' })
-      agent.session.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
+    let autonomousStarted!: () => void
+    const started = new Promise<void>((resolve) => { autonomousStarted = resolve })
+    harness.ctx.on('session/event', (session, event) => {
+      if (session === agent.session && event.type === 'assistant/chunk') autonomousStarted()
    })
+    agent.followup(createUserMessage({
+      content: [{ type: 'text', text: 'autonomous work' }],
+      source: { kind: 'plugin', plugin: 'test' },
+    }))
+    await started

    let settled = false
    const prompt = harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] })
      .finally(() => { settled = true })
    await vi.waitFor(() => {
-      expect(agent.session.events.filter(event => event.type === 'turn/start')).toHaveLength(2)
+      expect(agent.session.events.filter(event => event.type === 'agent/inbox/spliced'
+        && event.data.inserted.length > 0)).toHaveLength(2)
    })
    expect(settled).toBe(false)
    await harness.client.cancel({ sessionId })
    await expect(prompt).resolves.toEqual({ stopReason: 'cancelled' })
  })

+  it('correlates a prompt whose step history is replaced', async () => {
+    harness = await makeBridgeHarness({ script: [textResponse('rewritten answer')] })
+    harness.ctx.on('agent/pre-step', async () => ({
+      kind: 'enter',
+      messages: [createUserMessage({
+        content: [{ type: 'text', text: 'rewritten prompt' }],
+        source: { kind: 'plugin', plugin: 'test' },
+      })],
+    }))
+    const sessionId = await newSession(harness)
+
+    await expect(harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'original' }] }))
+      .resolves.toEqual({ stopReason: 'end_turn' })
+  })
+
  it('frees the prompt slot when the agent rejects the send synchronously', async () => {
    harness = await makeBridgeHarness({ script: [] })
    const sessionId = await newSession(harness)
@@ -143,7 +174,39 @@ describe('ACP prompt lifecycle', () => {
    await harness.client.cancel({ sessionId })
    await expect(prompt).resolves.toEqual({ stopReason: 'cancelled' })
    await agent.whenIdle()
-    expect(agent.session.events.findLast(event => event.type === 'turn/end')?.data.reason).toEqual({ kind: 'aborted' })
+    expect(agent.session.events.findLast(event => event.type === 'turn/end')?.data.reason)
+      .toEqual({ kind: 'aborted', reason: { kind: 'user' } })
+  })
+
+  it('settles a hook-cancelled turn as end_turn, not cancelled', async () => {
+    harness = await makeBridgeHarness({ script: ['hang'] })
+    const sessionId = await newSession(harness)
+    const prompt = harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] })
+    const agent = harness.ctx.agents.get(SessionId(sessionId))!
+    await vi.waitFor(() => { expect(agent.status).toBe('running') })
+    // A hook or another owner cancels the agent: the ACP client never called
+    // session/cancel, so this is ordinary quiescence and reports end_turn.
+    agent.cancel({ kind: 'hook', reason: 'owner intervention' })
+    await expect(prompt).resolves.toEqual({ stopReason: 'end_turn' })
+  })
+
+  it('cancels autonomous running work without an in-flight prompt', async () => {
+    harness = await makeBridgeHarness({ script: ['hang'] })
+    const sessionId = await newSession(harness)
+    const agent = harness.ctx.agents.get(SessionId(sessionId))!
+    agent.followup(createUserMessage({
+      content: [{ type: 'text', text: 'autonomous work' }],
+      source: { kind: 'plugin', plugin: 'test' },
+    }))
+    await vi.waitFor(() => {
+      expect(agent.session.events.some(event => event.type === 'turn/start')).toBe(true)
+    })
+
+    await harness.client.cancel({ sessionId })
+    await agent.whenIdle()
+
+    expect(agent.session.events.findLast(event => event.type === 'turn/end')?.data.reason)
+      .toEqual({ kind: 'aborted', reason: { kind: 'user' } })
  })

  it('an idle cancel does not affect the following prompt', async () => {
@@ -184,7 +247,7 @@ describe('ACP prompt lifecycle', () => {
    await vi.waitFor(() => { expect(messageText(harness!)).toBe('recovered') })
  })

-  it('a failed turn with no retry still rejects, at quiescence', async () => {
+  it('a failed turn with no retry still rejects', async () => {
    harness = await makeBridgeHarness({ script: [errorResponse('terminal boom')] })
    let offered = 0
    harness.ctx.on('agent/request-error', async () => { offered += 1 })
@@ -194,13 +257,36 @@ describe('ACP prompt lifecycle', () => {
    expect(offered).toBe(1)
  })

-  it('an admission-blocked prompt settles cancelled instead of hanging', async () => {
+  it('a pre-step-rejected prompt settles instead of hanging', async () => {
    harness = await makeBridgeHarness({ script: [] })
-    harness.ctx.on('agent/prompt-submit', async () => ({ kind: 'block' as const, reason: 'policy said no' }))
+    harness.ctx.on('agent/pre-step', async () => ({
+      kind: 'reject' as const,
+    }))
    const sessionId = await newSession(harness)
    await expect(harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] }))
-      .resolves.toEqual({ stopReason: 'cancelled' })
-    // The blocked prompt opened no turn and streamed nothing.
+      .resolves.toEqual({ stopReason: 'end_turn' })
+    // The rejected prompt closed a blocked turn without streaming anything.
    expect(messageText(harness)).toBe('')
  })
+
+  it('cancels a prompt removed before its turn claims it', async () => {
+    harness = await makeBridgeHarness({ script: [] })
+    const sessionId = await newSession(harness)
+    const dispose = harness.ctx.on('agent/inbox/inserted', (agent, { message }) => {
+      if (message.source.kind === 'user') agent.inbox.remove(message.id)
+    })
+
+    await expect(harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] }))
+      .resolves.toEqual({ stopReason: 'cancelled' })
+    dispose()
+  })
+
+  it('rejects a prompt when pre-step fails inside its open turn', async () => {
+    harness = await makeBridgeHarness({ script: [] })
+    harness.ctx.on('agent/pre-step', async () => { throw new Error('pre-step exploded') })
+    const sessionId = await newSession(harness)
+
+    await expect(harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] }))
+      .rejects.toThrow(/turn failed: pre-step exploded/)
+  })
 })
--- a/packages/bash/bash/README.i18n.yaml
+++ b/packages/bash/bash/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/bash/bash/README.md
-README.md: e459037205730455cc9bd3afb248d3a5541ce241
-README.zh.md: d5acab202d81b72d8524b291a0b6550ce45eae2f
+README.md: 88f519a21a0889d6b7649502c51077940c23709f
+README.zh.md: 294044692133da8baa57583146352e84c1ff9946
--- a/packages/bash/bash/README.md
+++ b/packages/bash/bash/README.md
@@ -35,6 +35,8 @@ The per-session sandbox-mode override vocabulary (the `'sandbox/mode'` event, th

 `stdin` and ordinary `env` are set by in-process plugins (the hooks bridges, native plugins) to feed a hook command its JSON payload and `CLAUDE_PROJECT_DIR`/`CLAUDE_PLUGIN_ROOT` values. `dshEnv` is a separate trusted overlay restricted by type to managed keys; the exported `DSH_ENV_PREFIX` is the single source for that namespace, its `DshEnvironmentKey` template type, executor scrubbing, registry validation, derived built-in names, and model guidance. Model bash uses the current snapshot collected by `ctx.bashEnv`. Implementations remove inherited managed keys, then merge `dshEnv` after ordinary `env`, so an omitted current fact cannot fall back to stale ambient state and an `env` entry cannot displace a managed value. The model-facing tool exposes none of these as parameters. All three remain optional on the resolved spec; absent means no input/overlay. See [the bash-stdin-env Agent Note](../../../.agents/notes/implemented/architecture/2026-06-30-bash-stdin-env-trusted-plugin-surface.md) and [the session environment Agent Note](../../../.agents/notes/implemented/feature/2026-07-10-agent-session-identity-and-log-location.md).

+The exported `parseExitStatus` (with `ParsedExitStatus`) is the shared rendering contract half of the shell tools: the inverse of the `[exit code: N]` / `[killed by signal: X]` markers `dsh-tool-bash`'s `renderResult` and `dsh-tool-pwsh`'s `renderPwshResult` append. Both tools' `presentResult` use it to split the rendered text into the terminal card's output body and its exit-status pill; it lives on the seam so the two tools never drift on the marker contract.
+
 ## Model Experience

 Indirectly, through `dsh-tool-bash`, which turns executor output and sandbox facts into guidance and retained tool-result tokens.
--- a/packages/bash/bash/README.zh.md
+++ b/packages/bash/bash/README.zh.md
@@ -35,6 +35,8 @@

 `stdin` 与普通 `env` 由同进程插件（hooks 桥接、原生插件）设置，用于向 hook 命令提供其 JSON payload 和 `CLAUDE_PROJECT_DIR`／`CLAUDE_PLUGIN_ROOT` 值。`dshEnv` 是受类型限制、仅允许受管 key 的独立受信任 overlay；导出的 `DSH_ENV_PREFIX` 是该 namespace、其 `DshEnvironmentKey` 模板类型、执行器清理、注册表验证、派生内置名称与模型指引的统一来源。模型 bash 使用 `ctx.bashEnv` 收集的当前快照。实现会移除继承的受管 key，再在普通 `env` 之后合并 `dshEnv`，因此省略的当前事实不会回退到陈旧环境状态，`env` 条目也无法顶掉受管值。面向模型的工具不将这三者中的任何一个公开为参数。这三者在已解析 spec 上仍然可选；缺失表示没有输入／overlay。详见 [bash-stdin-env Agent Note](../../../.agents/notes/implemented/architecture/2026-06-30-bash-stdin-env-trusted-plugin-surface.md) 与 [会话环境 Agent Note](../../../.agents/notes/implemented/feature/2026-07-10-agent-session-identity-and-log-location.md)。

+导出的 `parseExitStatus`（连同 `ParsedExitStatus`）是 shell 工具共享渲染契约的另一半：`dsh-tool-bash` 的 `renderResult` 与 `dsh-tool-pwsh` 的 `renderPwshResult` 追加的 `[exit code: N]`／`[killed by signal: X]` marker 的逆解析。两个工具的 `presentResult` 都用它把渲染文本拆成 terminal 卡的输出正文与其退出状态 pill；它放在 seam 上，两个工具便永远不会在 marker 契约上漂移。
+
 ## 模型体验

 通过 `dsh-tool-bash` 间接影响；该工具会将执行器输出与沙箱事实转为指引和保留的工具结果 token。
--- a/packages/bash/bash/src/index.ts
+++ b/packages/bash/bash/src/index.ts
@@ -22,6 +22,8 @@ export type {
  DshEnvironment,
  DshEnvironmentKey,
 } from './types.ts'
+export { parseExitStatus } from './render.ts'
+export type { ParsedExitStatus } from './render.ts'

 declare module 'cordis' {
  interface Context {
--- a/packages/bash/bash/src/render.ts
+++ b/packages/bash/bash/src/render.ts
@@ -0,0 +1,42 @@
+/**
+ * Shared rendering helpers for the shell tools (`dsh-tool-bash`,
+ * `dsh-tool-pwsh`): the exit-status marker contract the tools' renderers
+ * emit and the presentation layer parses back.
+ * @module @deepseek-ai/dsh-bash/render
+ */
+
+/**
+ * The exit status recovered from a rendered result, with the output body that
+ * status was split off from.
+ */
+export type ParsedExitStatus =
+  & { body: string }
+  & ({ exitCode: number } | { signal: string })
+
+/**
+ * Split a rendered shell-tool result string into its output body and the
+ * structured exit status — the inverse of the `[exit code: N]` /
+ * `[killed by signal: X]` markers the shell tools' renderers append. A killed
+ * marker yields `signal`; otherwise a non-zero marker yields `exitCode`;
+ * absent both means a clean exit 0.
+ *
+ * The consumed marker is removed from `body` because a terminal presentation
+ * shows the exit status as its own pill: leaving the marker in the output
+ * would render the exit twice. Other markers (timeout, sandbox denial) carry
+ * facts no pill shows, so they stay in the body.
+ *
+ * Replay only retains the rendered content text, not the original
+ * `BashRunResult`, so terminal presentation must recover the exit pill here.
+ * Requiring a leading newline and the end of the string keeps ordinary output
+ * that merely ends with marker-like text from matching unless the final line
+ * is indistinguishable from a real marker.
+ * @param text - rendered model-facing shell-tool result.
+ * @returns the marker-free body plus the recovered terminal exit code or signal.
+ */
+export function parseExitStatus(text: string): ParsedExitStatus {
+  const signal = /\n\[killed by signal: ([^\]\n]+)\]$/.exec(text)
+  if (signal?.[1] !== undefined) return { body: text.slice(0, signal.index), signal: signal[1] }
+  const exit = /\n\[exit code: (\d+)\]$/.exec(text)
+  if (exit?.[1] !== undefined) return { body: text.slice(0, exit.index), exitCode: Number(exit[1]) }
+  return { body: text, exitCode: 0 }
+}
--- a/packages/bash/bash/tests/render.spec.ts
+++ b/packages/bash/bash/tests/render.spec.ts
@@ -0,0 +1,36 @@
+/**
+ * Shared exit-status parse contract: the inverse of the `[exit code: N]` /
+ * `[killed by signal: X]` markers `dsh-tool-bash` and `dsh-tool-pwsh` append.
+ * Both tools' presenter suites round-trip their own renderers through this
+ * parse; this spec pins the parse's own edges (marker-like output, body
+ * slicing) once, at the seam that owns it.
+ */
+
+import { describe, expect, it } from 'vitest'
+import { parseExitStatus } from '../src/render.ts'
+
+describe('parseExitStatus', () => {
+  it('recovers a clean exit 0 with the body verbatim when no marker is present', () => {
+    expect(parseExitStatus('hi\n\n')).toEqual({ body: 'hi\n\n', exitCode: 0 })
+    expect(parseExitStatus('')).toEqual({ body: '', exitCode: 0 })
+  })
+
+  it('recovers a non-zero exit and strips only its marker from the body', () => {
+    expect(parseExitStatus('oops\n[exit code: 3]')).toEqual({ body: 'oops', exitCode: 3 })
+    // The marker needs the leading newline and the end of the string, so a
+    // clean result whose output merely ENDS in marker-like text is not read
+    // as a failure and the text stays in the body.
+    expect(parseExitStatus('[exit code: 5]')).toEqual({ body: '[exit code: 5]', exitCode: 0 })
+  })
+
+  it('recovers a signal kill ahead of any non-zero exit marker', () => {
+    expect(parseExitStatus('gone\n[killed by signal: SIGKILL]')).toEqual({ body: 'gone', signal: 'SIGKILL' })
+    // A fake signal marker with no leading newline is output, not a kill.
+    expect(parseExitStatus('[killed by signal: SIGKILL]')).toEqual({ body: '[killed by signal: SIGKILL]', exitCode: 0 })
+  })
+
+  it('keeps markers no pill shows (timeout) in the body', () => {
+    expect(parseExitStatus('slow\n[timed out after 100ms]\n[exit code: 143]'))
+      .toEqual({ body: 'slow\n[timed out after 100ms]', exitCode: 143 })
+  })
+})
--- a/packages/bash/tool-bash/src/render.ts
+++ b/packages/bash/tool-bash/src/render.ts
@@ -95,36 +95,9 @@ export function renderProcessRead(
 }

 /**
- * The exit status recovered from a rendered result, with the output body that
- * status was split off from.
+ * The exit-status parse is the shared marker-contract half of the shell-tool
+ * rendering story, owned by `@deepseek-ai/dsh-bash` so `dsh-tool-pwsh` reuses
+ * it (its renderer emits the same markers). Re-exported here to keep
+ * `../src/render.ts` a single import root for bash-tool consumers.
 */
-export type ParsedExitStatus =
-  & { body: string }
-  & ({ exitCode: number } | { signal: string })
-
-/**
- * Split a rendered {@link renderResult} string into its output body and the
- * structured exit status — the inverse of the status markers it appends. A
- * killed marker yields `signal`; otherwise a non-zero marker yields `exitCode`;
- * absent both means a clean exit 0.
- *
- * The consumed marker is removed from `body` because a terminal presentation
- * shows the exit status as its own pill: leaving the marker in the output would
- * render the exit twice. Other markers (timeout, sandbox denial) carry facts no
- * pill shows, so they stay in the body.
- *
- * Replay only retains the rendered content text, not the original
- * `BashRunResult`, so terminal presentation must recover the exit pill here.
- * Requiring a leading newline and the end of the string keeps ordinary output
- * that merely ends with marker-like text from matching unless the final line
- * is indistinguishable from a real marker.
- * @param text - rendered model-facing bash result.
- * @returns the marker-free body plus the recovered terminal exit code or signal.
- */
-export function parseExitStatus(text: string): ParsedExitStatus {
-  const signal = /\n\[killed by signal: ([^\]\n]+)\]$/.exec(text)
-  if (signal?.[1] !== undefined) return { body: text.slice(0, signal.index), signal: signal[1] }
-  const exit = /\n\[exit code: (\d+)\]$/.exec(text)
-  if (exit?.[1] !== undefined) return { body: text.slice(0, exit.index), exitCode: Number(exit[1]) }
-  return { body: text, exitCode: 0 }
-}
+export { parseExitStatus, type ParsedExitStatus } from '@deepseek-ai/dsh-bash'
--- a/packages/bash/tool-bash/tests/integration.spec.ts
+++ b/packages/bash/tool-bash/tests/integration.spec.ts
@@ -174,7 +174,7 @@ describe('bash tool through the agent loop', () => {
    expect(resultText(toolResult)).toContain('[exit code: 9]')
  })

-  it('background: start ack → completion notice as user/message → task_output collects it', async () => {
+  it('background: start ack → pending completion notice → task_output collects it', async () => {
    // The task id is deterministic (a fresh LocalTaskService counts per kind from 1),
    // so the script can name `bash-1` without threading a generated id.
    const adapter = new MockAdapter([
@@ -194,20 +194,22 @@ describe('bash tool through the agent loop', () => {
    expect(resultText(firstResult)).toBe('started background task bash-1')

    // The task settles on its own; the tool-tasks notice listener injects a
-    // durable plugin-sourced user/message into the owning agent's session
-    // (settlement may race turn end, so poll for it).
+    // pending next-step message without waking the idle agent.
    const isNotice = (e: SessionEvent): e is SessionEvent<'user/message'> =>
      e.type === 'user/message' && e.data.source.kind === 'plugin'
-    await pollUntil(() => events(agent).some(isNotice))
-    const notice = events(agent).find(isNotice)!
-    expect(notice.data.content.some(
+    await pollUntil(() => agent.inbox.nextStep.some(message => message.source.kind === 'plugin'))
+    const pendingNotice = agent.inbox.nextStep.find(message => message.source.kind === 'plugin')!
+    expect(pendingNotice.content.some(
      block => block.type === 'text' && block.text.includes('background task bash-1 (bash: echo bg-ok) finished'),
    )).toBe(true)
-    expect(notice.data.source).toEqual({ kind: 'plugin', plugin: 'tool-tasks' })
+    expect(pendingNotice.source).toEqual({ kind: 'plugin', plugin: 'tool-tasks' })

-    // The next turn collects the output through the generic task tool.
+    // The next turn first admits that notice as user/message, then collects
+    // the output through the generic task tool.
    agent.followup(createUserMessage({ content: [{ type: 'text', text: 'collect it' }], source: { kind: 'user' } }))
    await waitForIdle(ctx, agent)
+    const notice = events(agent).find(isNotice)!
+    expect(notice.data).toEqual(pendingNotice)
    const readResult = findEvent(events(agent), 'tool/result', 'last')
    expect(readResult.data.message.content[0].isError).toBe(false)
    expect(resultText(readResult)).toContain('bg-ok')
--- a/packages/bash/tool-pwsh/README.i18n.yaml
+++ b/packages/bash/tool-pwsh/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/bash/tool-pwsh/README.md
-README.md: dfe26a63684d61dcdd6f969c2c2261dac79325c7
-README.zh.md: 87a30130c2f4c56be34199dca39399c45eb4b323
+README.md: 78eb161f77b9524bc577b273abe59db6b931727c
+README.zh.md: 17696fe6d908838aaaca12e8179f2ad9cb780210
--- a/packages/bash/tool-pwsh/README.md
+++ b/packages/bash/tool-pwsh/README.md
@@ -36,7 +36,7 @@ When `run_in_background` is true, this plugin preflights `ctx.tasks.start()` bef

 ## UI presentation

-The tool owns its `presentCall`/`presentResult` render intent. A foreground call is a `terminal` card carrying command, description, and optional cwd; a `run_in_background` call is a `generic` card with the raw command, mirroring the bash tool's background presentation. A completed result is a `generic` card with the rendered output in a `console` fence. The bash tool's terminal card with its parsed exit-status pill has no pwsh counterpart yet — a PowerShell-aware presentation is roadmap work. These presenters are pure and replay-safe.
+The tool owns its `presentCall`/`presentResult` render intent. A foreground call is a `terminal` card carrying command, description, and optional cwd; a `run_in_background` call is a `generic` card with the raw command, mirroring the bash tool's background presentation. A completed foreground result is a `terminal` card too: the exit marker becomes the card's exit-status pill (`exitCode`/`signal`), and the marker-free body is the card's output — exactly the bash tool's terminal-card story, via the shared exit-status parse from `@deepseek-ai/dsh-bash`. Background acks and execution errors stay `generic` cards with the rendered output in a `console` fence. These presenters are pure and replay-safe.

 ## Model Experience

@@ -121,5 +121,4 @@ Append-only; newly visible content follows the reusable request prefix and does
 - **No sandbox escalation** — `sandbox_permissions`/`justification` are absent; escalation waits for a Windows-confining executor (the bash tool's sandbox surface is not mirrored).
 - **No persistent shell or PTY** — every call starts a fresh `pwsh -Command`; the PTY backends are Linux/macOS-only today, and a Windows ConPTY persistent shell is roadmap work.
 - **PowerShell-dialect contract** — the model must write PowerShell (native paths, `$env:` variables), not bash; there is no dialect translation.
- **Generic UI presentation** — results use the generic card; a PowerShell-aware terminal card with exit-status pill is roadmap work.
 - **Session-cwd identity is not canonicalized** — the workdir base is the session header cwd as-is, unlike the bash tool's sandbox-root-canonicalized identity; only the sandbox-less case applies here.
--- a/packages/bash/tool-pwsh/README.zh.md
+++ b/packages/bash/tool-pwsh/README.zh.md
@@ -36,7 +36,7 @@

 ## UI presentation

-工具拥有自己的 `presentCall`/`presentResult` 呈现意图。前台调用是携带命令、描述与可选 cwd 的 `terminal` 卡；`run_in_background` 调用是携带原始命令的 `generic` 卡，镜像 bash 工具的后台呈现。完成的结果是以 `console` 围栏包裹渲染输出的 `generic` 卡。bash 工具那种带解析退出状态 pill 的 terminal 卡在 pwsh 侧暂无对应——PowerShell 感知的呈现属于路线图工作。这些 presenter 是纯函数且可重放。
+工具拥有自己的 `presentCall`/`presentResult` 呈现意图。前台调用是携带命令、描述与可选 cwd 的 `terminal` 卡；`run_in_background` 调用是携带原始命令的 `generic` 卡，镜像 bash 工具的后台呈现。完成的前台结果同样是 `terminal` 卡：退出 marker 变成卡片的退出状态 pill（`exitCode`/`signal`），去 marker 的正文成为卡片输出——与 bash 工具的 terminal 卡故事完全一致，经由 `@deepseek-ai/dsh-bash` 的共享退出状态解析。后台 ack 与执行错误保持 `generic` 卡，以 `console` 围栏包裹渲染输出。这些 presenter 是纯函数且可重放。

 ## Model Experience

@@ -121,5 +121,4 @@ ack 是固定短行；任务输出按读取有界。
 - **无 sandbox 升级** — 没有 `sandbox_permissions`/`justification`；升级等待 Windows-confining 执行器（bash 工具的 sandbox 面不被镜像）。
 - **无持久 shell 或 PTY** — 每次调用都启动全新的 `pwsh -Command`；PTY 后端目前仅限 Linux/macOS，Windows ConPTY 持久 shell 属于路线图工作。
 - **PowerShell 方言契约** — 模型必须写 PowerShell（原生路径、`$env:` 变量），而不是 bash；没有方言翻译。
- **通用 UI 呈现** — 结果使用 generic 卡；带退出状态 pill 的 PowerShell 感知 terminal 卡属于路线图工作。
 - **会话 cwd 身份不做规范化** — workdir 基座直接取会话头 cwd 原值，不同于 bash 工具经 sandbox-root 规范化的身份；此处只涉及无 sandbox 场景。
--- a/packages/bash/tool-pwsh/src/index.ts
+++ b/packages/bash/tool-pwsh/src/index.ts
@@ -8,8 +8,9 @@
 * foreground and `run_in_background` execution (background handles register
 * with the generic `ctx.tasks` runtime), the managed `DSH_*` environment
 * through the shared `bash-env` registry, and the bash marker/truncation
- * rendering story. UI presentation stays on the existing generic/terminal
- * cards; a pwsh-specific rendering twin is roadmap work.
+ * rendering story. UI presentation mirrors the bash tool's too: a completed
+ * foreground call is a terminal card with the parsed exit-status pill, using
+ * the shared exit-status parse from `@deepseek-ai/dsh-bash`.
 *
 * @module @deepseek-ai/dsh-tool-pwsh
 */
@@ -25,6 +26,7 @@ import type {} from '@deepseek-ai/dsh-system-prompt'
 import type {} from '@deepseek-ai/dsh-tasks'
 import type {} from '@deepseek-ai/dsh-bash-env'
 import type { BashRunResult } from '@deepseek-ai/dsh-bash'
+import { parseExitStatus } from '@deepseek-ai/dsh-bash'
 import { processOutcome } from './background.ts'
 import { renderPwshProcessRead, renderPwshResult } from './render.ts'

@@ -297,10 +299,20 @@ export function apply(ctx: Context, config: Config = {}): void {
      }
    },
    /* jscpd:ignore-end */
-    presentResult: (_args: unknown, result: ToolResult): ToolResultView | undefined => {
+    /* jscpd:ignore-start -- the completed-result presentation mirrors presentBashResult's by design (Agent Note). */
+    presentResult: (args: unknown, result: ToolResult): ToolResultView | undefined => {
      const block = result.content.length === 1 ? result.content[0] : undefined
      if (block === undefined || block.type !== 'text') return undefined
-      return { card: 'generic', content: [{ type: 'text', text: `\`\`\`console\n${block.text.replace(/\n+$/, '')}\n\`\`\`` }] }
+      const raw = block.text
+      const isBackground = typeof args === 'object' && args !== null && (args as { run_in_background?: unknown }).run_in_background === true
+      // Background acknowledgements and errors have no terminal exit status.
+      if (isBackground || result.isError) {
+        return { card: 'generic', content: [{ type: 'text', text: `\`\`\`console\n${raw.replace(/\n+$/, '')}\n\`\`\`` }] }
+      }
+      // The exit marker becomes the card's exit pill, so it leaves the output body.
+      const { body, ...exit } = parseExitStatus(raw)
+      return { card: 'terminal', output: body, ...exit }
    },
+    /* jscpd:ignore-end */
  }))
 }
--- a/packages/bash/tool-pwsh/tests/tools.spec.ts
+++ b/packages/bash/tool-pwsh/tests/tools.spec.ts
@@ -28,7 +28,7 @@ import * as ToolPwsh from '@deepseek-ai/dsh-tool-pwsh'
 import * as BashEnvPlugin from '@deepseek-ai/dsh-bash-env'
 import type { BashProcessRead } from '@deepseek-ai/dsh-bash'
 import { processOutcome } from '../src/background.ts'
-import { renderPwshProcessRead } from '../src/render.ts'
+import { renderPwshProcessRead, renderPwshResult } from '../src/render.ts'

 const testToolSignal = new AbortController().signal

@@ -516,16 +516,16 @@ describe('background execution through the task runtime', () => {
 })

 describe('UI presentation', () => {
-  it('a real execute renders the console view through the tool definition presenter', async () => {
+  it('a real execute presents a completed foreground run as a terminal card with the parsed exit pill', async () => {
    const { ctx, bash } = await setup()
    bash.handler = () => runResult('hi\n')
    const args = { command: 'Write-Output hi', description: 'say hi' }
    const result = await call(ctx, 'pwsh', args)
    const view = ctx.tools.get('pwsh')?.presentResult?.(args, result)
-    expect(view).toEqual({
-      card: 'generic',
-      content: [{ type: 'text', text: '```console\nhi\n```' }],
-    })
+    // A terminal result keeps the RAW bytes (newlines intact) a terminal
+    // renderer needs; a clean run renders no exit marker, so the body is the
+    // raw output with a clean exit-0 pill, mirroring the bash tool.
+    expect(view).toEqual({ card: 'terminal', output: 'hi\n', exitCode: 0 })
  })

  it('the pending call view is a terminal card carrying command, description, and optional cwd', async () => {
@@ -553,6 +553,83 @@ describe('UI presentation', () => {
    })
  })

+  it('presentResult: a non-zero exit and a signal kill parse into exitCode / signal', async () => {
+    const { ctx } = await setup()
+    const present = ctx.tools.get('pwsh')
+    const args = { command: 'x', description: 'x' }
+    expect(present?.presentResult?.(args, { content: [{ type: 'text', text: 'oops\n[exit code: 3]' }], isError: false }))
+      .toEqual({ card: 'terminal', output: 'oops', exitCode: 3 })
+    expect(present?.presentResult?.(args, { content: [{ type: 'text', text: 'gone\n[killed by signal: SIGKILL]' }], isError: false }))
+      .toEqual({ card: 'terminal', output: 'gone', signal: 'SIGKILL' })
+  })
+
+  it('presentResult: markers a pill CANNOT show (timeout) stay in the terminal output', async () => {
+    const { ctx } = await setup()
+    const args = { command: 'x', description: 'x' }
+    expect(ctx.tools.get('pwsh')?.presentResult?.(
+      args,
+      { content: [{ type: 'text', text: 'slow\n[timed out after 100ms]\n[exit code: 143]' }], isError: false },
+    )).toEqual({ card: 'terminal', output: 'slow\n[timed out after 100ms]', exitCode: 143 })
+  })
+
+  it('presentResult exit parse is the inverse of renderPwshResult markers (round-trip)', async () => {
+    const { ctx } = await setup()
+    const present = ctx.tools.get('pwsh')!
+    const base = {
+      aborted: false,
+      timeoutMs: 1000,
+      stdout: { text: 'out', truncated: false },
+      stderr: { text: '', truncated: false },
+    }
+    const cases = [
+      { result: { ...base, exitCode: 0, signal: null, timedOut: false }, expect: { exitCode: 0 } },
+      { result: { ...base, exitCode: 7, signal: null, timedOut: false }, expect: { exitCode: 7 } },
+      { result: { ...base, exitCode: null, signal: 'SIGTERM' as const, timedOut: false }, expect: { signal: 'SIGTERM' } },
+      // A trapped-timeout run that exits 0 has no signal/exit marker → reads as exit 0 (it did exit 0).
+      { result: { ...base, exitCode: 0, signal: null, timedOut: true }, expect: { exitCode: 0 } },
+    ]
+    for (const c of cases) {
+      const rendered = renderPwshResult(c.result)
+      const out = present.presentResult!({ command: 'x', description: 'x' }, { content: [{ type: 'text', text: rendered }], isError: false })
+      // Drop card + output; the remaining fields are the parsed exit.
+      const { card: _c, output, ...exit } = out as { card: string; output?: string; exitCode?: number; signal?: string }
+      expect(exit).toEqual(c.expect)
+      // Whatever the parse consumed is gone from the body, so a card with an
+      // exit pill never shows the same status twice.
+      expect(output).not.toMatch(/\[exit code: \d+\]|\[killed by signal: /)
+    }
+  })
+
+  it('presentResult: a clean exit-0 whose output ENDS in marker-like text is NOT read as a failure', async () => {
+    const { ctx } = await setup()
+    const args = { command: 'Write-Output "[exit code: 5]"', description: 'print' }
+    // A successful command may print marker-like text. A clean result appends no marker or
+    // newline; parsing requires the leading newline emitted for real markers, so this stays exit 0.
+    const out = ctx.tools.get('pwsh')!.presentResult!(args, { content: [{ type: 'text', text: '[exit code: 5]' }], isError: false })
+    expect(out).toEqual({ card: 'terminal', output: '[exit code: 5]', exitCode: 0 })
+    // Same for a fake signal marker with no leading newline.
+    const sig = ctx.tools.get('pwsh')!.presentResult!(args, { content: [{ type: 'text', text: '[killed by signal: SIGKILL]' }], isError: false })
+    expect(sig).toEqual({ card: 'terminal', output: '[killed by signal: SIGKILL]', exitCode: 0 })
+  })
+
+  it('presentResult: a run_in_background ack is a generic card and carries no exit pill', async () => {
+    const { ctx } = await setup()
+    const result = ctx.tools.get('pwsh')!.presentResult!(
+      { command: 'Start-Sleep -Seconds 60', description: 'long wait', run_in_background: true },
+      { content: [{ type: 'text', text: 'started background task pwsh-1' }], isError: false },
+    )
+    expect(result).toEqual({ card: 'generic', content: [{ type: 'text', text: '```console\nstarted background task pwsh-1\n```' }] })
+  })
+
+  it('presentResult: an isError result is a generic card (no real process exit to report)', async () => {
+    const { ctx } = await setup()
+    const out = ctx.tools.get('pwsh')!.presentResult!(
+      { command: 'x', description: 'x' },
+      { content: [{ type: 'text', text: 'tool call aborted' }], isError: true },
+    )
+    expect(out).toEqual({ card: 'generic', content: [{ type: 'text', text: '```console\ntool call aborted\n```' }] })
+  })
+
  it('presentResult falls back to undefined for multi-block or non-text content', async () => {
    const { ctx } = await setup()
    const definition = ctx.tools.get('pwsh')
--- a/packages/bundle/headless/package.json
+++ b/packages/bundle/headless/package.json
@@ -33,6 +33,7 @@
    "schemastery": "^3.18.0"
  },
  "peerDependencies": {
+    "@deepseek-ai/dsh-agent": "^0.0.1",
    "@deepseek-ai/dsh-host-apiproxy": "^0.0.1",
    "@deepseek-ai/dsh-host-webserver": "^0.0.1",
    "@deepseek-ai/dsh-invariants": "^0.0.1",
@@ -40,6 +41,7 @@
    "cordis": "^4.0.0-rc.7"
  },
  "devDependencies": {
+    "@deepseek-ai/dsh-agent": "workspace:^",
    "@deepseek-ai/dsh-host-apiproxy": "workspace:^",
    "@deepseek-ai/dsh-host-webserver": "workspace:^",
    "@deepseek-ai/dsh-invariants": "workspace:^",
--- a/packages/bundle/headless/src/index.ts
+++ b/packages/bundle/headless/src/index.ts
@@ -2,19 +2,21 @@
 * @deepseek-ai/dsh-headless — the one-shot headless bundle: the bundle patch
 * (`cordis.patch.yml`) rides over dsh-base + dsh-web-app (the headless
 * session is web-observable while it runs — same composition), and this
- * runner plugin drives one task turn through the in-process API carrier
+ * runner plugin drives one task through the in-process API carrier
 * (InProcessApiClient over toFetchHandler(ctx.apiProxy), so the full wire
 * chain — serialization, zod, SSE framing — really runs), prints the final
- * assistant text, and exits (completed → 0, else 1). The task text arrives as
- * launcher-patched config (`dsh --profile headless "task"`).
+ * assistant text at agent quiescence, and exits (completed → 0, else 1). The
+ * task text arrives as launcher-patched config
+ * (`dsh --profile headless "task"`).
 * @module @deepseek-ai/dsh-headless
 */

 import type { Context } from 'cordis'
 import z from 'schemastery'
 import { InProcessApiClient, toFetchHandler } from '@deepseek-ai/dsh-host-apiproxy'
-// Empty type import carries the httpServer Context merge for the port read below.
+// Empty type imports carry the httpServer and agent/status Context merges used below.
 import type {} from '@deepseek-ai/dsh-host-webserver'
+import type {} from '@deepseek-ai/dsh-agent'
 import type { MuxFrame } from '@deepseek-ai/dsh-host-apiproxy/api'
 import type { RpcRequest, RpcResponse } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
 import type { SessionId } from '@deepseek-ai/dsh-session'
@@ -35,7 +37,7 @@ export const Config: z<Config> = z.object({
  task: z.string().required(),
 })

-/** Outcome of one headless turn: aggregated final text plus the turn-end reason kind. */
+/** Outcome of one headless run: aggregated final text plus the last turn-end reason kind. */
 interface TurnOutcome {
  text: string
  reason: string
@@ -73,46 +75,56 @@ async function unwrap<T>(response: RpcResponse<T>, io: HeadlessIo): Promise<T> {
 }

 /**
- * Consume mux frames until the task turn ends: anchor on the first turn/start
- * whose trigger kind is 'message' (startup-injected turns are skipped),
- * aggregate text from that turn's assistant/message events (last one wins),
- * finish on its turn/end.
+ * Consume mux frames until the agent reaches idle, per the one-shot CLI
+ * idle-to-idle contract: the stream opens immediately before the prompt, and
+ * its first observed turn/start begins the task. Text is the last committed
+ * assistant message of the whole interval (steering or injected work may run
+ * further turns before quiescence), and the outcome reason is the final
+ * turn/end's kind. Idleness is signalled out of band by the caller's
+ * `agent/status` subscription; the stream itself carries no status frame.
+ * @param frames - the mux stream opened before the prompt.
+ * @param sessionId - the headless session.
+ * @param idle - resolves when the agent reaches quiescence.
+ * @param io - process-facing effects for stream diagnostics.
+ * @returns the aggregated outcome.
 */
-async function consumeUntilTurnEnd(
-  frames: AsyncIterable<RpcRequest<MuxFrame>>, sessionId: SessionId, io: HeadlessIo,
+async function consumeUntilIdle(
+  frames: AsyncIterable<RpcRequest<MuxFrame>>,
+  sessionId: SessionId,
+  idle: Promise<void>,
+  io: HeadlessIo,
 ): Promise<TurnOutcome> {
-  let targetTurn: number | undefined
+  let started = false
  let text = ''
-  try {
-    for await (const frame of frames) {
-      const payload = frame.payload
-      if (payload.type === 'stream/error') {
-        io.stderr.write(`dsh: stream error: ${payload.error.message}\n`)
-        return { text, reason: 'error' }
-      }
-      if (payload.type !== 'session/event' || payload.sessionId !== sessionId) continue
-      const event = payload.event
-      if (targetTurn === undefined) {
-        if (event.type === 'turn/start' && event.data.trigger.kind === 'message') targetTurn = event.data.turn
-        continue
-      }
-      if (event.type === 'assistant/message' && event.data.turn === targetTurn) {
-        const joined = event.data.message.content.filter(block => block.type === 'text').map(block => block.text).join('')
-        if (joined !== '') text = joined
-      }
-      if (event.type === 'turn/end' && event.data.turn === targetTurn) {
-        return { text, reason: event.data.reason.kind }
+  let reason: string = 'error'
+  void (async () => {
+    try {
+      for await (const frame of frames) {
+        const payload = frame.payload
+        if (payload.type === 'stream/error') return
+        if (payload.type !== 'session/event' || payload.sessionId !== sessionId) continue
+        const event = payload.event
+        if (event.type === 'turn/start') {
+          started = true
+          continue
+        }
+        if (!started) continue
+        if (event.type === 'assistant/message') {
+          const joined = event.data.message.content.filter(block => block.type === 'text').map(block => block.text).join('')
+          if (joined !== '') text = joined
+        }
+        if (event.type === 'turn/end') reason = event.data.reason.kind
      }
+    } catch (error: unknown) {
+      io.stderr.write(`dsh: event stream failed: ${String(error)}\n`)
    }
-  } catch (error: unknown) {
-    io.stderr.write(`dsh: event stream failed: ${String(error)}\n`)
-  }
-  return { text, reason: 'error' }
+  })()
+  await idle
+  return { text, reason }
 }

 /**
- * Run one headless turn for the configured task and request exit
- * (completed → 0, else 1).
+ * Run one headless task to quiescence and request exit (completed → 0, else 1).
 * @param ctx - plugin context carrying apiProxy, httpServer, and the launcher's headlessIo.
 * @param config - validated {@link Config}.
 */
@@ -121,7 +133,7 @@ export function apply(ctx: Context, config: Config): void {
  if (io === undefined) {
    throw new Error('headless-runner: the launcher must provide ctx.headlessIo before the tree mounts')
  }
-  // Fire-and-forget by design: the turn outlives plugin activation, and every
+  // Fire-and-forget by design: the run outlives plugin activation, and every
  // failure path inside ends in io.exit, not a rejection.
  void (async () => {
    // The headless session is web-observable while it runs (same composition).
@@ -133,7 +145,12 @@ export function apply(ctx: Context, config: Config): void {
    // a move to a remote HTTP carrier unchanged.
    const abort = new AbortController()
    const frames = api.events.mux({}, abort.signal)
-    const done = consumeUntilTurnEnd(frames, created.sessionId, io)
+    const idle = new Promise<void>((resolve) => {
+      ctx.on('agent/status', (agent, status) => {
+        if (agent.id === created.sessionId && status === 'idle') resolve()
+      })
+    })
+    const done = consumeUntilIdle(frames, created.sessionId, idle, io)
    await unwrap(await api.sessions.prompt({
      sessionId: created.sessionId,
      mode: 'queue',
--- a/packages/bundle/headless/tests/headless.spec.ts
+++ b/packages/bundle/headless/tests/headless.spec.ts
@@ -1,12 +1,13 @@
 /**
- * One-shot runner behavior over a scripted in-process API: turn anchoring on
- * the first message-triggered turn, last-text-wins aggregation, exit-code
- * mapping by turn-end reason, stream/error and RPC-error paths, and the
+ * One-shot runner behavior over a scripted in-process API: idle-to-idle
+ * aggregation (last text of the whole interval), exit-code mapping by the
+ * final turn-end reason, stream-error and RPC-error paths, and the
 * launcher-owned `ctx.headlessIo` requirement.
 */

 import { describe, expect, it } from 'vitest'
 import { Context } from 'cordis'
+import type { Agent } from '@deepseek-ai/dsh-agent'
 import { apply, Config, type HeadlessIo } from '../src/index.ts'

 interface ScriptedEvent { type: string; seq?: number; time?: number; sessionId?: string; data: Record<string, unknown> }
@@ -46,7 +47,10 @@ function scriptedApi(events: ScriptedEvent[], options: { promptFails?: boolean }
  }
 }

-/** Mount the runner against a scripted API and wait for its exit request. */
+/**
+ * Mount the runner against a scripted API, emit the idle transition after the
+ * scripted frames drain, and wait for its exit request.
+ */
 async function run(events: ScriptedEvent[], options: { promptFails?: boolean } = {}): Promise<{ code: number; out: string; err: string }> {
  const ctx = new Context()
  let out = ''
@@ -62,6 +66,10 @@ async function run(events: ScriptedEvent[], options: { promptFails?: boolean } =
  ctx.provide('apiProxy', scriptedApi(events, options) as never)
  ctx.provide('httpServer', { port: 12345 } as never)
  apply(ctx, { task: 'do the thing' })
+  // Quiescence is out of band: give the scripted stream a beat to drain, then
+  // flip the agent idle exactly as the loop would.
+  await new Promise(resolve => setTimeout(resolve, 10))
+  ctx.emit('agent/status', { id: 'S1' } as Agent, 'idle')
  const code = await exited
  await ctx.fiber.dispose()
  return { code, out, err }
@@ -76,15 +84,15 @@ const text = (turn: number, value: string): ScriptedEvent => ({
 const end = (turn: number, reason: string): ScriptedEvent => ({ type: 'turn/end', data: { turn, reason: { kind: reason } } })

 describe('headless runner', () => {
-  it('anchors past startup turns, keeps the last text, prints, and exits 0 on completion', async () => {
+  it('aggregates to quiescence: last text wins across turns, final turn-end reason maps to exit 0', async () => {
    const { code, out, err } = await run([
      startupTurn,
-      end(0, 'completed'),
-      messageTurn,
-      // Off-session, non-text, and text-empty frames are skipped without affecting the aggregate.
+      // Off-session, non-text, and text-empty frames never affect the aggregate.
      { type: 'assistant/message', sessionId: 'OTHER', data: { turn: 1, message: { content: [{ type: 'text', text: 'other session' }] } } },
      { type: 'assistant/message', data: { turn: 1, message: { content: [{ type: 'tool_call', text: 'ignored' }] } } },
-      text(1, 'draft'),
+      text(0, 'draft'),
+      end(0, 'completed'),
+      messageTurn,
      text(1, 'final answer'),
      end(1, 'completed'),
    ])
@@ -93,24 +101,25 @@ describe('headless runner', () => {
    expect(err).toContain('observing at http://127.0.0.1:12345')
  })

-  it('exits 1 when the turn ends for any other reason', async () => {
+  it('exits 1 when the final turn ends for any other reason', async () => {
    const { code } = await run([messageTurn, end(1, 'aborted')])
    expect(code).toBe(1)
  })

-  it('reports a stream error and exits 1', async () => {
-    const { code, err } = await run([messageTurn, { type: 'stream/error', data: {} }])
+  it('exits 1 when no turn ever starts (idle without work)', async () => {
+    const { code, out } = await run([])
    expect(code).toBe(1)
-    expect(err).toContain('stream error')
+    expect(out).toBe('\n')
  })

-  it('prints an RPC business error and exits 1 without prompting further', async () => {
-    const { code, err } = await run([messageTurn, end(1, 'completed')], { promptFails: true })
+  it('keeps the error outcome after a stream error ends the frame consumer early', async () => {
+    const { code } = await run([messageTurn, { type: 'stream/error', data: {} }, end(1, 'completed')])
+    // The consumer stopped at the stream error; the completed turn-end after
+    // it is never observed, so the reason stays 'error'.
    expect(code).toBe(1)
-    expect(err).toContain('agent-busy')
  })

-  it('exits 1 through the stream-error path when the underlying carrier dies', async () => {
+  it('prints an RPC business error and exits 1 without waiting for idle', async () => {
    const ctx = new Context()
    let err = ''
    const exited = new Promise<number>((resolve) => {
@@ -120,36 +129,15 @@ describe('headless runner', () => {
        exit: resolve,
      } satisfies HeadlessIo)
    })
-    ctx.provide('apiProxy', {
-      sessions: {
-        create: (request: RpcShapedRequest) =>
-          Promise.resolve({ rpcId: request.rpcId, result: { ok: true, value: { sessionId: 'S1' } } }),
-        prompt: (request: RpcShapedRequest) =>
-          Promise.resolve({ rpcId: request.rpcId, result: { ok: true, value: { accepted: true } } }),
-      },
-      events: {
-        mux: async function* (): AsyncGenerator<never> {
-          throw new Error('carrier died')
-        },
-      },
-    } as never)
+    ctx.provide('apiProxy', scriptedApi([messageTurn, end(1, 'completed')], { promptFails: true }) as never)
    ctx.provide('httpServer', { port: 1 } as never)
    apply(ctx, { task: 't' })
    expect(await exited).toBe(1)
-    // The carrier converts its own failure into a stream/error frame.
-    expect(err).toContain('stream error')
-    expect(err).toContain('carrier died')
+    expect(err).toContain('agent-busy')
    await ctx.fiber.dispose()
  })

-  it('fails loud without the launcher-owned headlessIo seam', () => {
-    const ctx = new Context()
-    ctx.provide('apiProxy', scriptedApi([]) as never)
-    ctx.provide('httpServer', { port: 1 } as never)
-    expect(() => { apply(ctx, { task: 't' }) }).toThrow('must provide ctx.headlessIo')
-  })
-
-  it('exits 1 with the stream-failed diagnostic when the event channel cannot open at all', async () => {
+  it('reports the stream-failed diagnostic when the event channel dies, still settling at idle', async () => {
    const ctx = new Context()
    let err = ''
    const exited = new Promise<number>((resolve) => {
@@ -174,11 +162,20 @@ describe('headless runner', () => {
    } as never)
    ctx.provide('httpServer', { port: 1 } as never)
    apply(ctx, { task: 't' })
+    await new Promise(resolve => setTimeout(resolve, 10))
+    ctx.emit('agent/status', { id: 'S1' } as Agent, 'idle')
    expect(await exited).toBe(1)
    expect(err).toContain('event stream failed')
    await ctx.fiber.dispose()
  })

+  it('fails loud without the launcher-owned headlessIo seam', () => {
+    const ctx = new Context()
+    ctx.provide('apiProxy', scriptedApi([]) as never)
+    ctx.provide('httpServer', { port: 1 } as never)
+    expect(() => { apply(ctx, { task: 't' }) }).toThrow('must provide ctx.headlessIo')
+  })
+
  it('validates config: the task is required', () => {
    expect(() => new Config({ } as never)).toThrow()
    expect(new Config({ task: 'x' })).toEqual({ task: 'x' })
--- a/packages/bundle/headless/tsconfig.json
+++ b/packages/bundle/headless/tsconfig.json
@@ -20,6 +20,9 @@
    {
      "path": "../../host/webserver"
    },
+    {
+      "path": "../../core/agent"
+    },
    {
      "path": "../../core/session"
    },
--- a/packages/client/connection/src/client/api.ts
+++ b/packages/client/connection/src/client/api.ts
@@ -12,7 +12,7 @@ export type {
  WorkspaceApi, WorkspaceId, WorkspaceView,
  CommandsApi, CommandDescriptor, SkillsApi, SkillEntry,
  ModelCatalogFailure, ModelCatalogModel, ModelProviderGroup, ModelReasoning,
-  InboxItemId, ModelReasoningEffort, ModelTarget, QueueAction, QueuedInboxItem, SessionModels,
+  ModelReasoningEffort, ModelTarget, QueueAction, QueuedInboxItem, SessionModels,
  GoalsApi, GoalRef,
  SettingsApi, SettingsNamespaceView, SettingsPathOpView, SettingsSecretView,
  CredentialsApi, CredentialView, ConfigurableProviderView, LlmApi,
@@ -34,6 +34,7 @@ export {
 export { AbstractApiClient } from '@deepseek-ai/dsh-host-apiproxy/client'
 export type { IApiClient } from '@deepseek-ai/dsh-host-apiproxy/client'
 export type { SessionId, SessionEvent } from '@deepseek-ai/dsh-session/types'
+export type { MessageId } from '@deepseek-ai/dsh-llm/brand'
 export type { ContentBlock, StreamChunk } from '@deepseek-ai/dsh-llm/types'

 import type { RpcResponse, RpcResult } from '@deepseek-ai/dsh-host-apiproxy/api'
--- a/packages/client/connection/src/client/fixture.ts
+++ b/packages/client/connection/src/client/fixture.ts
@@ -339,7 +339,7 @@ function fixtureUsage(turn: number, step: number): TokenUsage {
 }

 /** fx-alpha history script: 60 turns (~130+ messages -> 3 pages at PAGE_MESSAGES=50),
- *  mixing reasoning blocks / tool call+result / steering / context. */
+ *  mixing reasoning blocks / tool call+result / context. */
 function buildAlphaLog(): SessionEvent[] {
  const events: Record<string, unknown>[] = []
  let time = Date.now() - 3_600_000
@@ -359,7 +359,7 @@ function buildAlphaLog(): SessionEvent[] {
    return seq
  }
  for (let turn = 0; turn < 60; turn++) {
-    push({ type: 'turn/start', data: { turn, trigger: { kind: 'message', source: { kind: 'user' } } } })
+    push({ type: 'turn/start', data: { turn } })
    const userSeq = push({
      type: 'user/message', surfaceOp: 'append',
      data: userMessage(text(turn === 59 ? USER_MARKDOWN_LITERAL : `问题 ${turn}：fixture 历史消息，用于翻页与渲染验收。`)),
@@ -393,9 +393,6 @@ function buildAlphaLog(): SessionEvent[] {
      push({ type: 'assistant/message', surfaceOp: 'append', data: { turn, step: 0, message: assistantMessage(blocks) } })
      push({ type: 'step/end', data: { turn, step: 0 } })
    }
-    if (turn % 13 === 6) {
-      push({ type: 'steering/message', surfaceOp: 'append', data: { turn, message: userMessage(text(`插话 ${turn}：fixture steering 消息。`)) } })
-    }
    push({ type: 'turn/end', data: { turn, reason: { kind: 'completed' } } })
  }
  // Three view-sample turns (60-62) cover the built-in card types. The real filesystem names in
@@ -403,7 +400,7 @@ function buildAlphaLog(): SessionEvent[] {
  // stays presenter-less as the unknown fallback.
  const toolTurn = (turn: number, name: string, args: string, resultText: string): void => {
    const callId = `fx-call-${turn}`
-    push({ type: 'turn/start', data: { turn, trigger: { kind: 'message', source: { kind: 'user' } } } })
+    push({ type: 'turn/start', data: { turn } })
    push({ type: 'user/message', surfaceOp: 'append', data: userMessage(text(`问题 ${turn}：${name} 样本。`)) })
    push({ type: 'step/start', data: { turn, step: 0 } })
    push({
@@ -440,7 +437,7 @@ function buildAlphaLog(): SessionEvent[] {
      + 'await tools.read({ file_path: "notes/missing.txt" }).catch(() => "tolerated")\n'
      + 'return { listing, demo }'
    const args = JSON.stringify({ code: program, description: 'Read the notes files and summarize' })
-    push({ type: 'turn/start', data: { turn, trigger: { kind: 'message', source: { kind: 'user' } } } })
+    push({ type: 'turn/start', data: { turn } })
    push({ type: 'user/message', surfaceOp: 'append', data: userMessage(text(`问题 ${turn}：run_code 样本。`)) })
    push({ type: 'step/start', data: { turn, step: 0 } })
    push({
@@ -685,7 +682,7 @@ function viewFor(event: SessionEvent, log: readonly SessionEvent[]): ToolEventVi
 * Fixture parallel of the plan unit's double-event fold: `command/run`
 * records named `plan` set the wanted target (`off` → false, else true);
 * `plan/mode` commits and clears it. `wanted` is exposed for the prompt
- * boundary (the fixture's agent/step parallel).
+ * boundary (the fixture's step/start parallel).
 */
 function foldPlan(log: readonly SessionEvent[]): { active: boolean; pending: boolean; wanted: boolean | null } {
  let active = false
@@ -901,13 +898,9 @@ function projectionFramesOf(id: SessionId, log: readonly SessionEvent[], event:
    if (!Object.hasOwn(values, 'title')) return []
    return [{ type: 'session/projection', sessionId: id, key: 'title', value: values['title'], seq: event.seq }]
  }
-  // Goal fold: a round-zero goal-sourced user message advances the goal unit.
-  if (type === 'user/message') {
-    const source = (event as unknown as { data?: { source?: { kind?: string; round?: number } } }).data?.source
-    if (source?.kind === 'goal' && source.round === 0) {
-      return [{ type: 'session/projection', sessionId: id, key: 'goal', value: backscanGoal(log), seq: event.seq }]
-    }
-    return []
+  // The goal domain's own durable change advances its projection.
+  if (type === 'goal/change') {
+    return [{ type: 'session/projection', sessionId: id, key: 'goal', value: backscanGoal(log), seq: event.seq }]
  }
  // Standing-plan fold: writes replace the list; turn/start clears it (null).
  if (type === 'todo/write' || type === 'turn/start') {
@@ -961,7 +954,7 @@ function pageOf(
    const event = log[i]
    /* v8 ignore next -- dense-array guard: log seqs are array indexes, i stays within [0, end). */
    if (event === undefined) break
-    if (event.type === 'user/message' || event.type === 'assistant/message' || event.type === 'steering/message') messages++
+    if (event.type === 'user/message' || event.type === 'assistant/message') messages++
    if (event.type === 'turn/start' && messages >= maxMessages) {
      start = i
      break
@@ -990,11 +983,11 @@ function searchBlockText(block: ContentBlock): string[] {
  }
 }

-/** One current-surface user/assistant/steering document, if searchable. */
+/** One current-surface user/assistant document, if searchable. */
 function searchEventText(event: SessionEvent): string {
  const content = event.type === 'user/message'
    ? event.data.content
-    : event.type === 'assistant/message' || event.type === 'steering/message'
+    : event.type === 'assistant/message'
      ? event.data.message.content
      : undefined
  if (content === undefined) return ''
@@ -1140,7 +1133,7 @@ interface FxGoalProjection {
  updatedAt: number
 }

-/** One durable goal change riding a round-zero goal-sourced user message. */
+/** One durable goal change. */
 type FxGoalChange =
  | { kind: 'goal/change'; version: 1; operation: 'clear'; cleared: { id: string; revision: number }; clearedAt: number }
  | {
@@ -1161,14 +1154,10 @@ function backscanGoal(log: readonly SessionEvent[]): FxGoalProjection | null {
  for (let i = log.length - 1; i >= 0; i--) {
    const event = log[i] as unknown as {
      type: string
-      data?: { source?: { kind?: string; round?: number; change?: FxGoalChange } }
+      data?: FxGoalChange
    } | undefined
-    if (event === undefined || event.type !== 'user/message') continue
-    const source = event.data?.source
-    if (source?.kind !== 'goal' || source.round !== 0) continue
-    const change = source.change
-    // oxlint-disable-next-line typescript/no-unnecessary-condition
-    if (change === undefined || change.kind !== 'goal/change') continue
+    if (event === undefined || event.type !== 'goal/change' || event.data === undefined) continue
+    const change = event.data
    if (change.operation === 'clear') return null
    return { goal: change.goal, roundsStarted: change.roundsStarted, createdAt: change.createdAt, updatedAt: change.updatedAt }
  }
@@ -1419,20 +1408,14 @@ export function createFixtureApi(options: FixtureOptions = {}): ApiProxy {
    for (const frame of projectionFramesOf(id, log, event)) emitMux(frame)
  }

-  /** Append one goal/change as its round-zero goal-sourced user message (host GoalService parallel). */
+  /** Append one durable goal/change (host GoalService parallel). */
  const appendGoalChange = (id: SessionId, change: FxGoalChange): FxGoalProjection => {
-    const ref = change.operation === 'clear' ? change.cleared : change.goal
-    const payload = change.operation === 'clear'
-      ? { cleared: change.cleared, clearedAt: change.clearedAt }
-      : { goal: change.goal, roundsStarted: change.roundsStarted, createdAt: change.createdAt, updatedAt: change.updatedAt }
+    const log = logOf(id)
    append(id, {
-      type: 'user/message', surfaceOp: 'append',
-      data: userMessage(
-        text(`<goal_state>${JSON.stringify(payload)}</goal_state>`),
-        { kind: 'goal', goalId: ref.id, revision: ref.revision, round: 0, change } as unknown as MessageSource,
-      ),
+      type: 'goal/change',
+      data: change,
    })
-    return backscanGoal(logOf(id)) as FxGoalProjection
+    return backscanGoal(log) as FxGoalProjection
  }

  /** Shared CAS mutation path of the goal verbs (undefined next = invalid transition). */
@@ -1583,23 +1566,20 @@ export function createFixtureApi(options: FixtureOptions = {}): ApiProxy {
      nextTurn.set(sessionId, turn + 1)
      retryScenarios.set(sessionId, { turn, stepStarted: true })
      setRunning(sessionId, true)
-      append(sessionId, { type: 'turn/start', data: { turn, trigger: { kind: 'message', source: { kind: 'user' } } } })
+      append(sessionId, { type: 'turn/start', data: { turn } })
      append(sessionId, { type: 'user/message', surfaceOp: 'append', data: { content: text('请重试这个请求'), source: { kind: 'user' } } })
      append(sessionId, { type: 'step/start', data: { turn, step: 1 } })
      append(sessionId, { type: 'assistant/chunk', data: { turn, step: 1, chunk: { type: 'block-start', index: 0, blockType: 'text' } } })
      append(sessionId, { type: 'assistant/chunk', data: { turn, step: 1, chunk: { type: 'text-delta', index: 0, text: '应撤回的半截回复' } } })
-      append(sessionId, { type: 'step/end', data: { turn, step: 1 } })
    },
-    /** Record one retry decision, then open the next retry turn. */
+    /** Record one retry decision; the next attempt remains in the same step. */
    scheduleModelRetry(id: string, retry = 1, delayMs = 450): void {
      const sessionId = sid(id)
      const scenario = retryScenarios.get(sessionId)
      if (scenario === undefined) throw new Error(`fixture: no model retry scenario for ${id}`)
      if (!scenario.stepStarted) {
-        append(sessionId, { type: 'step/start', data: { turn: scenario.turn, step: 1 } })
        append(sessionId, { type: 'assistant/chunk', data: { turn: scenario.turn, step: 1, chunk: { type: 'block-start', index: 0, blockType: 'text' } } })
        append(sessionId, { type: 'assistant/chunk', data: { turn: scenario.turn, step: 1, chunk: { type: 'text-delta', index: 0, text: `第 ${String(retry)} 次应撤回的回复` } } })
-        append(sessionId, { type: 'step/end', data: { turn: scenario.turn, step: 1 } })
        scenario.stepStarted = true
      }
      const failure = { code: 'TRANSPORT', message: '连接被重置' }
@@ -1611,14 +1591,6 @@ export function createFixtureApi(options: FixtureOptions = {}): ApiProxy {
          retry, maxRetries: 2, delayMs, failure,
        },
      })
-      append(sessionId, {
-        type: 'turn/end',
-        data: { turn: scenario.turn, reason: { kind: 'error', step: 1, failure } },
-      })
-      const next = nextTurn.get(sessionId) ?? scenario.turn + 1
-      nextTurn.set(sessionId, next + 1)
-      append(sessionId, { type: 'turn/start', data: { turn: next, trigger: { kind: 'retry' } } })
-      scenario.turn = next
      scenario.stepStarted = false
    },
    /** Record one retry decision, then cancel its source turn before the retry starts. */
@@ -1635,17 +1607,23 @@ export function createFixtureApi(options: FixtureOptions = {}): ApiProxy {
          retry: 1, maxRetries: 2, delayMs, failure,
        },
      })
-      append(sessionId, { type: 'turn/end', data: { turn: scenario.turn, reason: { kind: 'aborted' } } })
+      append(sessionId, { type: 'step/end', data: { turn: scenario.turn, step: 1 } })
+      append(sessionId, { type: 'turn/end', data: { turn: scenario.turn, reason: { kind: 'aborted', reason: { kind: 'user' } },
+      } })
      retryScenarios.delete(sessionId)
      setRunning(sessionId, false)
    },
-    /** Finish the timing-hook retry with a finalized response in the open retry turn. */
+    /** Finish the timing-hook retry with a finalized response in the open step. */
    completeModelRetry(id: string): void {
      const sessionId = sid(id)
      const scenario = retryScenarios.get(sessionId)
      if (scenario === undefined) throw new Error(`fixture: no model retry scenario for ${id}`)
      retryScenarios.delete(sessionId)
-      append(sessionId, { type: 'step/start', data: { turn: scenario.turn, step: 1 } })
+      append(sessionId, { type: 'assistant/chunk', data: {
+        turn: scenario.turn,
+        step: 1,
+        chunk: { type: 'block-start', index: 0, blockType: 'text' },
+      } })
      append(sessionId, {
        type: 'assistant/message',
        surfaceOp: 'append',
@@ -1944,17 +1922,15 @@ export function createFixtureApi(options: FixtureOptions = {}): ApiProxy {
        summary.blank = false
        const userText = content.map(b => (b.type === 'text' ? b.text : '')).join('')
        if (mode === 'steer' && replays.has(id)) {
-          // Steering: insert a steering message into the current turn; the replay continues.
-          /* v8 ignore next -- the ?? arm needs a missing counter, but a live replay implies a prior prompt already set it. */
-          const turn = (nextTurn.get(id) ?? 1) - 1
-          append(id, { type: 'steering/message', surfaceOp: 'append', data: { turn, message: userMessage(content) } })
+          // Steering: the durable user/message lands inside the current turn; the replay continues.
+          append(id, { type: 'user/message', surfaceOp: 'append', data: userMessage(content) })
          return ok(request, { accepted: true as const })
        }
        const turn = nextTurn.get(id) ?? 0
        nextTurn.set(id, turn + 1)
        setRunning(id, true)
-        append(id, { type: 'turn/start', data: { turn, trigger: { kind: 'message', source: { kind: 'user' } } } })
-        // Boundary flush parallel (the host's agent/step seam): an outstanding
+        append(id, { type: 'turn/start', data: { turn } })
+        // Boundary flush parallel (the host's step/start observer): an outstanding
        // /plan selection commits as plan/mode inside the opened turn.
        const plan = foldPlan(logOf(id))
        if (plan.wanted !== null && plan.wanted !== plan.active) {
--- a/packages/client/connection/src/client/index.ts
+++ b/packages/client/connection/src/client/index.ts
@@ -18,7 +18,7 @@ export type {
  ToolCallView, ToolResultView, WorkspaceApi, WorkspaceId, WorkspaceView,
  CommandsApi, CommandDescriptor, SkillsApi, SkillEntry,
  ModelCatalogFailure, ModelCatalogModel, ModelProviderGroup, ModelReasoning,
-  InboxItemId, ModelReasoningEffort, ModelTarget, QueueAction, QueuedInboxItem, SessionModels,
+  MessageId, ModelReasoningEffort, ModelTarget, QueueAction, QueuedInboxItem, SessionModels,
  SubagentsApi, SubagentAddress, SubagentCatalog, SubagentListEntry, SubagentPromptReceipt,
  RpcRequest, RpcResponse, RpcResult, RpcError, RpcErrorCode,
  ClientRequest, ServerResponse, ServerRequest, ClientResponse, RpcMessage, RpcReceipt,
--- a/packages/client/connection/tests/fixture.spec.ts
+++ b/packages/client/connection/tests/fixture.spec.ts
@@ -311,7 +311,7 @@ describe('createFixtureApi', () => {
    expect(idleCancel.result).toMatchObject({ ok: true })
  })

-  it('steer during a replay inserts a steering message and the replay continues to completion', async () => {
+  it('steer during a replay lands a user/message inside the current turn and the replay continues', async () => {
    const api = createFixtureApi()
    const created = await api.sessions.create(req({}))
    if (!created.result.ok) throw new Error('create failed')
@@ -324,7 +324,7 @@ describe('createFixtureApi', () => {
    await api.sessions.prompt(req({ sessionId: id, mode: 'steer' as const, content: [{ type: 'text' as const, text: '插话' }] }))
    const frames = await framesPromise
    const types = frames.filter((f): f is Extract<MuxFrame, { type: 'session/event' }> => f.type === 'session/event').map(f => f.event.type)
-    expect(types).toContain('steering/message')
+    expect(JSON.stringify(frames)).toContain('插话')
    expect(types.at(-1)).toBe('turn/end') // steer did not restart the turn
  })

@@ -372,7 +372,7 @@ describe('createFixtureApi', () => {
    }))
    const frames = await framesPromise
    const types = frames.filter((f): f is Extract<MuxFrame, { type: 'session/event' }> => f.type === 'session/event').map(f => f.event.type)
-    expect(types[0]).toBe('turn/start') // idle steer degraded to a queued turn, not a steering insert
+    expect(types[0]).toBe('turn/start') // idle steer degraded to a queued turn, not an in-turn insert
  })

  it('gamma interval flip emits host/session-status and a running log-less session subscribes at lastSeq -1', async () => {
@@ -1008,6 +1008,21 @@ describe('FixtureApiClient (protocol-level fake carrier)', () => {
    // complete → complete is an invalid transition.
    expect((await client.goals.complete({ sessionId: id, ref })).result.ok).toBe(false)
    expect((await client.goals.clear({ sessionId: id, ref })).result).toEqual({ ok: true, value: { cleared: true } })
+
+    const goalHistory = await client.sessions.history({ sessionId: id })
+    if (!goalHistory.result.ok) throw new Error('goal history failed')
+    const goalEvents = goalHistory.result.value.events.map(entry => entry.event as unknown as {
+      type: string
+      data: {
+        operation?: string
+        source?: { kind?: string; round?: number }
+      }
+    })
+    const goalChanges = goalEvents.filter(event => event.type === 'goal/change')
+    expect(goalChanges.map(event => event.data.operation))
+      .toEqual(['create', 'edit', 'pause', 'resume', 'complete', 'clear'])
+    expect(goalEvents.some(event => event.type === 'user/message'
+      && event.data.source?.kind === 'goal' && event.data.source.round === 0)).toBe(false)
  })

  it('maps empty, prompt-reject, and workspace-first query scenarios', async () => {
--- a/packages/client/runtime/README.i18n.yaml
+++ b/packages/client/runtime/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/runtime/README.md
-README.md: e55587202dfdd8b2d3e7e707507ebe041769b7c5
-README.zh.md: 0d5092074592d49807d06e1bb70fc64fc2d6dcf4
+README.md: b390c2830a47ed380e01bc7ec763b4bd8d8459e8
+README.zh.md: 0aaad0b7620394f151b6a757f924d22d4f2140ab
--- a/packages/client/runtime/README.md
+++ b/packages/client/runtime/README.md
@@ -24,7 +24,7 @@ SlotsService gives the renderer separate bare observables for `useSessions` and

 ## Pending queue projection

-`ConversationSnapshot.queue` is the Host's authoritative transient inbox snapshot and carries both queued and pending-steering occurrences with their resolved placement. Each row carries its `InboxItemId`, stable `MessageId`, complete editable text when every content block is text, and a flattened preview. `session/queue` replaces the whole projection, while an accepted live `steering/message` event retires only the first matching current steering occurrence so the durable node can take over before the following Host snapshot; history replay never consumes a later occurrence that reused the same `MessageId`. Reconnect buffering retains only the latest snapshot, and neither ordinary durable turn events nor running-status changes guess that an item was claimed. `Session.updateQueue()` sends edit, remove, and strict-steer operations without optimistic mutation; claim and closed-window races surface `queue-item-not-found` and `steer-unavailable`.
+`ConversationSnapshot.queue` is the Host's authoritative transient snapshot of `agent.inbox.nextTurn`; pending next-step steering stays outside this projection. Each row carries its `MessageId`, complete editable text when every content block is text, and a flattened preview. The Host derives whole `session/queue` snapshots from durable `agent/inbox/spliced` mutations and sends a baseline on reconnect; the message-local `agent/inbox/inserted`, `claimed`, and `discarded` notifications are not used to reconstruct this projection. `Session.updateQueue()` sends edit/remove operations through Host-side `Inbox.splice()` without optimistic client mutation, so the next Host snapshot is the sole visible commit and a claim race can surface `queue-item-not-found`.

 ## The human transcript

@@ -56,10 +56,6 @@ The Session object validates plugin-owned, provider-routed `llm/retry` payloads

 Each resident `Session` owns a `modelSelection` snapshot containing the current provider/model target, provider-grouped directory, provider-local failures, and the `idle`/`loading`/`ready`/`selecting`/`error` state. History establishes or refreshes the current target, opening a selector refreshes the directory, and selection failures preserve the last target and usable groups. Directory and selection operations share a monotonically increasing generation so an older response cannot overwrite a newer selection. A reconnect rebuild restores the target reported by the Host without replacing unchanged selection substructure.

-## Addressed subagent conversations
-
-`SessionListState.subagentsByParent` carries direct durable catalogs and `currentAddress` records the catalog-derived `{parentSessionId, childSessionId}` for the selected child. Only that recorded address selects subagent transport: lineage alone remains insufficient because ordinary forks also have `parentId`. An addressed Session loads and reconnects through `subagent.history`, sends through `subagent.prompt`, never calls ordinary cancel, and persists its address with the selected session across refresh and repeated ordinary selection of that same child. The list also projects the header's coarse `origin: 'subagent'` classification for navigation filtering; the recorded address, not `origin`, remains transport authority. Catalog reads are single-flight; the Host baseline and `host/session-status` both derive activity from child Agent driver status, and status frames received during a read are replayed over its response. An origin-classified `host/session-added` immediately marks any loaded direct parent row `hasChildren: true` and causes one debounced refetch when that parent is selected or its catalog is open. Parent availability propagates into `ConversationSnapshot.subagent` so presentation can replace the composer with a read-only explanation without activating the parent.
-
 ## Model Experience

 None, as the session object layer selects the provider/model route used by a later Host request but adds no model-visible content.
--- a/packages/client/runtime/README.zh.md
+++ b/packages/client/runtime/README.zh.md
@@ -24,7 +24,7 @@ SlotsService 分别为 renderer 提供 `useSessions` 与 `useWorkspaces` 的裸

 ## 待处理队列投影

-`ConversationSnapshot.queue` 是 Host 提供的权威瞬态 inbox 快照，携带 queued 与待处理 steering（中途引导）单次入队项及其已解析 placement。每行都携带其 `InboxItemId`、稳定的 `MessageId`、所有内容块均为文本时的完整可编辑文本，以及扁平化预览。`session/queue` 会整体替换该投影；已接纳的实时 `steering/message` 事件则只退役第一个匹配的当前 steering 单次入队项，让持久节点能在下一份 Host 快照之前接管，而历史回放绝不会消费后来复用同一 `MessageId` 的单次入队项。重连缓冲只保留最新快照，普通持久轮次事件和 running 状态变化都不会猜测某个项已被认领。`Session.updateQueue()` 发送编辑、移除和严格 steering 操作，不进行乐观更新；认领与窗口关闭竞态分别会返回 `queue-item-not-found` 和 `steer-unavailable`。
+`ConversationSnapshot.queue` 是 Host 提供的 `agent.inbox.nextTurn` 权威瞬态快照；待处理的 next-step steering（中途引导）不进入此投影。每行携带其 `MessageId`、所有内容块均为文本时的完整可编辑文本，以及扁平化预览。Host 根据持久 `agent/inbox/spliced` 变更派生完整 `session/queue` 快照，并在重连时发送基线；面向单条消息的 `agent/inbox/inserted`、`claimed` 与 `discarded` 通知不用于重建该投影。`Session.updateQueue()` 经 Host 侧 `Inbox.splice()` 发送编辑／移除操作，客户端不做乐观变更，因此下一份 Host 快照是唯一可见的提交结果，claim 竞态则会返回 `queue-item-not-found`。

 ## 面向人的 transcript（文本记录）

@@ -56,10 +56,6 @@ Session 对象会在事件 wire 边界依据生产方的完整字段契约，验

 每个常驻 `Session` 都拥有一个 `modelSelection` 快照，其中包含当前提供方/模型目标、按提供方分组的目录、逐提供方失败记录，以及 `idle`／`loading`／`ready`／`selecting`／`error` 状态。历史记录会建立或刷新当前目标，打开选择器会刷新目录；选择失败会保留上一个目标和可用分组。目录与选择操作共用单调递增的代次，因此较旧响应无法覆盖较新的选择。重连重建会恢复 Host 报告的目标，同时不替换未变化的选择子结构。

-## 已寻址的 subagent 对话
-
-`SessionListState.subagentsByParent` 携带直接持久化目录，`currentAddress` 则记录所选 child 从目录得到的 `{parentSessionId, childSessionId}`。只有这份已记录地址能选择 subagent 传输；单凭谱系仍然不足，因为普通 fork 同样具有 `parentId`。已寻址的 Session 通过 `subagent.history` 加载和重连，通过 `subagent.prompt` 发送，绝不调用普通取消，并在刷新期间及通过普通选择路径重复选择同一 child 时，把地址与所选会话一同持久化。列表还会投影 header 的粗粒度 `origin: 'subagent'` 分类供导航过滤；传输的权威依据仍是已记录地址，而不是 `origin`。目录读取为 single-flight；Host 基线与 `host/session-status` 都根据 child Agent driver 状态推导活动状态，读取期间收到的状态帧会在该读取的响应之上回放。按 origin 分类的 `host/session-added` 会立即把任何已加载的直接 parent 行标记为 `hasChildren: true`，并在该 parent 被选中或其目录打开时触发一次去抖动的重拉。parent 可用性会传播到 `ConversationSnapshot.subagent`，使呈现层可以把编辑器替换为只读说明，而不激活 parent。
-
 ## 模型体验

 无，因为会话对象层会选择后续 Host 请求使用的提供方/模型路由，但不添加任何模型可见内容。
--- a/packages/client/runtime/src/client/contract/session.ts
+++ b/packages/client/runtime/src/client/contract/session.ts
@@ -9,7 +9,7 @@
 */
 import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
 import type {
-  InboxItemId, QueueAction, RpcResult, SessionId,
+  MessageId, QueueAction, RpcResult, SessionId,
 } from '@deepseek-ai/dsh-client-connection/client'
 import type { ConversationSnapshot } from '../sessions/conversation.ts'
 import type { ObservableSnapshot } from './store.ts'
@@ -44,7 +44,7 @@ export interface ISession {
   * @param action - requested queue operation.
   * @returns acceptance, or a business/transport error.
   */
-  updateQueue(itemId: InboxItemId, action: QueueAction): Promise<RpcResult<{ accepted: true }>>
+  updateQueue(itemId: MessageId, action: QueueAction): Promise<RpcResult<{ accepted: true }>>
  /**
   * Cancel the running turn. Pending queued work remains and resumes in FIFO
   * order after the Host reaches cancellation quiescence.
--- a/packages/client/runtime/src/client/index.ts
+++ b/packages/client/runtime/src/client/index.ts
@@ -48,7 +48,7 @@ export type {
  AssistantTiming, CodeSubCall, CommandNode, CompactionSummaryNode, ComposerPhase,
  ContextMessageNode, ConversationNode, ConversationSnapshot, ModelRetryNode, QueuedMessage,
  RunningToolCall,
-  SteeringMessageNode, TodoItem, ToolResultNode, TurnErrorNode, UnknownSurfaceNode, UserMessageNode,
+  TodoItem, ToolResultNode, TurnErrorNode, UnknownSurfaceNode, UserMessageNode,
 } from './sessions/conversation.ts'
 export type {
  ConversationContext, ConversationContextOriginKind,
--- a/packages/client/runtime/src/client/session-history/history-fold.ts
+++ b/packages/client/runtime/src/client/session-history/history-fold.ts
@@ -172,12 +172,6 @@ function materializeNode(
        ...(requestConfig === undefined ? {} : { requestConfig }),
        ...(assistantTiming === undefined ? {} : { timing: assistantTiming }),
      }
-    case 'steering/message':
-      return {
-        kind: 'steering', messageId: event.data.message.id,
-        seq: event.seq, time: event.time, turn: event.data.turn,
-        content: event.data.message.content, source: event.data.message.source,
-      }
    case 'tool/result': {
      const result = event.data.message.content[0]
      const callId = String(event.data.message.source.callId)
--- a/packages/client/runtime/src/client/sessions/conversation.ts
+++ b/packages/client/runtime/src/client/sessions/conversation.ts
@@ -9,7 +9,7 @@ import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
 import type { LlmRetryEventData } from '@deepseek-ai/dsh-llm-retry/types'
 import type { TodoItem } from '@deepseek-ai/dsh-session/types'
 import type {
-  InboxItemId, RpcError, SessionId, SubagentAddress, ToolCallView, ToolResultView,
+  RpcError, SessionId, SubagentAddress, ToolCallView, ToolResultView,
 } from '@deepseek-ai/dsh-client-connection/client'
 import type { PendingInteraction } from './pending.ts'
 export type { TodoItem }
@@ -102,19 +102,6 @@ export interface AssistantMessageNode {
  interrupted?: true
 }

-/** A steering message injected mid-turn. */
-export interface SteeringMessageNode {
-  kind: 'steering'
-  /** Stable identity shared with its pre-admission inbox occurrence. */
-  messageId: MessageId
-  seq: number
-  /** Unix epoch ms from the source session event. */
-  time: number
-  turn: number
-  content: readonly ContentBlock[]
-  source: unknown
-}
-
 /** A context/system injection surfaced in the flow. */
 export interface ContextMessageNode {
  kind: 'context'
@@ -236,7 +223,6 @@ export interface CommandNode {
 export type ConversationNode =
  | UserMessageNode
  | AssistantMessageNode
-  | SteeringMessageNode
  | ContextMessageNode
  | ModelRetryNode
  | TurnErrorNode
@@ -276,11 +262,11 @@ export interface RunningToolCall {

 /** One transient inbox occurrence from the authoritative `session/queue` snapshot. */
 export interface QueuedMessage {
-  readonly id: InboxItemId
+  readonly id: MessageId
  /** Stable message identity used for transient-to-durable steering handoff. */
  readonly messageId: MessageId
  /** Agent-resolved placement; only queued rows accept queue mutations. */
-  readonly placement: 'queued' | 'steering'
+  readonly placement: 'queued' | 'steering' | 'context'
  /** Complete content used to render pending steering before it becomes durable. */
  readonly content: readonly ContentBlock[]
  readonly preview: string
--- a/packages/client/runtime/src/client/sessions/failure-display.ts
+++ b/packages/client/runtime/src/client/sessions/failure-display.ts
@@ -1,10 +1,13 @@
 /**
 * Convert a durable failure into copy that is safe to expose in the GUI.
- * @param failure - Structured failure preserved by the session event.
+ * @param failure - Failure value preserved by the session event.
 * @returns Display-safe copy for client projections.
 */
-export function displayFailureMessage(failure: { code?: string; message: string }): string {
+export function displayFailureMessage(failure: unknown): string {
+  if (failure === null || typeof failure !== 'object') return String(failure)
+  const record = failure as { code?: unknown; message?: unknown }
  // Provider AUTH messages may echo a masked or partially preserved credential.
  // Keep the raw diagnostic in the session log, but never project it into UI state.
-  return failure.code === 'AUTH' ? 'API key is invalid' : failure.message
+  if (record.code === 'AUTH') return 'API key is invalid'
+  return typeof record.message === 'string' ? record.message : JSON.stringify(failure)
 }
--- a/packages/client/runtime/src/client/sessions/request-inspection.ts
+++ b/packages/client/runtime/src/client/sessions/request-inspection.ts
@@ -242,6 +242,7 @@ function promptChange(
 function deriveRequests(events: readonly SessionEvent[]): readonly RequestView[] {
  const requests: RequestView[] = []
  const ordinaryByStep = new Map<string, number>()
+  const lastStepByTurn = new Map<number, string>()
  let activeStep: string | undefined
  let activePrompt: ConversationPromptSnapshot | undefined
  let activeCompaction: number | undefined
@@ -268,6 +269,7 @@ function deriveRequests(events: readonly SessionEvent[]): readonly RequestView[]
      const { turn, step } = sourceEvent.data
      const key = requestKey(turn, step)
      ordinaryByStep.set(key, requests.length)
+      lastStepByTurn.set(turn, key)
      requests.push({
        purpose: 'assistant',
        startSeq: sourceEvent.seq,
@@ -360,12 +362,15 @@ function deriveRequests(events: readonly SessionEvent[]): readonly RequestView[]
      })
      continue
    }
-    if (sourceEvent.type === 'turn/end' && sourceEvent.data.reason.kind === 'error') {
-      const reason = sourceEvent.data.reason
-      updateAssistant(ordinaryByStep.get(requestKey(sourceEvent.data.turn, reason.step)), {
-        status: 'error',
-        error: displayFailureMessage('failure' in reason ? reason.failure : reason),
-      })
+    if (sourceEvent.type === 'turn/end') {
+      const lastStep = lastStepByTurn.get(sourceEvent.data.turn)
+      if (sourceEvent.data.reason.kind === 'error') {
+        updateAssistant(lastStep === undefined ? undefined : ordinaryByStep.get(lastStep), {
+          status: 'error',
+          error: displayFailureMessage(sourceEvent.data.reason.error),
+        })
+      }
+      lastStepByTurn.delete(sourceEvent.data.turn)
      continue
    }

--- a/packages/client/runtime/src/client/sessions/session.ts
+++ b/packages/client/runtime/src/client/sessions/session.ts
@@ -5,7 +5,7 @@ import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
 import type { LlmRetryEventData } from '@deepseek-ai/dsh-llm-retry/types'
 import type { SessionEvent } from '@deepseek-ai/dsh-session/types'
 import type {
-  HistoryEntry, IApiClient, InboxItemId, MuxFrame, QueueAction, RpcError,
+  HistoryEntry, IApiClient, MessageId, MuxFrame, QueueAction, RpcError,
  RpcId, RpcResponse, RpcResult, SessionId, SubagentAddress, ToolEventView,
 } from '@deepseek-ai/dsh-client-connection/client'
 // Value import from the inline-safe wire layer (not the connection plugin):
@@ -98,6 +98,8 @@ export class Session implements SessionFace {
  private readonly transcript = new TranscriptAdapter()
  private partial: PartialAccumulator | null = null
  private openCalls = new Map<string, RunningToolCall>()
+  /** Last entered step per turn, folded from step/start for terminal error placement. */
+  private lastStepByTurn = new Map<number, number>()
  /** Operational notices and interrupted-turn terminal nodes merged into the flow by seq.
   *  Derived from window events and rebuilt with partial/openCalls; the transcript is
   *  seq-monotonic, so a plain seq merge preserves event order. */
@@ -271,7 +273,7 @@ export class Session implements SessionFace {
  }

  /** Apply one operation to a still-pending queue occurrence. */
-  async updateQueue(itemId: InboxItemId, action: QueueAction): Promise<RpcResult<{ accepted: true }>> {
+  async updateQueue(itemId: MessageId, action: QueueAction): Promise<RpcResult<{ accepted: true }>> {
    try {
      return (await this.api.sessions.updateQueue({ sessionId: this.sessionId, itemId, action })).result
    } catch (error) {
@@ -664,11 +666,12 @@ export class Session implements SessionFace {
    this.applyEventSideEffects(event, view)
  }

-  /** Retire the first matching live steering occurrence when its durable event takes over. */
+  /** Retire the first matching live steering occurrence when its durable message takes over. */
  private handoffPendingSteering(event: SessionEvent): void {
-    if (event.type !== 'steering/message') return
+    if (event.type !== 'user/message') return
+    const message = event.data
    const index = this.queued.findIndex(item =>
-      item.placement === 'steering' && item.messageId === event.data.message.id)
+      item.placement === 'steering' && item.messageId === message.id)
    if (index === -1) return
    this.queued = this.queued.filter((_item, candidate) => candidate !== index)
    this.queueRev++
@@ -803,14 +806,17 @@ export class Session implements SessionFace {
      return
    }
    switch (event.type) {
-      case 'turn/start': {
+      case 'turn/start':
+        this.lastStepByTurn.set(event.data.turn, 0)
        this.turnTimings.set(event.data.turn, { startTime: event.time })
        this.turnTimingsRev++
-        if (event.data.trigger.kind === 'retry') this.settleScheduledRetry('started')
        return
-      }
+      case 'step/start':
+        this.lastStepByTurn.set(event.data.turn, event.data.step)
+        return
      case 'assistant/chunk': {
        const { turn, step, chunk } = event.data
+        this.settleScheduledRetry('started', turn)
        if (this.partial === null || this.partial.turn !== turn || this.partial.step !== step) {
          this.partial = new PartialAccumulator(turn, step)
        }
@@ -837,6 +843,7 @@ export class Session implements SessionFace {
        return
      }
      case 'turn/end': {
+        const lastStep = this.lastStepByTurn.get(event.data.turn) ?? 0
        const timing = this.turnTimings.get(event.data.turn)
        if (timing !== undefined) {
          this.turnTimings.set(event.data.turn, { ...timing, endTime: event.time })
@@ -844,25 +851,26 @@ export class Session implements SessionFace {
        }
        this.turnEnds.set(event.data.turn, event.seq)
        this.turnEndsRev++
-        if (event.data.reason.kind === 'aborted' || event.data.reason.kind === 'disposed') {
+        if (event.data.reason.kind === 'aborted') {
          this.settleScheduledRetry('cancelled', event.data.turn)
        }
        if (
          event.data.reason.kind === 'error'
          && !this.derivedNodes.some(node => node.kind === 'model-retry' && node.turn === event.data.turn)
        ) {
-          const failure = 'failure' in event.data.reason ? event.data.reason.failure : event.data.reason
+          const failure = event.data.reason.error
          this.derivedNodes.push({
            kind: 'turn-error',
            seq: event.seq,
            time: event.time,
            turn: event.data.turn,
-            step: event.data.reason.step,
+            step: lastStep,
            message: displayFailureMessage(failure),
-            ...(failure.code === undefined ? {} : { code: failure.code }),
+            code: failure.code,
          })
          this.derivedRev++
        }
+        if (event.data.reason.kind === 'error') this.settleScheduledRetry('started', event.data.turn)
        // Aborted turns never finalize. The accumulated partial is VALUE, not residue: freeze it
        // into an interrupted terminal node (pulse stops, text survives) instead of deleting it.
        // Shared by live and window-replay paths, so a refresh reconstructs the same frozen node
@@ -897,6 +905,7 @@ export class Session implements SessionFace {
          })
          this.derivedRev++
        }
+        this.lastStepByTurn.delete(event.data.turn)
        return
      }
      default:
@@ -931,6 +940,7 @@ export class Session implements SessionFace {
  private rebuildDerivedFromWindow(): void {
    this.partial = null
    this.openCalls.clear()
+    this.lastStepByTurn.clear()
    this.callsRev++
    this.derivedNodes = []
    this.derivedRev++
--- a/packages/client/runtime/src/client/sessions/transcript-adapter.ts
+++ b/packages/client/runtime/src/client/sessions/transcript-adapter.ts
@@ -71,12 +71,6 @@ function materializeNode(
        turn: event.data.turn, step: event.data.step,
        blocks: toAssistantBlocks(event.data.message.content), usage: event.data.usage,
      }
-    case 'steering/message':
-      return {
-        kind: 'steering', messageId: event.data.message.id,
-        seq: event.seq, time: event.time, turn: event.data.turn,
-        content: event.data.message.content, source: event.data.message.source,
-      }
    case 'tool/result': {
      const result = event.data.message.content[0]
      const callId = String(event.data.message.source.callId)
--- a/packages/client/runtime/tests/event-script.ts
+++ b/packages/client/runtime/tests/event-script.ts
@@ -12,7 +12,7 @@ const at = (seq: number, e: Record<string, unknown>): SessionEvent =>

 export const ev = {
  turnStart: (seq: number, turn: number): SessionEvent =>
-    at(seq, { type: 'turn/start', data: { turn, trigger: { kind: 'message', source: { kind: 'user' } } } }),
+    at(seq, { type: 'turn/start', data: { turn } }),
  user: (seq: number, body: string): SessionEvent =>
    at(seq, { type: 'user/message', surfaceOp: 'append', data: createUserMessage({
      content: text(body), source: { kind: 'user' },
@@ -82,7 +82,12 @@ export const ev = {
      },
    }),
  turnEnd: (seq: number, turn: number, reason: 'completed' | 'aborted' | 'disposed' = 'completed'): SessionEvent =>
-    at(seq, { type: 'turn/end', data: { turn, reason: { kind: reason } } }),
+    at(seq, { type: 'turn/end', data: {
+      turn,
+      reason: reason === 'completed'
+        ? { kind: 'completed' }
+        : { kind: 'aborted', reason: { kind: reason === 'disposed' ? 'disposed' : 'user' } },
+    } }),
  commandRun: (seq: number, commandId: string, name: string, args = ''): SessionEvent =>
    at(seq, { type: 'command/run', data: { commandId, name, args, source: { kind: 'user' } } }),
  commandDone: (seq: number, commandId: string, kind: 'success' | 'error' = 'success', text?: string): SessionEvent =>
--- a/packages/client/runtime/tests/queue-store.spec.ts
+++ b/packages/client/runtime/tests/queue-store.spec.ts
@@ -7,9 +7,7 @@ import { describe, expect, it } from 'vitest'
 import { createUserMessage } from '@deepseek-ai/dsh-llm'
 import type { ContentBlock, UserMessage } from '@deepseek-ai/dsh-llm/types'
 import type { SessionEvent } from '@deepseek-ai/dsh-session/types'
-import type {
-  InboxItemId, MuxFrame, RpcId, SessionId,
-} from '@deepseek-ai/dsh-client-connection/client'
+import type { MessageId, MuxFrame, RpcId, SessionId } from '@deepseek-ai/dsh-client-connection/client'
 import { Session } from '../src/client/sessions/session.ts'
 import { SessionManager } from '../src/client/sessions/manager.ts'
 import { FakeApiClient } from './fake-api.ts'
@@ -17,7 +15,7 @@ import { FakeApiClient } from './fake-api.ts'
 const SID = 'fk-q1' as SessionId
 const text = (value: string): ContentBlock[] => [{ type: 'text', text: value }]
 const rid = (id: string): RpcId => id as RpcId
-const iid = (id: string): InboxItemId => id as InboxItemId
+const iid = (id: string): MessageId => id as MessageId

 interface QueueFixture {
  id: string
@@ -151,16 +149,16 @@ describe('queue snapshot intake', () => {
    const durable = {
      seq: 0,
      time: 1_700_000_000_000,
-      type: 'steering/message',
+      type: 'user/message',
      surfaceOp: 'append',
-      data: { turn: 1, message },
+      data: message,
    } as SessionEvent

    session.handleMuxEnvelope(rid('env-durable'), {
      type: 'session/event', sessionId: SID, event: durable,
    })
    expect(session.getSnapshot().queue.map(item => item.id)).toEqual(['s-second'])
-    expect(session.getSnapshot().nodes.filter(node => node.kind === 'steering')).toHaveLength(1)
+    expect(session.getSnapshot().nodes.filter(node => node.kind === 'user')).toHaveLength(1)

    session.handleMuxEnvelope(rid('env-reused-id'), queueFrame([
      { id: 's-later', body: '', placement: 'steering', message },
@@ -170,6 +168,32 @@ describe('queue snapshot intake', () => {
    })
    expect(session.getSnapshot().queue.map(item => item.id)).toEqual(['s-later'])
  })
+
+  it('hands off live steering when the agent claims it as a user message', async () => {
+    const session = makeSession()
+    await session.open()
+    const message = createUserMessage({
+      content: text('claimed steering'),
+      source: { kind: 'user' },
+    })
+    session.handleMuxEnvelope(rid('env-claimed'), queueFrame([
+      { id: 's-claimed', body: '', placement: 'steering', message },
+    ]))
+
+    session.handleMuxEnvelope(rid('env-user-message'), {
+      type: 'session/event',
+      sessionId: SID,
+      event: {
+        seq: 0,
+        time: 1_700_000_000_000,
+        type: 'user/message',
+        surfaceOp: 'append',
+        data: message,
+      },
+    })
+
+    expect(session.getSnapshot().queue).toEqual([])
+  })
 })

 describe('queue operation transport', () => {
--- a/packages/client/runtime/tests/request-inspection.spec.ts
+++ b/packages/client/runtime/tests/request-inspection.spec.ts
@@ -275,20 +275,15 @@ describe('inspectRequests', () => {
    const snapshot = inspectRequests(entriesOf([
      at(0, 'step/start', { turn: 1, step: 1 }),
      at(1, 'turn/end', {
-        turn: 1,
-        reason: {
-          kind: 'error',
-          step: 1,
-          failure: {
-            code: 'AUTH',
-            message: 'Authentication Fails, Your api key: sk-preview-secret is invalid',
-          },
+        turn: 1, reason: { kind: 'error', error: {
+          code: 'AUTH',
+          message: 'Authentication Fails, Your api key: sk-preview-secret is invalid',
+        },
        },
      }),
      at(2, 'step/start', { turn: 2, step: 1 }),
      at(3, 'turn/end', {
-        turn: 2,
-        reason: { kind: 'error', step: 1, message: 'plugin exploded' },
+        turn: 2, reason: { kind: 'error', error: { message: 'plugin exploded', code: 'UNKNOWN' } },
      }),
    ]))

--- a/packages/client/runtime/tests/session.spec.ts
+++ b/packages/client/runtime/tests/session.spec.ts
@@ -206,7 +206,7 @@ describe('live event path', () => {
    expect(published).toEqual(['累计', null])
  })

-  it('retracts the failed step partial on retry and keeps a replayable notice before the recovered response', async () => {
+  it('retracts the failed-attempt partial and starts the retry on new chunk evidence', async () => {
    const { session } = await opened()
    const feed = (event: SessionEvent) => { session.handleMuxEnvelope('r' as never, { type: 'session/event', sessionId: SID, event }) }
    const retryTurn = [
@@ -215,25 +215,13 @@ describe('live event path', () => {
      ev.stepStart(8, 1),
      ev.chunkStart(9, 1),
      ev.chunkText(10, 1, '不完整回复'),
-      ev.stepEnd(11, 1),
-      ev.retry(12, 1, 0, 1, 2, 450, '连接被重置'),
-      at(13, {
-        type: 'turn/end',
-        data: {
-          turn: 1,
-          reason: {
-            kind: 'error', step: 0,
-            failure: { code: 'TRANSPORT', message: '连接被重置' },
-          },
-        },
-      }),
-      at(14, { type: 'turn/start', data: { turn: 2, trigger: { kind: 'retry' } } }),
-      ev.stepStart(15, 2),
-      ev.assistant(16, 2, '完整回复'),
-      ev.stepEnd(17, 2),
-      ev.turnEnd(18, 2),
+      ev.retry(11, 1, 0, 1, 2, 450, '连接被重置'),
+      ev.chunkStart(12, 1),
+      ev.assistant(13, 1, '完整回复'),
+      ev.stepEnd(14, 1),
+      ev.turnEnd(15, 1),
    ]
-    for (const event of retryTurn.slice(0, 7)) feed(event)
+    for (const event of retryTurn.slice(0, 6)) feed(event)

    let snapshot = session.getSnapshot()
    expect(snapshot.partial).toBeNull()
@@ -252,15 +240,14 @@ describe('live event path', () => {
    })
    expect(JSON.stringify(snapshot.nodes)).not.toContain('不完整回复')

-    for (const event of retryTurn.slice(7)) feed(event)
+    for (const event of retryTurn.slice(6)) feed(event)
    snapshot = session.getSnapshot()
    expect(snapshot.nodes.slice(-2).map(node => node.kind)).toEqual(['model-retry', 'assistant'])
    expect(snapshot.nodes.some(node => node.kind === 'turn-error')).toBe(false)
    expect(snapshot.nodes.at(-2)).toMatchObject({ kind: 'model-retry', retryState: 'started' })
    expect(snapshot.nodes.at(-1)).toMatchObject({ kind: 'assistant', blocks: [{ kind: 'text', text: '完整回复' }] })
-    const retryStart = retryTurn.find(event =>
-      event.type === 'turn/start' && event.data.trigger.kind === 'retry')
-    if (retryStart?.type !== 'turn/start') throw new Error('test fixture must include a retry turn/start')
+    const retryStart = retryTurn.find(event => event.type === 'turn/start')
+    if (retryStart?.type !== 'turn/start') throw new Error('test fixture must include the retried turn start')
    const retryEnd = retryTurn.find(event =>
      event.type === 'turn/end' && event.data.turn === retryStart.data.turn)
    if (retryEnd?.type !== 'turn/end') throw new Error('test fixture must complete the retry turn')
@@ -285,35 +272,33 @@ describe('live event path', () => {
    const failedTurns = [
      ev.turnStart(6, 1),
      ev.user(7, '鉴权失败'),
-      at(8, {
+      ev.stepStart(8, 1),
+      at(9, {
        type: 'turn/end',
-        data: {
-          turn: 1,
-          reason: {
-            kind: 'error',
-            step: 0,
-            failure: {
-              code: 'AUTH',
-              message: 'Authentication Fails, Your api key: sk-preview-secret is invalid',
-            },
-          },
+        data: { turn: 1, reason: { kind: 'error', error: {
+          code: 'AUTH',
+          message: 'Authentication Fails, Your api key: sk-preview-secret is invalid',
+        },
+        },
        },
      }),
-      ev.turnStart(9, 2),
-      ev.user(10, '内部失败'),
-      at(11, {
+      ev.turnStart(10, 2),
+      ev.user(11, '内部失败'),
+      ev.stepStart(12, 2, 1),
+      at(13, {
        type: 'turn/end',
-        data: { turn: 2, reason: { kind: 'error', step: 1, message: 'plugin exploded' } },
+        data: { turn: 2, reason: { kind: 'error', error: { message: 'plugin exploded', code: 'UNKNOWN' } } },
      }),
    ]
    for (const event of failedTurns) feed(event)

    const errors = session.getSnapshot().nodes.filter(node => node.kind === 'turn-error')
    expect(errors).toMatchObject([
-      { seq: 8, turn: 1, step: 0, code: 'AUTH', message: 'API key is invalid' },
-      { seq: 11, turn: 2, step: 1, message: 'plugin exploded' },
+      { seq: 9, turn: 1, step: 0, code: 'AUTH', message: 'API key is invalid' },
+      // Every failed turn carries a structured failure; unstructured errors
+      // flatten to the UNKNOWN code.
+      { seq: 13, turn: 2, step: 1, code: 'UNKNOWN', message: 'plugin exploded' },
    ])
-    expect('code' in errors[1]!).toBe(false)

    const replay = makeSession()
    replay.api.onHistory = () => histResponse([...plainTurn(0, 0, 'a', 'b'), ...failedTurns])
@@ -450,7 +435,7 @@ describe('live event path', () => {
  })

  it.each(['aborted', 'disposed'] as const)(
-    'marks a scheduled retry as cancelled when its failed turn ends %s',
+    'marks a scheduled retry as cancelled when its failed turn receives the %s cause',
    async (reason) => {
      const { session } = await opened()
      const feed = (event: SessionEvent) => {
@@ -470,6 +455,24 @@ describe('live event path', () => {
    },
  )

+  it('marks a scheduled retry as started when its failed turn ends with an error', async () => {
+    const { session } = await opened()
+    const feed = (event: SessionEvent) => {
+      session.handleMuxEnvelope('r' as never, { type: 'session/event', sessionId: SID, event })
+    }
+    feed(ev.turnStart(6, 1))
+    feed(ev.retry(7, 1))
+    feed(at(8, {
+      type: 'turn/end',
+      data: { turn: 1, reason: { kind: 'error', error: { message: 'retry failed', code: 'UNKNOWN' } } },
+    }))
+
+    expect(session.getSnapshot().nodes.at(-1)).toMatchObject({
+      kind: 'model-retry',
+      retryState: 'started',
+    })
+  })
+
  it('freezes an unfinalized partial into an interrupted node on turn/end (cancel path)', async () => {
    const { session } = await opened()
    const feed = (event: SessionEvent) => { session.handleMuxEnvelope('r' as never, { type: 'session/event', sessionId: SID, event }) }
--- a/packages/client/runtime/tests/transcript-adapter.spec.ts
+++ b/packages/client/runtime/tests/transcript-adapter.spec.ts
@@ -88,21 +88,14 @@ describe('TranscriptAdapter', () => {
    adapter.reset([
      ev.user(0, '用户'),
      ev.assistant(1, 0, '助手'),
-      at(2, { type: 'steering/message', surfaceOp: 'append', data: {
-        turn: 0,
-        message: createUserMessage({
-          content: [{ type: 'text', text: '插话' }],
-          source: { kind: 'user' },
-        }),
-      } }),
-      at(3, { type: 'user/message', surfaceOp: 'append', data: createUserMessage({
+      at(2, { type: 'user/message', surfaceOp: 'append', data: createUserMessage({
        content: [{ type: 'text', text: '上下文' }], source: { kind: 'plugin', plugin: 'p' },
      }) }),
-      ev.toolCall(4, 0, 'c1', 'echo', '{"x":1}'),
-      ev.toolResult(5, 0, 'c1', '结果'),
+      ev.toolCall(3, 0, 'c1', 'echo', '{"x":1}'),
+      ev.toolResult(4, 0, 'c1', '结果'),
    ])
    const nodes = adapter.nodes()
-    expect(nodes.map(n => n.kind)).toEqual(['user', 'assistant', 'steering', 'context', 'tool-result'])
+    expect(nodes.map(n => n.kind)).toEqual(['user', 'assistant', 'context', 'tool-result'])
    expect(nodes.find(n => n.kind === 'tool-result')).toMatchObject({
      callId: 'c1', call: { name: 'echo', argsRaw: '{"x":1}' }, isError: false,
    })
--- a/packages/client/ui-conversation/README.i18n.yaml
+++ b/packages/client/ui-conversation/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-conversation/README.md
-README.md: 3b4d2f2c1d7934d619768f2b3b355c8c585290cc
-README.zh.md: e3664a0d621214cced2d8a0d7d5d5f7800f15d90
+README.md: 4869fa4df929027f031082deb04cc1ab3d18921c
+README.zh.md: 5c3091efa11b65f43ea5ea3037a60d0aa1bafbda
--- a/packages/client/ui-conversation/README.md
+++ b/packages/client/ui-conversation/README.md
@@ -38,7 +38,7 @@ The todo surfaces are two registrations over that shape, both plain registrant p

 `QueueDock` is the terminal input-dock entry at `order: 20`. It hides while empty, renders one pending row directly, and defaults two or more rows to a collapsed `"<n> 条排队消息"` header whose button expands or collapses the complete list. The header exposes `aria-expanded` and `aria-controls`; the expanded list scrolls within a 180px height bound. An active edit or mutation keeps its rows visible, and emptying the queue restores the collapsed default for the next queue. Each visible ordinary-session row remains a single-line preview with its exact-occurrence edit, delete, and strict-steer actions; addressed subagents retain the rows as a read-only projection because their continuation transport does not expose queue mutation. If strict steer loses to a closed window, the original occurrence remains queued for normal delivery; if the driver already claimed it, normal delivery is already underway. Neither converged race displays a failure, while transport and unknown failures do.

-The Host's placement-aware `session/queue` snapshot also carries pending steering. QueueDock filters it out, while ChatView projects it as a user-style bubble with Copy at the conversation tail; Fork stays absent because the message has not entered a durable turn. The Host delays steering retirement until the durable `steering/message` has entered the mux stream. On that accepted live event, the client runtime retires the first matching current steering occurrence before publishing the snapshot; historical events cannot hide later occurrences that reuse the same `MessageId`. The bubble therefore hands off without a gap or duplicate, immediately restores Copy and the branch control from the durable node, enables branch only when that node is the completed turn's transcript tail, and survives reconnect from the same authority.
+The Host's placement-aware `session/queue` snapshot also carries pending steering. QueueDock filters it out, while ChatView projects it as a user-style bubble with Copy at the conversation tail; non-user next-step items (injected context) carry the `context` placement instead and render nowhere until claimed. Fork stays absent because the message has not entered a durable turn. The Host delays steering retirement until the durable `user/message` carrying the steering has entered the mux stream. On that accepted live event, the client runtime retires the first matching current steering occurrence before publishing the snapshot; historical events cannot hide later occurrences that reuse the same `MessageId`. The bubble therefore hands off without a gap or duplicate, immediately restores Copy and the branch control from the durable node, enables branch only when that node is the completed turn's transcript tail, and survives reconnect from the same authority.

 Keyboard message submission resolves delivery from the addressed session's running state and steering capability. While idle, Enter and Cmd/Ctrl+Enter both perform an ordinary Queue send. While a primary session is running, the browser-persisted General Settings preference assigns plain Enter to `Queue` (the default) or `Steer`, and Cmd/Ctrl+Enter performs the other behavior; Shift+Enter remains a newline. Addressed subagents keep both gestures on their Queue-only continuation transport even while running. The preference affects only the steer-capable busy-state gesture pair, and the send button and non-keyboard submit actions remain Queue. Composer Steer uses the existing best-effort `session.prompt(mode: 'steer')` contract: if the current next-step window closes before acceptance, AgentLoop admits the message as the next waking Queue turn without surfacing a failure or losing the draft transaction.

@@ -69,4 +69,4 @@ None; this package neither assembles nor sends a provider request.
 - **The approval panel has no durable grant control** — it supports allow-once and reject only.
 - **TodoPanel truncates long item text to one ellipsized line** — the figma strip has no wrap or expand affordance; full text is not readable inline.
 - **Queue edit is text-only** — rows containing non-text blocks still show a flattened preview, but their edit control is disabled because the inline editor cannot preserve those blocks. A text row's edit mode replaces delete and strict steer with save and cancel; Enter saves and Escape cancels.
- **Queue strict steer preserves complete messages** — while the Agent is running, the steer action atomically transfers the addressed Queue occurrence into the current next-step window. Mixed-content rows remain eligible because the action forwards the immutable message instead of the text projection. The placement-aware Host snapshot renders pending steering at the conversation tail until the consumed `steering/message` folds into the durable transcript, so immediate display, reconnect, and replay share one linear authority.
+- **Queue strict steer preserves complete messages** — while the Agent is running, the steer action atomically transfers the addressed Queue occurrence into the current next-step window. Mixed-content rows remain eligible because the action forwards the immutable message instead of the text projection. The placement-aware Host snapshot renders pending steering at the conversation tail until the consumed `user/message` folds into the durable transcript, so immediate display, reconnect, and replay share one linear authority.
--- a/packages/client/ui-conversation/README.zh.md
+++ b/packages/client/ui-conversation/README.zh.md
@@ -38,7 +38,7 @@ todo 两个面就是在该形状上的两个注册项，都是普通注册方插

 `QueueDock` 是 `order: 20` 的末端 input-dock 条目。队列为空时隐藏；只有一个待处理项时直接渲染该行；存在两个或更多待处理项时，默认收起为 `"<n> 条排队消息"` 表头，其按钮可展开或收起完整列表。表头暴露 `aria-expanded` 和 `aria-controls`；展开后的列表以 180px 为高度上限，并可滚动。存在进行中的编辑或变更时，列表行会保持可见；队列清空后，下一次出现队列时会恢复默认收起状态。普通会话中的每条可见行仍是单行预览，并提供针对精确单次入队项的编辑、删除和严格 steering（中途引导）操作；已寻址 subagent 则保留只读行，因为其继续执行传输不提供 Queue 变更。如果严格 steering 输给已关闭的窗口，原单次入队项会留在 Queue 中正常投递；如果驱动器已经认领该项，正常投递就已开始。这两种已收敛的竞态都不显示失败，传输和未知错误仍会显示。

-Host 带 placement 的 `session/queue` 快照也会携带待处理 steering。QueueDock 会将其过滤掉，ChatView 则把它投影为会话流末尾带复制操作的用户样式气泡；消息尚未进入持久轮次，因此不显示 fork。Host 会等持久 `steering/message` 进入 mux 流之后再退役 steering。客户端运行时接纳该实时事件时，会在发布快照前退役第一个匹配的当前 steering 单次入队项；历史事件无法隐藏后来复用同一 `MessageId` 的单次入队项。气泡交接时因而不会产生空档或重复，会立即从持久节点恢复复制操作与分支控件，仅当该节点是已完成轮次的 transcript 尾部时才启用分支，并能在重连后从同一权威恢复。
+Host 带 placement 的 `session/queue` 快照也会携带待处理 steering。QueueDock 会将其过滤掉，ChatView 则把它投影为会话流末尾带复制操作的用户样式气泡；非用户来源的 next-step 项（注入上下文）改以 `context` placement 广播，领取前不在任何界面渲染。消息尚未进入持久轮次，因此不显示 fork。Host 会等携带该 steering 的持久 `user/message` 进入 mux 流之后再退役 steering。客户端运行时接纳该实时事件时，会在发布快照前退役第一个匹配的当前 steering 单次入队项；历史事件无法隐藏后来复用同一 `MessageId` 的单次入队项。气泡交接时因而不会产生空档或重复，会立即从持久节点恢复复制操作与分支控件，仅当该节点是已完成轮次的 transcript 尾部时才启用分支，并能在重连后从同一权威恢复。

 键盘消息提交会根据所寻址会话的运行状态和 steering 能力解析投递方式。空闲时，Enter 和 Cmd/Ctrl+Enter 都执行普通 Queue 发送。主会话运行期间，浏览器持久化的 General Settings 偏好会把普通 Enter 分配为 `Queue`（默认值）或 `Steer`，Cmd/Ctrl+Enter 则执行另一种行为；Shift+Enter 仍然换行。已寻址 subagent 即使正在运行，也会让这两个手势都使用其仅支持 Queue 的继续执行传输。该偏好只影响支持 steering 的繁忙态手势对，发送按钮与非键盘提交操作仍使用 Queue。Composer Steer 复用现有尽力而为的 `session.prompt(mode: 'steer')` 契约：如果当前 next-step 窗口在接纳前关闭，AgentLoop 会把消息接纳为下一条唤醒 Queue 轮次，不显示失败，也不会丢失草稿事务。

@@ -69,4 +69,4 @@ Host 带 placement 的 `session/queue` 快照也会携带待处理 steering。Qu
 - **审批面板的「始终允许此类」暂缓**：持久授权需要授权存储设计；今天只能回答允许一次／拒绝。
 - **TodoPanel 将过长条目截成单行省略号**：figma 条没有换行或展开入口，完整文本无法在行内读完。
 - **Queue 编辑仅支持文本**：包含非文本块的行仍显示扁平化预览，但由于内联编辑器无法保留这些块，其编辑控件会被禁用。文本行进入编辑模式后，删除和严格 steering（中途引导）操作会被保存和取消取代；Enter 保存，Escape 取消。
- **Queue 严格 steering 会保留完整消息**：Agent 运行期间，steering 操作会以原子方式把所寻址的 Queue 单次入队项转移到当前 next-step 窗口。包含混合内容的行仍可使用此操作，因为它会转发不可变消息，而非文本投影。带 placement 的 Host 快照会在会话流末尾渲染待处理 steering，直到已消费的 `steering/message` 折叠进持久 transcript（文本记录），因此立即展示、重连和回放共享同一个线性权威。
+- **Queue 严格 steering 会保留完整消息**：Agent 运行期间，steering 操作会以原子方式把所寻址的 Queue 单次入队项转移到当前 next-step 窗口。包含混合内容的行仍可使用此操作，因为它会转发不可变消息，而非文本投影。带 placement 的 Host 快照会在会话流末尾渲染待处理 steering，直到已消费的 `user/message` 折叠进持久 transcript（文本记录），因此立即展示、重连和回放共享同一个线性权威。
--- a/packages/client/ui-conversation/src/client/chat/MessageIconActions.tsx
+++ b/packages/client/ui-conversation/src/client/chat/MessageIconActions.tsx
@@ -1,4 +1,4 @@
-// Shared IconActions chrome for user, steering, and assistant messages: copy
+// Shared IconActions chrome for user and assistant messages: copy
 // live, optional branch wiring, and an optional date-aware clock.

 import { useCallback, useEffect, useId, useRef, useState } from 'react'
--- a/packages/client/ui-conversation/src/client/chat/MessageItem.tsx
+++ b/packages/client/ui-conversation/src/client/chat/MessageItem.tsx
@@ -1,4 +1,4 @@
-// MessageItem: simple chat nodes — user and consumed-steering bubbles
+// MessageItem: simple chat nodes — user bubbles
 // (right-aligned, with clock + copy / branch IconActions), pending steering
 // (copy only), context injection, compaction marker, retry disclosure, and
 // unknown-surface JSON rows.
@@ -6,7 +6,7 @@
 import { memo, useEffect, useMemo, useState } from 'react'
 import type { ReactNode } from 'react'
 import type {
-  CompactionSummaryNode, ContextMessageNode, ModelRetryNode, SteeringMessageNode,
+  CompactionSummaryNode, ContextMessageNode, ModelRetryNode,
  TurnErrorNode, UnknownSurfaceNode, UserMessageNode,
 } from '@deepseek-ai/dsh-client-runtime/client'
 import { JsonBlock, MessageText, StateDot } from '@deepseek-ai/dsh-client-ui-primitives'
@@ -19,7 +19,6 @@ import css from './MessageItem.module.css'
 export interface MessageItemProps {
  node:
    | UserMessageNode
-    | SteeringMessageNode
    | ContextMessageNode
    | CompactionSummaryNode
    | ModelRetryNode
@@ -227,7 +226,6 @@ export const MessageItem = memo(function MessageItem({
  const truncated = (total: number): string => t('json.truncated', { total })
  switch (node.kind) {
    case 'user':
-    case 'steering':
      return (
        <UserStyleBubble
          content={node.content}
--- a/packages/client/ui-conversation/src/client/chat/chat-flow.ts
+++ b/packages/client/ui-conversation/src/client/chat/chat-flow.ts
@@ -87,7 +87,6 @@ export function messageBranchSeqs(
      nodeIndex++
    }
    if (tail?.kind === 'user'
-      || (tail?.kind === 'steering' && tail.turn === turn)
      || (tail?.kind === 'assistant' && tail.turn === turn && hasContentText(tail.blocks))) {
      result.add(tail.seq)
    }
--- a/packages/client/ui-conversation/src/client/contract/terminal-card-model.ts
+++ b/packages/client/ui-conversation/src/client/contract/terminal-card-model.ts
@@ -1,6 +1,6 @@
 /**
 * Pure derivation of the terminal-card props from a frozen call slice: the
- * `card:'terminal'` render intent the bash tool declares arrives on the
+ * `card:'terminal'` render intent the shell tools declare arrives on the
 * snapshot as `callView`/`resultView`, and this is the one place that turns
 * that pair into what {@link TerminalBlock} draws. Both conversation render
 * sites (the chat tool row's expanded body and the details panel's Output
--- a/packages/client/ui-conversation/src/client/contract/tool-call-model.ts
+++ b/packages/client/ui-conversation/src/client/contract/tool-call-model.ts
@@ -31,6 +31,9 @@ export const VARIANT_TITLES: Record<ToolRowVariant, string> = {
 /** Known tool name -> variant. */
 const TOOL_VARIANTS: Record<string, ToolRowVariant> = {
  bash: 'bash',
+  // The PowerShell twin is a shell tool: the bash row family (icon, colors)
+  // with its own title from TOOL_TITLES, not the generic `others` row.
+  pwsh: 'bash',
  read: 'read',
  web_fetch: 'read',
  web_search: 'search',
@@ -49,6 +52,7 @@ const TOOL_TITLES: Record<string, string> = {
  cordis_inspect: 'Inspect',
  cordis_mount: 'Mount temporary Plugin',
  cordis_unmount: 'Unmount temporary Plugin',
+  pwsh: 'Pwsh',
 }

 /**
--- a/packages/client/ui-conversation/src/client/skeleton/ConversationRoot.tsx
+++ b/packages/client/ui-conversation/src/client/skeleton/ConversationRoot.tsx
@@ -145,7 +145,7 @@ export function ConversationRoot({
      {hero && <HeroGlow className={css.heroGlow} />}
      {hero && <HeroShell t={t} />}
      {hero && heroWorkspaceRow}
-      {!hero && zone !== undefined && renderSlot('conversation.input.dock', zone)}
+      {zone !== undefined && renderSlot('conversation.input.dock', zone)}
      {inputBar}
    </div>
  )
--- a/packages/client/ui-conversation/tests/chat-branch-tails.spec.tsx
+++ b/packages/client/ui-conversation/tests/chat-branch-tails.spec.tsx
@@ -1,5 +1,5 @@
 // @vitest-environment jsdom
-// Remaining chat branch tails: MessageItem context/unknown/steering arms,
+// Remaining chat branch tails: MessageItem context/unknown arms,
 // user IconActions, StatsLine no-cache join,
 // AssistantMarkdown single-line reasoning. (Tool-row dispatch tails live
 // with the keyed-slot machinery specs since the tool ring dissolved into
@@ -203,30 +203,6 @@ describe('MessageItem arms', () => {
    expect(vi.getTimerCount()).toBe(0)
  })

-  it('consumed steering renders copy and branch actions without a badge', () => {
-    const writeText = vi.fn().mockResolvedValue(undefined)
-    Object.defineProperty(navigator, 'clipboard', {
-      configurable: true,
-      value: { writeText },
-    })
-    const fork = vi.fn()
-    const view = render(
-      <MessageItem t={t} node={{
-        kind: 'steering', messageId: 'steer-message', seq: 2, time: 1_000, turn: 1, source: null,
-        content: [{ type: 'text', text: 'steer!' }, { type: 'image', data: 'x' }] as never,
-      } as never}
-      onFork={fork}
-      />,
-    )
-    expect(view.queryByText('插话')).toBeNull()
-    expect(view.getByText('steer!')).toBeTruthy()
-    expect(view.getByText(/附加内容块/)).toBeTruthy()
-    fireEvent.click(view.getByRole('button', { name: '复制' }))
-    expect(writeText).toHaveBeenCalledWith('steer!')
-    fireEvent.click(view.getByRole('button', { name: '在新对话中分支' }))
-    expect(fork).toHaveBeenCalledWith(2)
-  })
-
  it('context uses the Tool calls disclosure chrome and keeps its JSON collapsed by default', () => {
    const ctxView = render(
      <MessageItem t={t} node={{
--- a/packages/client/ui-conversation/tests/chat-tool-row.spec.tsx
+++ b/packages/client/ui-conversation/tests/chat-tool-row.spec.tsx
@@ -59,6 +59,7 @@ const result = (over?: Partial<ToolResultNode>): ToolResultNode => ({
 describe('tool-call-model', () => {
  it('classifies known tools and falls back to others', () => {
    expect(classifyTool('bash')).toBe('bash')
+    expect(classifyTool('pwsh')).toBe('bash')
    expect(classifyTool('read')).toBe('read')
    expect(classifyTool('web_fetch')).toBe('read')
    expect(classifyTool('web_search')).toBe('search')
@@ -71,6 +72,12 @@ describe('tool-call-model', () => {
    expect(classifyTool('todo_write')).toBe('others')
  })

+  it('gives the pwsh shell row the bash family treatment with its own title', () => {
+    const m = toolRowModel('pwsh', running())
+    expect(m.variant).toBe('bash')
+    expect(m.title).toBe('Pwsh')
+  })
+
  it('derives state across running/ok/error/interrupted', () => {
    expect(toolRowModel('bash', running()).state).toBe('running')
    expect(toolRowModel('bash', result()).state).toBe('ok')
--- a/packages/client/ui-conversation/tests/chat-view.spec.tsx
+++ b/packages/client/ui-conversation/tests/chat-view.spec.tsx
@@ -274,11 +274,7 @@ describe('chat-flow derivation', () => {
      user(6, 'second'),
      assistant(7, 'clean tail', 2),
      user(10, 'user-only tail'),
-      {
-        kind: 'steering', messageId: 'steering-tail' as never,
-        seq: 13, time: 13_000, turn: 4,
-        content: [{ type: 'text', text: 'steering tail' }], source: null,
-      },
+      user(13, 'steering tail'),
    ]
    const seqs = messageBranchSeqs(nodes, new Map([[1, 5], [2, 8], [3, 11], [4, 14]]))
    expect([...seqs]).toEqual([7, 10, 13])
@@ -392,8 +388,7 @@ describe('ChatView', () => {
        nodes: [
          assistant(1, 'working'),
          {
-            kind: 'steering', messageId: pending.messageId,
-            seq: 2, time: 2_000, turn: 1,
+            kind: 'user', seq: 2, time: 2_000,
            content: [{ type: 'text', text: 'interrupt now' }], source: null,
          },
        ],
@@ -430,8 +425,7 @@ describe('ChatView', () => {
    const h = makeHarness({
      queue: [pending],
      nodes: [{
-        kind: 'steering', messageId: pending.messageId,
-        seq: 2, time: 2_000, turn: 1,
+        kind: 'user', seq: 2, time: 2_000,
        content: pending.content, source: null,
      }],
      running: true,
@@ -732,9 +726,13 @@ describe('ChatView', () => {
    expect(status.textContent).toMatch(/^Deep diving\.\.\.2分0\d秒$/)
    expect(status.querySelector('[aria-hidden="true"]')).not.toBeNull()
    act(() => {
-      h.set({ nodes: [trigger, {
-        kind: 'steering', messageId: 'st' as never, seq: 2, time: Date.now(), turn: 1,
-        content: [{ type: 'text', text: 'also' }], source: null,
+      h.set({ queue: [{
+        id: 'steering-occurrence' as never,
+        messageId: 'steering-message' as never,
+        placement: 'steering',
+        content: [{ type: 'text', text: 'also' }],
+        preview: 'also',
+        text: 'also',
      }] })
    })
    expect(status.textContent).toMatch(/^Deep diving\.\.\.2分0\d秒$/)
--- a/packages/client/ui-goal/README.i18n.yaml
+++ b/packages/client/ui-goal/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-goal/README.md
-README.md: c9a8f330949ed0db9c4986e7043a5063b8a26805
-README.zh.md: 9df1a0091545436642ef5644d3258364e63a20ec
+README.md: 0ea00b8bf9b07f02b5df0f7b3e7d3d9c6f109fde
+README.zh.md: 70bf443118e5d2b1ce46e7bc1479bf932507b3f9
--- a/packages/client/ui-goal/README.md
+++ b/packages/client/ui-goal/README.md
@@ -8,11 +8,11 @@ The `/client` export surface is the plugin body (`apply`/`inject`), the `GoalBar

 ## Model Experience

-Indirectly, through the `goal.edit`/`goal.pause`/`goal.resume`/`goal.clear` RPCs the strip's verbs submit: each accepted mutation appends a model-visible `goal/change` context message to the session (the same durable event the projection folds), so the model sees the updated goal state on its next turn. The strip itself adds no prompt content.
+Indirectly, through the `goal.edit`/`goal.pause`/`goal.resume`/`goal.clear` RPCs the strip's verbs submit: each accepted mutation commits in a durable `agent/inbox/spliced` insertion, which the goal projection folds immediately, and queues a `goal/change` context message. The model sees that context only if a later pre-step admits it; discarding the queued message does not roll back the projected state. The strip itself adds no prompt content.

 #### KV Cache effect

-None beyond the goal mutation's own context event, which appends to the log tail like any other message.
+None unless the queued goal context is admitted. An admitted context extends the history tail like any other message; an insertion discarded before admission does not affect the cache.

 ## Known Limitations and Deferred Work

--- a/packages/client/ui-goal/README.zh.md
+++ b/packages/client/ui-goal/README.zh.md
@@ -8,11 +8,11 @@ Goal 界面插件（浏览器端部分）：`GoalBar` 条带是 `conversation.in

 ## 模型体验

-间接影响：条带动词提交的 `goal.edit`/`goal.pause`/`goal.resume`/`goal.clear` RPC 每次被接受后，会向会话追加一条模型可见的 `goal/change` 上下文消息（与投影折叠的正是同一条持久事件），模型在下一轮即可看到更新后的 goal 状态。条带自身不添加任何提示词内容。
+间接影响：条带动词提交的 `goal.edit`/`goal.pause`/`goal.resume`/`goal.clear` RPC 每次被接受后，变更都会在持久 `agent/inbox/spliced` 插入项中提交，goal 投影会立即折叠该插入项，同时将一条 `goal/change` 上下文消息排队。只有后续 pre-step 准入该上下文时，模型才会看到它；丢弃已排队的消息不会回滚投影状态。条带自身不添加任何提示词内容。

 #### KV Cache 影响

-除 goal 变更自身的上下文事件（如同任何消息一样追加在日志尾部）外无额外影响。
+除非已排队的 goal 上下文获准，否则没有影响。获准的上下文会像其他消息一样扩展历史尾部；准入前被丢弃的插入项不会影响缓存。

 ## 已知限制与暂缓事项

--- a/packages/client/ui-trajectory/src/client/layout.ts
+++ b/packages/client/ui-trajectory/src/client/layout.ts
@@ -76,7 +76,7 @@ const PREVIEW_OUTPUT_CHARACTERS = 512

 type InputNode = Extract<
  ConversationSnapshot['nodes'][number],
-  { kind: 'user' | 'steering' | 'context' }
+  { kind: 'user' | 'context' }
 >

 type OrderedLayoutEntry =
@@ -326,19 +326,17 @@ export function deriveTrajectoryLayout(input: TrajectoryLayoutInput): readonly T
      continue
    }
    const { node, nodeIndex: i } = entry
-    if (node.kind === 'user' || node.kind === 'steering') {
+    if (node.kind === 'user') {
      // user/message has no turn on the wire; enclose it in the next assistant
      // (or partial) turn, else open the turn after the last assistant.
-      const turn = node.kind === 'steering'
-        ? node.turn
-        : enclosingUserTurn(nodes, i, partial, lastAssistantTurn)
+      const turn = enclosingUserTurn(nodes, i, partial, lastAssistantTurn)
      pushMessage(turn, {
        absTime: finiteTime(node.time),
        cell: {
          index: ++index,
          kind: 'user',
          ...inputCellDetail(node),
-          opensTurn: node.kind === 'user',
+          opensTurn: true,
        },
      })
      prevAbsTime = finiteTime(node.time) ?? prevAbsTime
@@ -454,7 +452,7 @@ export function deriveTrajectoryLayout(input: TrajectoryLayoutInput): readonly T
    else for (const laid of laidList) pushMessage(call.turn, laid)
  }

-  // Orphan turn-0 cells (orphaned tools / steering turn 0) fold into Turn 1.
+  // Orphan turn-0 cells (orphaned tools) fold into Turn 1.
  const prologue = turns.get(0)
  if (prologue !== undefined) {
    turns.delete(0)
@@ -795,7 +793,7 @@ function stringifySourceValue(value: unknown): string {
 }

 /**
- * Turn that encloses a user/message: next assistant/steering turn, else the
+ * Turn that encloses a user/message: next assistant turn, else the
 * in-flight partial, else the turn after the last finalized assistant (or 1).
 */
 function enclosingUserTurn(
@@ -808,7 +806,7 @@ function enclosingUserTurn(
    const n = nodes[i]
    /* v8 ignore next -- dense-array guard: i stays within nodes.length, so the undefined arm needs a sparse array no caller builds. */
    if (n === undefined) continue
-    if (n.kind === 'assistant' || n.kind === 'steering') return n.turn
+    if (n.kind === 'assistant') return n.turn
  }
  if (partial !== null) return partial.turn
  if (lastAssistantTurn !== null) return lastAssistantTurn + 1
@@ -832,7 +830,7 @@ function firstVisibleTurn(
  partial: ConversationSnapshot['partial'],
 ): number {
  const turns = nodes.flatMap(node =>
-    (node.kind === 'assistant' || node.kind === 'steering') && node.turn > 0
+    node.kind === 'assistant' && node.turn > 0
      ? [node.turn]
      : [],
  )
--- a/packages/compact/command-compact/src/index.ts
+++ b/packages/compact/command-compact/src/index.ts
@@ -27,6 +27,8 @@ function expectedFailure(error: ManualCompactionError): CommandResult {
        kind: 'error',
        text: 'Compaction is unavailable because this process has an active compaction, or the agent is not idle.',
      }
+    case 'cancelled':
+      return { kind: 'error', text: 'Compaction cancelled.' }
    case 'changed':
      return {
        kind: 'error',
--- a/packages/compact/command-compact/tests/command-compact.spec.ts
+++ b/packages/compact/command-compact/tests/command-compact.spec.ts
@@ -175,6 +175,7 @@ describe('/compact human command', () => {

  it.each([
    ['busy', 'Compaction is unavailable because this process has an active compaction, or the agent is not idle.'],
+    ['cancelled', 'Compaction cancelled.'],
    ['changed', 'The history selected for compaction changed before it could be replaced. The conversation is unchanged; the attempt is recorded in the session log.'],
    ['summary', 'Compaction could not produce a useful summary. The conversation is unchanged; the attempt is recorded in the session log.'],
    ['commit', 'Compaction did not finish cleanly; some session history may have changed. Inspect the current session state before retrying.'],
--- a/packages/compact/compact-basic/README.i18n.yaml
+++ b/packages/compact/compact-basic/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/compact/compact-basic/README.md
-README.md: fdd51db977feae593a01954593019b5205c17df8
-README.zh.md: d841b29ab6d0e0d188c150035b780acbc5646b63
+README.md: 0c7b009255dc2d41dc81cf2c7ff745e02ef28b9a
+README.zh.md: 4af584a059c99725882afd6206bdf9c984c7d4e3
--- a/packages/compact/compact-basic/README.md
+++ b/packages/compact/compact-basic/README.md
@@ -17,7 +17,7 @@ This backend owns the compaction policy:
 - **Convergence** — retry head-checkpoint compaction up to `compactionRetries`; reject a summary that does not shrink its source, and throw if retries cannot return below threshold.
 - **Summarization** — a direct `llm/stream` call uses the configured provider/model pair and cap, falling back to the latest logged request target and then the agent target, without running the loop-only `agent/request` seam. The call replays the conversation's own system prompt, tools, and shadowed-region messages verbatim and appends the compaction instruction as the final user message, so it reuses the provider's warm prefix cache instead of invalidating it. It sets `GenerateOptions.purpose` to `compaction`, which adapters may forward as request attribution (the DeepSeek adapter sends `x-deepseek-harness-compact: 1`) without touching the model-visible body. Only returned text enters the checkpoint, excluding reasoning and tool calls that would leak private reasoning or create an orphaned call.
 - **Framing** — the replacement user message marks established checkpoint context with `<compacted-summary>` tags. The raw summary remains on the provenance event, and later automatic cycles merge the prior checkpoint.
- **Lifecycle** — all entry points share one bracket-first region transaction. It validates the range and live lock, appends `compact/start` synchronously, prepares and awaits the summary, revalidates, appends provenance plus the replacement, and makes exactly one closing attempt. Automatic and explicit-region calls require a numeric open-turn owner and whole-surface stability. `compactNow()` reserves idle admission, uses `turn: null`, accepts append-only context outside its selected span, flushes every closed attempt, and releases admission in `finally`.
+- **Lifecycle** — all entry points share one bracket-first region transaction. It validates the range and live lock, appends `compact/start` synchronously, prepares and awaits the summary, revalidates, appends provenance plus the replacement, and makes exactly one closing attempt. Automatic and explicit-region calls require a numeric open-turn owner and whole-surface stability; the serial `agent/pre-step` listener checks pressure before request derivation, while canonical provider overflow enters through `agent/request-error` and authorizes retry only after durable surface progress. `compactNow()` reserves idle admission, uses `turn: null`, accepts append-only context outside its selected span, flushes every closed attempt, and releases admission in `finally`.
 - **Overflow recovery** — provider-confirmed overflow needs no capacity metadata: it bypasses normal pressure and retention, prunes, then attempts one maximal balanced head reduction while leaving the newest indivisible unit. Retry is authorized whenever `surface.replaceGeneration` advances, including when pruning lands before later summary work throws. No replacement, an exhausted target-specific cap, cancellation, or an unknown/noncanonical error preserves the original provider failure.
 - **Failure handling** — a live unmatched `compact/start` is the durable lock. An unmatched marker before a newer `session/end-seed` is stale evidence from a prior lifecycle and does not block; one after that boundary reports `busy`. Summary and changed-span failures close with an error and leave the conversation surface untouched, though the attempt remains in the log. A failed close deliberately leaves a blocking orphan. Operational pressure failures warn and continue, while overflow-recovery failure preserves the original provider error only when no earlier replacement advanced the surface. Cancellation remains authoritative after cleanup and durability.

--- a/packages/compact/compact-basic/README.zh.md
+++ b/packages/compact/compact-basic/README.zh.md
@@ -17,7 +17,7 @@
 - **收敛**：最多按 `compactionRetries` 重试头部检查点压缩；拒绝不能缩小源内容的摘要，如果重试仍无法回到阈值以下，则抛出异常。
 - **摘要**：直接 `llm/stream` 调用使用已配置的提供方／模型对与上限，回退到最新已记录请求目标，然后再回退到 agent 目标，而不运行仅用于 agent loop 的 `agent/request` seam。该调用会逐字回放会话自身的系统提示词、工具与已遮蔽区域消息，并将压缩指令作为最后一条 user 消息追加，从而复用提供方的热前缀 cache，而非使它失效。它将 `GenerateOptions.purpose` 设为 `compaction`，适配器可将其作为请求归因转发（DeepSeek 适配器发送 `x-deepseek-harness-compact: 1`），但不会触碰模型可见的请求体。只有返回的文本会进入检查点；推理（reasoning）和工具调用都会被排除，以免泄露私有推理或产生遗留调用。
 - **框定**：替换 user 消息使用 `<compacted-summary>` 标签标记已建立的检查点上下文。原始摘要保留在溯源事件上，后续自动周期会合并之前的检查点。
- **生命周期**：所有入口点共享一个先记录标记的区域事务。它会验证范围与活动锁，同步追加 `compact/start`，准备并等待摘要，重新验证，再追加溯源信息和替换，最后恰好进行一次闭合尝试。自动调用和显式范围调用要求数字标识的开放轮次归属，并要求整个表层保持稳定。`compactNow()` 会预留空闲接纳，使用 `turn: null`，允许所选 span 之外追加仅追加上下文，flush 每次已闭合尝试，并在 `finally` 中释放接纳预留。
+- **生命周期**：所有入口点共享一个先记录标记的区域事务。它会验证范围与活动锁，同步追加 `compact/start`，准备并等待摘要，重新验证，再追加溯源信息和替换，最后恰好进行一次闭合尝试。自动调用和显式范围调用要求数字标识的开放轮次归属，并要求整个表层保持稳定；串行 `agent/pre-step` listener 会在派生请求之前检查压力，而规范提供方溢出则经由 `agent/request-error` 进入，并且只在表层取得持久进展后才允许重试。`compactNow()` 会预留空闲接纳，使用 `turn: null`，允许所选 span 之外追加仅追加上下文，flush 每次已闭合尝试，并在 `finally` 中释放接纳预留。
 - **溢出恢复**：提供方已确认的溢出不需容量元数据。它会绕过常规压力与保留，执行剪枝，再尝试一次最大平衡头部缩减，并留下最新不可分单元。只要 `surface.replaceGeneration` 前进，就允许重试，包括剪枝在后续摘要工作抛出异常前已落地的情况。如果没有替换、目标特定上限已耗尽、已取消，或遇到未知／非规范错误，则保留原始提供方失败。
 - **失败处理**：活动的未匹配 `compact/start` 是持久锁。位于较新 `session/end-seed` 之前的未匹配标记，是先前生命周期留下的陈旧证据，不会阻塞；位于该边界之后的标记报告 `busy`。摘要和 span 变更失败会以错误闭合，并保持会话表层不变，但日志中仍保留该尝试。闭合失败会有意留下阻塞性的未匹配标记。压力检查中的运行故障会发出警告并继续；只有此前没有替换推进表层时，溢出恢复失败才保留原始提供方错误。完成清理与持久化后，取消仍具有最终决定权。

--- a/packages/compact/compact-basic/src/index.ts
+++ b/packages/compact/compact-basic/src/index.ts
@@ -12,7 +12,7 @@ import type { TokenMeterService } from '@deepseek-ai/dsh-token-meter'
 import type { Session } from '@deepseek-ai/dsh-session'
 import { CONTEXT_WINDOW_EXCEEDED_CODE, assertNever } from '@deepseek-ai/dsh-llm'
 import type { LlmCallConfig } from '@deepseek-ai/dsh-llm'
-import type { Agent } from '@deepseek-ai/dsh-agent'
+import type { Agent, PreStepDecision } from '@deepseek-ai/dsh-agent'
 // Type-only: makes the optional sibling service available to `ctx.get()`.
 import type {} from '@deepseek-ai/dsh-compact-tool-result-prune'
 import {
@@ -143,28 +143,30 @@ export class BasicCompactService extends CompactService {
      )
    }

-    ctx.on('agent/step', async (
+    ctx.on('agent/pre-step', async (
      agent: Agent,
-      _turn: number,
-      _step: number,
-      signal: AbortSignal,
-    ) => {
-      if (signal.aborted) return
-      try {
-        const result = await this.compactIfNeeded(agent, 'pressure', signal)
-        if (result !== null) logResult(result, 'step pressure')
-      } catch (error: unknown) {
-        if (error instanceof TargetPressureConfigError) {
-          if (this.warnedPressureConfigTargets.has(error.targetKey)) return
-          this.warnedPressureConfigTargets.add(error.targetKey)
+      _messages,
+      { signal },
+      next,
+    ): Promise<PreStepDecision> => {
+      if (!signal.aborted) {
+        try {
+          const result = await this.compactIfNeeded(agent, 'pressure', signal)
+          if (result !== null) logResult(result, 'step pressure')
+        } catch (error: unknown) {
+          if (error instanceof TargetPressureConfigError) {
+            if (this.warnedPressureConfigTargets.has(error.targetKey)) return next()
+            this.warnedPressureConfigTargets.add(error.targetKey)
+          }
+          const message = error instanceof Error ? error.message : String(error)
+          ctx.logger.warn(`step compaction failed: ${message}; continuing the turn`)
        }
-        const message = error instanceof Error ? error.message : String(error)
-        ctx.logger.warn(`step compaction failed: ${message}; continuing the turn`)
      }
+      return next()
    })

-    ctx.on('agent/settled', (agent) => {
-      this.overflowRetries.delete(agent)
+    ctx.on('agent/status', (agent, status) => {
+      if (status === 'idle') this.overflowRetries.delete(agent)
    })

    // A successful response starts a fresh overflow-recovery sequence even
@@ -177,15 +179,11 @@ export class BasicCompactService extends CompactService {

    ctx.on('agent/request-error', async (
      agent,
-      _turn,
-      _step,
-      _error,
-      failure,
-      _priorFailures,
-      _retryPolicy,
+      context,
      signal,
      next,
    ) => {
+      const { failure } = context
      if (failure.code !== CONTEXT_WINDOW_EXCEEDED_CODE || signal.aborted) return next()
      this.overflowAgents.set(agent.session, agent)
      const target = routedTarget(agent.session)
@@ -367,46 +365,56 @@ export class BasicCompactService extends CompactService {
   * Force one useful idle-session compaction below the pressure threshold, and
   * resolve only after its standalone marker pair is durably checkpointed.
   * @param agent - idle agent whose next-turn admission this call reserves.
-   * @param signal - command-owned cancellation forwarded to summarization.
+   * @param signal - cancellation scoped to this compaction request.
   * @returns the committed result, or `null` when no safe useful range exists.
   */
-  override async compactNow(
-    agent: Agent,
-    signal: AbortSignal,
-  ): Promise<CompactionResult | null> {
+  override compactNow(agent: Agent, signal: AbortSignal): Promise<CompactionResult | null> {
    signal.throwIfAborted()
-    const releaseTurnAdmission = agent.reserveTurnAdmission()
-    if (releaseTurnAdmission === undefined) {
+    try {
+      return agent.runMaintenance(async (agentSignal) => {
+        const operationSignal = AbortSignal.any([agentSignal, signal])
+        try {
+          operationSignal.throwIfAborted()
+          const range = selectCompactableRange(
+            agent.session,
+            this.ctx.tokenMeter.measure(agent.session),
+            0,
+          )
+          if (range === null) return null
+          return await compactSurfaceRegion(
+            this.regionDependencies(),
+            agent.session,
+            range.start,
+            range.end,
+            agent,
+            {
+              owner: null,
+              stability: 'selected-span',
+              flush: async () => {
+                await this.ctx.sessions.flush(agent.session)
+              },
+            },
+            operationSignal,
+          )
+        } catch (error: unknown) {
+          if (agentSignal.aborted && operationSignal.reason === agentSignal.reason) {
+            throw new ManualCompactionError(
+              'cancelled',
+              'manual compaction was cancelled',
+              { cause: error },
+            )
+          }
+          operationSignal.throwIfAborted()
+          throw error
+        }
+      })
+    } catch (error: unknown) {
      throw new ManualCompactionError(
        'busy',
        'manual compaction requires an idle agent with no waking queued work',
+        { cause: error },
      )
    }
-    try {
-      const range = selectCompactableRange(
-        agent.session,
-        this.ctx.tokenMeter.measure(agent.session),
-        0,
-      )
-      if (range === null) return null
-      return await compactSurfaceRegion(
-        this.regionDependencies(),
-        agent.session,
-        range.start,
-        range.end,
-        agent,
-        {
-          owner: null,
-          stability: 'selected-span',
-          flush: async () => {
-            await this.ctx.sessions.flush(agent.session)
-          },
-        },
-        signal,
-      )
-    } finally {
-      releaseTurnAdmission()
-    }
  }

  /** Bind the effective token meter and dynamically dispatched summarizer hook. */
--- a/packages/compact/compact-basic/tests/compact-basic.spec.ts
+++ b/packages/compact/compact-basic/tests/compact-basic.spec.ts
@@ -105,7 +105,7 @@ function promptInput(text: string): SummarizationInput {
 function conversation(turns = 4, text = 'fixture '.repeat(40).trim()): Session {
  const session = Session.create(SessionId(`conversation-${turns}`))
  for (let turn = 1; turn <= turns; turn += 1) {
-    session.append('turn/start', { turn, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('turn/start', { turn })
    session.append('user/message', createUserMessage({
      content: [{ type: 'text', text: `${text} user ${turn}` }],
      source: { kind: 'user' },
@@ -134,7 +134,6 @@ function conversation(turns = 4, text = 'fixture '.repeat(40).trim()): Session {
  }
  session.append('turn/start', {
    turn: turns + 1,
-    trigger: { kind: 'message', source: { kind: 'user' } },
  })
  return session
 }
@@ -143,7 +142,7 @@ function toolConversation(): Session {
  const session = Session.create(SessionId('tools'))
  for (let turn = 1; turn <= 3; turn += 1) {
    const callId = CallId(`call-${turn}`)
-    session.append('turn/start', { turn, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('turn/start', { turn })
    session.append('user/message', createUserMessage({
      content: [{ type: 'text', text: `request ${turn} `.repeat(300) }],
      source: { kind: 'user' },
@@ -183,7 +182,7 @@ function toolConversation(): Session {
    session.append('step/end', { turn, step: 1 })
    session.append('turn/end', { turn, reason: { kind: 'completed' } })
  }
-  session.append('turn/start', { turn: 4, trigger: { kind: 'message', source: { kind: 'user' } } })
+  session.append('turn/start', { turn: 4 })
  return session
 }

@@ -191,7 +190,7 @@ function toolConversation(): Session {
 function oversizedToolResult(chars = 3_000, withCompactablePrompt = false): Session {
  const session = Session.create(SessionId(`oversized-tool-${chars}`))
  const callId = CallId('oversized')
-  session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+  session.append('turn/start', { turn: 1 })
  if (withCompactablePrompt) {
    session.append('user/message', createUserMessage({
      content: [{ type: 'text', text: 'older history '.repeat(200) }],
@@ -228,7 +227,7 @@ function oversizedToolResult(chars = 3_000, withCompactablePrompt = false): Sess
  }, { surfaceOp: 'append' })
  session.append('step/end', { turn: 1, step: 1 })
  session.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
-  session.append('turn/start', { turn: 2, trigger: { kind: 'message', source: { kind: 'user' } } })
+  session.append('turn/start', { turn: 2 })
  return session
 }

@@ -486,7 +485,7 @@ describe('pressure measurement and retention', () => {
  it('skips when no durable routed model exists instead of using AgentOptions fallback', async () => {
    const compact = service(compactConfig)
    const session = Session.create(SessionId('headerless'))
-    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('turn/start', { turn: 1 })
    await expect(compact.compactIfNeeded(agent(session, MODEL), 'pressure', SIGNAL))
      .resolves.toBeNull()
    expect(compact.calls).toHaveLength(0)
@@ -569,7 +568,7 @@ describe('pressure measurement and retention', () => {
    const compact = service(compactConfig)
    const session = Session.create(SessionId('single-tool-pair'))
    const callId = CallId('single-call')
-    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('turn/start', { turn: 1 })
    session.append('step/start', { turn: 1, step: 1 })
    session.append('request/header', {
      header: { config: { provider: MODEL, model: MODEL } },
@@ -659,7 +658,7 @@ describe('pressure measurement and retention', () => {
  it('declines when envelope pressure is high but the surface has no compactable range', async () => {
    const compact = service(compactConfig)
    const empty = Session.create(SessionId('empty'))
-    empty.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    empty.append('turn/start', { turn: 1 })
    empty.append('request/header', {
      header: { config: { provider: MODEL, model: MODEL }, system: 'x'.repeat(100_000) },
      reason: 'initial',
@@ -735,7 +734,7 @@ describe('pressure measurement and retention', () => {
    const ctx = createContext()
    const session = Session.create(SessionId('one-tool-pair'))
    const callId = CallId('only')
-    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('turn/start', { turn: 1 })
    session.append('step/start', { turn: 1, step: 1 })
    session.append('assistant/message', {
      turn: 1,
@@ -1077,7 +1076,7 @@ describe('compaction region transaction', () => {
  it('lets a model-independent custom summarizer compact without a conversation model', async () => {
    const compact = service()
    const session = Session.create(SessionId('model-less-region'))
-    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('turn/start', { turn: 1 })
    session.append('user/message', createUserMessage({
      content: [{ type: 'text', text: 'history '.repeat(100) }],
      source: { kind: 'user' },
@@ -1371,8 +1370,11 @@ describe('default one-shot summarizer', () => {
 })

 describe('automatic listener and loader composition', () => {
-  function postStep(ctx: Context, owner: Agent, signal = SIGNAL): Promise<unknown> {
-    return agentEvents(ctx, owner).serial('agent/step', 1, 1, signal)
+  function preStep(ctx: Context, owner: Agent, signal = SIGNAL) {
+    return agentEvents(ctx, owner).waterfall(
+      'agent/pre-step', [], { turn: 1, step: 1, signal },
+      () => Promise.resolve({ kind: 'enter' as const, messages: [] }),
+    )
  }

  function recover(
@@ -1385,7 +1387,10 @@ describe('automatic listener and loader composition', () => {
    const failure: LlmFailure = { message: error.message, code: error.code ?? 'UNKNOWN' }
    const turn = owner.session.events.findLast(event => event.type === 'turn/start')?.data.turn ?? 1
    return agentEvents(ctx, owner).waterfall(
-      'agent/request-error', turn, 1, error, failure, [], undefined, signal, next,
+      'agent/request-error',
+      { turn, step: 1, provider: 'test', failure, retryPolicy: undefined },
+      signal,
+      next,
    ).then(action => action?.kind === 'retry')
  }

@@ -1393,23 +1398,23 @@ describe('automatic listener and loader composition', () => {
    return Object.assign(new Error(message), { code: CONTEXT_WINDOW_EXCEEDED_CODE })
  }

-  it('compacts post-step above threshold using the durable routed model and remains idle below it', async () => {
+  it('compacts before a step above threshold using the durable routed model and remains idle below it', async () => {
    const ctx = createContext()
    const compact = new TestCompactService(ctx, {
      thresholdRatio: 0.5,
      retainTokens: 180,
    })
    const pressured = conversation(4)
-    await postStep(ctx, agent(pressured, 'unconfigured-agent-fallback'))
+    await preStep(ctx, agent(pressured, 'unconfigured-agent-fallback'))
    expect(pressured.events.some(event => event.type === 'compact/summary')).toBe(true)

    const small = conversation(1)
-    await postStep(ctx, agent(small, MODEL))
+    await preStep(ctx, agent(small, MODEL))
    expect(small.events.some(event => event.type === 'compact/start')).toBe(false)
    expect(compact.calls).toHaveLength(1)
  })

-  it('skips post-step pressure when the step signal is already aborted', async () => {
+  it('skips pre-step pressure when the step signal is already aborted', async () => {
    const ctx = createContext()
    const compact = new TestCompactService(ctx, {
      thresholdRatio: 0.5,
@@ -1418,8 +1423,8 @@ describe('automatic listener and loader composition', () => {
    const pressured = conversation(4)
    const compactIfNeeded = vi.spyOn(compact, 'compactIfNeeded')

-    await expect(postStep(ctx, agent(pressured, MODEL), AbortSignal.abort('step aborted')))
-      .resolves.toBeUndefined()
+    await expect(preStep(ctx, agent(pressured, MODEL), AbortSignal.abort('step aborted')))
+      .resolves.toEqual({ kind: 'enter', messages: [] })

    expect(compactIfNeeded).not.toHaveBeenCalled()
    expect(pressured.events.some(event => event.type === 'compact/start')).toBe(false)
@@ -1436,7 +1441,7 @@ describe('automatic listener and loader composition', () => {
    compact.error = 'temporary failure'
    const session = conversation(4)

-    await expect(postStep(ctx, agent(session, MODEL))).resolves.toBeUndefined()
+    await expect(preStep(ctx, agent(session, MODEL))).resolves.toEqual({ kind: 'enter', messages: [] })
    expect(warnings).toContainEqual(expect.stringContaining('temporary failure'))
    expect(session.events.some(event => event.type === 'compact/summary')).toBe(false)
  })
@@ -1456,8 +1461,8 @@ describe('automatic listener and loader composition', () => {
    })
    const session = conversation(4)

-    await postStep(ctx, agent(session, MODEL))
-    await postStep(ctx, agent(session, MODEL))
+    await preStep(ctx, agent(session, MODEL))
+    await preStep(ctx, agent(session, MODEL))

    expect(warnings).toEqual([
      expect.stringContaining(`no context capacity for ${MODEL}/${MODEL}`),
@@ -1474,8 +1479,8 @@ describe('automatic listener and loader composition', () => {
    })
    const session = conversation(4)

-    await postStep(ctx, agent(session, MODEL))
-    await postStep(ctx, agent(session, MODEL))
+    await preStep(ctx, agent(session, MODEL))
+    await preStep(ctx, agent(session, MODEL))

    expect(warnings).toEqual([
      expect.stringContaining('retainTokens (500) must be less than threshold tokens 500'),
@@ -1701,7 +1706,6 @@ describe('automatic listener and loader composition', () => {
    const session = Session.create(SessionId('headerless-overflow'))
    session.append('turn/start', {
      turn: 1,
-      trigger: { kind: 'message', source: { kind: 'user' } },
    })

    await expect(recover(ctx, agent(session, MODEL), overflow())).resolves.toBe(false)
@@ -1759,7 +1763,7 @@ describe('automatic listener and loader composition', () => {
      retainTokens: 180,
    })
    const session = conversation(4)
-    await postStep(ctx, agent(session, MODEL))
+    await preStep(ctx, agent(session, MODEL))
    const summaries = session.events.filter(event => event.type === 'compact/summary').length
    expect(summaries).toBe(1)
    expect(await recover(ctx, agent(session, MODEL), overflow())).toBe(false)
@@ -1774,7 +1778,7 @@ describe('automatic listener and loader composition', () => {
      retainTokens: 180,
    })
    const session = conversation(4)
-    await postStep(ctx, agent(session, MODEL))
+    await preStep(ctx, agent(session, MODEL))
    expect(session.events.some(event => event.type === 'compact/start')).toBe(false)
    expect(await recover(ctx, agent(session, MODEL), overflow())).toBe(false)
  })
@@ -1804,7 +1808,7 @@ describe('automatic listener and loader composition', () => {
    await fiber.dispose()

    const session = conversation(4)
-    await postStep(ctx, agent(session, MODEL))
+    await preStep(ctx, agent(session, MODEL))
    expect(session.events.some(event => event.type === 'compact/start')).toBe(false)
    expect(await recover(ctx, agent(session, MODEL), overflow())).toBe(false)
  })
--- a/packages/compact/compact-basic/tests/compact-loop-repro.spec.ts
+++ b/packages/compact/compact-basic/tests/compact-loop-repro.spec.ts
@@ -190,7 +190,6 @@ function overflowHistorySeed(): SessionEvent[] {
    const sentinel = turn === 1 ? 'OLD HISTORY SENTINEL' : 'RECENT HISTORY'
    session.append('turn/start', {
      turn,
-      trigger: { kind: 'message', source: { kind: 'user' } },
    })
    session.append('user/message', createUserMessage({
      content: [{ type: 'text', text: `${sentinel} ${'old context '.repeat(200)}` }],
@@ -307,7 +306,7 @@ describe('CBR-001: a real-loop checkpoint is a valid boundary on both sides', ()

 describe('context-overflow recovery across the real loop and compact-basic', () => {
  it.each(['thrown', 'in-band'] as const)(
-    'force-compacts a %s overflow between failed and retry steps',
+    'force-compacts a %s overflow within the retried step',
    async (delivery) => {
      const ctx = new Context()
      const adapter = new OverflowRecoveryAdapter(delivery)
@@ -353,18 +352,12 @@ describe('context-overflow recovery across the real loop and compact-basic', ()
        expect(retry).not.toContain('OLD HISTORY SENTINEL')

        const events = [...agent.session.events]
-        const failedStepEnd = events.find(event =>
+        const stepStart = events.find(event =>
+          event.type === 'step/start' && event.data.turn === 3 && event.data.step === 1,
+        )!
+        const stepEnd = events.find(event =>
          event.type === 'step/end' && event.data.turn === 3 && event.data.step === 1,
        )!
-        const failedEnd = events.find(event =>
-          event.type === 'turn/end' && event.data.turn === 3,
-        )!
-        const retryStart = events.find(event =>
-          event.type === 'turn/start' && event.data.turn === 4,
-        )!
-        const retryStep = events.find(event =>
-          event.type === 'step/start' && event.data.turn === 4 && event.data.step === 1,
-        )!
        const compaction = events.filter(event =>
          event.type === 'compact/start'
          || event.type === 'compact/summary'
@@ -375,11 +368,13 @@ describe('context-overflow recovery across the real loop and compact-basic', ()
          'compact/summary',
          'compact/end',
        ])
-        expect(retryStart.seq).toBeGreaterThan(failedEnd.seq)
        expect(compaction.every(event =>
-          event.seq > failedStepEnd.seq && event.seq < failedEnd.seq,
+          event.seq > stepStart.seq && event.seq < stepEnd.seq,
        )).toBe(true)
-        expect(retryStep.seq).toBeGreaterThan(retryStart.seq)
+        expect(events.filter(event => event.type === 'turn/start').slice(-1).map(event => event.data.turn))
+          .toEqual([3])
+        expect(events.filter(event => event.type === 'step/start' && event.data.turn === 3))
+          .toHaveLength(1)
        expect(events.at(-1)).toMatchObject({
          type: 'turn/end',
          data: { reason: { kind: 'completed' } },
@@ -419,9 +414,9 @@ describe('context-overflow recovery across the real loop and compact-basic', ()
      expect(adapter.conversationRequests).toHaveLength(3)
      expect(adapter.summaryRequests).toHaveLength(1)
      expect(agent.session.events.filter(event => event.type === 'llm/retry').map(event => event.data))
-        .toEqual([expect.objectContaining({ turn: 4, step: 1, retry: 1, failure: { message: 'temporary provider outage', code: 'SERVER' } })])
-      expect(agent.session.events.filter(event => event.type === 'turn/start').slice(-3).map(event => event.data.turn))
-        .toEqual([3, 4, 5])
+        .toEqual([expect.objectContaining({ turn: 3, step: 1, retry: 1, failure: { message: 'temporary provider outage', code: 'SERVER' } })])
+      expect(agent.session.events.filter(event => event.type === 'turn/start').slice(-1).map(event => event.data.turn))
+        .toEqual([3])
      expect(agent.session.events.at(-1)).toMatchObject({
        type: 'turn/end',
        data: { reason: { kind: 'completed' } },
--- a/packages/compact/compact-basic/tests/loader-composition.spec.ts
+++ b/packages/compact/compact-basic/tests/loader-composition.spec.ts
@@ -77,7 +77,7 @@ describe('real Loader composition', () => {
    expect(unloaded).toEqual([])
    expect(loaded.get('toolResultPrune')).toBeInstanceOf(ToolResultPruneService)
    expect(loaded.get('compact')).toBeInstanceOf(BasicCompactService)
-    expect((loaded.compact as BasicCompactService).config).toMatchObject({
+    expect((loaded.compact as unknown as BasicCompactService).config).toMatchObject({
      thresholdRatio: 0.5,
      retainRatio: 0.125,
      auto: false,
--- a/packages/compact/compact-basic/tests/manual-compact.spec.ts
+++ b/packages/compact/compact-basic/tests/manual-compact.spec.ts
@@ -112,7 +112,7 @@ async function loopHarness(): Promise<LoopHarness> {
  const agent = ctx.agentLoop.create(SessionId('manual-compact'), { provider: MODEL, model: MODEL })
  const log: string[] = []
  ctx.on('session/event', (_session, event) => {
-    if (event.type === 'turn/start') log.push(`turn/start:${event.data.trigger.kind}`)
+    if (event.type === 'turn/start') log.push('turn/start')
    if (event.type === 'turn/end') log.push('turn/end')
    if (event.type === 'compact/start') log.push(`compact/start:${String(event.data.turn)}`)
    if (event.type === 'compact/summary') log.push('compact/summary')
@@ -141,11 +141,14 @@ function derivedText(session: Session): string[] {
 }

 /** Await one classified manual-compaction rejection. */
-async function rejection(operation: Promise<unknown>): Promise<ManualCompactionError> {
-  const caught: unknown = await operation.then(
-    (value: unknown) => { throw new Error(`expected a rejection, resolved with ${String(value)}`) },
-    (error: unknown) => error,
-  )
+async function rejection(operation: Promise<unknown> | (() => Promise<unknown>)): Promise<ManualCompactionError> {
+  let caught: unknown
+  try {
+    const value = await (typeof operation === 'function' ? operation() : operation)
+    throw new Error(`expected a rejection, resolved with ${String(value)}`)
+  } catch (error: unknown) {
+    caught = error
+  }
  if (!(caught instanceof ManualCompactionError)) {
    throw new Error(`expected a ManualCompactionError, got ${String(caught)}`)
  }
@@ -169,7 +172,7 @@ function closedConversation(turns = 2, lastTurnNumber = turns): Session {
  const session = Session.create(SessionId(`closed-${turns}-${lastTurnNumber}`))
  for (let index = 1; index <= turns; index += 1) {
    const turn = index === turns ? lastTurnNumber : index
-    session.append('turn/start', { turn, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('turn/start', { turn })
    session.append('user/message', createUserMessage({
      content: [{ type: 'text', text: `${PROMPT} ${turn}` }],
      source: { kind: 'user' },
@@ -195,15 +198,20 @@ function closedConversation(turns = 2, lastTurnNumber = turns): Session {
  return session
 }

-/** A fake idle agent whose admission reservation is scripted per test. */
+/** A fake idle agent whose maintenance claim is scripted per test. */
 function fakeAgent(
  session: Session,
  reserve: () => (() => void) | undefined,
+  maintenanceSignal = new AbortController().signal,
 ): Agent {
  return {
    session,
    options: { provider: MODEL, model: MODEL },
-    reserveTurnAdmission: reserve,
+    runMaintenance<T>(task: (signal: AbortSignal) => Promise<T>): Promise<T> {
+      const release = reserve()
+      if (release === undefined) throw new Error('agent already has active work')
+      return task(maintenanceSignal).finally(release)
+    },
  } as unknown as Agent
 }

@@ -256,7 +264,7 @@ describe('compactNow through the real loop', () => {
    const summary = log.indexOf('compact/summary')
    const end = log.indexOf('compact/end:null')
    const flush = log.indexOf('flush')
-    const nextTurn = log.indexOf('turn/start:message')
+    const nextTurn = log.indexOf('turn/start')
    expect(start).toBeLessThan(summary)
    expect(summary).toBeLessThan(end)
    expect(end).toBeLessThan(flush)
@@ -270,7 +278,7 @@ describe('compactNow through the real loop', () => {
    expect(second.some(text => text.includes(PROMPT))).toBe(false)
  })

-  it('keeps context injected during summarization between the markers and after the checkpoint', async () => {
+  it('keeps context injected during summarization pending for the next step', async () => {
    const harness = await loopHarness()
    const { agent, compact } = harness
    await seedHistory(harness)
@@ -285,18 +293,22 @@ describe('compactNow through the real loop', () => {

    expect(result).not.toBeNull()
    const start = agent.session.events.findLast(event => event.type === 'compact/start')
-    const injected = agent.session.events.findLast(event => event.type === 'user/message'
-      && event.data.source.kind === 'plugin' && event.data.source.plugin === 'test')
+    const injected = agent.inbox.nextStep.find(message =>
+      message.source.kind === 'plugin' && message.source.plugin === 'test')
    const end = agent.session.events.findLast(event => event.type === 'compact/end')
    expect(start).toBeDefined()
    expect(injected).toBeDefined()
    expect(end).toBeDefined()
-    expect(start!.seq).toBeLessThan(injected!.seq)
-    expect(injected!.seq).toBeLessThan(end!.seq)
-    expect(result?.shadowedSeqs).not.toContain(injected?.seq)
+    expect(agent.session.events.some(event => event.type === 'user/message'
+      && event.data.id === injected?.id)).toBe(false)
+
+    agent.followup(createUserMessage({
+      content: [{ type: 'text', text: 'after compaction' }],
+      source: { kind: 'user' },
+    }))
+    await agent.whenIdle()
    const messages = derivedText(agent.session)
    expect(messages[0]).toContain('checkpoint')
-    expect(messages.at(-1)).toContain('INJECTED CONTEXT')
    expect(messages.filter(text => text.includes('INJECTED CONTEXT'))).toHaveLength(1)
  })

@@ -334,7 +346,7 @@ describe('compactNow through the real loop', () => {
      content: [{ type: 'text', text: 'first in line' }],
      source: { kind: 'user' },
    }))
-    expect((await rejection(compact.compactNow(agent, SIGNAL))).code).toBe('busy')
+    expect((await rejection(() => compact.compactNow(agent, SIGNAL))).code).toBe('busy')
    expect(compact.calls).toHaveLength(0)

    await agent.whenIdle()
@@ -400,7 +412,7 @@ describe('compactNow transaction and failure classification', () => {
    session.append('compact/start', { turn: null })
    const agent = fakeAgent(session, () => () => undefined)

-    const error = await rejection(compact.compactNow(agent, SIGNAL))
+    const error = await rejection(() => compact.compactNow(agent, SIGNAL))
    expect(error.code).toBe('busy')
    expect(error.message).toContain('compaction lock is already active')
    expect(compact.calls).toHaveLength(0)
@@ -424,7 +436,7 @@ describe('compactNow transaction and failure classification', () => {
    const { compact } = detachedService()
    const original = closedConversation(2)
    original.append('compact/start', { turn: null })
-    original.append('turn/start', { turn: 3, trigger: { kind: 'message', source: { kind: 'user' } } })
+    original.append('turn/start', { turn: 3 })
    original.append('turn/end', { turn: 3, reason: { kind: 'interrupted' } })
    const reloaded = Session.create(SessionId('reloaded-orphan'), [...original.events])
    const agent = fakeAgent(reloaded, () => () => undefined)
@@ -436,7 +448,7 @@ describe('compactNow transaction and failure classification', () => {
  it('refuses an open turn in the log', async () => {
    const { compact } = detachedService()
    const session = closedConversation(2)
-    session.append('turn/start', { turn: 3, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('turn/start', { turn: 3 })
    const agent = fakeAgent(session, () => () => undefined)

    const error = await rejection(compact.compactNow(agent, SIGNAL))
@@ -448,7 +460,7 @@ describe('compactNow transaction and failure classification', () => {
    const { compact } = detachedService()
    const agent = fakeAgent(closedConversation(2), () => undefined)

-    expect((await rejection(compact.compactNow(agent, SIGNAL))).code).toBe('busy')
+    expect((await rejection(() => compact.compactNow(agent, SIGNAL))).code).toBe('busy')
    expect(compact.calls).toHaveLength(0)
  })

@@ -685,7 +697,13 @@ describe('compactNow transaction and failure classification', () => {
      const controller = new AbortController()
      controller.abort(reason)

-      await expect(compact.compactNow(agent, controller.signal)).rejects.toBe(reason)
+      let thrown: unknown
+      try {
+        void compact.compactNow(agent, controller.signal)
+      } catch (error: unknown) {
+        thrown = error
+      }
+      expect(thrown).toBe(reason)
      expect(reserve).not.toHaveBeenCalled()
      expect(measure).not.toHaveBeenCalled()
      expect(compact.calls).toHaveLength(0)
@@ -713,6 +731,21 @@ describe('compactNow transaction and failure classification', () => {
      .toContain('summarizer aborted')
  })

+  it('classifies agent cancellation during maintenance as an expected cancellation', async () => {
+    const { compact } = detachedService()
+    const controller = new AbortController()
+    const reason = new Error('agent cancelled maintenance')
+    const session = closedConversation(2)
+    const agent = fakeAgent(session, () => () => undefined, controller.signal)
+    compact.duringSummary = () => { controller.abort(reason) }
+    compact.error = new Error('summarizer observed cancellation')
+
+    const error = await rejection(compact.compactNow(agent, SIGNAL))
+
+    expect(error.code).toBe('cancelled')
+    expect(error.cause).toBe(reason)
+  })
+
  it('aborts before committing when cancellation lands after summarization', async () => {
    const { compact } = detachedService()
    const controller = new AbortController()
@@ -814,7 +847,7 @@ describe('compactNow transaction and failure classification', () => {
  it('excludes a manual request while an explicit region compaction runs', async () => {
    const { compact } = detachedService()
    const session = closedConversation(3)
-    session.append('turn/start', { turn: 4, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('turn/start', { turn: 4 })
    const agent = fakeAgent(session, () => () => undefined)
    const gate = deferred()
    compact.gate = gate.promise
--- a/packages/compact/compact-tool-result-prune/tests/tool-result-prune.spec.ts
+++ b/packages/compact/compact-tool-result-prune/tests/tool-result-prune.spec.ts
@@ -38,7 +38,6 @@ function appendToolStep(
  const callId = CallId(call)
  session.append('turn/start', {
    turn,
-    trigger: { kind: 'message', source: { kind: 'user' } },
  })
  session.append('step/start', { turn, step: 1 })
  session.append('assistant/message', {
@@ -165,7 +164,6 @@ describe('ToolResultPruneService session transaction', () => {
    })
    session.append('turn/start', {
      turn: 2,
-      trigger: { kind: 'message', source: { kind: 'user' } },
    })

    const result = service().pruneSession(session)
@@ -214,7 +212,6 @@ describe('ToolResultPruneService session transaction', () => {
    appendToolStep(session, 3, 'c', [{ type: 'text', text: 'C'.repeat(80) }])
    session.append('turn/start', {
      turn: 4,
-      trigger: { kind: 'message', source: { kind: 'user' } },
    })
    const prune = service()
    const first = prune.pruneSession(session)
@@ -231,7 +228,6 @@ describe('ToolResultPruneService session transaction', () => {
    appendToolStep(session, 1, 'a', [{ type: 'text', text: 'A'.repeat(100) }])
    session.append('turn/start', {
      turn: 2,
-      trigger: { kind: 'message', source: { kind: 'user' } },
    })
    service().pruneSession(session)
    const replay = Session.create(session.id, [...session.events])
@@ -250,7 +246,6 @@ describe('ToolResultPruneService session transaction', () => {
    expect(() => prune.pruneSession(session)).toThrow(/outside any open turn/)
    session.append('turn/start', {
      turn: 2,
-      trigger: { kind: 'message', source: { kind: 'user' } },
    })
    expect(() => prune.pruneSession(session)).not.toThrow()
  })
--- a/packages/compact/compact/README.i18n.yaml
+++ b/packages/compact/compact/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/compact/compact/README.md
-README.md: cfb65f2a786dd58d38a7020a8caefeb3d7372f52
-README.zh.md: a804fd0eac4c509724eb7be79c57385311cb39a2
+README.md: cd2404cda8d8702ca0400d3f23d9e1fe041495a1
+README.zh.md: ed6ccc630118dc1bd6d6ea761beefafadb4bd48f
--- a/packages/compact/compact/README.md
+++ b/packages/compact/compact/README.md
@@ -38,7 +38,7 @@ The private per-session cache is keyed by `session.surface.replaceGeneration` an

 ## Surface contract

-`SurfaceEventType` is a closed union — only `user/message`, `assistant/message`, `tool/result`, and `steering/message` may carry `surfaceOp`. A `compact/*` event therefore **cannot** appear on the surface. A successful compaction instead:
+`SurfaceEventType` is a closed union — only `user/message`, `assistant/message`, and `tool/result` may carry `surfaceOp`. A `compact/*` event therefore **cannot** appear on the surface. A successful compaction instead:

 1. appends `compact/start` (log-only) — acquires the lock,
 2. summarizes the range,
--- a/packages/compact/compact/README.zh.md
+++ b/packages/compact/compact/README.zh.md
@@ -38,7 +38,7 @@

 ## 表层契约

-`SurfaceEventType` 是封闭联合：只有 `user/message`、`assistant/message`、`tool/result` 和 `steering/message` 可以携带 `surfaceOp`。因此 `compact/*` 事件**不能**出现在表层上。成功压缩改为：
+`SurfaceEventType` 是封闭联合：只有 `user/message`、`assistant/message` 和 `tool/result` 可以携带 `surfaceOp`。因此 `compact/*` 事件**不能**出现在表层上。成功压缩改为：

 1. 追加 `compact/start`（仅日志）：获取锁；
 2. 摘要该范围；
--- a/packages/compact/compact/src/index.ts
+++ b/packages/compact/compact/src/index.ts
@@ -22,7 +22,13 @@ export { COMPACT_CHECKPOINT_SOURCE, isCompactCheckpointSource } from './checkpoi
 export type CompactionTrigger = 'pressure' | 'context-overflow'

 /** Expected failure classes for an explicit idle-session compaction request. */
-export type ManualCompactionErrorCode = 'busy' | 'changed' | 'summary' | 'commit' | 'persistence'
+export type ManualCompactionErrorCode =
+  | 'busy'
+  | 'cancelled'
+  | 'changed'
+  | 'summary'
+  | 'commit'
+  | 'persistence'

 /**
 * Expected manual-compaction failure suitable for a direct human-command result.
@@ -59,7 +65,14 @@ export interface CompactAgentContext {
 * other compaction transactions.
 */
 export interface ManualCompactAgentContext extends CompactAgentContext {
-  reserveTurnAdmission(): (() => void) | undefined
+  /**
+   * Run a non-turn maintenance operation only while the agent is idle, withholding later
+   * waking input until it settles.
+   * @param task - operation whose fulfillment or rejection is preserved, with an agent-owned cancellation signal.
+   * @throws synchronously when the agent is already active.
+   * @returns the task promise.
+   */
+  runMaintenance<T>(task: (signal: AbortSignal) => Promise<T>): Promise<T>
 }

 declare module 'cordis' {
@@ -102,21 +115,22 @@ export abstract class CompactService extends Service {

  /**
   * Explicitly compact useful history even below automatic pressure thresholds.
-   * Implementations reserve idle turn admission synchronously before any
-   * asynchronous work, select a useful range without writing on a no-op, then
+   * Implementations synchronously start an idle task before any asynchronous
+   * work, select a useful range without writing on a no-op, then
   * append a standalone `compact/start` before summarization. That durable
   * marker is the compaction lock until one `compact/end` attempt. Later waking
   * prompts remain accepted in FIFO order and start only after the optional
-   * durability checkpoint and admission release. Context injected while the
+   * durability checkpoint and idle-task settlement. Context injected while the
   * summary runs may sit between the marker pair; only the selected span must
   * remain stable.
   *
   * @param agent - idle agent whose durable history should be compacted.
-   * @param signal - command-owned cancellation forwarded to summarization.
+   * @param signal - cancellation scoped to this compaction request.
   * @returns the compaction result, or `null` when no safe useful range exists.
-   * @throws {@link ManualCompactionError} for expected busy, changed-span,
-   * summarization/shrink, commit-stage, or persistence failures, and the exact
-   * abort reason when cancelled. Failed attempts remain visible in the log.
+   * @throws {@link ManualCompactionError} for expected busy, agent-cancellation,
+   * changed-span, summarization/shrink, commit-stage, or persistence failures;
+   * an aborted request preserves its exact abort reason. Failed attempts remain
+   * visible in the log.
   */
  abstract compactNow(
    agent: ManualCompactAgentContext,
--- a/packages/compact/compact/tests/compact.spec.ts
+++ b/packages/compact/compact/tests/compact.spec.ts
@@ -110,7 +110,7 @@ describe('CompactService seam', () => {
    const signal = new AbortController().signal
    expect(await svc.compactNow({
      ...stubAgent(session),
-      reserveTurnAdmission: () => () => undefined,
+      runMaintenance: task => task(new AbortController().signal),
    }, signal)).toBeNull()
    expect(svc.lastSignal).toBe(signal)
  })
--- a/packages/compact/compact/tests/invariant.spec.ts
+++ b/packages/compact/compact/tests/invariant.spec.ts
@@ -23,7 +23,7 @@ const summary = (overrides: Record<string, unknown> = {}) => ({
 })

 function startTurn(session: ReturnType<Context['sessions']['create']>, turn = 1): void {
-  session.append('turn/start', { turn, trigger: { kind: 'message', source: { kind: 'user' } } })
+  session.append('turn/start', { turn })
 }

 describe('compaction invariants', () => {
@@ -142,7 +142,7 @@ describe('compaction invariants', () => {
    const ctx = new Context()
    await ctx.plugin(SessionStore)
    const session = ctx.sessions.create()
-    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('turn/start', { turn: 1 })
    session.append('compact/start', { turn: 1 })
    await ctx.plugin(InvariantService)
    await ctx.plugin(CompactInvariant)
@@ -156,7 +156,7 @@ describe('compaction invariants', () => {
    expect(() => {
      ctx.emit('session/event', session, {
        type: 'turn/start', seq: 0, time: 0,
-        data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } },
+        data: { turn: 1 },
      })
      ctx.emit('session/event', session, {
        type: 'step/start', seq: 1, time: 1, data: { turn: 1, step: 1 },
--- a/packages/compact/compact/tests/tool-pairing.spec.ts
+++ b/packages/compact/compact/tests/tool-pairing.spec.ts
@@ -271,8 +271,7 @@ describe('tool-pairing cache refresh', () => {
    expect(eventIndexReads).toBe(3)

    events.push({
-      type: 'turn/end', seq: 3, time: 3,
-      data: { turn: 1, reason: { kind: 'completed' } },
+      type: 'turn/end', seq: 3, time: 3, data: { turn: 1, reason: { kind: 'completed' } },
    })
    expect(toolPairingBalancedAfter(session, nodes[2]!)).toBe(true)
    expect(eventCollectionReads).toBe(1)
--- a/packages/context/session-reference/README.i18n.yaml
+++ b/packages/context/session-reference/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/context/session-reference/README.md
-README.md: b1c76ef6865d6782941e13c2698fe76e38fb3abd
-README.zh.md: cd083c9d5a49f2bb6e2358bbfbc10d8d299c2783
+README.md: 145ec112d6b9cce9e9eb1567c60cde41c6d6eb3c
+README.zh.md: 71bab6c94161a37de507482405fb8362e08a89fa
--- a/packages/context/session-reference/README.md
+++ b/packages/context/session-reference/README.md
@@ -12,9 +12,9 @@ English | [中文](README.zh.md)

 ## Snapshot semantics

-Preparation calls `ctx.sessionQuery.readSurface()` once per distinct source and never rereads it after enqueue. It projects only direct-user `user/message`, direct-user `steering/message`, assistant text, and `user/message` checkpoints carrying the canonical `dsh-compact` source marker from the folded current surface. For a source prompt that already contains baked prefix context, projection reads only its model-hidden display content, preventing recursive snapshot propagation. Shadowed pre-compaction events, tools, reasoning, context, plugin-generated user messages other than marked compact checkpoints, and unfinished assistant chunks are excluded. A compacted source therefore contributes its latest checkpoint plus retained later conversation, not restored shadowed text.
+Preparation calls `ctx.sessionQuery.readSurface()` once per distinct source and never rereads it after enqueue. It projects only direct-user `user/message`, assistant text, and `user/message` checkpoints carrying the canonical `dsh-compact` source marker from the folded current surface. For a source prompt that already contains baked prefix context, projection reads only its model-hidden display content, preventing recursive snapshot propagation. Shadowed pre-compaction events, tools, reasoning, context, plugin-generated user messages other than marked compact checkpoints, and unfinished assistant chunks are excluded. A compacted source therefore contributes its latest checkpoint plus retained later conversation, not restored shadowed text.

-The context source is `{ kind: 'session-reference', version: 1, references }`; each reference records its source id and label, capture seq, compact presence, retained/omitted message counts, omitted UTF-8 bytes, and truncation state. A host captures the snapshot before submitting the associated prompt and appends it as sourced context at the same safe admission boundary. The target log therefore records the snapshot separately from the readable direct message. Later source mutation, compaction, or deletion cannot change target replay.
+The context source is `{ kind: 'session-reference', version: 1, references }`; each reference records its source id and label, capture seq, compact presence, retained/omitted message counts, omitted UTF-8 bytes, and truncation state. When the agent is idle, the standard TUI installs a one-shot `agent/pre-step` wrapper that adds the snapshot only to an `enter` decision containing the claimed direct prompt. While the agent is running, it calls `inject()` immediately before `steer()`, placing both messages in the next-step inbox for the same later claim. The target log therefore records a sourced context `user/message` followed by the readable direct `user/message`. Later source mutation, compaction, or deletion cannot change target replay.

 ## Configuration

--- a/packages/context/session-reference/README.zh.md
+++ b/packages/context/session-reference/README.zh.md
@@ -12,9 +12,9 @@

 ## 快照语义

-准备阶段会对每个不同源调用一次 `ctx.sessionQuery.readSurface()`，入队后绝不重读。它仅投影折叠后当前表层中的用户直接发出的 `user/message`、用户直接发出的 `steering/message`、assistant 文本，以及 `user/message` 检查点；这类检查点携带规范 `dsh-compact` 源标记。对于已经包含固化前缀上下文的源提示词，投影只读取其对模型隐藏的显示内容，以防止快照递归传播。已遮蔽的压缩（compaction）前事件、工具、推理（reasoning）、上下文、除已标记 compact 检查点外的插件生成 user 消息，以及未完成的 assistant 分片均会被排除。因此，已压缩源只会提供最新检查点及其后保留的会话内容，不会还原已遮蔽的文本。
+准备阶段会对每个不同源调用一次 `ctx.sessionQuery.readSurface()`，入队后绝不重读。它仅投影折叠后当前表层中的用户直接发出的 `user/message`、assistant 文本，以及 `user/message` 检查点；这类检查点携带规范 `dsh-compact` 源标记。对于已经包含固化前缀上下文的源提示词，投影只读取其对模型隐藏的显示内容，以防止快照递归传播。已遮蔽的压缩（compaction）前事件、工具、推理（reasoning）、上下文、除已标记 compact 检查点外的插件生成 user 消息，以及未完成的 assistant 分片均会被排除。因此，已压缩源只会提供最新检查点及其后保留的会话内容，不会还原已遮蔽的文本。

-上下文源为 `{ kind: 'session-reference', version: 1, references }`；每条引用会记录其源 id 与 label、捕获 seq、是否存在 compact、已保留／已省略消息数、已省略 UTF-8 字节数与截断状态。宿主会在提交关联提示词之前捕获快照，并在同一安全接纳边界把它追加为带来源信息的上下文。因此，目标日志会把快照与可读的直接消息分开记录。后续源变更、压缩或删除都无法改变目标回放。
+上下文源为 `{ kind: 'session-reference', version: 1, references }`；每条引用会记录其源 id 与 label、捕获 seq、是否存在 compact、已保留／已省略消息数、已省略 UTF-8 字节数与截断状态。agent 空闲时，标准 TUI 会安装一次性的 `agent/pre-step` 包装层，只把快照添加到包含已领取直接提示词的 `enter` 决策。agent 运行时，它会紧接着调用 `inject()` 和 `steer()`，把两条消息放入 next-step inbox，等待后续同一次领取。目标日志因此会先记录一条带来源信息的上下文 `user/message`，再记录可读的直接 `user/message`。后续源变更、压缩或删除都无法改变目标回放。

 ## 配置

--- a/packages/context/session-reference/src/projection.ts
+++ b/packages/context/session-reference/src/projection.ts
@@ -44,12 +44,6 @@ function projectSessionConversation(snapshot: SessionSurfaceSnapshot): Projected
        if (text !== '') conversation.push({ role: 'user', text, checkpoint, originalText: text, omittedBytes: 0 })
        break
      }
-      case 'steering/message': {
-        if (event.data.message.source.kind !== 'user') break
-        const text = textContent(event.data.message.content)
-        if (text !== '') conversation.push({ role: 'user', text, checkpoint: false, originalText: text, omittedBytes: 0 })
-        break
-      }
      case 'assistant/message': {
        const text = textContent(event.data.message.content)
        if (text !== '') conversation.push({ role: 'assistant', text, checkpoint: false, originalText: text, omittedBytes: 0 })
--- a/packages/context/session-reference/tests/session-reference.spec.ts
+++ b/packages/context/session-reference/tests/session-reference.spec.ts
@@ -97,25 +97,19 @@ function appendConversation(session: Session): void {
    { surfaceOp: 'append' },
  )
  session.append(
-    'steering/message',
-    {
-      turn: 2,
-      message: createUserMessage({
-        content: [{ type: 'text', text: 'human steer' }],
-        source: { kind: 'user' },
-      }),
-    },
+    'user/message',
+    createUserMessage({
+      content: [{ type: 'text', text: 'human steer' }],
+      source: { kind: 'user' },
+    }),
    { surfaceOp: 'append' },
  )
  session.append(
-    'steering/message',
-    {
-      turn: 2,
-      message: createUserMessage({
-        content: [{ type: 'text', text: 'plugin steer' }],
-        source: { kind: 'plugin', plugin: 'goal' },
-      }),
-    },
+    'user/message',
+    createUserMessage({
+      content: [{ type: 'text', text: 'plugin steer' }],
+      source: { kind: 'plugin', plugin: 'goal' },
+    }),
    { surfaceOp: 'append' },
  )
  session.append(
@@ -161,14 +155,11 @@ function appendConversation(session: Session): void {
    { surfaceOp: 'append' },
  )
  session.append(
-    'steering/message',
-    {
-      turn: 2,
-      message: createUserMessage({
-        content: [{ type: 'reasoning', text: 'empty projected steering' }],
-        source: { kind: 'user' },
-      }),
-    },
+    'user/message',
+    createUserMessage({
+      content: [{ type: 'reasoning', text: 'empty projected steering' }],
+      source: { kind: 'user' },
+    }),
    { surfaceOp: 'append' },
  )
  session.append(
--- a/packages/context/time-context/README.i18n.yaml
+++ b/packages/context/time-context/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/context/time-context/README.md
-README.md: 9fe818855439466b2a3e349cd54a2f408cf5ec10
-README.zh.md: fdc50bc89b3455351c67171301817f49570d89b7
+README.md: 9956918c63b49de8ec5e739bc3d9887e269930a8
+README.zh.md: fd338cc192c2168915017dd22ac6a1631d8cc21b
--- a/packages/context/time-context/README.md
+++ b/packages/context/time-context/README.md
@@ -16,21 +16,21 @@ Opt-in durable context with the current zoned time and elapsed time sampled duri

 When `timeZone` is omitted, the plugin resolves the Node process's system zone once at plugin load. Node honors `TZ`; without that override, the host or container supplies the zone. An explicit `timeZone` must be an IANA identifier and is validated at plugin load.

-`refreshIntervalMs` must be a non-negative safe integer. Omission or `0` appends on every pre-step attempt whose signal is not already aborted. A positive value appends only when the session has no earlier time-context injection, wall time moved backward, or at least that many milliseconds have elapsed since the latest injection.
+`refreshIntervalMs` must be a non-negative safe integer. Omission or `0` adds context to every eligible entering pre-step whose signal is not already aborted. A positive value adds it only when the session has no earlier time-context injection, wall time moved backward, or at least that many milliseconds have elapsed since the latest injection.

 ## Timing semantics

-The plugin prepends an `agent/step` listener. When an injection is due, it appends one injected `user/message` through `agent.inject()` before `step/start` and ordinary automatic compaction, with source `{ kind: 'plugin', plugin: 'time-context' }`. A suppressed attempt appends nothing.
+The plugin prepends an `agent/pre-step` listener. When an injection is due and the downstream decision enters the proposed step, it adds one sourced `UserMessage` to the returned batch. AgentLoop records that context after `step/start` and before ordinary automatic compaction with source `{ kind: 'plugin', plugin: 'time-context' }`. A suppressed, rejected, or failed pre-step records nothing.

 Positive-interval scheduling scans the raw durable session events for the latest `user/message` with that source, including a reading shadowed by compaction. The schedule therefore applies across turns and resumed processes without process-local cache state. It reduces append frequency and history growth but never removes an existing reading, and sessions schedule independently.

 Step 1 measures from the latest preceding model-visible message, including the prompt that opened the turn. Later steps measure from the preceding time-context event in the same turn. Both baselines use durable session-event timestamps; backward wall-clock movement clamps elapsed time to zero. A missing first-step baseline, or a later step with no earlier same-turn reading because interval suppression skipped it, reports `unavailable`.

-A time reading records a request-preparation attempt, not a committed step or transmitted request. Because the listener runs first, its append may remain when a later pre-step listener cancels or fails the attempt; the log is append-only and the plugin performs no rollback.
+A time reading records an entered pre-step batch, not a completed step or transmitted request. A later request-preparation failure can therefore leave the reading in history, but a downstream pre-step listener that rejects or fails prevents it from being recorded.

 The separately published `./invariant` companion checks each plugin-attributed reading against the open turn, next pre-step position, elapsed baseline, and durable event time. Its rendered timestamp must parse and cannot postdate the event; process suspension between sampling and append does not invalidate the reading.

-The time reading stays in derived conversation history until a later compaction shadows it. Request headers contain no time-context state. Request reconstruction uses the complete durable surface prefix at each `step/start`, so transmitted requests need not map one-to-one to readings: a failed preparation can leave an extra reading, while interval suppression can let a request reuse existing history without adding one.
+The time reading stays in derived conversation history until a later compaction shadows it. Request headers contain no time-context state. Request reconstruction uses the complete durable surface prefix after each `step/start`, so transmitted requests need not map one-to-one to readings: request preparation can fail after step entry, while interval suppression can let a request reuse existing history without adding one.

 ## Model Experience

--- a/packages/context/time-context/README.zh.md
+++ b/packages/context/time-context/README.zh.md
@@ -16,21 +16,21 @@

 省略 `timeZone` 时，插件会在加载时解析一次 Node 进程的系统时区。Node 遵循 `TZ`；如果没有该覆盖，时区由宿主或容器提供。显式 `timeZone` 必须是 IANA 标识符，并在插件加载时验证。

-`refreshIntervalMs` 必须是非负安全整数。省略或设为 `0` 时，对每次信号尚未中止的合格步骤前尝试执行追加。正数值只会在会话没有早先 time-context 注入、挂钟时间倒退，或自最新注入起已经过至少相应毫秒数时执行追加。
+`refreshIntervalMs` 必须是非负安全整数。省略或设为 `0` 时，会为每次信号尚未中止且返回 enter 的合格 pre-step 添加上下文。正数值只会在会话没有早先 time-context 注入、挂钟时间倒退，或自最新注入起已经过至少相应毫秒数时添加上下文。

 ## 时序语义

-该插件会前置一个 `agent/step` 监听器。需要注入时，它会追加一条注入的 `user/message`，通过 `agent.inject()` 完成，时机位于 `step/start` 和普通自动压缩（compaction）之前，其源为 `{ kind: 'plugin', plugin: 'time-context' }`。被抑制的尝试不追加任何内容。
+该插件会前置一个 `agent/pre-step` 监听器。需要注入且下游决策进入拟议步骤时，它会在返回批次中添加一条带来源的 `UserMessage`。AgentLoop 会在 `step/start` 之后、普通自动压缩（compaction）之前记录该上下文，其来源为 `{ kind: 'plugin', plugin: 'time-context' }`。被抑制、reject 或失败的 pre-step 不会记录任何内容。

 正间隔调度会扫描原始持久会话事件，查找最新的上述源 `user/message`，包括已被压缩遮蔽的时间读数。因此，调度可以跨轮次以及进程恢复持续生效，不需要进程本地缓存状态。它会降低追加频率与历史增长，但绝不移除现有时间读数，且每个会话独立调度。

 第 1 步从前一条模型可见消息起测量，包括开启轮次的提示词。后续步骤从同一轮次中前一个 time-context 事件起测量。两种基线都使用持久会话事件时间戳；挂钟时间倒退时，经过时长限制为零。如果第一步缺少基线，或者后续步骤因间隔抑制而没有较早的同轮次时间读数，则报告 `unavailable`。

-时间读数记录的是一次请求准备尝试，不是已提交步骤或已传输请求。因为 listener 首先运行，后续的步骤前监听器取消或使该尝试失败时，该追加可能仍会保留。日志仅追加，该插件不执行回滚。
+时间读数记录的是一个已进入步骤的 pre-step 批次，不是已完成步骤或已传输请求。后续请求准备失败时，该读数可能已留在历史中；但下游 pre-step 监听器 reject 或失败时，该读数不会被记录。

 单独发布的 `./invariant` 配套模块会根据当前未结束的轮次、下一个步骤前位置、经过时长基线与持久事件时间检查每个归因于插件的时间读数。其渲染时间戳必须可解析，且不能晚于该事件；采样与追加之间的进程挂起不会使时间读数失效。

-时间读数会保留在派生会话历史中，直到后续压缩遮蔽它。请求标头不含 time-context 状态。请求重建会在每个 `step/start` 处使用完整持久表层前缀，因此已传输请求无需与时间读数一一对应：失败的准备可能留下额外时间读数，而间隔抑制可让请求复用现有历史，无需添加时间读数。
+时间读数会保留在派生会话历史中，直到后续压缩遮蔽它。请求标头不含 time-context 状态。请求重建会在每个 `step/start` 之后使用完整持久表层前缀，因此已传输请求无需与时间读数一一对应：请求准备可能在进入步骤后失败，而间隔抑制可让请求复用现有历史，无需添加时间读数。

 ## 模型体验

--- a/packages/context/time-context/src/index.ts
+++ b/packages/context/time-context/src/index.ts
@@ -1,26 +1,26 @@
 /**
- * Opt-in request-preparation clock context. Eligible pre-step attempts append
- * durable, source-attributed time readings to conversation history.
+ * Opt-in request clock context. Eligible steps add durable,
+ * source-attributed time readings to the request history.
 *
 * @module @deepseek-ai/dsh-time-context
 */

 import type { Context } from 'cordis'
 import z from 'schemastery'
-import type { Agent } from '@deepseek-ai/dsh-agent'
+import type { Agent, PreStepDecision } from '@deepseek-ai/dsh-agent'
 import { createUserMessage } from '@deepseek-ai/dsh-llm'

 /** Cordis plugin name used by loader diagnostics. */
 export const name = 'time-context'

-/** The agent registry that owns the pre-step lifecycle seam. */
+/** The agent registry that owns pre-step processing. */
 export const inject = ['agents']

 /** Request-preparation clock formatting and append scheduling. Invalid values fail plugin load. */
 export interface Config {
  /** IANA time zone used for the rendered timestamp. Omit to resolve the Node process's system zone at plugin load. */
  timeZone?: string
-  /** Minimum milliseconds between durable injections in one session. Omit or set to 0 to inject on every eligible pre-step attempt. */
+  /** Minimum milliseconds between durable injections in one session. Omit or set to 0 to inject at every eligible step. */
  refreshIntervalMs?: number
 }

@@ -65,7 +65,6 @@ function precedingMessageTime(agent: Agent): number | undefined {
      case 'user/message':
      case 'assistant/message':
      case 'tool/result':
-      case 'steering/message':
        return event.time
      default:
        // Merge-extensible session events: non-surface records are not messages.
@@ -157,23 +156,33 @@ export function apply(ctx: Context, config: Config): void {
  }
  const resolvedTimeZone = formatter.resolvedOptions().timeZone

-  ctx.on('agent/step', (
+  ctx.on('agent/pre-step', async (
    agent: Agent,
-    turn: number,
-    step: number,
-    signal: AbortSignal,
-  ) => {
-    if (signal.aborted) return
+    _messages,
+    { turn, step, signal },
+    next,
+  ): Promise<PreStepDecision> => {
+    const decision = await next()
+    if (decision.kind === 'reject' || signal.aborted) return decision
    const now = Date.now()
    if (refreshIntervalMs !== undefined && refreshIntervalMs > 0) {
      const lastInjection = latestInjectionTime(agent)
      if (lastInjection !== undefined
        && now >= lastInjection
-        && now - lastInjection < refreshIntervalMs) return
+        && now - lastInjection < refreshIntervalMs) return decision
    }
    const previous = step === 1
      ? precedingMessageTime(agent)
      : precedingStepContextTime(agent, turn)
-    agent.inject(createUserMessage({ content: [{ type: 'text', text: renderText(now, turn, step, previous, formatter, resolvedTimeZone) }], source: { kind: 'plugin', plugin: name } }))
+    return {
+      kind: 'enter',
+      messages: [
+        ...decision.messages,
+        createUserMessage({
+          content: [{ type: 'text', text: renderText(now, turn, step, previous, formatter, resolvedTimeZone) }],
+          source: { kind: 'plugin', plugin: name },
+        }),
+      ],
+    }
  }, { prepend: true })
 }
--- a/packages/context/time-context/src/invariant.ts
+++ b/packages/context/time-context/src/invariant.ts
@@ -18,31 +18,27 @@ export const name = 'time-context-invariant'
 /** Service required before the companion can reserve package ownership. */
 export const inject = ['invariants']

-/** Derive the pre-step position at which a time-context reading may append. */
+/** Derive the entered step boundary at which a time-context reading may append. */
 function preparationPosition(history: readonly SessionEvent[], fail: InvariantFailure): { turn: number; step: number } {
-  const currentTurnEvents: SessionEvent[] = []
-  let openTurn: number | undefined
  for (const event of history.slice().reverse()) {
-    if (event.type === 'turn/end') {
-      fail('time-context reading must be appended inside an open turn')
-    }
-    if (event.type === 'turn/start') {
-      openTurn = event.data.turn
-      break
-    }
-    currentTurnEvents.push(event)
-  }
-  if (openTurn === undefined) fail('time-context reading must be appended inside an open turn')
-
-  for (const event of currentTurnEvents) {
-    if (event.type === 'step/start') {
-      fail(`time-context reading must precede step/start, but step ${event.data.step} is already open`)
-    }
-    if (event.type === 'step/end') {
-      return { turn: openTurn, step: event.data.step + 1 }
+    switch (event.type) {
+      case 'step/start':
+        return { turn: event.data.turn, step: event.data.step }
+      case 'turn/start':
+      case 'step/end':
+      case 'turn/end':
+      case 'request/header':
+      case 'assistant/chunk':
+      case 'assistant/message':
+      case 'tool/call':
+      case 'tool/result':
+        fail('time-context reading must be appended at a prompt boundary')
+        break
+      default:
+        break
    }
  }
-  return { turn: openTurn, step: 1 }
+  fail('time-context reading must be appended at a prompt boundary')
 }

 /** Validate one plugin-attributed time reading against its session position and timestamp. */
--- a/packages/context/time-context/tests/invariant.spec.ts
+++ b/packages/context/time-context/tests/invariant.spec.ts
@@ -46,10 +46,10 @@ function reading(
 function preparing(turn: number, step: number): Session {
  const session = Session.create(SessionId(`time-invariant-${turn}-${step}`))
  for (let priorTurn = 1; priorTurn < turn; priorTurn += 1) {
-    session.append('turn/start', { turn: priorTurn, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('turn/start', { turn: priorTurn })
    session.append('turn/end', { turn: priorTurn, reason: { kind: 'completed' } })
  }
-  session.append('turn/start', { turn, trigger: { kind: 'message', source: { kind: 'user' } } })
+  session.append('turn/start', { turn })
  session.append('user/message', createUserMessage({
    content: [{ type: 'text', text: `turn ${turn}` }],
    source: { kind: 'user' },
@@ -58,6 +58,7 @@ function preparing(turn: number, step: number): Session {
    session.append('step/start', { turn, step: priorStep })
    session.append('step/end', { turn, step: priorStep })
  }
+  session.append('step/start', { turn, step })
  return session
 }

@@ -87,13 +88,13 @@ describe('time-context invariants', () => {
    const ctx = new Context()
    await ctx.plugin(SessionStore)
    const session = ctx.sessions.create(SessionId('time-invariant-late-valid'))
-    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('turn/start', { turn: 1 })
+    session.append('step/start', { turn: 1, step: 1 })
    session.append('user/message', createUserMessage({
      content: [{ type: 'text', text: 'prepare' }],
      source: { kind: 'user' },
    }), { surfaceOp: 'append' })
    appendReading(session, reading())
-    session.append('step/start', { turn: 1, step: 1 })

    await ctx.plugin(InvariantService, { enabled: true })
    await expect(ctx.plugin(TimeInvariant)).resolves.toBeDefined()
@@ -103,7 +104,8 @@ describe('time-context invariants', () => {
    const ctx = new Context()
    await ctx.plugin(SessionStore)
    const session = ctx.sessions.create(SessionId('time-invariant-late-invalid'))
-    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('turn/start', { turn: 1 })
+    session.append('step/start', { turn: 1, step: 1 })
    session.append('user/message', createUserMessage({
      content: [{ type: 'text', text: 'prepare' }],
      source: { kind: 'user' },
@@ -125,19 +127,22 @@ describe('time-context invariants', () => {
  it('rejects a reading after cancellation closes the turn', async () => {
    const ctx = await setup()
    const session = preparing(1, 2)
-    session.append('turn/end', { turn: 1, reason: { kind: 'aborted' } })
+    session.append('turn/end', { turn: 1, reason: { kind: 'aborted', reason: { kind: 'user' } } })
    expect(() => { ctx.emit('session/event', session, event(reading('1', '2', 'step context'))) })
-      .toThrow(/inside an open turn/)
+      .toThrow(/at a prompt boundary/)
  })

-  it('rejects a reading after step/start or without any open turn', async () => {
+  it('rejects a reading outside a prompt boundary', async () => {
    const ctx = await setup()
-    const started = preparing(1, 1)
-    started.append('step/start', { turn: 1, step: 1 })
-    expect(() => { ctx.emit('session/event', started, event(reading())) }).toThrow(/must precede step\/start/)
+    const ended = preparing(1, 1)
+    ended.append('step/end', { turn: 1, step: 1 })
+    expect(() => { ctx.emit('session/event', ended, event(reading())) }).toThrow(/at a prompt boundary/)
+    const notEntered = Session.create(SessionId('time-invariant-turn-only'))
+    notEntered.append('turn/start', { turn: 1 })
+    expect(() => { ctx.emit('session/event', notEntered, event(reading())) }).toThrow(/at a prompt boundary/)
    expect(() => {
      ctx.emit('session/event', Session.create(SessionId('time-invariant-empty')), event(reading()))
-    }).toThrow(/inside an open turn/)
+    }).toThrow(/at a prompt boundary/)
  })

  it.each([
@@ -180,7 +185,7 @@ describe('time-context invariants', () => {
    expect(() => { ctx.emit('session/event', preparing(1, 1), user) }).not.toThrow()
    expect(() => {
      ctx.emit('session/event', preparing(1, 1), {
-        type: 'turn/start', seq: 0, time: 0, data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } },
+        type: 'turn/start', seq: 0, time: 0, data: { turn: 1 },
      })
      ctx.emit('tools/change')
    }).not.toThrow()
--- a/packages/context/time-context/tests/time-context.e2e.ts
+++ b/packages/context/time-context/tests/time-context.e2e.ts
@@ -54,7 +54,7 @@ describe('time-context through a real headless cordis.yml', () => {
    expect(contexts).toHaveLength(2)
    expect(starts).toHaveLength(2)
    for (let index = 0; index < contexts.length; index += 1) {
-      expect(contexts[index]!.seq).toBeLessThan(starts[index]!.seq)
+      expect(contexts[index]!.seq).toBeGreaterThan(starts[index]!.seq)
      expect(contexts[index]!.surfaceOp).toBe('append')
      expect(contexts[index]!.data.source).toEqual({ kind: 'plugin', plugin: 'time-context' })
    }
@@ -65,10 +65,11 @@ describe('time-context through a real headless cordis.yml', () => {
    expect(contextText[0]).toMatch(
      /Time sampled while preparing turn 1, step 1: \d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\+08:00\[Asia\/Shanghai\]/,
    )
-    expect(contextText[0]).toMatch(
+    expect(contextText[0]).toContain('Elapsed since the preceding model-visible message: unavailable.')
+    expect(contextText[1]).toMatch(/Time sampled while preparing turn 2, step 1:/)
+    expect(contextText[1]).toMatch(
      /Elapsed since the preceding model-visible message: (?:\d+d )?(?:\d+h )?(?:\d+m )?\d+s\./,
    )
-    expect(contextText[1]).toMatch(/Time sampled while preparing turn 2, step 1:/)

    const headers = events.filter(event => event.type === 'request/header')
    expect(JSON.stringify(headers)).not.toContain('Time sampled while preparing')
--- a/packages/context/time-context/tests/time-context.spec.ts
+++ b/packages/context/time-context/tests/time-context.spec.ts
@@ -4,7 +4,7 @@ import Loader from '@cordisjs/plugin-loader'
 import { createUserMessage, CallId, LlmAdapter } from '@deepseek-ai/dsh-llm'
 import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm'
 import { Session, SessionId, type SessionEvent } from '@deepseek-ai/dsh-session'
-import AgentRegistry, { agentEvents, type Agent } from '@deepseek-ai/dsh-agent'
+import AgentRegistry, { agentEvents, Inbox, type Agent } from '@deepseek-ai/dsh-agent'
 import { defineContentToolFixture } from '@deepseek-ai/dsh-tools'
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
 import { mountAgentLoopTestDependencies } from '@deepseek-ai/dsh-agent-loop-testkit'
@@ -17,7 +17,7 @@ const SIGNAL = new AbortController().signal

 beforeEach(() => {
  process.env['TZ'] = 'UTC'
-  vi.useFakeTimers()
+  vi.useFakeTimers({ toFake: ['Date'] })
  vi.setSystemTime(BASE)
 })

@@ -40,24 +40,21 @@ function sessionAgent(session: Session, id = 'agent'): Agent {
    id: SessionId(id),
    options: {},
    session,
+    inbox: new Inbox(session, { inserted: () => {}, discarded: () => {}, claimed: () => {} }),
    status: 'running',
-    acceptsNextStep: true,
    ctx: new Context(),
-    followup: () => {},
-    steer: () => ({ outcome: Promise.resolve({ status: 'rejected' as const }) }),
-    inject(input) {
-      session.append('user/message', input, { surfaceOp: 'append' })
-    },
    send: () => {},
-    updateInbox: () => 'not-found',
-    reserveTurnAdmission: () => undefined,
+    followup: () => {},
+    steer: () => {},
+    inject: () => { throw new Error('time-context must append directly to the open step') },
    cancel() {},
+    runMaintenance: task => task(new AbortController().signal),
    whenIdle: () => Promise.resolve(),
  }
 }

 function openMessageTurn(session: Session, turn: number): void {
-  session.append('turn/start', { turn, trigger: { kind: 'message', source: { kind: 'user' } } })
+  session.append('turn/start', { turn })
  session.append('user/message', createUserMessage({
    content: [{ type: 'text', text: `turn ${turn}` }],
    source: { kind: 'user' },
@@ -83,7 +80,17 @@ async function fire(
  step: number,
  signal: AbortSignal = SIGNAL,
 ): Promise<void> {
-  await agentEvents(ctx, agent).serial('agent/step', turn, step, signal)
+  const decision = await agentEvents(ctx, agent).waterfall(
+    'agent/pre-step',
+    [],
+    { turn, step, signal },
+    () => Promise.resolve({ kind: 'enter' as const, messages: [] }),
+  )
+  if (decision.kind === 'enter') {
+    for (const message of decision.messages) {
+      agent.session.append('user/message', message, { surfaceOp: 'append' })
+    }
+  }
 }

 function textResponse(text: string): StreamChunk[] {
@@ -161,7 +168,7 @@ describe('durable step context', () => {
  it('reports an unavailable first-step baseline when no model-visible message precedes it', async () => {
    const { ctx } = await mount()
    const session = Session.create(SessionId('unavailable'))
-    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('turn/start', { turn: 1 })

    await fire(ctx, sessionAgent(session), 1, 1)

@@ -286,22 +293,17 @@ describe('durable step context', () => {
    expect(contextTexts(independent)).toHaveLength(1)
  })

-  it('runs before ordinary pre-step listeners and skips an already-aborted step', async () => {
+  it('skips an already-aborted prompt submission', async () => {
    const { ctx } = await mount()
    const session = Session.create(SessionId('ordering'))
    const agent = sessionAgent(session)
    openMessageTurn(session, 1)
-    let ordinarySawContext = false
-    ctx.on('agent/step', (subject) => {
-      ordinarySawContext = subject.session.events.some(event => event.type === 'user/message')
-    })

    await fire(ctx, agent, 1, 1)
    const abort = new AbortController()
    abort.abort()
    await fire(ctx, agent, 1, 2, abort.signal)

-    expect(ordinarySawContext).toBe(true)
    expect(contextTexts(session)).toHaveLength(1)
  })
 })
@@ -359,28 +361,24 @@ describe('configuration and lifecycle', () => {

 describe('real agent-loop request history', () => {
  it.each([
-    ['throws', 'error'],
-    ['cancels', 'aborted'],
-  ] as const)('discards the pending preparation reading when a later step listener %s', async (mode, reasonKind) => {
+    ['throws'],
+    ['cancels'],
+  ] as const)('does not commit a preparation reading when a downstream pre-step listener %s', async (mode) => {
    const adapter = new ScriptedAdapter([textResponse('unused')])
    const ctx = await loopHarness(adapter)
-    let laterSawReading = false
-    ctx.on('agent/step', (subject) => {
-      laterSawReading = contextTexts(subject.session).length === 1
+    ctx.on('agent/pre-step', (subject, _messages, _context, next) => {
      if (mode === 'throws') throw new Error('later pre-step failure')
      subject.cancel({ kind: 'user' })
+      return next()
    })
    const agent = ctx.agentLoop.create(SessionId(`late-${mode}`), { provider: 'mock', model: 'mock' })

    agent.followup(createUserMessage({ content: [{ type: 'text', text: 'start' }], source: { kind: 'user' } }))
    await agent.whenIdle()

-    expect(laterSawReading).toBe(false)
    expect(contextTexts(agent.session)).toHaveLength(0)
    expect(adapter.requests).toHaveLength(0)
    expect(agent.session.events.some(event => event.type === 'step/start')).toBe(false)
-    const turnEnd = agent.session.events.findLast(event => event.type === 'turn/end')
-    expect(turnEnd?.type === 'turn/end' && turnEnd.data.reason.kind).toBe(reasonKind)
    await ctx.fiber.dispose()
  })

@@ -408,7 +406,7 @@ describe('real agent-loop request history', () => {
    expect(contexts).toHaveLength(adapter.requests.length)
    expect(starts).toHaveLength(adapter.requests.length)
    for (let index = 0; index < contexts.length; index += 1) {
-      expect(contexts[index]!.seq).toBeLessThan(starts[index]!.seq)
+      expect(contexts[index]!.seq).toBeGreaterThan(starts[index]!.seq)
    }
    expect(contexts.every(event => event.data.source.kind === 'plugin'
      && event.data.source.plugin === 'time-context'
@@ -417,7 +415,7 @@ describe('real agent-loop request history', () => {
    const firstRequestText = requestText(adapter.requests[0]!)
    const secondRequestText = requestText(adapter.requests[1]!)
    expect(firstRequestText).toContain('Time sampled while preparing turn 1, step 1:')
-    expect(firstRequestText).toContain('Elapsed since the preceding model-visible message: 0s.')
+    expect(firstRequestText).toContain('Elapsed since the preceding model-visible message: unavailable.')
    expect(firstRequestText).not.toContain('Time sampled while preparing turn 1, step 2:')
    expect(secondRequestText).toContain('Time sampled while preparing turn 1, step 1:')
    expect(secondRequestText).toContain('Time sampled while preparing turn 1, step 2:')
--- a/packages/context/tmux-context/README.i18n.yaml
+++ b/packages/context/tmux-context/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/context/tmux-context/README.md
-README.md: 801a1f42624b9ab96eb86ec4fec4467c84021561
-README.zh.md: 23510883ff35b35cb69b71da42720d01b574fcf3
+README.md: 26eff205b399bfcd20f55e91ef46cadbd70ae604
+README.zh.md: 6950443ce7ce9c46a605ef70500dd4f63c44163b
--- a/packages/context/tmux-context/README.md
+++ b/packages/context/tmux-context/README.md
@@ -17,7 +17,7 @@ Opt-in durable context naming the tmux session, window, and pane this agent proc

 ## How it reads tmux

-The plugin prepends an `agent/step` listener that runs only on the first step of each turn. When due, it runs one read-only command through the `ctx.bash` executor seam:
+The plugin prepends an `agent/pre-step` listener that runs only on the first step of each turn. When due, it runs one read-only command through the `ctx.bash` executor seam:

 ```sh
 [ -n "$TMUX_PANE" ] || exit 1
@@ -33,7 +33,7 @@ State is pulled on every eligible turn — a moved, renamed, or re-laid-out pane

 ## Timing semantics

-When an injection is due, the plugin appends one injected `user/message` through `agent.inject()` before `step/start`, with source `{ kind: 'plugin', plugin: 'tmux-context' }`. Change suppression and interval scheduling scan the raw durable session events for the latest injection of this source, so the schedule survives compaction and resumed processes without process-local cache state; sessions schedule independently. The reading records a request-preparation attempt, not a committed step; because the listener runs first, its append may remain when a later pre-step listener cancels or fails the attempt (the log is append-only and the plugin performs no rollback).
+The plugin prepends an `agent/pre-step` listener. When an injection is due and the downstream decision enters the proposed step, it prepends one sourced `UserMessage` to the returned batch. AgentLoop records that context after `step/start` with source `{ kind: 'plugin', plugin: 'tmux-context' }`. Change suppression and interval scheduling scan the raw durable session events for the latest injection of this source, so the schedule survives compaction and resumed processes without process-local cache state; sessions schedule independently. A downstream pre-step listener that rejects or fails prevents the reading from being recorded.

 ## Model Experience

--- a/packages/context/tmux-context/README.zh.md
+++ b/packages/context/tmux-context/README.zh.md
@@ -17,7 +17,7 @@

 ## 如何读取 tmux

-插件前置注册一个 `agent/step` 监听器，仅在每轮的第一个 step 运行。当需要注入时，它通过 `ctx.bash` 执行器 seam 运行一条只读命令：
+插件前置注册一个 `agent/pre-step` 监听器，仅在每轮的第一个 step 运行。当需要注入时，它通过 `ctx.bash` 执行器 seam 运行一条只读命令：

 ```sh
 [ -n "$TMUX_PANE" ] || exit 1
@@ -33,7 +33,7 @@ exec tmux display-message -t "$TMUX_PANE" -p '<format>'

 ## 时序语义

-当需要注入时，插件在 `step/start` 之前通过 `agent.inject()` 追加一条注入的 `user/message`，来源为 `{ kind: 'plugin', plugin: 'tmux-context' }`。变化抑制与间隔调度会扫描原始持久会话事件中该来源的最近一次注入，因此调度可跨压缩与恢复的进程存续，无需进程内缓存状态；各会话独立调度。该读数记录的是一次请求准备尝试，而非已提交的 step；由于监听器最先运行，当后续 pre-step 监听器取消或失败时，它的追加可能仍会保留（日志只追加，插件不做回滚）。
+该插件会前置一个 `agent/pre-step` 监听器。需要注入且下游决策进入拟议步骤时，它会在返回批次前添加一条带来源的 `UserMessage`。AgentLoop 会在 `step/start` 之后记录该上下文，其来源为 `{ kind: 'plugin', plugin: 'tmux-context' }`。变化抑制与间隔调度会扫描原始持久会话事件中该来源的最近一次注入，因此调度可跨压缩与恢复的进程存续，无需进程内缓存状态；各会话独立调度。下游 pre-step 监听器 reject 或失败时，该读数不会被记录。

 ## 模型体验

--- a/packages/context/tmux-context/src/index.ts
+++ b/packages/context/tmux-context/src/index.ts
@@ -3,7 +3,7 @@
 * append durable, source-attributed context naming the tmux session, window,
 * and pane this agent process runs in, plus the window's pane-tree layout.
 *
- * The plugin pulls state once per turn, on the first step (`step === 1`), by
+ * The plugin pulls state once per turn, for the first request (`step === 1`), by
 * running one `tmux display-message` through the `ctx.bash` executor seam. It
 * confirms this process genuinely runs inside the pane `$TMUX_PANE` names by
 * matching the pane's `#{pane_tty}` against this process's controlling terminal,
@@ -20,14 +20,14 @@

 import type { Context, LoggerService } from 'cordis'
 import z from 'schemastery'
-import type { Agent } from '@deepseek-ai/dsh-agent'
+import type { Agent, PreStepDecision } from '@deepseek-ai/dsh-agent'
 import type { BashExecutor, BashRunResult } from '@deepseek-ai/dsh-bash'
 import { createUserMessage } from '@deepseek-ai/dsh-llm'

 /** Cordis plugin name used by loader diagnostics. */
 export const name = 'tmux-context'

-/** The agent registry that owns the `agent/step` lifecycle seam. */
+/** The agent registry that owns pre-step processing. */
 export const inject = ['agents']

 /** Per-turn tmux-location scheduling. Invalid values fail plugin load. */
@@ -206,7 +206,7 @@ function validateRefreshInterval(refreshIntervalMs: number | undefined): void {
 }

 /**
- * Register a prepended `agent/step` listener for the lifetime of `ctx`.
+ * Register a prepended pre-step listener for the lifetime of `ctx`.
 * @param ctx - plugin context; the listener is disposed with it.
 * @param config - durable refresh scheduling configuration.
 * @throws when the refresh interval is invalid.
@@ -215,27 +215,34 @@ export function apply(ctx: Context, config: Config): void {
  const refreshIntervalMs = config.refreshIntervalMs
  validateRefreshInterval(refreshIntervalMs)

-  ctx.on('agent/step', async (
+  ctx.on('agent/pre-step', async (
    agent: Agent,
-    turn: number,
-    step: number,
-    signal: AbortSignal,
-  ): Promise<void> => {
-    if (signal.aborted || step !== 1) return
+    _messages,
+    { turn, step, signal },
+    next,
+  ): Promise<PreStepDecision> => {
+    const decision = await next()
+    if (decision.kind === 'reject' || signal.aborted || step !== 1) return decision
    const bash = ctx.get('bash')
-    if (bash === undefined) return
+    if (bash === undefined) return decision
    const previous = latestInjectedState(agent)
    if (refreshIntervalMs !== undefined && refreshIntervalMs > 0 && previous !== undefined) {
      const now = Date.now()
-      if (now >= previous.time && now - previous.time < refreshIntervalMs) return
+      if (now >= previous.time && now - previous.time < refreshIntervalMs) return decision
    }
    const location = await queryTmuxLocation(bash, ctx.logger, process.pid, signal)
-    if (location === undefined) return
+    if (location === undefined) return decision
    const state = renderState(location)
-    if (previous !== undefined && previous.state === state) return
-    agent.inject(createUserMessage({
-      content: [{ type: 'text', text: renderReading(location, turn) }],
-      source: { kind: 'plugin', plugin: name },
-    }))
+    if (previous !== undefined && previous.state === state) return decision
+    return {
+      kind: 'enter',
+      messages: [
+        createUserMessage({
+          content: [{ type: 'text', text: renderReading(location, turn) }],
+          source: { kind: 'plugin', plugin: name },
+        }),
+        ...decision.messages,
+      ],
+    }
  }, { prepend: true })
 }
--- a/packages/context/tmux-context/tests/tmux-context.spec.ts
+++ b/packages/context/tmux-context/tests/tmux-context.spec.ts
@@ -1,7 +1,7 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { Context } from 'cordis'
 import { Session, SessionId } from '@deepseek-ai/dsh-session'
-import AgentRegistry, { agentEvents, type Agent } from '@deepseek-ai/dsh-agent'
+import AgentRegistry, { agentEvents, Inbox, type Agent } from '@deepseek-ai/dsh-agent'
 import { createUserMessage } from '@deepseek-ai/dsh-llm'
 import { BashExecutor } from '@deepseek-ai/dsh-bash'
 import type { BashExecRequest, BashExecSpec, BashProcess, BashRunResult } from '@deepseek-ai/dsh-bash'
@@ -96,24 +96,21 @@ function sessionAgent(session: Session, id = 'agent'): Agent {
    id: SessionId(id),
    options: {},
    session,
+    inbox: new Inbox(session, { inserted: () => {}, discarded: () => {}, claimed: () => {} }),
    status: 'running',
-    acceptsNextStep: true,
    ctx: new Context(),
-    followup: () => {},
-    steer: () => ({ outcome: Promise.resolve({ status: 'rejected' as const }) }),
-    updateInbox: () => 'not-found',
-    inject(input) {
-      session.append('user/message', input, { surfaceOp: 'append' })
-    },
    send: () => {},
-    reserveTurnAdmission: () => undefined,
+    followup: () => {},
+    steer: () => {},
+    inject: () => { throw new Error('tmux-context must append directly to the open step') },
    cancel() {},
+    runMaintenance: task => task(new AbortController().signal),
    whenIdle: () => Promise.resolve(),
  }
 }

 function openMessageTurn(session: Session, turn: number): void {
-  session.append('turn/start', { turn, trigger: { kind: 'message', source: { kind: 'user' } } })
+  session.append('turn/start', { turn })
  session.append('user/message', createUserMessage({
    content: [{ type: 'text', text: `turn ${turn}` }],
    source: { kind: 'user' },
@@ -139,7 +136,17 @@ async function fire(
  step: number,
  signal: AbortSignal = SIGNAL,
 ): Promise<void> {
-  await agentEvents(ctx, agent).serial('agent/step', turn, step, signal)
+  const decision = await agentEvents(ctx, agent).waterfall(
+    'agent/pre-step',
+    [],
+    { turn, step, signal },
+    () => Promise.resolve({ kind: 'enter' as const, messages: [] }),
+  )
+  if (decision.kind === 'enter') {
+    for (const message of decision.messages) {
+      agent.session.append('user/message', message, { surfaceOp: 'append' })
+    }
+  }
 }

 afterEach(() => {
@@ -369,19 +376,11 @@ describe('tmux-context no-op paths', () => {
    expect(warn).toHaveBeenCalledWith(expect.stringContaining('spawn refused'))
  })

-  it('skips an already-aborted step and runs before ordinary agent/step listeners', async () => {
+  it('skips an already-aborted prompt submission', async () => {
    const { ctx } = await mount({}, true)
    const session = Session.create(SessionId('ordering'))
    const agent = sessionAgent(session)
    openMessageTurn(session, 1)
-    let ordinarySawContext = false
-    ctx.on('agent/step', (subject) => {
-      ordinarySawContext = subject.session.events.some(
-        event => event.type === 'user/message'
-          && event.data.source.kind === 'plugin'
-          && event.data.source.plugin === 'tmux-context',
-      )
-    })

    const abort = new AbortController()
    abort.abort()
@@ -389,7 +388,6 @@ describe('tmux-context no-op paths', () => {
    expect(contextTexts(session)).toHaveLength(0)

    await fire(ctx, agent, 1, 1)
-    expect(ordinarySawContext).toBe(true)
    expect(contextTexts(session)).toHaveLength(1)
  })
 })
--- a/packages/context/workspace-context/README.i18n.yaml
+++ b/packages/context/workspace-context/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/context/workspace-context/README.md
-README.md: 2669422ec1fa7a74ba329cd96ee6b7e5e6da7e9d
-README.zh.md: e9fab4c6998f1193068389b41bdd7fa7d8c98dca
+README.md: 7add269c7a1b38e9624cf6d0368151661bc72a6b
+README.zh.md: 3456c5c36275e8e521b312b1b0b7e1dd102ca23c
--- a/packages/context/workspace-context/README.md
+++ b/packages/context/workspace-context/README.md
@@ -6,7 +6,7 @@ Per-session workspace instruction loading for `AGENTS.md`-compatible files. The

 ## Lifecycle

-The baseline is injected at the first `agent/step` of each live session. It reads `$DSH_HOME/AGENTS.md` followed by, in each directory from the project root to `agent.session.header.cwd`, every existing base candidate and then every existing local-overlay candidate. Within one directory, candidates whose content is byte-identical after trimming leading and trailing whitespace collapse to the earliest candidate in configured order, so a `CLAUDE.md` that merely duplicates its sibling `AGENTS.md` is rendered once. The durable sourced `user/message` enters the same request as the claimed prompt.
+The first eligible `agent/pre-step` of each live session composes the baseline. When the downstream decision enters a nonempty first-step batch, the plugin folds the baseline into that final batch right after the claimed prompt, so the direct prompt and the durable baseline enter step 1 and reach the first request together. A rejected or empty first-step decision leaves the baseline in the agent's `next-step` inbox for a later wakeup. The loader reads `$DSH_HOME/AGENTS.md` followed by, in each directory from the project root to `agent.session.header.cwd`, every existing base candidate and then every existing local-overlay candidate. Within one directory, candidates whose content is byte-identical after trimming leading and trailing whitespace collapse to the earliest candidate in configured order, so a `CLAUDE.md` that merely duplicates its sibling `AGENTS.md` is rendered once. If a previously queued workspace context is still pending, the plugin removes and replaces that exact inbox item instead of accumulating duplicates.

 The plugin also listens on `tools/post-execute` for successful first-party `read`, `write`, and `edit` calls. Each touch checks newly reached descendant scopes and every previously loaded scope. Each configured candidate name is an independent scope in its directory: a newly present file is attached through the result's `additionalContexts`; a changed file appends a replacement; a file that disappears or becomes a per-directory duplicate of an earlier candidate appends a removal notice. Native calls and Code Mode sub-dispatches share this path: `run_code` defers each nested context until its outer result, so the loop still appends updates after tool-call/result adjacency is complete. This follows structured filesystem activity rather than shell `cd`, because each local bash call starts a fresh shell and parsing arbitrary shell syntax would be unreliable.

@@ -48,11 +48,11 @@ The plugin owns the complete `<system-reminder>` framing, and every injected `us

 ## State And Refresh

-Model-visible text contains no hidden state markers. Each baseline or dynamic context event instead carries a typed `workspace-instructions` source with a list of `{ action, scope, path, digest? }` changes; the complete startup or resume baseline also carries `baseline: true`. On every relevant tool touch, the plugin reconstructs loaded state from its visible session events and overlays a short in-memory pending window for context present on the immutable top-level `tools/result` but not yet appended by the loop. A matching durable `user/message` confirms the pending transition. If the owning `step/end` arrives before a matching context reaches the log, the plugin clears the pending transition and its version fast path so the next successful touch can load it again. Nested Code Mode results stage pending changes under the outer execution token for same-run duplicate suppression; the outer result rolls that state back and recommits only contexts that survived outer policy.
+Model-visible text contains no hidden state markers. Each baseline or dynamic context event instead carries a typed `workspace-instructions` source with a list of `{ action, scope, path, digest? }` changes; the complete startup or resume baseline also carries `baseline: true`. A matching durable `user/message` confirms a queued baseline and its candidate versions. An entering pre-step folds newly composed context into its final batch immediately after the claimed messages and removes the pending inbox copy; rejection keeps the current context queued. If a listener rewrites away a claimed workspace message without entering its replacement, a later boundary recomposes the current context. On every relevant tool touch, the plugin reconstructs loaded state from its visible session events and overlays a short in-memory pending window for context present on the immutable top-level `tools/result` but not yet appended by the loop. If the owning `step/end` arrives before a matching dynamic context reaches the log, the plugin clears that pending transition and its version fast path so the next successful touch can load it again. Nested Code Mode results stage pending changes under the outer execution token for same-run duplicate suppression; the outer result rolls that state back and recommits only contexts that survived outer policy.

 An unchanged path and SHA-1 content digest is not injected again. A per-session, per-scope provider cache stores only `{ path, version, digest, trimmedDigest }`: when the provider's opaque `FsVersion` and the effective visible state both match, reconciliation skips the content read; a changed version triggers a bounded read and SHA-1 confirmation before any model-visible update. The `trimmedDigest` — SHA-1 over the whitespace-trimmed content — is the per-directory duplicate key, so an unchanged file can still be removed when an earlier candidate converges on its content. Resume works because SHA-1 state is persisted in the typed source, while an empty in-memory version cache merely causes one confirming read. Compaction re-arms a scope after its context event leaves the visible surface even when the cached version is unchanged. A removal is a tombstone, so a later candidate reappearance is loaded again. Only model-visible changes actually rendered within the byte budget enter the source, pending state, and version cache; an omitted change remains eligible for a later touch, while a same-digest version refresh updates only the provider cache.

-The initial baseline event itself is not rewritten. Its typed changes remain authoritative only while that event is in the visible session surface; the next successful filesystem touch re-adds an unchanged baseline scope after compaction, or appends its replacement or removal. The in-memory scope marker and provider-version cache only select and accelerate probes. A hot plugin remount retains a baseline only when its typed event remains visible, while rebuilding current scope and version tracking; otherwise it injects a current baseline. A resumed loop always recomposes the current baseline and also reconciles still-visible dynamic scopes before its first request. There is no file watcher, so an on-disk change becomes visible at the next successful `read`, `write`, or `edit` touch, or when a resumed loop prepares its baseline.
+The initial baseline event itself is not rewritten. Its typed changes remain authoritative only while that event is in the visible session surface; the next successful filesystem touch re-adds an unchanged baseline scope after compaction, or appends its replacement or removal. The in-memory scope marker and provider-version cache only select and accelerate probes. A hot plugin remount retains a baseline only when its typed event remains visible, while rebuilding current scope and version tracking; otherwise it queues a current baseline. A resumed loop always recomposes the current baseline and also reconciles still-visible dynamic scopes at its first pre-step; an entering first request records that context in the same step. There is no file watcher, so an on-disk change becomes visible at the next successful `read`, `write`, or `edit` touch, or when a resumed loop prepares its baseline.

 ## Configuration

--- a/Show More
+++ b/Show More