fix(agent): commit mutable setup at publication

Agent setup may await while a mutable contribution registry changes. The previous subagent path validated and committed its provisioning batch inside the setup callback. A revocation queued after that callback returned therefore treated the installation as resident and released it, even though AgentLoop had not published the child yet. AgentLoop could then admit and announce a child whose required capability had already disappeared.

Introduce AgentSetupCommit as the optional synchronous result of create and resume setup. AgentLoop now awaits setup, invokes that commit with no intervening asynchronous boundary, and only then enters the Session and Agent registries. A commit failure follows the existing private-transaction rollback, so neither identity is published and the caller can reuse the id.

Keep continuable-subagent installations provisional until this publication commit. Contribution removal still releases every installation immediately, but now marks an unpublished batch invalid so its commit rejects with ACTIVATION_SETUP_REVOKED. Once the commit succeeds, later removal remains ordinary live revocation.

Cover create and resume ordering, resume commit rejection and identity reuse, and an assembled microtask revocation that leaves only the parent Agent and Session. Update the public JSDoc, architecture flow, package contracts, current Agent Notes, Chinese counterparts, pairing records, and generated Cordis API to describe the new boundary.

Validated with the four focused Agent/subagent test files (91 tests), the isolated assembled regression, targeted TypeScript project builds, generated Cordis API freshness, export JSDoc verification, scoped translation pairing, Markdown wrapping, and Mermaid parsing.

packages/subagent/tool-subagent-report/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/subagent/tool-subagent-report/README.md
-README.md: c1cff4d023e35ff246e592f58b0c85c8a10f327a
-README.zh.md: 167a6338e8db9fbb5efce7037392f7c75e48f116
+README.md: cd73154dfb9c8b37f4a811c3beedbe6a63207f58
+README.zh.md: 4b31bed48ea0e50ec3a9d507548658defb94b8b8

packages/subagent/tool-subagent-report/README.md

@@ -58,7 +58,6 @@ Append-only; the report follows the parent's reusable request prefix. Waking del
 
 ## Known Limitations and Deferred Work
 
-- **Setup revocation can follow lower-level Session publication** — the final revocation check runs after `ctx.agents.create()` or `ctx.agents.resume()` returns, by which point that call has already published its Agent and Session. Revocation in this window rolls back the handle and prevents the subagent Activation start edge, but may leave a persisted Session. Closing this gap requires a future Agent-creation setup transaction seam before lower-level publication.
 - **A parent whose host-owned disposal already started can still accept** — `AgentHandle.dispose()` cancels, awaits quiescence, and only then unwinds the scope and leaves the registry; it exposes no signal for "disposal started." A report accepted in that window is appended to the parent's transcript, but that parent will not act on it in this process. A continuation-manager-owned parent rejects forest teardown through the manager's admission boundary.
 - **Acceptance is weaker than durable delivery** — there is no durable mailbox, idempotency key, delivery receipt, retry protocol, or exactly-once claim. A process failure after one side recorded acceptance leaves the outcome ambiguous, and an external retry may duplicate the report.
 - **A staged quiet report is not immediately reconstructable** — acceptance returns its stable `MessageId`, but the parent Session reconstructs the framed content only after pending context reaches its ordinary log boundary.

packages/subagent/tool-subagent-report/README.zh.md

@@ -58,7 +58,6 @@
 
 ## 已知限制与暂缓事项
 
-- **setup 撤销可能发生在底层 Session 发布之后**：最终撤销检查发生在 `ctx.agents.create()` 或 `ctx.agents.resume()` 返回之后，此时该调用已发布其 Agent 和 Session。在这个窗口内撤销会回滚 handle，并阻止 subagent Activation 的 start 边，但可能留下持久化 Session。要弥合这个缺口，需要未来在底层发布之前提供 Agent 创建 setup 事务 seam。
 - **父级可能在宿主启动 dispose 后继续接受报告**：`AgentHandle.dispose()` 会先取消并等待完全停稳，然后才撤销作用域并离开注册表；它不公开「dispose 已开始」信号。在该窗口内接受的报告会追加到父级 transcript，但该父级不会在本进程中处理它。对于由延续管理器拥有的父级，管理器的准入边界会在整棵子树拆卸期间拒绝该上报。
 - **接受弱于持久投递**：没有持久化 mailbox、幂等键、投递回执、重试协议，也不保证恰好一次。任一侧记录接受后若进程失败，结果都不明确；外部重试可能产生重复上报。
 - **暂存的静默报告无法立即重建**：接受时会返回其稳定 `MessageId`，但只有当待处理上下文到达普通日志边界后，父级 Session 才能重建带前缀的内容。

packages/subagent/tool-subagent-report/tests/tool-subagent-report.spec.ts

@@ -350,6 +350,34 @@ describe('dsh-tool-subagent-report', () => {
     expect(ctx.agents.list().map(agent => agent.id)).toEqual([parent.id])
   })
 
+  it('rolls back materialization when setup revocation lands before publication', async () => {
+    const { ctx, parent } = await setup({ load: false })
+    const self: { revoke?: () => void } = {}
+    let installed = false
+    self.revoke = ctx.subagents.registerContinuableSetup(() => {
+      installed = true
+      queueMicrotask(() => { self.revoke?.() })
+      return () => { installed = false }
+    })
+    const announced: SessionId[] = []
+    const removeListener = ctx.on('session/created', (session) => { announced.push(session.id) })
+
+    await expect(ctx.subagents.startContinuable({
+      provider: 'spawn',
+      label: 'revoked child',
+      request: {
+        prompt: [{ type: 'text', text: 'revoked child' }],
+        parent,
+      },
+      signal: testSignal,
+    })).rejects.toMatchObject({ code: 'ACTIVATION_SETUP_REVOKED' })
+    removeListener()
+    expect(installed).toBe(false)
+    expect(announced).toEqual([])
+    expect(ctx.agents.list().map(agent => agent.id)).toEqual([parent.id])
+    expect(ctx.sessions.list()).toEqual([parent.session])
+  })
+
   it('accepts a report into a host-disposing but still-registered parent', async () => {
     const { ctx } = await setup()
     const parentHandle = await ctx.agents.create({